Securing the digital space amid the new normal
THE RAPID growth in digital transactions has often been cited as the silver lining for economies currently constricted by lockdown restrictions due to the pandemic. Even so, this increase has also exposed businesses and households to an increased threat of cyberattacks.
In an e-mail to BusinessWorld last month, the Bangko Sentral ng Pilipinas (BSP) said the reported cyber incidents were higher compared with pre-pandemic levels.
“With the shift to digital financial services due to the pandemic, the cyber threat landscape has naturally evolved and brought in more opportunities for threat actors…,” the BSP said.
While the BSP did not provide specific figures, one can glean from other sources the extent of the increase in cyberattacks.
In the Asia-Pacific Online Policy Forum last August 2020, internet security firm Kaspersky noted the number of new malicious applications collected increased to 400,000 during the pandemic from 300,000 previously.
Kaspersky also reported in an e-mailed statement on Feb. 15 on cyberattacks aimed at the education sector the use of popular online learning platforms or video conferencing applications as lures. It noted users around the globe who encountered threats distributed under the guise of these applications reached 168,550 from January to June 2020, around 205 times more compared with the number of cases in the same period in 2019. As of January this year, the number of users encountering these threats rose by 60% to 270,171.
To counter these threats, BSP supervised financial institutions (BSFIs) were said to have implemented heightened security controls and processes such as multi-layered network controls, authentication controls, and cybersecurity awareness programs during the pandemic, the central bank said.
“While their tactics were constantly shifting from distributeddenial-of-service (DDoS) to malware attacks, these cyber threat actors heavily relied on social engineering attacks such as phishing,” the central bank said, adding that phishing attacks remain the top cybersecurity concern among banks and other businesses.
Bank of the Philippine Islands (BPI) Head of Enterprise Information Security Management and Data Privacy Jonathan B. Paz shared the same assessment: “Cybercriminals have taken advantage of the surge in the number of people using the bank’s digital platforms.
This mass migration to digital channels induced more criminals to shift to phishing and other related scams,” he said in a separate e-mailed response to queries.
Mr. Paz classified three “generic” types of attacks seen during the pandemic: (1) state-sponsored attacks in the form of DDoS or ransomware; (2) wholesale attacks in the form of “advanced persistent threats” (APTs); and (3) retail attacks in the form of phishing, “vishing” or voice phishing, and SIM-swaps.
“Per the latest Interpol report survey covering 194 countries, the retail attacks comprise 59% of all reported attacks in 2020,” Mr. Paz said.
“For the phishing e-mails, there has been a surge of COVID-themed phishing attacks last year. Some of these include offering cures, preferential priority for vaccines, and other COVID-19 related matters,” he said, noting the phishing sites they took down in 2020 increased to as many as 500 a month from 300 previously.
Some victims fall for these phishing sites as these typically include the usual layout and graphics used by banks with promises of gifts and other promotional prizes. Links to the site and e-mail addresses used are also just slightly different from typical addresses in disseminating bank announcements and other information.
“Online scams are all about identity/credentials theft. Banks have implemented multi-factor and out-of-band authentication mechanisms, and encryption. They have also tightened know-your-customer/onboarding processes to help ensure that clients are better protected by giving them more control over the access to their accounts,” Mr. Paz said.
In a separate e-mail, Maybank Philippines, Inc. President and Chief Executive Officer (PCEO) Officer-in-Charge Abigail Tina M. del Rosario said its incident response amid the pandemic evolved through the adoption of multi-channel and collaborative escalation and detection processes across all of its employees.
“Maybank Philippines adopts a vigilant 24/7 security operation center to monitor, detect and identify security threats; response to such incidents is therefore triggered right away, so incidents that could lead to a potential data breach is immediately contained, without compromise to operations and resources,” she said.
KEEPING LINES OPEN
Meanwhile, the BSP has also kept their lines open in communicating consumer concerns and complaints with the BSFIs, particularly when one has fallen to the schemes of these fraudsters. It has been a common practice to loop in the Consumer Affairs unit of the central bank in airing concerns to banks.
“[I]n order to provide a more accessible venue for the public to communicate their concerns, the BSP has recently launched an online consumer chatbot, named BSP Online Buddy or BOB, where the public can submit their concerns and questions regarding their transactions with BSFIs,” the BSP said.
“This is on top of the other available consumer assistance channels such as e-mail, snail mail, telephone/fax, and the Consumer Assistance Desk. Customer complaints received by the BSP’s Consumer Affairs unit are referred to the concerned BSFI for appropriate action,” it added.
Apart from raising consumer awareness, there has also been a campaign to continuously remind banks and other financial institutions of industry-wide best and up-to-date practices in improving cyber protection.
“Cybercriminal activities undermine public’s trust and confidence in the financial system... During the pandemic, the BSP’s approach in addressing cybersecurity challenges include providing a conducive environment for digital innovation, espousing vigorous cybersecurity measures, and promoting dynamic consumer protection mechanisms,” the central bank said.
There have also been baseline assessments of the pandemic’s impact to these financial institutions and their clients by constant surveillance of the operating and cyber threat environment, according to the BSP.
“From providing the necessary regulatory reliefs to fostering greater digital innovation, issuing coherent cybersecurity and technology policies, to ramping up cyber awareness campaigns for financial consumers, the BSP made sure that supervisory actions were risk-informed, datadriven and intelligence-led,” it added.
The Bankers Association of the Philippines (BAP) also launched the BAP Cybersecurity Incident Database (BAPCID) as an information-sharing platform in 2019 which “proactively counter emerging cyber threats and raise overall situational awareness.”
“Since the launching of BAPCID, participating BSFIs were able to have wider visibility on emerging cyber threats having access to threat intelligence reports and statistics. The BSP also uses the platform to share relevant cyber threat specific advisories and memoranda so BSFIs can proactively respond and do the necessary remediation to minimize potential impact and losses,” BSP said.
The central bank further stretched its cybersecurity efforts with a new framework to be introduced this year.
“The BSP is currently developing a Cybersecurity Capability Maturity Model (CCMM) Framework consisting of four levels to facilitate cyber maturity assessment levels of BSFIs, with Level 4 as the most mature and Level 1 as the baseline. With this framework, BSFIs can chart their own progress and pinpoint specific areas where they need to improve to move to the higher level,” the central bank said.
The regulator continues to closely monitor the capability of BSFIs to address evolving cyber threats and risks.
“For instance, cyber spending of BSFIs increased by as much as 43% from 2018 to 2019. This is a good indicator that BSFIs are putting greater emphasis on strengthening cybersecurity and in ascertaining the level of support and commitment of the BSFIs’ board and senior management on cybersecurity concerns,” said the BSP.
Maybank Philippines particularly enhanced its network and infrastructure cyber defense mechanism to strengthen its cybersecurity measures during the pandemic.
“As a leading financial institution within a global network, Maybank Philippines has long realized the impact of cybersecurity risks in its operations and have therefore made significant yet balanced investments in cybersecurity-related activities year on year,” Ms. Del Rosario said, noting the bank took proactive activities to ease risks as well as appoint and scout the right people for their cybersecurity team.
For BPI, Mr. Paz said the bank has intensified its focus and investment on heightening public awareness, saying cybersecurity is a “shared responsibility.”
“For fraudsters to be successful, they need user IDs, passwords, and the registered mobile numbers. The user IDs and passwords are usually captured via phishing e-mails and/or non-secure forms while mobile numbers are attacked either via taking control of the device (e.g., SIM swapping, device binding) and deceiving clients to divulge their OTPs or one-time-passwords,” he said.
“The best defense against these attacks is public awareness,” he added.
JENNIFER L. DACANAY, a 48-year-old housewife wished to upgrade her credit card status. Unfortunately, she faced credit card fraud and lost some money in the process.
Just last December, Mrs. Dacanay received a phone call from someone posing as a bank officer and promised her with a “lifetime of free annual membership fee, an upgrade to the next tier (from Platinum to Titanium) and a P1,000 [gift certificate] to boot.” In the hopes of obtaining the upgrade, she agreed and met up with a said representative of the bank.
“I was out when he came to deliver the letter and [gift certificate] and so he asked my whereabouts and met me there. He gave me the letter, the [gift certificate] and also [took] my card which he ‘cut’ in front of me,” Mrs. Dacanay said in an e-mail interview to BusinessWorld.
Later on, Mrs. Dacanay received a phone call from the bogus representative that same afternoon and asked to disclose her phone PIN. “Because of this, they were able to successfully withdraw P40,000 from my credit card through its cash advance facility,” she said.
She immediately reported the incident to the bank hotline, but was informed by the bank that she was liable for the fraudulent transactions due to her disclosing her PIN to the perpetrator. The bank sent a replacement card within three to five days after being notified of her case.
Mrs. Dacanay’s case was one of the many incidents that were not elevated to the Bangko Sentral ng Pilipinas (BSP). The number of those that did reached 23,000 last year, the BSP told BusinessWorld.
Majority of the consumer complaints raised were categorized under deposits, credit card and money lending. Of that number, 25% were related to credit card concerns and 24% were online banking and automated teller machine (ATM) transactions.
“We think that the volume of complaints BSP received is an indication that more people are now more aware of the BSP’s Consumer Assistance Mechanism (CAM),” the central bank said.
CAM facilitates communication between the consumer and the BSP supervised financial institutions (BSFI) to address the former’s concerns. To aid the regulator in enforcing this mechanism, it launched on August last year the BSP Online Buddy (BOB), an online chatbot system. Once the consumer submits a complaint to the chatbot, the latter will then automatically refer the complaint to the concerned BSFI to which it is expected to directly respond via e-mail to the consumer filing the complaint and address it within a given timeline.
According to the BSP, it processed more than 25,000 conversations from the public since its launch up until end-December 2020. BOB has referred around 3,000 complaints to BSFIs or 13% of the total volume of complaints received, which are also referred to banks concerned on the same date of the complaint receipt. On average, BOB processed 21 complaints a day last year.
The central bank also cited the BSP Regulations on Financial Consumer Protection (FCP) as among the programs launched by the BSP in dealing with consumer complaints.
“Pursuant to BSP Circular No. 857 as amended by Circular 1048, consumer protection standards must always be adhered to by BSFIs including the effective redress of consumer concerns. With the amended FCP framework, BSFIs are expected to institutionalize their redress mechanism and have in place an effective FCP framework and risk management system commensurate with their business profile/operations,” the BSP said.
The central bank added the amended framework also provides BSFIs “more flexibility” in adopting and implementing their FCP framework proportionate to their asset size, structure, nature of products and services provided, and the complexity of operations.
In time for digitalization, the central bank also initiated the Digital Literacy Program that remind consumers of the importance of protecting their online banking accounts. With assistance from a strategic communications firm and the BSP media relations team, tips and messages are constantly disseminated for the public’s knowledge. These campaign messages inform consumers how to start an online account, tips on creating strong passwords, keeping personal information confidential, and warning them of phishing e-mails and spoofed websites.
“The BSP is also continuously advocating the enactment of one of its top priority measures — the proposed Financial Consumer
Protection Act. The proposed measure aims to institutionalize consumer protection standards by directing financial service providers to, among others, adhere to consumer protection standards of fair and respectful treatment of clients, transparency, privacy, and protection of client data and access to redress mechanism…,” the BSP said.
In a briefing, BSP Governor Benjamin E. Diokno said the bill will encompass the central bank’s goals in financial inclusion and education as well as good governance and tight supervision.
In fulfillment of strengthening the central bank’s consumer protection program, it has also taken steps to work with technical assistance partners to modify and improve data analytics for evidence-based decision making and an expansion of personnel to supervise its chatbot tool.
BDO FINDING WAYS
Just like any firm last year, BDO Unibank, Inc. had to adapt to the constraints imposed by community lockdowns as they operated at less than full capacity.
“Against this backdrop, we provided assistance to our employees in terms of transportation and accommodation, among others, to ensure more consistent attendance and allow us to cater to more customers and handle complaints effectively,” BDO said in an e-mail.
BDO noted common complaints from customers last year to be mostly related to electronic fund transfers and the adjustments made for loan repayment amortization schedules following the implementation of Republic Act 11469 or the Bayanihan to Heal as One Act which provided a 30-day loan holiday. This was in contrast to the year before wherein most complaints were “transaction-related” such as withdrawal issues and online/onsite transaction disputes.
“Complaints are received via the different channels of communication… such as BDO Customer Contact Center (calls and e-mails) and social media posts. These then go through a filtering process where cases are evaluated, sorted, and forwarded to the concerned business/ fulfillment units for resolution, feedback, and service recovery action (when applicable),” BDO said.
“Banks can enhance their digital capabilities to enable them to meet the evolving demands of clients,” it added. —
THE FOURTH QUARTER of 2020 saw local financial markets rebound somewhat with reports of the COVID-19 (coronavirus disease 2019) vaccine developments and expectations of economic recovery driving performance during the period.
The peso averaged P48.27 against the dollar in the October to December period, appreciating 1.37% from the previous quarter’s average of P48.94:$1, Bangko Sentral ng Pilipinas (BSP) data showed. Likewise, the local unit appreciated by 5.4% compared with the P50.99-to-a-dollar average seen in the fourth quarter of 2019.
Meanwhile, Treasury bill (T-bills) auctions conducted in the last three months of 2020 saw robust demand with total subscriptions of reaching around P918.91 billion, which is around four times the P230-billion aggregate offered amount. This oversubscription amount of P688.91 billion was higher compared with the P626.08 billion posted in the previous quarter.
Similarly, auctions of Treasury bonds (Tbonds) during the period had a total subscription amount of P453 billion, around 2.5 times more than the offered amount of P180 billion.
At the secondary market, domestic yields were lower by a range of 4.8 basis points (bps) for the 91-day T-bill to 29.30 bps for the threeyear T-bonds compared to end-September 2020 levels.
Quarter on quarter, most of the tenors saw their yields fall except those for the 10-, 20-, and 25-year debt papers, which rose by 1.6 bps, 8.9 bps, and 7.4 bps, respectively. Yields were lower by an average of 12.28 bps during the reference period, according to the PHP Bloomberg Valuation Service Reference Rates published on the Philippine Dealing System’s website.
For equities, the benchmark Philippine Stock Exchange index (PSEi) closed at 7,139.71 on Dec 29, 2020, 21.8% higher compared with the PSEi close of 5,864.23 on Sept. 30, 2020.
In an e-mail to BusinessWorld, the BSP said movements in the fourth quarter were driven mainly by macroeconomic developments as well as the developing COVID-19 situation in the country and the government’s policy measures in response to the pandemic.
“Positive developments on vaccine advancements would continue to positively impact the financial markets. Information on existing vaccines’ efficacy to the new virus strain would significantly boost market confidence. Vaccines could potentially steer the domestic and global economy towards recovery,” the BSP said.
For the equities market, the BSP pointed to various factors, which include among others the improvements in the earnings performance of listed companies in the third quarter, the optimism surrounding the prospects of an economic rebound following plans to gradually reopen the economy, the expected pickup in spending amid the holiday season, and the central bank’s implementation of further monetary stimulus measures such as the P540-billion provisional advances to the National Government and the 25-bp policy rate cut in November last year.
“Meanwhile, local firms opted to tap the bond market as an alternative funding option amid the tightened lending requirements as banks manage their capital and nonperforming loans,” the BSP added.
On the other hand, the central bank said the lingering difficulty in procuring vaccine doses in developing countries posts a downside to this outlook.
“The Philippines and Vietnam, for instance, have only secured doses for 5.1% and 6.2% of their populations, respectively. Though this may have already improved as negotiations continue with vaccine manufacturers,” it said.
Moreover, the BSP noted the emergence of the new virus strain “can necessitate prolonged restrictions on movement and economic activities.”
“This can further strain economic recovery and result in volatility in financial markets. For countries struggling to contain outbreaks, this can prolong the economic pain,” the BSP said.
“Good management of the vaccine drive will be essential, especially for developing markets such as the Philippines…,” it added.
While these factors affecting financial markets could potentially linger in 2021, the central bank looks to the proposed implementation of fiscal reforms such as the Government Financial Institutions Unified Initiatives to Distressed Enterprises for Economic Recovery (GUIDE) bill, which seeks to provide financial assistance to distressed micro, small and medium enterprises; and the Financial Institutions Strategic Transfer (FIST), which seeks to help banks and other financial institutions recover from potential losses.
Meanwhile, private sector economists see inflation as a major indicator that could affect growth.
“The higher-than-expected uptick in domestic headline inflation may altogether keep monetary policy rates at all-time low as the BSP juggles that difficult job of helping the economy recover and keeping price stability,” UnionBank of the Philippines, Inc. Chief Economist Ruben Carlo O. Asuncion said.
Bank of the Philippine Islands Lead Economist and Vice-President Emilio S. Neri, Jr. said they are observing upside risks which will likely prop up the inflation rate above three percent in the coming months.
“The distribution of vaccines around the world in 2021 may lift global demand and push oil prices higher. However, even at current levels ($47), oil is expected to register a 180% year-on-year increase in the second quarter given the low base from last year,” Mr. Neri said.
Headline inflation stood at 3.5% in December 2020, bringing the average inflation for the year to 2.6% — matching the BSP’s forecast for the year, but still faster than the 2.5% recorded in 2019.
To recall, the average inflation rate registered in 2018 at 5.2%, the fastest since 2008’s 8.2%, was driven by swelling crude oil prices in the world market.
“Inflation is fast becoming an issue and will likely threaten the economic recovery,” said ING Bank N.V. Manila Senior Economist Nicholas Antonio T. Mapa, adding the upcoming presidential elections in 2022 may also affect market sentiment this year with “increased spending and political maneuvering.”
Rizal Commercial Banking Corp. Chief Economist Michael L. Ricafort looks to increased infrastructure this year to pumpprime the economy as supported by the timely approval of the 2021 national budget, as well as the extension of the appropriation/funds availability for 2020 national budget to end2021 and for the Bayanihan II to end-June 2021.
Of the P4.506-trillion 2021 national budget, the Department of Public Works and Highways was given the second largest allotment of P694 billion, following the health sector with P287 billion.
PROSPECTS FOR GDP RECOVERY
The country’s gross domestic product (GDP) shrank by a record low 9.5% in 2020 — the fastest year-on-year decline since the 1940s — following the 8.3% contraction posted in the fourth quarter.
For this year, Mr. Neri expects the GDP to still contract, albeit at a slower pace than what was seen in 2020. He also considered the possibility of a double-digit growth in some quarters, assuming the government will refrain from imposing stricter quarantine restrictions.
“Given all these, our baseline forecast for 2021 is now at 6.8% as the [fourth-quarter] print exceeded our expectations. However, even at this brisk pace, economic output will not be able to return to the 2019 level yet and a full recovery may only happen in 2022…,” he said.
Meanwhile, Mr. Asuncion expects better GDP performance this year to drive financial markets this year.
“Historically, equities move up when the economy performs better. Fixed-income markets, like today in this crisis, take advantage of profit opportunities, not on the long-end but on the short and belly of the curve. Players will wait for better prospects before deciding to position longer. For forex, if the economy performs better, it is expected that the Peso will depreciate and help trade perform better,” Mr. Asuncion said.
Mr. Mapa shared this view, adding government spending and the Treasury’s borrowing program “will also come into play” although neither would likely figure in the country’s economic performance at the onset.
Mr. Ricafort said further reopening of the economy will lift hopes of coming back to the 6% growth trajectory. “The negative GDP base for 2020 at -9.5% would mathematically increase the odds of a GDP growth of at least 6% for 2021, provided that the economy reopens further, including easing of some restrictions of public transportation that allows greater productivity for the labor force…,” he said.
With these in mind, see the BSP’s and analysts’ outlook for each of the key markets.
FIXED-INCOME SECURITIES
BSP: Domestic bond market is expected to be liquid and have robust demand as the BSP continues to ensure the proper functioning of financial markets. With the market flushed with liquidity and with lingering uncertainty, some (most) market players will possibly continue placing funds in safe havens, as evidenced by the high oversubscription consistently seen in the weekly Bureau of the Treasury (BTr) auctions.
Security Bank Corp. Chief Economist Robert Dan J. Roces: For [the first-quarter of 2021], while the economy is projected to pick up this year, the pace looks slow while downside risks remain with regard to the rising COVID-19 cases as well as issues with vaccine procurement. In the meantime, we expect yields to be rangebound with a slight upward bias. As usual, volatility may be triggered by RTB’s (retail T-bonds), policy rate signals, and black swan events.
Market will look to the BSP and what will be its next move: to cut further or to hold for a long time. Steeper US treasuries pushing BTr to accept incrementally higher long bond yields amid rising inflation risk providing guidance on direction of longertenor bonds.
Mr. Ricafort: The sustained and lingering excess liquidity in the financial system would help keep short-term interest rates relatively low. Further monetary easing measures remain possible to do more of the heavy lifting for the economy amid the limited funds for any additional stimulus measures. Federal Reserve officials signalled that the key Fed Funds Rate could remain at the record low of 0.00%-0.25% over the next two to three years in able to help support economic recovery after the COVID -19 pandemic by way of lower borrowing costs.
Mr. Mapa: We may see a steepening of the yield curve with inflation forcing a correction for longer dated issues with short dates still anchored due BSP’s accommodative stance. Increased borrowing by the BTr or any other development that may cause tightening of liquidity conditions may also force the entire yield curve higher.
Mr. Neri: BSP officials have suggested that they intend to keep interest rates low until the economy returns to its pre-pandemic growth rate, so there’s a chance that government securities rates will stay at current levels. But then higher inflation in the coming months and government borrowings to fund deficit spending may pose a challenge and may cause the yield curve to steepen. The market also looks to the fiscal stimulus program of the incoming Biden administration, and its impact on US debt yields as well.
EQUITIES
BSP: In 2021, the PSEi is expected to continue to rise amid expectations of economic recovery due to continued improvement in demand. Although the decline in household income amid the pandemic has forced consumers to tighten their spending, ecommerce and the widespread use of delivery services can help offset the decline in consumer spending.
Mr. Roces: With the expectation of a long pause in policy rates at low levels and some recovery in corporate earnings and economic activity, the environment would be more