BSP Memorandum No. M-2014-040

(NAR) VOL. 25 NO. 4 / OCTOBER - DECEMBER 2014

[ BSP MEMORANDUM NO. M-2014-040, October 03, 2014 ]

CARD FRAUD AND SKIMMING ATTACKS

Adopted: 03 October 2014 Date Filed: 20 October 2014 Electronic payment cards (i.e., ATM debit, credit and prepaid cards) are still vulnerable to skimming attacks given the continued use of magnetic stripe [1] technology. Pending migration of the entire payment card network to EMV by 01 January 2017, electronic payment cards remain largely defenseless against modern fraud techniques unless multiple layers of protection are adopted by BSP-Supervised Institutions (BSIs). To manage subject risk, BSIs are reminded to consider the specific controls to mitigate exposure from skimming attacks outlined under Annex “A” - Appendix 75f of Circular No. 808 dated 22 August 2013, namely: Installation or implementation of additional controls to ATM and POS machines, such as anti-skimming solution, tamper-resistant keypads or video surveillance; Establishment of detection process and alert mechanisms for timely and appropriate incident response and action; and Use of transaction alerts on withdrawals and other transactions exceeding certain defined thresholds. Abovementioned controls highlight the BSI’s need to (a) protect ATM and POS machines and (b) have proactive systems and processes in place to prevent, detect, manage or respond to card skimming incidents. Also, BSIs need to strengthen their customer awareness programs as a first line of defense against fraudsters reiterating the precautionary measures under Annex “C” - Appendix 75f of Circular No. 808.

A. SECURITY CONTROLS FOR AUTOMATED TELLER MACHINES (ATMs) AND POINT OF SALE (POS) DEVICES BSIs shall put in place adequate safeguards as card skimming attacks may happen at various points in payment card processing, such as ATMs, payment kiosks and POS terminals. Following are the minimum security measures required for ATM facilities and POS devices pursuant to Annex “A” - Appendix 75f of Circular No. 808 with the corresponding additional recommended controls necessary given the evolving nature of the skimming attacks:

1. AUTOMATED TELLER MACHINESPertinent Provisions Recommended Control Measures • Locate ATM’s in highly visible BSIs are expected to enhance their areas; risk management processes to • Provide sufficient lighting at include the conduct of a thorough and around the ATMs; and risk assessment, which considers, • Where ATM crimes (e.g., specific ATM model, ATM location, robbery, vandalism, skimming) volume of transactions and such are high in a specific area or other factors necessary to identify location, the BSI should install those ATMs requiring additional surveillance camera or cameras controls. For those classified as high which shall view and record all risk, installation of robust anti-persons entering the facility. skimming solution and/or additional Such recordings shall be security devices and measures shall preserved by the BSI for at least be necessary. The results of the risk thirty (30) days. assessment shall likewise be used to identify specific or vulnerable ATM models due for replacement.

• Implement ATM programming Logical controls, such as transaction enhancements like masking/non- alert systems and/or notifications, printing of card numbers. shall also be considered by BSIs to ensure risks are appropriately mitigated or managed.

• Educate customers by advising Consumer education remains one of them regularly of risks associated the key defenses against fraud, with using the ATM and how to identity theft and security breach. avoid these risks; Concerned BSIs shall accordingly • Post a clearly visible sign near enhance their consumer awareness the ATM facility which, at a initiatives in response to the minimum, provides the telephone business environment. More than numbers of the BSI as well as protection of the Personal other BSIs’ hotline numbers for Identification Number (PIN) and the other cardholders who are measures outlined in Annex “C” – allowed to transact business in Appendix 75f of Circular 808, the ATM, and police hotlines for advisories on how to check for emergency cases. skimming devices shall also be released and posted in ATM premises.

• Conduct and document periodic Periodic security inspection is a security inspection at the ATM necessary step to ensure that ATMs location. are not compromised. Other than security officers, BSIs shall consider requesting assistance of branch personnel in ensuring ATMs remain safe for the consumers. Inspection shall be documented and performed on a periodic basis, the frequency of which depends on the results of the risk assessment. To further promote confidence in the use of ATMs, BSIs shall post in their ATM premises information that ATM machines are regularly checked for the presence of skimming devices.

• Educate BSI personnel to be To manage reputational risk, responsive and sensitive to adequate handling and containmentcustomer concerns. of consumer concerns and complaints shall be undertaken by highly-trained BSI personnel. A well-defined customer complaint resolution process must be in place specifying prompt notifications as well as the conduct of investigations aimed at resolving issues and complaints within a reasonable timeframe.

2. POINT-OF-SALE DEVICES Pertinent Provisions Recommended Control Measures • The party providing POS Similar to ATMs, physical security terminal must always increase controls shall be in place for POS the physical security around the devices with the added concern on vicinity of such POS terminal connectivity to minimize risk of and on the POS terminal itself, interception in the established among others, by using POS communication link. Risk terminal that minimizes the assessment of POS terminals possibility of interception on considering the location, volume such terminal or in its and amount of transactions and communication network. other risk factors should also be undertaken.

• BSI deploying POS devices at Likewise, POS devices shall be merchant locations must configured to assist in ensuring familiarize the merchant with the confidentiality of sensitive safe operation of the device. The information so as to minimize acquiring institution must ensure opportunity for card skimming. that the POS devices as well as other devices that capture In addition to physical and logical information do not expose/store controls, BSIs should exercise information such as the PIN proper oversight of their accredited number or other information merchants and enforce baseline classified as confidential. It must controls in minimizing card also ensure that a customer’s PIN skimming and fraud risks such as number cannot be printed at the hiring practices and background point of sale for any reason checks of employees handling whatsoever. payment card processing.

B. PREVENTION, DETECTION, MANAGEMENT AND RESPONSE RELATIVE TO SKIMMING INCIDENTS 1. PREVENTION Other than the minimum security requirements for ATMs and POS, Annex “A” - Appendix 75f of Circular No. 808 requires the study, analysis and assessment of ATM crimes to determine root cause and problem areas. Lessons learned from BSI's or another BSI's experience shall be used to promote changes, measures or process improvements to prevent recurrence or occurrence of incidents to the BSIs.2. DETECTION In addition to consumer complaints handling, Annex “A” – Appendix 75f of Circular No. 808 requires the implementation of fraud detection systems with behavioral scoring and correlation capabilities to identify and curb fraudulent activities even prior to completion of the transaction or knowledge of the consumer. The system will enable BSIs to effectively monitor actions by cardholders that deviate from usual card usage patterns which may subsequently lead to investigation.

3. MANAGEMENT AND RESPONSE BSIs should establish processes necessary for the timely investigation and resolution of card fraud and skimming related cases. Such processes shall include determining, within a reasonable timeframe, the party liable for the loss and equitable compensation for affected customers once fraud has been established. Pursuant to this objective and Annex “A” - Appendix 75f of Circular No. 808, the BSP enjoins BSIs to implement collaboration and information sharing practices. Practices shall include sharing of CCTV video images whenever available, without extra financial charges, subject to data confidentiality agreements and related industry-wide policies and procedures. BSIs’ policies and procedures should be harmonized to conform to this information sharing mechanism. Participation in industry collaboration and information sharing efforts such as the Inter-network Anti-Fraud Committee (IAFC) and the Information Security Officers’ Group (ISOG) is also highly encouraged. In some instances, BSIs may need to seek assistance and cooperate with law enforcement agencies for prompt resolution of cybercrime cases, especially if these involve public safety and security. BSIs that fail to adopt the abovementioned controls/measures to mitigate card fraud and skimming attacks may be subject to monetary and non-monetary sanctions provided under Subsection X176.9 of Circular No. 808. For information and guidance.

(SGD) CHUCHI G. FONACIER Sector-in-Charge [1] EMV (stands for Europay, MasterCard and Visa) is a global standard for credit, debit and prepaid payment cards based on chip card technology. Chip cards are a more secure alternative to traditional magnetic stripe payment cards.