Landbank brushes off DICT in probe of OTP system

Efforts by the Department of Information and Communications Technology (DICT) to look into the possibility of a faulty One Time Password (OTP) system that could have made Land Bank of the Philippines vulnerable to a phishing attack have been brushed off by the government bank.

The DICT’s Computer Emergency Response Team (CERT-PH) coordinated with Landbank last Jan. 27 to assist in investigating alleged unauthorized withdrawals or debit transactions.

CERT-PH intended to look into a faulty OTP system that could have allowed the recent phishing of public school teachers’ accounts and unauthorized fund transfers.

However, Landbank had referred the DICT’s inquiries on the matter to the Bangko Sentral ng Pilipinas (BSP), to which the state-owned bank had submitted its report.

The DICT said Landbank maintained that it gave its report to the BSP since the latter is the “sectoral CERT lead” of the banking sector.

“The CERT-PH asked Landbank for possible early information if the incident violated any system integrity or if there were hacking-related behaviors involved. The coordination was initiated with the intent to provide immediate technical assistance if necessary,” the DICT said.

While this effort could not be helped by Landbank, the DICT said it would continue to give support to the BSP and the Cybercrime Investigation and Coordinating Center (CICC) which probes alleged faulty OTP systems of banks.

“The DICT will continue to coordinate with the CICC and BSP to address the issue,” it said.

“In light of this issue, the proposed SIM Card Registration Act can help prevent alleged hacking, fraudulences and scams in the future. The SIM Card Registration Act, requiring Subscriber Identity Module card registration, will expand other existing laws such as the Cybercrime Prevention Act and the Data Privacy Act to ensure the protection of the citizens. The bill is now only awaiting the signature of President Duterte to become a law,” the DICT said.