Despite constant warnings: Bank clients still fall prey to phishing

CEBU, Philippines - Bank depositors still fall prey to phishing scams despite the banking sector’s intensified security measures and constant warnings to clients to never give out personal details to fraudulent emails.

Maximo Eleccion, past president of Cebu Bankers Club, yesterday said that the banks are doing their best to protect their clients from various fraud amid incidents of identity theft.

"We are sorry that inspite of all our reminders, we still hear clients being victimized," CBC said in an official statement forwarded by Eleccion to The Freeman.

This ensued after a complaint was raised by Jollibee Foods Corporation regional marketing head Nelson Judaya, through The Freeman, after he lost P65,000 from his ATM account with Metrobank.

Judaya said the incident happened last week recalling that he did not make any withdrawal or transaction through ATM or online banking during that time.

He said that after finding out about it, he immediately informed the manager of Metrobank Leon Kilat, Cebu City about the incident.

The incident is now being investigated by the bank.

He said the bank manager suspected that his account could have been a victim of phishing when he mentioned that he received email links and accessed them.

Judaya added that the manager told him that it is highly possible that accessing those fraudulent emails could have made his account vulnerable to scammers.

Phishing scam

Phishing scam is done through hacking into one's personal account, hijacking one's data and taking over one's online identity to commit fraudulent acts/crimes or conduct unauthorized business.

According to the Bangko Sentral ng Pilipinas, phishing attacks and fraud perpetrated via other vectors continue to be a primary concern affecting the financial services industry.

The banking public have been warned against phishing scam in which a person's personal information is stolen without his or her knowledge to do fraudulent acts.

The central bank said the incidents reported by banks mostly involved "unauthorized intra or interbank fund transfer facilitated via phishing emails received by clients."

The CBC statement also said: "It is our standard operating procedure to investigate what happened to the account why they were victimized. This may take some time depending on the bank, and the complexity of the case."

CBC asked for patience from clients and allow the bank to conduct their investigation. If found that it was the fault of the client, the bank can cannot credit their account of the money in question.

"We are always one with them but they have to understand they we cannot pay them if the loss is caused by their fault or negligence," the statement further read.

"We continually remind them of the things they need to do: non disclosure of personal information and non disclosure of ATM PIN to avoid being victimized," the statement further said.

Measures

Last year, BSP released a memorandum telling banks to put in place measures that protect their clients from fraudulent emails or websites.

Memorandum 2015-025 provides the provisions and guidelines on the management of risks associated with fake emails and websites.

The BSP requires banks to have a dynamic consumer awareness program where they should educate their clients on the risks of using online banking.

Banks are also told to implement "additional authentication and authorization controls for sensitive transactions or activities" such as enrollment in a new online service, large fund transfer and account maintenance charges.

BSP further orders banks to boost their security monitoring systems to detect and respond to potential breaches in a timely manner.

Banks are further required to "implement a mechanism to authenticate official website to protect customers from spoofed or faked websites." (FREEMAN)