Cosmos Bank: why sensitive actions need independent checks

What was reported

The Times of India reported that Cosmos Bank lost approximately ₹94.42 crore in attacks on 11 and 13 August 2018. Its report described ₹80.50 crore through ATM-related transactions involving malware on an ATM switch server, followed by a separate ₹13.92 crore transfer through the SWIFT system. The bank said depositors would not be directly affected. [1]

What remains unknown

The cited account is not a complete forensic report. We do not infer an “unsegmented” network from it, or treat the whole reported loss as ATM fraud. This is a historical case, included for its continuing relevance to sensitive business workflows.

TRIARII’s perspective

Our interpretation is that businesses should examine how an important action becomes trusted. Who can approve it? Which system checks it? Is there an independent record? If something unusual happens, can someone pause the process quickly?

A local SME does not operate the same infrastructure as a bank. We would translate these questions into its own context: business banking access, accounting accounts, invoice changes and administrator privileges. The scale differs, but the need to understand approval and escalation remains useful. This comparison does not establish that any particular control would have stopped the Cosmos Bank attack.

What we would assess in a comparable business

• Identify critical actions: map payment approval, changes to beneficiary details and sensitive account administration.
• Review privileged access: examine individual accounts, authentication and permissions; assess separation between routine work and privileged administration.
• Check independent verification: determine how unusual payments or changed bank details are confirmed through a trusted channel.
• Make escalation usable: identify who monitors available alerts, who can suspend a process and how the bank or specialist responder is contacted.

NIST’s small-business guidance supports risk-based access, monitoring and response planning. Specialist assessment would be needed for banking transaction infrastructure; this article describes transferable SME questions. [2]

What this means for TRIARII

For our developing assessment model, this case reinforces the value of examining workflows alongside software. We aim to connect an observed gap to its business consequence, agree a corrective action and recheck what changed. It also reminds us to define the limits of our role: complex financial infrastructure requires the appropriate expertise and authority. A documented, manageable SME improvement is more useful than a broad assurance we cannot substantiate.