QuestionsQuestions (BSP CIRCULAR LETTER)
To alert banks that incidents of technology fraud involving ATM systems occurred in other countries and to instruct banks to conduct physical inspections and implement additional internal controls to prevent similar fraud in the Philippines.
A specialized scanner attached to the ATM card slot and a hidden pinhole camera.
It captures the stored PIN, card number, and other relevant information from the magnetic strip of the ATM card.
It captures the actual entry/input of the PIN into the ATM by the cardholder.
The captured magnetic-strip data is copied into another ATM card to produce a duplicate card, and the PIN captured by the camera is used with the duplicated card to withdraw funds without authorization.
Because attaching hidden skimming/scanning devices (e.g., on the card slot) can be detected through routine physical checks for unusual attachments.
Any hardware added or affixed to the ATM (especially near the card slot) that is not part of the ATM’s normal design, such as a card-slot scanner or other tampering devices.
It advises implementing appropriate additional internal controls, because the fraud depends on physical tampering and information capture; stronger controls reduce the likelihood of undetected skimming devices and compromise of card data.
The circular is addressed to banks (it advises banks to conduct inspections and implement controls). It provides guidance and does not primarily impose direct obligations on ATM users.
A BSP issuance that serves as regulatory guidance/advisory instructions. Banks are expected to comply with the measures advised, particularly those related to safeguarding systems and preventing fraud.
By describing fraud that relies on physically attaching a scanner to the card slot and hiding a camera; thus, physical security and inspection are treated as key fraud-prevention measures.
It captures the stored PIN, card number, and other relevant information; this allows criminals to replicate card data and then use the captured PIN to conduct unauthorized withdrawals.
First, capture card data (scanner) and PIN entry (camera); second, use the captured data to create a duplicate card and perform unauthorized withdrawals.
Yes. While the circular specifically describes a pinhole camera hidden on/near the ATM, the broader control principle—strong surveillance/inspection and internal controls to prevent compromise of PIN and card data—remains relevant.
It was adopted/signed by (SGD.) ALBERTO V. REYES, Deputy Governor.