SENATE deputy minority leader Risa Hontiveros has filed a resolution urging the chamber to probe the weekend incidents of unauthorized deductions and transfers that hit users of digital wallet GCash.
Hontiveros’ Senate Resolution No. 1234 said the Senate should determine the circumstances behind the unauthorized transactions, which she said happened while the account owners were “sleeping.”
Successive unauthorized deductions and transfers of P1,000 and P2,000 were reported on November 8 and 9 by numerous GCash users.
GCash, which is operated by G-Xchange Inc., said the unauthorized transactions were due to errors in its system reconciliation process and said they have initiated corrections to prevent a recurrence of the debits.
Hontiveros noted that a similar incident happened in 2023 “wherein multiple GCash accounts were compromised using ‘phishing attacks’ staged through various online gambling platforms.”
“GXI (G-Xchange Inc.) denied the incidents were caused by ‘hackers’ or other malicious actors, and attributed the ‘unauthorized deductions’ to errors in its ongoing system reconciliation process. The DICT’s (Department of Information and Communications Technology) also recently warned the public of phishing attempts disguised as text messages originating from GCash or PayMaya, the latter being another fintech (financial technology) e-wallet service operated by Maya Philippines Inc.,” Hontiveros said in the resolution.
An investigation conducted by the DICT showed that the incident was caused by an “internal issue” rather than external hacking.
The Click party-list, a digital technology group, said the GCash incident highlights the need for the passage of the proposed Cybersecurity Act to address the growing number of cyberattacks, threats, and vulnerabilities.
Click’s Nick Conti said the Cybersecurity Act will pave the way for the creation of a National Cybersecurity Council which will be responsible for “enhancing public-private partnerships in information sharing related to cyberattacks, threats, and vulnerabilities.”
A Senate version of the proposed measure has been pending in the Committee on Science and Technology since 2022.
Conti said it is important for the government to have a body that can investigate private institutions in cases of cybersecurity concerns. “Who is responsible for holding digital wallet providers accountable when system glitches occur or when they fail to protect consumers’ hard-earned money?” he asked.
Conti said Congress should likewise enact a measure that would establish a Digital Wallet Ombudsman within the DICT to “address complaints, oversee investigations into security incidents, and enforce penalties on platforms found negligent in safeguarding user data and funds.”
“We need an advocate for consumer rights in the digital economy, someone to hold e-wallet providers accountable and ensure they meet the standards expected of them,” Conti said.
He said lawmakers can also study the inclusion of financial protections, such as mandatory insurance coverage, for e-wallet funds to protect users against unexpected losses, pointing out that unlike banks, which insure deposits through agencies like the PDIC, e-wallets currently lack this safeguard, leaving users vulnerable to financial losses due to security breaches.
Hontiveros said the Senate must review existing rules and regulations governing fintech services since there is “no legislative framework yet in place to ensure stability and transparency, build public trust, and promote inclusion vis-à-vis this class of service.”
She said millions of Filipinos who have no bank accounts are relying on e-wallet services “that’s why there should be laws to protect them.”
“The list of risks and complications which threaten the earnings of mobile financial service users grows longer everyday. We urgently need upgraded laws to ensure that mobile financial service providers and fintech firms observe the necessary level of care and accountability in handling digital transactions,” Hontiveros said.
