Banxico SPEI interbank heist (Mexico, 2018)

In April and May 2018, Mexico's interbank payment backbone — SPEI (Sistema de Pagos Electrónicos Interbancarios), operated by central bank Banco de México (Banxico) — was abused in a series of cyberattacks that injected fraudulent transfers and drained an estimated 300 to 400 million pesos (roughly $15-20 million). It remains one of the most significant attacks ever against a national payment system.

What happened

Critically, the SPEI core was not breached. Instead, attackers exploited weaknesses in the third-party and in-house software that individual banks used to connect their systems to SPEI. By compromising those connection components, the perpetrators were able to forge payment orders — phantom transfers that SPEI processed as legitimate because they arrived through an authenticated participant link.

The fraudulent transfers funneled money into accounts at other institutions controlled by the attackers. Accomplices — money mules — then withdrew the funds in cash at bank branches, an unusual pattern of large withdrawals that suggested possible insider assistance. At least five financial institutions were affected, with reporting naming Banorte, Banco del Bajío and Banjército among those targeted.

Impact

• An estimated 300-400 million pesos (~$15-20 million) was diverted and cashed out.
• Because the stolen funds moved between institutional accounts, ordinary customers' balances were reported not to have been directly debited.
• Banxico activated a contingency scheme that slowed and rerouted transfers, causing settlement delays and longer transaction times across the banking system for weeks.

Why it matters

The SPEI episode is a landmark case in payment-system and third-party risk. It showed that a robust central infrastructure can be undermined through the weakest participant's integration layer, and that financial criminals could combine a technical software compromise with a physical cash-out network. In response, Banxico imposed mandatory minimum cybersecurity standards for SPEI participants and pushed institutions toward a separate, hardened connection architecture — reforms that reshaped how Mexican banks attach to the national payment rails.