BSP wants stronger measures against cyber fraud (Sabong News)
Author
Lee C. Chipongian
Date
MARCH 23 2022
The Bangko Sentral ng Pilipinas (BSP) has recommended eight more supplementary control measures to fight against cyber fraud and to prevent attacks on retail electronic payments and financial services.
In a memo (Memorandum No. M-2022-015) issued on Wednesday, March 23, BSP Deputy Governor Chuchi G. Fonacier said fraudsters particularly those using phishing methods to exploit legitimate applications are becoming more adept in bypassing a BSP-supervised financial institution’s (BSFI) “layers of controls”.
“BSFIs should conduct continuing risk assessment of its product features, business rules and application controls, and implement appropriate enhancements and mitigation, as necessary,” said Fonacier.
The memo listed eight supplementary control measures that BSP wants BSFIs to adopt to “ensure consistent and industry-wide approach in countering the aggressive phishing campaigns.”
The BSP recommends the following: the removal of clickable links in emails or SMS sent to retail customers followed by an information campaign that the BSFI will no longer be sending clickable links; and customer notification through existing mobile or email registered with the BSFI whenever there is a request to change a customer’s mobile number, email address, or account credentials.
The BSP said that after the conduct of a thorough risk analysis and assessment, BSFIs should have: mandatory fund transfer transaction notification to customers through SMS and/or email for transactions exceeding a predefined amount; holding period or delay before activation of a new soft token on a mobile device; and cooling-off period before the implementation of requests for key account changes such as those for the mobile number and email address.
The BSP also wants personalized SMS/email OTP messages for device registration, fund transfer, and profile update, among others, as well as restriction to any BSFI officer or representative from manually obtaining or inquiring about critical authentication information such as customer password and/or one-time password/pin.
Other supplementary control measures recommended are: creation of dedicated and well-resourced customer assistance teams that deal with feedback on potential fraud cases on a priority basis; conduct of regular customer education campaigns against online scam and phishing schemes with mechanisms to monitor their effectiveness and relevance; and adoption of strong fraud surveillance mechanisms to ensure prompt responses in dealing with the growing threat of online scams.
“As financial transactions increasingly shift to electronic or digital channels, attacks on retail customers using mobile and internet/web applications have risen,” said Fonacier.
The most common cyber fraud using phishing and other variants such as smishing and vishing, is account takeover and social engineering attacks. These are intended to manipulate customers into disclosing sensitive personal and account information necessary to execute unauthorized transactions, said the BSP.
Fonacier said the eight supplementary control measures are consistent with the risk-based approach under existing BSP rules on IT risk management and financial consumer protection frameworks.
“These should supplement existing security controls including multi-factor authentication (MFA) implementation, calibration of fraud management system rules and parameters, conduct of threat hunting exercises, and takedown of phishing sites, among others,” she said.
The BSP is advising BSFIs to work with and use the existing information sharing platforms such as those employed by the Bankers Association of the Philippines Cyber Incident Database or BAPCID to aid in their fraud investigation and if possible, in the recovery of stolen funds.
“In certain instances, BSFIs may need to seek assistance and cooperate with law enforcement authorities for prompt resolution of cybercrime cases, especially if these involve public safety and security, pursuant to the Cybercrime Prevention Act of 2012 and other relevant laws and regulations,” said Fonacier.
