January 26th, 2022
House Ways and Means Chair Joey Sarte Salceda (Albay, 2nd district) reiterated his call for tougher cybersecurity measures against phishing attacks and other mobile banking scams as some two dozen public school teachers have complained recently of unauthorized transactions done through their accounts with the Land Bank of the Philippines.
“It’s alarming because just as the BSP is about to conclude its ongoing investigation into phishing attacks last Christmas season, the criminals behind it appear to have shifted their attention towards a different bank.”
“That means the problem isn’t just a case of one bank or another being negligent. I have no doubt these banks can do better, but the modus also appears to be very similar, and the destination accounts used also happen to be in similar banks,” Salceda added.
“It’s even more alarming because the Landbank is the main government depository, and the vast majority of public sector employees have their hard-earned salary banked there,” Salceda added.
Measures suggested
As preliminary measures, Salceda proposed that banks authorize withdrawals and transfers only from “registered devices.”
“It appears to me that the scammers are somehow able to use other devices to transfer funds from the accounts to other accounts. I think the simplest fix is to limit access to remote banking accounts to devices that the account holder registered with the bank. That already closes the door to remote hacking of accounts. They have to get to your phone or to your computer to make unauthorized transfers,” Salceda said.
Salceda adds that banks may have to review identification requirements, particularly with mobile banking applications.
“Some common banking and finance names appear as the destination of the transfers. We may have to review identification requirements for opening a bank account in these banks,” Salceda added.
Landbank urged to return funds
Salceda also urged Landbank to restore funds to the scam victims once found that their systems were at fault.
“The BSP can release standards for what constitutes ‘the user’s fault’ and what qualifies as ‘the bank’s fault.’ Anything that counts as the ‘bank’s fault’ should be its liability to the user,” Salceda said.
“BDO promised to return funds, although I called them out for reports of requiring quitclaims of its account holders. The Landbank, as a state bank, has to set the industry example by promising to return the funds and making its systems less vulnerable,” Salceda added. #