Key Definitions Under the Law
- Access Device: Any instrument such as cards, codes, account numbers, electronic serial numbers, or other identifiers used to obtain money, goods, or initiate fund transfers excluding paper instruments.
- Payment Card: Cards used to withdraw cash or make payments electronically linked to deposits, prepaid, or credit loan accounts.
- Counterfeit Access Device: Fake, altered, forged, or reproduced copies of valid access devices.
- Hacking: Unauthorized access or interference with computer or information systems to corrupt, steal, destroy electronic data without the owner's consent.
- Card Skimming: Illegal copying of magnetic stripe data from payment cards.
- Application: Computer programs designed to perform coordinated functions for users.
- Online Banking: Managing bank accounts and transactions via the internet.
Enumerated Prohibited Acts Constituting Access Device Fraud
- Producing, using, or trafficking in counterfeit access devices.
- Skimming, copying, or counterfeiting cards to access accounts regardless of resulting loss.
- Possession or use of software or hardware components designed to commit access device fraud.
- Unauthorized or fraudulent access of applications, online banking, and various card accounts.
- Hacking or introduction of computer viruses causing destruction or loss of electronic data or documents.
Penalties for Violations Related to Access Device Fraud
- Imprisonment ranging from 4 years to life imprisonment depending on the offense severity.
- Fines scaled according to the degree of fraud and number of access devices involved, ranging from P300,000 to P5,000,000.
- Lifetime imprisonment and highest fines apply when offenses cause economic sabotage, such as hacking banks, skimming 50 or more cards, or affecting 50 or more accounts.
- Repeat offenses result in heavier penalties.
Presumption of Fraudulent Intent in Credit Card Abandonment
- Cardholders who abandon or surreptitiously leave their registered addresses with unpaid balances over P200,000 past due for 90 days are presumed to have used the credit card to defraud.
Reporting Requirements for Access Device Fraud
- Companies issuing access devices must investigate reported fraud and provide real-time reports to the NBI and Anti-Cybercrime Group of the PNP.
- Reports serve as official complaints allowing law enforcement to pursue investigations and prosecutions.
- Banks and financial institutions remain regulated by the Bangko Sentral ng Pilipinas; other issuers are regulated by the Securities and Exchange Commission.
Severability and Effectivity
- If any provision is declared unconstitutional, the remainder of the law continues in force.
- Inconsistent laws and regulations are repealed or amended.
- The law takes effect 15 days after publication in the Official Gazette or a newspaper of general circulation.