Scams in the Philippines: What AFASA Means for Banks

In recent years incidences of digital identity theft and scams that involve fraudsters gaining access to user credentials that allows them to take over a genuine customer’s account or persuade a customer to transfer money to an account controlled by them, have risen sharply. The Philippine National Police recorded almost 3,000 cases of digital identity theft in 2023, up 12% on the previous year, and our own data shows that account takeover attacks across the APAC region increased by 18% in 2023 and 52% in 2022. Scams and third-party account takeover account for more than 44% of all frauds in the region.

The new legislation

AFASA was signed into law, also known as Republic Act 12010, in July 2024, with the aim of combatting financial cybercrimes, safeguarding the interests of financial consumers, and upholding the integrity of the financial system.

The new Act takes a multi-faceted approach to tackling scamming:

• It widens the definition of financial crime to criminalize activities including money mule activity (such as taking over someone else’s account or opening an account using a false identity), social engineering schemes (obtaining sensitive identifying information through deception or fraud, which leads to unauthorized access of an account), and acts of economic sabotage;
• It introduces severe penalties for scammers, including substantial fines and imprisonment;
• It provides Bangko Sentral ng Pilipinas (BSP) with the authority to examine and investigate bank accounts, e-wallets, and other financial accounts that are involved in prohibited acts, including suspected scams;
• Imposes responsibilities on BSP-supervised institutions to put in place adequate risk and fraud management systems to ensure that their customers’ accounts are protected. 

In practice this means that it is now mandatory for institutions to implement fraud risk management systems that are proportionate to the size and complexity of their business. AFASA builds on requirements set out in the BSP’s Circular 1140 issued in 2022, which requires banks and other financial institutions to ‘implement automated and real-time fraud monitoring and detection systems to identify and block suspicious or fraudulent online transactions.’ Institutions that fail to meet the requirements could face investigation by the BSP and the possibility of severe penalties.

Fraud challenges facing businesses and consumers

• Building a risk profile for each user. ThreatMetrix® analyzes transactions and attack patterns from billions of global online transactions in near real-time and builds risk profiles of users as they interact online. 
• Create a digital identity. Using this unique digital intelligence, we build reliable, anonymized digital identities of every online user as they transact across locations, devices and digital businesses. This intelligence helps our customers better distinguish between a trusted user and a potential threat. 
• Identify suspicious behavior. Behavioral intelligence has become a crucial part of fraud prevention strategy to tackle the rise of AI and deepfakes, remote access, and investment and romance scams. BehavioSec® is a behavioral biometrics solution that is able to detect suspicious activity, including indications of bots or signs of coercion. User interactions that deviate from normal behavior that is associated with a trusted digital identity are flagged as suspicious and additional step-up authentication can be considered to confirm the user’s identity.   
• Focus on beneficiaries. The risks associated with beneficiaries can often be overlooked in fraud prevention. Traditionally, institutions have focused their fraud prevention efforts on their customers; as regulators focus more on stopping money mules, preventing illicit money flows coming into the network is equally important.

AFASA is a strong indication of the growing threat in the region from fraud and online scams, and a sign that regulators will be expecting institutions to take significant steps to protect themselves and their customers. For more information about our comprehensive LexisNexis® Risk Solutions services, get in touch today.