Money and Payments (MP)

Taxonomies › Critical Infrastructure › MP · Money and Payments

How money moves: the routing data, messages, ledgers, settlement and fallbacks that let people pay for food, fuel and medicines and get paid. Part of The Estate deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

Entries

BKS-MP-A · Routing reference data poisoned at source

Banks route payments with shared reference data: the IBAN-to-BIC mapping, the BIC directory and national clearing tables, published by a few sources. Corrupt the source or its distribution, and every bank that loads the update misroutes or rejects payments at once, and nobody can quickly prove which payments went where.

Principle. Shared routing data must be authenticated, checked for plausibility and reversible before any bank acts on it.

Design measures.

1. Verify the publisher’s signature on every directory file, and refuse files that fail or arrive outside the expected schedule.
2. Compare each update with the previous version and hold large changes, or changes to critical institutions, for review.
3. Keep the last known-good version ready to restore within minutes, and record which version routed each payment.

Mappings: STRIDE T, D · CAPEC-194 · CWE-353, CWE-347 · CIE 1, 9, 10

BKS-MP-K · Ledgers nobody can reconcile

An adversary alters or destroys account balances and transaction records inside a bank or payment system. When positions no longer reconcile, the institution cannot say who owns what, payments stop, and the doubt spreads to every institution that settles with it.

Case: Bank Sepah, Iran, 2025.

Principle. Records of value must be provably intact, and rebuildable from a copy the attacker could not reach.

Design measures.

1. Chain or sign ledger records so an altered entry breaks verification, and check the chain continuously.
2. Reconcile against counterparties and the settlement system often during the day, not only at day end.
3. Keep immutable, offline copies of end-of-day positions, held by a separate party, as the basis for rebuilding.

Mappings: STRIDE T, R, D · CWE-353, CWE-1293 · CIE 1, 10, 2

BKS-MP-Q · One settlement system for a country

A country’s interbank payments settle through one real-time gross settlement system, one clearing house or a few central counterparties, and many firms share the same providers. If one of them is disabled, payments, salaries and trades stop for everyone, while contingency plans assume service returns the same day.

Case: ICBC Financial Services, 2023; ION Trading, 2023.

Principle. Every payment system a country cannot do without must keep settling, at reduced scope, when its main platform is lost.

Design measures.

1. Run a tested contingency platform on separate technology and staff, able to settle priority payments for days.
2. Define in advance which payments go first: wages, benefits, fuel, food and utility settlement.
3. Rehearse a full switchover with participants at least yearly, including manual and file-based settlement.

Mappings: STRIDE D · CIE 10, 7, 1

BKS-MP-J · No stand-in when authorisation fails

Card payments at tills, pumps and pharmacies need a live answer from the acquirer, processor or card scheme. When that path is down, terminals refuse every card, and shops that hold little cash cannot sell food, fuel or medicines, even with the goods on the shelf.

Case: Kaseya VSA and Coop Sweden, 2021.

Principle. Essential purchases must still be possible when online authorisation is lost.

Design measures.

1. Enable offline or stand-in authorisation with limits for essential merchants, and test it regularly.
2. Give terminals a second route to a different processor where the scheme allows.
3. Keep cash handling, float and procedures ready at essential outlets, with staff who know them.

Mappings: STRIDE D · CIE 10, 7

BKS-MP-10 · Bulk payment files changed in transit

Salaries, pensions and benefits leave as bulk files from payroll bureaus and government agencies to banks. A file altered between approval and submission pays the wrong people or nobody, on the day households depend on it, and the error is found only when complaints arrive.

Principle. A bulk payment file must be provably the one that was approved, and checked before release.

Design measures.

1. Sign bulk files at the point of approval and verify the signature at the bank before processing.
2. Check each file against the previous run for unusual changes in totals, counts and payees.
3. Agree a fallback with the bank to repeat the last good run when a file cannot be trusted.

Mappings: STRIDE T · CAPEC-153 · CWE-353, CWE-924 · CIE 2, 10

BKS-MP-9 · Directory updates loaded blindly

Banks load reference data updates into payment engines automatically, from a vendor feed or a shared folder, with no check on who changed what. Whoever reaches the feed, the folder or the loading job can change routing for the whole bank without touching the payment systems themselves.

Principle. Changes to reference data are changes to production and need the same control.

Design measures.

1. Load reference data only from an authenticated source, through a controlled job with its own credentials.
2. Show the differences from the last version to a named approver before the update goes live.
3. Log every reference data change with source, approver and time, and alert on loads outside the schedule.

Mappings: STRIDE T, E · CAPEC-75 · CWE-15, CWE-732 · CIE 3, 9

BKS-MP-8 · Key accounts quietly remapped

A small change to one entry in routing or payee data redirects payments for a single target: a government agency, a utility’s settlement account or a payroll bureau. Nothing fails, so nothing alarms, and money flows to the wrong place until a counterparty asks where it is.

Principle. The accounts that essential services depend on must be watched more closely than the rest.

Design measures.

1. Keep a protected list of critical accounts and routing entries, and alert on any change to them.
2. Confirm changes to critical payee details out of band with the account holder.
3. Reconcile expected incoming payments for critical institutions daily and investigate gaps at once.

Mappings: STRIDE T, S · CWE-1293 · CIE 8, 6

BKS-MP-7 · Messages altered at the SWIFT interface

Between core banking and the SWIFT interface sit middleware, file transfers and operator workstations. An adversary there can create, change, delete or hide payment messages and their confirmations, as in the Bangladesh Bank theft, and can use the same position to disrupt rather than steal.

Case: Bangladesh Bank, 2016; Mexico SPEI connections, 2018.

Principle. A payment message must be checkable end to end against the system that created it, wherever it passes.

Design measures.

1. Reconcile messages sent through SWIFT against core banking records independently and in near real time.
2. Protect the messaging zone as SWIFT’s Customer Security Controls Framework requires, with separate credentials and monitoring.
3. Send confirmations and statements to a channel the messaging operators cannot alter.

Mappings: STRIDE T, R, S · CAPEC-94 · CWE-924, CWE-353 · CIE 3, 6

BKS-MP-6 · Payee checks turned against payers

Name checks such as Verification of Payee and Confirmation of Payee answer from data held by the payee’s bank or a shared service. Corrupt that data and the check approves fraudulent payees or flags genuine ones, so money goes astray or ordinary payments stall while people phone to confirm.

Principle. A payee check must fail safe and show when its own answers cannot be trusted.

Design measures.

1. Protect the account-name data behind the check as critical data, with change control and monitoring.
2. Watch match and mismatch rates across the service and alert on sudden shifts.
3. Define how payers proceed when the service is unavailable or unreliable, without abandoning the check.

Mappings: STRIDE T, S · CWE-807 · CIE 2, 6

BKS-MP-5 · Sanctions lists corrupted

Payment screening relies on sanctions and watch lists loaded from authorities and vendors. A poisoned list blocks legitimate payments for whole sectors or lets sanctioned parties through, and banks cannot tell which until regulators or customers point it out.

Principle. Screening lists are critical inputs and must be authenticated and checked like code.

Design measures.

1. Load lists only from authenticated sources and compare each update with the official publication.
2. Alert when an update adds or removes far more entries than usual.
3. Keep the previous list ready to restore, and record which list version screened each payment.

Mappings: STRIDE T · CAPEC-194 · CWE-353 · CIE 9, 2

BKS-MP-4 · Format translation changes the payment

Many banks translate between the older SWIFT MT formats and ISO 20022 messages. Each translation layer is a place where fields are truncated, mapped wrongly or altered, and one change there affects every payment that passes through it.

Principle. Every translation of a payment message must be checkable against the original.

Design measures.

1. Keep the original message alongside the translated one and compare key fields automatically.
2. Test translators against hostile and malformed messages, not only valid samples.
3. Control changes to mapping rules as strictly as changes to payment code.

Mappings: STRIDE T · CAPEC-277 · CWE-1287 · CIE 4, 2

BKS-MP-3 · No cash to fall back on

When cards and transfers fail, cash is the fallback, but ATMs, cash centres and cash-in-transit routes run on the same networks, power and fuel. Where cash use has fallen, few shops accept it and households hold little, so a payments outage becomes an outage of everything.

Principle. A minimum cash system must be kept able to work when digital payments do not.

Design measures.

1. Keep cash distribution able to run on its own power, communications and fuel for days.
2. Agree with authorities which outlets must accept cash in a payments outage, and test it.
3. Plan ATM and branch operation on reduced connectivity, with limits rather than shutdown.

Mappings: STRIDE D · CIE 10, 7

BKS-MP-2 · One route to the outside world

Cross-border payments for a country or region pass through a few correspondent banks and messaging connections. Disrupting them cuts importers off from suppliers of food, fuel and medicines just when they are needed, and alternative routes take weeks to arrange.

Principle. Payment routes for essential imports must have a tested alternative before it is needed.

Design measures.

1. Map which correspondents and connections carry payments for essential imports.
2. Hold active, tested relationships with at least one alternative correspondent and route.
3. Agree with authorities how priority import payments move if normal routes fail.

Mappings: STRIDE D · CIE 7, 10

Public cases cited in this suit

• Bank Sepah, Iran, 2025. On 17 June 2025, during the Israel-Iran war, a cyberattack disrupted Iran’s state-owned Bank Sepah, closing branches and stopping cards and some fuel payments; the group claiming it said it had destroyed the bank’s data, and reports said damage to backups prolonged the outage. Attribution: Claimed by Predatory Sparrow. Sources: BankInfoSecurity: pro-Israel hacking group claims to disrupt Iran’s Bank Sepah; Iran International: banking disruptions persist after cyberattacks
• ICBC Financial Services, 2023. In November 2023 ransomware disrupted ICBC Financial Services, the US arm of the world’s largest bank, which could not settle US Treasury trades for other market participants; settlement details were carried across Manhattan on a USB stick. Attribution: Criminal ransomware (LockBit, as reported); no state attribution. Sources: Computer Weekly: ransomware attack on major Chinese lender disrupts financial markets; Security Affairs: ICBC suffered a ransomware attack
• ION Trading, 2023. In early 2023 ransomware hit ION, whose software many firms use for derivatives trade processing and clearing, disrupting trading and reporting in the City of London. Attribution: Criminal ransomware (LockBit); no state attribution. Sources: Computer Weekly: ransomware attack on major Chinese lender disrupts financial markets; ESRB: systemic cyber risk (2024 presentation)
• Kaseya VSA and Coop Sweden, 2021. In July 2021 ransomware was pushed through Kaseya VSA, a remote management tool used by managed service providers; Coop Sweden’s tills stopped working and it closed about 800 stores for several days. Attribution: Attributed by the FBI to the REvil ransomware group. Sources: The Record: Coop closes 800 stores after Kaseya ransomware attack; Truesec: Coop restored within 6 days
• Bangladesh Bank, 2016. In February 2016 attackers inside Bangladesh Bank’s network used its SWIFT-connected systems to send fraudulent transfer requests worth about 951 million dollars to the Federal Reserve Bank of New York; 81 million dollars reached accounts in the Philippines. Attribution: Attributed by the US Department of Justice (2018 complaint, 2021 indictment) to North Korean state-sponsored hackers (Lazarus Group). Sources: Finextra: US charges North Korean over Bangladesh Bank hack; RFA: US charges three North Korean spies
• Mexico SPEI connections, 2018. In April 2018 attackers compromised software that five Mexican financial institutions used to connect to the central bank’s SPEI payment system and sent hundreds of false transfer orders worth about 300 million pesos; dozens of institutions moved to a contingency connection. Attribution: Unattributed. Sources: Finextra: hackers steal millions from Mexican banks; Expansión: cronología del hackeo al SPEI

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.