Increasing Incidence of Identity Theft

CIRCULAR LETTER NO. CL-2007-048

To : All Banks and BSP-Supervised Non-Bank Financial Institutions

Subject : INCREASING INCIDENCE OF IDENTITY THEFT

Pursuant to the provisions of Items 2.a and 2.b, Circular 542 dated 01 September 2006, all banks are hereby enjoined to adjust or update, as appropriate, their information security program in light of changes in internal and external threats to information as shown by the increasing incidence of identity theft.

Identity theft causes harm not only to the individual whose identity has been stolen but also to the financial institution that might inadvertently facilitate these fraudulent transactions. The reputational and financial risks associated with this crime may later translate to reputational and financial costs to the financial institutions if left unattended.

There are several schemes perpetrated by these identity thieves: credit card fraud, account takeover fraud, new account fraud and check fraud 1 to name a few.

The prevention of identity theft and more importantly deterrence of breaches in security of customer information must be acted upon immediately by bank management.

Banks and non-bank financial institutions are likewise enjoined to review their policy in establishing the identity of their customer and monitor account activity to determine those transactions that do not conform with the normal or expected transactions for that customer or type of account. “Know Your Customer” (KYC) policy should be a core feature of banks’ risk management and control procedures, and be complemented by regular compliance reviews and internal audit. The importance of the strict implementation of the KYC policy has never been more pronounced and cannot be over-emphasized with the emergence of identity theft and similar fraud.

For information and guidance.

NESTOR A. ESPENILLA, JR. Deputy Governor

--------------------------

11 Credit card fraud is where a fraudster causes the credit card of another person to be charged for a purchase. Account takeover fraud occurs when a fraudster obtains an individual’s personal information, and changes the official mailing address with that individual’s financial institution (FI). Once accomplished, the fraudster has established a window of opponunity in which transactions are conducted without the victim’s knowledge. New account fraud involves the criminal using a false identity, made-up or stolen; to open a new account, typically to obtain a credit card or loan. Check fraud may either be done through (i) alterations to the check, (ii) forgeries of the maker’s signature on either the face of the check or the payee’s endorsement on the back of the check, or (iii) counterfeit  checks created by a dishonest third party