Bank clients lose over P1 billion to cybercrime

MANILA, Philippines — Entrepreneur Neneronda Tan recently got the shock of her life when she found out that she had P1.74 million in credit card debt incurred from 14 transactions—none of which she authorized—all made deep in the night in less than two hours.

This was right after she lost her cell phone signal when she accepted a call from someone claiming to represent courier DHL, advising her of an upcoming delivery, according to a complaint dated Oct. 25, 2021, filed by Tan at the National Bureau of Investigation.

Sensing that something was amiss when her cell phone signal was not restored overnight, Tan reported the incident to her telecom provider the next morning and called her bank to suspend her credit card.

By the time she got through the bank’s hotline in the afternoon, it was then that she found out about the transactions made between 12:59 a.m. and 2:44 a.m. of Oct. 23. There were other transactions that failed because her credit limit had been breached.

Meanwhile, her telecom provider told her that on the day she lost her signal on Oct. 22, a female impostor had gone to one of its service centers and requested to suspend her cell phone line. When asked for valid IDs, the impostor presented a “Neneronda Tan” voter’s ID and TIN card that matched her personal information, although the photos in the IDs were of the impostor’s.

To date, the Tan family has yet to receive updates on how the hacking happened, or the course of action to take regarding the unauthorized credit card charges.

In January, Sen. Sherwin Gatchalian also reported that his credit card had been hacked and some P1 million worth of food purchases had been charged to his account.

Piling up losses

These are just the more known incidents and are part of a much bigger financial cybercrime picture.

The Bankers Association of the Philippines (BAP) estimated that more than P1 billion worth of hard-earned money has gone down the drain so far this year due to fraud, including unauthorized bank withdrawals and fund transfers, as cybercriminals more aggressively prowled the digital space as locked-down consumers shifted to digital channels.

The industry-wide loss was based on data gathered by the BAP from reports filed by fraud victims, said BAP cybersecurity committee vice chair Ramon Jocson, who is also executive vice president of Bank of the Philippine Islands.

“Some of the victims don’t even bother to report anymore,” Jocson said.

He also cited a study by Kaspersky estimating that one out of three internet users in the Philippines had been scammed, alongside a separate study by Cisco estimating that 57 percent of all small and medium enterprises (SMEs) had been hacked or penetrated by fraudsters.

In terms of volume, it said cybercrimes victimizing banks and clients have increased by as much as three times the prepandemic levels.

Asked who ended up paying for the losses—the bank or the client—Veloso said in a text message: “It depends on the finding of the bank and it’s (based on) discussions with the client.”

“This is one of BAP’s priority, to develop a commonly acceptable course of action, avoiding too many variables,” BAP executive director Benjamin Castillo replied in a separate text message.

Antiscam campaign

The BAP signed on Wednesday a memorandum of understanding with the Kapisanan ng mga Brodkaster ng Pilipinas (KBP) to enlist local broadcasters in the war against cybercriminals.

“The signing of this memorandum of understanding signifies the alliance between various stakeholders in our goal to ensure every Filipino will have a safe banking experience. As we usher in the new normal, Filipinos have become more comfortable in conducting bank transactions online,” said BAP president Wick Veloso, who is also president of Philippine National Bank.

The BAP has also launched its “Anti-Scam Campaign,” a wide-ranging information drive undertaken with various partners to promote cybersecurity, cybersafety and awareness.

KBP agreed to help disseminate information on cybersecurity and data protection.

“We believe that this collaboration project will result in a more intensive consumer awareness and education as a strong first line of defense against cyberthreats,” added KBP chair Ruperto Nicdao Jr., who is also president of Manila Broadcasting Corp.

An MOU signing with the Department of Justice will also be held to train cybercrime enforcers and prosecutors in holding cybercriminals accountable for their actions.

The Bank Marketing Association of the Philippines will also be the official partner in unifying the execution of the antiscam campaign on social media by BAP member-banks.