Log in Request a demo

Significant cyber incident

SPEI interbank payment system attacks, Mexico, 2018

Between 17 April and 8 May 2018, attackers broke into the systems that five participants of Mexico's SPEI interbank payment system use to send payment orders.

In short

Between 17 April and 8 May 2018, attackers broke into the systems that five participants of Mexico's SPEI interbank payment system use to send payment orders. They inserted fake transfer orders, which were paid out to real accounts and withdrawn in cash. Banco de Mexico said about 300 million pesos were involved in irregular transfers under review. The central SPEI system was not attacked.

Last updated October 2026

What happened

On 27 April 2018 Banco de Mexico (Banxico) said incidents had occurred at three participants of SPEI, the national interbank payment system, and that clients might see delays. Its later records show a first attack on one participant on 17 April, two more on 24 April, one on 26 April and one on 8 May. By 22 May it counted five participants with cyber security breaches.

The attackers did not go after the central system run by Banxico. They went after the applications and servers that the participants use to prepare payment orders and connect to SPEI. They inserted fake orders into that flow. The attacked systems then signed and sent the orders to SPEI as if they were genuine, and SPEI paid them out. The money reached real accounts and was withdrawn in cash.

Banxico said about 300 million pesos were involved in irregular transfers under review (22 May 2018). Reuters, citing a source, put the theft above 300 million pesos, and cited El Financiero for about 400 million pesos, so figures differ by source. Banxico said client funds were not affected. In August 2018 it published a public version of the forensic findings.

Timeline

  1. 2017-07

    Banxico issues Circular 14/2017 with cyber security and continuity requirements for SPEI participants

  2. 2018-01-31

    Deadline for participants to comply with the Circular 14/2017 requirements

  3. 2018-04-13

    Per the audit office (ASF), Banxico learns that one participant has detected unrecognized operations, reported by the participant as internal fraud

  4. 2018-04-17

    One SPEI participant records a cyber attack; Banxico warns participants to take extra care

  5. 2018-04-24

    Two more attack events; Banxico asks participants for extra measures and controls

  6. 2018-04-24

    Banxico creates its Cybersecurity Directorate (ASF audit)

  7. 2018-04-26

    One more attack event

  8. 2018-04-27

    Banxico press release: incidents at three participants, possible slowness for clients

  9. 2018-04-30

    Banxico release: problem traced to an external connection application; SPEI hits a record of more than 6.8 million payments

  10. 2018-05-08

    Fifth attack event; Banxico asks participants to set controls on their connections

  11. 2018-05-14

    Banxico press release on its technology, operational and regulatory actions

  12. 2018-05-17

    Circulars 4/2018 and 5/2018 published in the Diario Oficial; Governor tells press about three banks, a broker and a credit union

  13. 2018-05-22

    Banxico: 5 participants breached, about 300 million pesos under review

  14. 2018-08-29

    Banxico publishes the public version of the forensic report

  15. 2018-11-28

    Banxico publishes a summary of its actions after the attacks: independent review of its own systems, Circulars 14/2017 and 4/2018, supervision, and alert protocols between authorities

How the attack worked

Banxico’s accounts describe the method in some detail. They do not say how the attackers first got in, and they name no tool or malware. The August 2018 forensic report says the attackers used common techniques.

Getting into the participant’s network

The forensic report lists credential theft, privilege escalation and movement between servers. It says the attackers needed deep knowledge of each institution’s technology and processes, and access to it. In every case reported as a cyber event, the connection application had been built by a third party. Banxico said the weakness could lie in the application or in the infrastructure where it ran. Banxico does not certify these providers.

Inserting fake orders

The attackers inserted payment orders into the flow before it reached SPEI. The orders were charged to the participant’s own account. The receiving accounts were real. Banxico first said the sending accounts did not exist, then corrected this: two were real accounts and the rest did not exist. The step they used had no control to confirm that an order was legitimate.

Using the speed of the system

The participant’s own system signed and sent the orders, so SPEI accepted them. The report says the attackers used the fast, automated processing of SPEI so the orders were paid before the originating institutions could detect them. The receiving banks credited their customers, and the money was withdrawn in cash.

Covering tracks

After the transfers the attackers deleted many traces in the systems of the institutions. The report says this points to a professional attack. Participants noticed the orders through their own alerts and through alerts from receiving participants, and some transfers were stopped before withdrawal.

How the attack ran
  1. Gain accessAttackers entered participants’ systems using techniques such as credential theft, privilege escalation and lateral movement
  2. Insert fake ordersFake transfer orders were put into the flow of the third-party connection application, charged to the participant’s own account
  3. Send to SPEIThe participant’s system signed and sent the orders, and SPEI settled them
  4. Cash outReceiving banks credited real accounts and the funds were withdrawn in cash
  5. Hide tracesThe attackers deleted logs and other traces on the participants’ systems

Who says who was behind it

No public attribution in the sources opened. Banxico's forensic report of 29 August 2018 calls the attack professional and says the attackers needed deep knowledge of the institutions and access to them, but names no group, tool or person.
Reuters, 14 May 2018, citing two sources close to the investigation, said hackers may have had help inside bank branches, because such large cash withdrawals are uncommon. This was not confirmed by Banxico in the sources opened.

Impact

Banxico, 22 May 2018: 5 participants with cyber security breaches; amounts in irregular transfers under review about 300 million pesos.

Sources differ on the amount: Reuters (14 May 2018), citing one source, said more than 300 million pesos ($15.4 million), and cited El Financiero, citing an anonymous source, for about 400 million pesos. On 17 May Reuters quoted the Governor saying some of the 300 million had not been withdrawn and could still be recovered.

Banxico: client funds were not affected, because the stolen money came from the participants' own accounts and client funds sit in a separate system.

Service: from late April, payments slowed for clients of affected institutions and for transfers involving them. Banxico said 48 participants were operating through alternate systems. The five directly attacked institutions held 13.09 percent of SPEI transactions by number and 7.64 percent by amount.

Banxico said SPEI reached a record of more than 6.8 million payments on 30 April 2018.

Government and regulator response

  • From 17 April 2018: Banxico disconnected attacked participants from their usual link and moved them to contingency operation through its alternate client COAS. It also moved participants at higher risk to the same scheme.
  • 24 April 2018: Banxico created a Cybersecurity Directorate, according to the audit office (ASF).
  • 27 and 30 April 2018: Banxico told the public about incidents at three participants and the external connection application. Banxico and the CNBV said they were monitoring all participants closely.
  • 14 May 2018: Banxico set out its actions: alerts in SPEI for message anomalies, renewed security elements for operators, extra controls required from connection providers, and a request that participants search for dormant software.
  • 17 May 2018: Circular 4/2018 gave participants one day before handing over cash or cashier’s cheques for transfers of 50,000 pesos or more. Circular 5/2018 allowed temporary authorizations for longer checks on incoming transfers of that size, for up to six months.
  • May 2018: Banxico said its supervision of Circular 14/2017 compliance, started in 2017, had found uneven results, and that it was raising the priority of supervision.
  • 29 August 2018: Banxico published the public version of the forensic analyses, done by third parties hired by the affected institutions. It said measures were being put in place that were already in the rules.
  • 28 November 2018: Banxico summarized its actions: an independent review of its own infrastructure that confirmed its systems were not breached, new alert and response rules, detailed supervision of financial institutions with formal sanction processes to follow, and alert protocols between authorities. Banxico repeated that client funds and the central SPEI system were never compromised.
  • Audit findings (Cuenta Publica 2018): the audit office said Banxico asked an affected participant for its forensic image but had not analyzed it by December 2019, that Banxico checked its own logs but did not run a forensic analysis, and that its incident response plan did not cover events at participants. It also found that the banking regulator and Banxico did not have a mechanism to share findings from their inspection visits on technology risk.

Lessons

  1. The trusted link is a target

    The attackers did not attack SPEI. They attacked the systems that sign and send orders to it. Treat the connection to a payment network as a critical asset of your own.

  2. Control the step before signing

    The fake orders entered at a stage with no check that an order was legitimate. Put validation before the point where your system signs a payment.

  3. Third-party software is your risk

    Every case involved a connection application from a third party, and Banxico does not certify such providers. Each participant stays responsible for how it works.

  4. Fast payments leave little time

    The report says attackers used automated processing so orders were paid before detection. Set limits, velocity checks and delays for large or unusual transfers.

  5. Receivers can catch fraud

    Alerts from receiving participants helped stop some transfers. Share suspicious payment signals across institutions quickly.

  6. Rules need checking

    Requirements had been in force since 2017, yet supervision found uneven compliance. A rule on paper does not prove a control works.

  7. Plan for a participant being hit

    The audit office found that Banxico's cyber incident response plan did not cover events at a participant that could affect the operator and other participants, and that it did not run a forensic analysis of its own systems, because it judged SPEI itself unaffected. Operators of shared payment systems should plan for a member breach and test their own side too.

What to check in your own organization

  1. Payment order integrity

    Check that every payment order is validated against the core system before it is signed, so an order inserted in the middle cannot be sent.

  2. Signing keys and operator logins

    Check who and what can sign payment messages. Renew operator credentials after any incident, as Banxico required.

  3. Third-party connection software

    List the vendors that connect you to payment networks, how their code is updated, and who can access their servers.

  4. Privileged and lateral movement alerts

    Alert on new admin use, credential dumping and unusual server to server logins on payment servers.

  5. Log protection

    Send logs off the payment servers at once, so deleting them locally does not erase the trail.

  6. Large transfer controls

    Review limits, delays and extra checks for large or first-time beneficiary transfers, and for cash withdrawals of received funds.

  7. Fallback operation

    Test that you can switch to a separate, safe connection quickly and know how much slower it will be.

Questions

What happened to Mexico's SPEI payment system in 2018?

Between 17 April and 8 May 2018, attackers entered systems of five SPEI participants and inserted fake transfer orders. Banxico said the central SPEI system was not attacked.

How much money was involved?

Banxico said about 300 million pesos were in irregular transfers under review (22 May 2018). Reuters cited a source for more than 300 million and another report for about 400 million, so figures differ.

Were customers' accounts affected?

Banxico said no. The stolen funds came from the participants' own accounts, and client funds sit in a separate system with checks on each operation.

Who was behind it?

There is no public attribution in the sources opened. Banxico called the attack professional but named no group.

Which banks were hit?

Banxico did not name them. The Governor said three banks, a broker and a credit union saw fake transfers (Reuters, 17 May 2018).

What changed afterwards?

Banxico added alerts in SPEI, required extra controls from connection providers, and issued Circulars 4/2018 and 5/2018 on cash withdrawals and validation of incoming transfers.

What did Mexico's audit office find about the SPEI attacks?

The Auditoria Superior de la Federacion audited cyber security in electronic banking and payment systems for the 2018 public account. It listed a timeline in which Banxico learned on 13 April 2018 of unrecognized operations at one participant, and found that Banxico's incident response plan did not cover events at participants that could affect the operator and other participants.

What did Banxico do after the attacks?

On 28 November 2018 Banxico listed its actions: an independent review of its own infrastructure, which confirmed its infrastructure and systems were not breached; alert and response rules in Circular 14/2017; a rule in Circular 4/2018 so that receivers of transfers cannot withdraw more than 50,000 pesos in cash on the day the deposit arrives; detailed supervision of institutions; and alert protocols between authorities.

Sources

  1. Puntos importantes sobre la situacion actual del SPEI (22 May 2018) Banco de Mexico
  2. Reporte de analisis forenses, version publica (29 August 2018) Banco de Mexico
  3. Informacion sobre los ataques a los Participantes del SPEI (May 2018) Banco de Mexico
  4. Incidentes operativos registrados en algunos participantes del SPEI (27 April 2018) Banco de Mexico
  5. Informacion adicional sobre los incidentes operativos (30 April 2018) Banco de Mexico, copy on CNBV site
  6. Acciones emprendidas por el Banco de Mexico para mitigar los riesgos (14 May 2018) Banco de Mexico
  7. Acciones del Banco de Mexico con respecto a los incidentes de seguridad de los participantes en el SPEI (28 November 2018) Banco de Mexico
  8. Auditoria de Ciberseguridad a la Banca Electronica y Medios de Pago del Sistema Financiero del Gobierno Mexicano, audit 2018-5-06B00-21-0054-2019 (Cuenta Publica 2018) Auditoria Superior de la Federacion (copy hosted by Banobras)
  9. Informacion sobre los Ataques a Participantes del SPEI, Recuadro 6, Informe Trimestral enero-marzo 2018 Banco de Mexico
  10. Thieves steal millions out of Mexican banks in transfer heist (14 May 2018) Reuters via Business Insurance
  11. Hackers siphoned off $15m from five firms, says Mexican central bank (17 May 2018) Reuters via Oman Observer

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Credential theft

Credential theft is the stealing of account names, passwords and similar login material so that someone else can use them.

Read more

Glossary term

Privilege escalation

Privilege escalation is when an attacker gains higher-level permissions than they started with.

Read more

Technique

OS Credential Dumping

OS credential dumping is when an attacker pulls account login material out of a computer.

Read more