Imagine robbing a bank without ever touching its vault. No masks, no tunnels. You just log in as the bank, politely ask its other bank to send you a billion dollars, and wait for the weekend.

That is almost exactly what happened to Bangladesh Bank , the central bank of Bangladesh, in February 2016. It is one of my favourite case studies, because the most important parts of the story are about process, not code.

Step one: become the bank

Central banks move money through SWIFT , the global messaging network banks use to tell each other "pay this amount to that account". SWIFT itself was not hacked. The attackers got inside Bangladesh Bank's own network, reached the computers that talk to SWIFT, and obtained valid credentials.

From that point, their messages were not "hacker traffic". They were real instructions from a real central bank, sent through the real channel.…