IN 2024, it was reported that the Philippine financial services industry experienced about 38,370 phishing attacks.
The attacks are part of the 83-percent year-over-year global rise in financial related scams that utilize fake banking websites, fraudulent investment portals, phishing SMS messages to obtain customer information or mislead users to unauthorized transactions. It is estimated that 23 percent of ransomware attacks on financial services organizations were due to compromised credentials.
Financial services professionals were the most likely to open phishing email with a global click rate of over 26 percent in opening phishing emails recorded. The global average cost of the data breach in the financial services industry stood at $6.08 million on the same year.
BSP Circular 1213
TO address tighter security regulation, the Bangko Sentral ng Pilipinas (BSP) issued Circulars 1213, 1214, and 1215, laying out measures that banks, e-wallets and other financial institutions must take to combat mule accounts, phishing schemes and other forms of digital fraud. This followed after the enactment of the Anti-Financial Account Scamming Act (Afasa) in 2024.
The BSP’s directive focused on making all types of local biometric-based passkeys stronger. BSP Circular 1213 mandates a shirt toward secure, user-friendly cybersecurity alternatives as it observed limitations on the use of interceptable authentication mechanisms such as One-Time Pins (OTPs) via SMS and email. With the increasing prevalence of social engineering attacks aimed at obtaining login credentials, banking, financial services, and insurance institutions should limit the use of authentication mechanisms that can be shared to, or intercepted by third parties unrelated to the transaction.
BSP Circular 1213 cites the use of modern authentication standards such as the Fast Identity Online (FIDO), a technical specification for online user identity authentication that allows biological features or a security key to log in to online accounts. It encourages financial institutions to adopt phishing-resistant methods such as:
Biometric and behavioral biometrics
Cryptographic authentication
Hardware tokens and passwordless solutions
The circular further adds that proposed liability shifts mean that institutions persisting with outdated methods like SMS OTPs may be held financially accountable for resulting fraud losses.
Anticipating sophisticated cyber threats
THE BSP, through Circular 1213, wants financial institutions to be prepared as cyber criminals continue to mount more sophisticated and frequent attacks. Prone to these attacks are banking, payment services, insurance and fintech, among others. Even QR-code phishing and AI-driven phishing have increased in the past years. Philippine banks must be aware and adopt
The Bank Marketing Association of the Philippines (BMAP) affirms its commitment to help communicate the BSP’s directives to help keep financial institutions and consumers safe.