BSP ramps up efforts vs fraud, cybercrime
The Bangko Sentral ng Pilipinas (BSP) proposed tighter regulations that banks and nonbanks must follow to ramp up consumer protection against fraud and other financial cybercrimes.
The BSP is soliciting comments from stakeholders on a draft circular that would amend the manual of regulations for financial institutions, specifically the provisions on information technology (IT) controls for electronic products and services that regulated entities offer to the public.
The central bank will wait for the industry’s feedback until Feb. 10.
The BSP said the proposed changes were meant to enforce Republic Act No. 12010, or the Anti-Financial Account Scamming Act (Afasa), which was signed into law last year in a bid to combat financial cybercrimes.
Afasa prohibits and punishes crimes like acting as money mules to carry out scams, as well as performing social engineering schemes and economic sabotage.
The law gives the BSP limited authority to investigate bank deposits, e-wallets and other financial accounts involved in such crimes.
Risk management
Afasa also imposes responsibilities on regulated entities to employ adequate risk and fraud management systems to ensure that their clients’ financial accounts are protected.
Latest available data from the BSP showed that 59.48 percent of cyberfraud losses in 2023 were due to account takeover, identity theft and phishing attacks.
This was more than twice the level that was recorded in 2022.
That said, the proposed circular would order banks to adopt an “aggressive security posture,” including a robust fraud management system (FMS) capable of rapidly detecting and preventing fraudulent transactions.
The FMS must spot and avert fraud by detecting unusually rapid account activity; changes in mobile number and email address that may indicate account takeover; and transactions done from unexpected geographical locations.
Banks and nonbanks must also analyze transactions against databases of insecure merchants, as well as account activities associated with mobile devices and IP addresses previously involved in fraudulent transactions.
The FMS must likewise detect deviations from a user’s typical behavior, such as spending patterns or login habits that could indicate unauthorized access.
“Detection through FMS is one of the grounds to temporarily hold funds and initiate a coordinated verification process,” the draft document read.
The proposed circular added that financial institutions “shall perform acts as may be legally warranted to preserve the integrity of the financial account.”
