Policy and criminal-economic sabotage
- Republic Act No. 11449 amends Section 2 of Republic Act No. 8484 to state that the State shall protect rights and define liabilities in commercial transactions by regulating the issuance and use of access devices.
- Republic Act No. 11449 declares that advances in information technology on access devices have been exploited by criminals and criminal syndicates to perpetrate fraudulent activities undermining public trust in the banking industry.
- Republic Act No. 11449 declares that the commission of a crime using access devices is a form of economic sabotage and a heinous crime punishable to the maximum level allowed by law.
Core definitions under RA 8484
- Republic Act No. 11449 amends Section 3 of Republic Act No. 8484 by defining Access Device as any card, plate, code, account number, electronic serial number, personal identification number, or other telecommunications service/equipment/instrumental identifier, or other means of account access used to obtain money, goods, services, or any other thing of value, or to initiate a transfer of funds (other than a transfer originated solely by paper instrument).
- Republic Act No. 11449 defines Counterfeit Access Device as an access that is counterfeit, fictitious, altered, or forged; an identifiable component of an access device or counterfeit access device; or any fraudulent copy or reproduction of a valid access device.
- Republic Act No. 11449 defines Hacking as unauthorized access into or interference in a computer system/server or information and communications system, or any access to corrupt, alter, steal, or destroy using a computer or similar information and communication devices without the owner’s knowledge and consent, including introduction of computer viruses and resulting corruption, destruction, alteration, theft, or loss of electronic data message or electronic documents.
- Republic Act No. 11449 defines Payment Card in two parts within Section 3:
- Payment cards that can be used by cardholders and accepted by terminals to withdraw cash and/or make payment, fund transfer, and other financial transactions, typically linked deposits, prepaid, or loan credit accounts; and
- Payment card as any card of whatever material or form including any debit card (but not a credit card) issued by a bank or business entity that enables a customer to access an automated teller machine to perform transactions such as deposits, cash withdrawals, and obtaining account information, and a payment card shall be considered an access device for purposes of Republic Act No. 8484.
- Republic Act No. 11449 defines Card Skimming as a fraud involving illegal copying of information from the magnetic stripe of a payment card to gain access to customer accounts.
- Republic Act No. 11449 defines Application as a computer program designed to perform a group of coordinated functions, tasks, or activities for the benefits of the user.
- Republic Act No. 11449 defines Online Banking as use of the internet by bank customers to manage bank accounts and perform account transactions.
Unlawful access device fraud acts
- Republic Act No. 11449 amends Section 9 of Republic Act No. 8484 to declare that the following acts constitute access device fraud and are unlawful:
- Section 9(a) prohibits producing, using, trafficking in one or more counterfeit access devices.
- Section 9(q) prohibits skimming, copying, or counterfeiting any credit card, payment card, or debit card, and obtaining information therein with intent to access the account and operate it, whether or not cash is withdrawn or monetary injury is caused to the account holder or depository bank.
- Section 9(r) prohibits production or possession of any software component such as programs, application, or malware, or any hardware component such as skimming device or any electronic gadget/equipment used to perpetrate any of the foregoing acts.
- Section 9(s) prohibits accessing, with or without authority, any application, online banking account, credit card account, ATM account, or debit card account in a fraudulent manner, regardless of whether monetary loss results to the account holder.
- Section 9(t) declares “hacking” unlawful using the Hacking definition (unauthorized access or interference resulting in corruption, alteration, theft, destruction, or loss of electronic data messages/documents).
Penalties for access device fraud
- Republic Act No. 11449 amends Section 10 of Republic Act No. 8484 to require punishment for any person committing acts constituting access device fraud under Section 9 with the following penalties and fines:
- Section 10(a) imposes imprisonment of not less than twelve (12) years and not more than twenty (20) years, plus a fine of twice the equivalent of the aggregate amount of all affected or exposed bank accounts, with a minimum fine of PHP 500,000 if the offender is in possession of ten (10) or more counterfeit access devices and/or unauthorized access devices and was able to access at least one (1) account or had gained credit through the fraudulent use of any such access device in possession.
- Section 10(b) imposes imprisonment of not less than six (6) years and not more than twelve (12) years, plus a fine of PHP 300,000 or twice the equivalent of the aggregate amount of all affected or exposed bank accounts—whichever is higher—if the offender is in possession of ten (10) or more counterfeit access devices and/or unauthorized access devices but was not proven to have accessed any account or have gained any credit through those access devices.
- Section 10(c) imposes imprisonment of not less than four (4) years and not more than six (6) years, plus a fine of twice the value of the fraudulent obtained credit, without prejudice to civil liability, for an offense involving fraudulent use of a credit card.
- Section 10(d) imposes imprisonment of not less than six (6) years and not more than ten (10) years, plus a fine of PHP 500,000 or twice the value obtained by the offender—whichever is higher—without prejudice to civil liability, for an offense under items (b), (c), (d), (e), (g), (h), (i), (j), (k), (l), (m), (n), (o), (p), (q), (r), (s), and (t) of Section 9, when it does not occur after a conviction for another offense under the same section.
- Section 10(e) imposes imprisonment of not less than ten (10) years and not more than twelve (12) years, plus a fine of PHP 500,000 or twice the value obtained by the offender—whichever is higher—without prejudice to civil liability—for an offense under Section 9(a), (f), and (q) that does not occur after a conviction for another offense under Section 9.
- Section 10(f) imposes imprisonment of not less than twelve (12) years and not more than twenty (20) years, plus a fine of PHP 800,000 or twice the value obtained by the offender—whichever is higher—without prejudice to civil liability—for any offense under Section 9 that occurs after a conviction for another offense under the same section, or an attempt to commit the same.
- Section 10(g) provides life imprisonment and a fine of not less than PHP 1,000,000 but not more than PHP 5,000,000 if the offense constitutes economic sabotage, deemed committed when any prohibited act under Section 9 is committed under any of the following circumstances:
- (1) the prohibited act involves the hacking of a bank’s system; or
- (2) the act of skimming affects fifty (50) or more payment cards; or
- (3) the prohibited act affected fifty (50) or more online banking accounts, credit cards, payment cards, and debit cards.
Credit card fraud presumption
- Republic Act No. 11449 amends the last sentences of Section 14 of Republic Act No. 8484.
- A cardholder who abandons or surreptitiously leaves the place of employment, business, or residence stated in the cardholder’s application for credit card, without informing the credit card company of where the cardholder could actually be found, is prima facie presumed to have used the credit card with intent to defraud.
- The presumption applies when the outstanding and unpaid balance is past due for at least ninety (90) days and is more than PHP 200,000 at the time of abandonment or surreptitious leaving.
Mandatory reporting of access device fraud
- Republic Act No. 11449 amends Section 16 of Republic Act No. 8484 to impose reporting and investigation duties.
- All companies engaged in the business of issuing access devices, including banks, financing companies, and other financial institutions issuing access devices, and all partner merchants, must conduct an initial investigation on any reported access device fraud.
- The required investigation reports must be furnished in real time to the National Bureau of Investigation (NBI) and the Anti-Cybercrime Group of the Philippine National Police (PNP).
- Reports must contain (1) a narration about the fraud committed and (2) identification of the perpetrator, if feasible.
- The report must also constitute the complaint necessary for the NBI or the Anti-Cybercrime Group of the PNP to pursue further investigation and prosecution.
- Banks, financing companies, and other financial institutions (including their subsidiaries and affiliates) issuing access devices must continue to be regulated and supervised by the Bangko Sentral ng Pilipinas; other companies issuing access devices must continue to be regulated and supervised by the Securities and Exchange Commission.
Separability, repeals, and amendments
- Republic Act No. 11449 provides that if any separable provision is declared unconstitutional, the remaining provisions continue in force (separability clause).
- Republic Act No. 11449 repeals, amends, or modifies inconsistent laws, decrees, executive orders, rules, and regulations, or parts thereof.
- Republic Act No. 11449 is an amendment to Republic Act No. 8484, specifically amending Sections 2, 3, 9, 10, 14, and 16.