State Bank Enhances Control Measures to Protect Customers from Digital Banking Frauds

Digital banking has gained significant popularity in Pakistan, offering convenience and accessibility to a large number of financial services users. However, with the rise in digital banking usage, the risk of digital banking fraud has also increased. In response to this challenge, the State Bank of Pakistan (SBP) has implemented new control measures to protect customers from digital banking fraud.

This article discusses the enhanced requirements set by SBP and their importance in creating a safer digital banking ecosystem.

The Need for Enhanced Control Measures

Fraudsters have been taking advantage of customers' lack of awareness regarding digital banking frauds. To address this issue, SBP has been working closely with the banking industry and other stakeholders to devise effective controls against sophisticated fraud techniques.

These techniques include spoofing of banks' official helpline numbers, SIM swap attacks, identity theft, and false registrations. The objective is to raise customer awareness and strengthen the security of digital financial services.

SBP's Consultation with Stakeholders

In April 2023, SBP released a comprehensive set of guidelines to enhance the security of digital banking products and services. These guidelines were formulated after extensive consultation with the banking industry and other stakeholders. The aim was to develop a robust control regime that ensures the protection of account holders and fosters effective communication of digital fraud prevention policies.

Rollout of New Guidelines

The new guidelines require Financial Institutions (FIs) to formulate digital fraud prevention policies by December 31, 2023. These policies should cover end-to-end processes for digital fraud risk management and customer complaint management. FIs are encouraged to collaborate with relevant stakeholders in designing, reviewing, and continuously improving these processes.

The guidelines emphasize the importance of minimizing the disclosure of customer information and aligning fraud risk management and complaint management processes to facilitate the immediate resolution of fraudulent transactions.

Formulating Digital Fraud Prevention Policy

Financial Institutions are now mandated to develop a robust digital fraud prevention policy. This policy will serve as a framework for protecting account holders and ensuring effective communication within the organization. FIs will carefully design, review, and enhance their processes to minimize the chances of customer information disclosure. Encryption and other security measures will be implemented to safeguard customer data.

End-to-End Processes for Fraud Risk Management

The guidelines emphasize the need for FIs to establish end-to-end processes for managing digital fraud risks. These processes will cover various aspects, including governance and oversight of digital frauds, implementation of international standards, and fraud risk management solutions.

Transactional controls, such as reasonable and configurable limits, will be implemented to prevent, trace, and stop fraudulent transactions. FIs will also monitor devices, accounts, and transactions to detect and mitigate potential fraud.

Minimizing Disclosure of Customer Information

To enhance customer trust and protect their sensitive information, FIs will realign their processes to minimize the disclosure of customer data. Whether in part or whole, customer information should be adequately protected through secure processes and applications.

By implementing robust security measures, FIs can ensure that customers' personal and financial details remain confidential and safeguarded.

Fraudulent Transaction Dispute Handling (FTDH) System

The guidelines emphasize the establishment of a Fraudulent Transaction Dispute Handling (FTDH) system. This system will enable FIs to promptly handle and resolve disputes related to fraudulent transactions.

Immediate action will be taken to investigate and address any reported fraudulent activity. By streamlining the dispute resolution process, FIs can provide timely support to affected customers and minimize the impact of digital banking frauds.

Governance and Oversight of Digital Frauds

To effectively combat digital banking frauds, FIs need to establish robust governance and oversight mechanisms. The guidelines provide a framework for implementing effective controls and monitoring mechanisms.

Regular assessments and audits will be conducted to ensure compliance with the guidelines and to identify areas for improvement. By prioritizing governance and oversight, FIs can mitigate the risks associated with digital banking frauds.

Implementation of International Standards

The guidelines emphasize the adoption of international standards for digital fraud prevention and control. FIs are encouraged to benchmark their practices against global best practices to enhance the security of their digital banking systems. By aligning with international standards, FIs can strengthen their defense against evolving fraud techniques and demonstrate their commitment to customer safety and security.

Transactional Controls to Prevent Fraudulent Transactions

To prevent and detect fraudulent transactions, FIs will implement transactional controls. These controls will include setting reasonable and configurable limits to ensure that suspicious transactions are flagged and investigated promptly. By implementing effective transactional controls, FIs can minimize the risk of financial losses due to digital banking frauds.

Device and Account Monitoring

Continuous monitoring of devices, accounts, and transactions is crucial for identifying potential fraud. FIs will implement robust monitoring systems to detect suspicious activities and promptly respond to any anomalies. By closely monitoring devices and accounts, FIs can proactively prevent fraudulent transactions and protect their customers' funds.

Incident-Related Controls

In addition to preventive measures, incident-related controls play a vital role in managing digital banking fraud. FIs will establish post-incident follow-up procedures and ensure proper handling of disputed transactions.

Customer data and information will be protected through encryption and other security measures. By implementing incident-related controls, FIs can effectively manage and mitigate the impact of digital banking fraud incidents.

Restricting Fund Transfers and Liability Shift Framework

To restrict fraudulently transferred funds from leaving the banking system, SBP has directed banks offering branchless banking wallets to impose a two-hour restriction on cash-out, mobile top-up, and other online purchases from incoming fund transfers.

This measure aims to provide additional time for detecting and blocking fraudulent transactions. Furthermore, the guidelines introduce a liability shift framework, holding banks responsible for compensating customers due to any delays in taking timely remedial and control measures.

The State Bank of Pakistan's enhanced control measures for digital banking fraud prevention are crucial for maintaining customer trust and ensuring the safety of the digital banking ecosystem. By implementing robust policies and processes, financial institutions can protect customers from evolving fraud techniques. These measures will not only enhance customer trust but also promote digital financial inclusion by creating a secure and reliable digital banking environment.