********************************************
Following is a question by the Hon Lau Kong-wah and a written reply by the Secretary for Financial Services and the Treasury, Professor K C Chan, in the Legislative Council today (May 12):
Question:
It has been reported that recently, an automatic teller machine (ATM) of a bank was suspected to be tampered with by fraudsters, causing a total loss of some $280,000 to 10 customers. In this connection, will the Government inform this Council:
(a) of the number of fraud reports related to ATMs received by the authorities in each of the past three years, with a breakdown by the deception method and the amount of money involved;
(b) whether it knows the total number of ATMs which have not been installed with keypad covers at present, broken down by District Council district, and the percentage of the number in all ATMs in Hong Kong; among such ATM terminals, the respective numbers of those the ATM network services for which are provided by Electronic Teller Card and Joint Electronic Teller Services Limited; whether the authorities will request banks to have all of their ATMs installed with keypad covers or other new security devices; if they will, of the details;
(c) whether it has assessed if the magnetic stripe technology currently adopted for ATM cards in Hong Kong is lagging behind that of other places; if the assessment outcome is in the affirmative, of the total number of years that the technology lags behind; whether the authorities will request banks to introduce chip cards which render data duplication more difficult for ATM transactions, or upgrade the technology of ATM cards; if such chip cards will not be introduced or such technology will not be upgraded, of the reasons for that; and
(d) given that it has been reported that the Hong Kong Monetary Authority has delayed the disclosure of the aforesaid incident to the public for four days, of the reasons for the delay; whether the authorities have guidelines on disclosing to members of the public ATM fraud cases, so as to alert members of the public to react immediately and safeguard their personal properties?
Reply:
President,
(a) Including an alleged ATM fraud case reported recently, the Hong Kong Monetary Authority (HKMA) has received a total of three cases reported by banks of suspected tampering of ATMs in the past three years. The yearly figures on the amount of money involved in such cases are as follows -
Approximate amount of
No. of cases money involved (HK$)
------------ ---------------------
2007 0 0
2008 0 0
2009 2 196,000
2010 1 300,000
These three cases had been referred to the Police for investigation. We believe that these cases involved fraudsters capturing data of ATM cards using reading devices attached to the ATMs and obtaining customers' ATM personal identification numbers using hidden cameras. The fraudsters subsequently used the stolen information to produce counterfeit cards to withdraw money from the customers' bank accounts outside Hong Kong. The "Code of Banking Practice" provides that card issuers are responsible for bearing the full loss incurred by their customers when transactions are made through the use of counterfeit cards. Customers affected by ATM fraud cases therefore would not suffer any monetary loss.
(b) Currently, there are about 2,800 ATMs in Hong Kong. About 85% of such ATMs are equipped with keypad covers and the breakdowns are as follows –
ATM Network JETCO ETC
----------- ----- ---
Number of ATMs 1,533 1,245
Number of ATMs with 1,456 890
keypad covers installed
(roughly evenly located
across Hong Kong)
The banks are working towards installing keypad covers on all ATMs as soon as practicable. The HKMA has been working closely with the banking industry to identify ways to make the ATMs more secure. It also has required the banks to conduct more frequent patrols of ATMs, monitor suspicious transactions and strengthen customer education. Indeed, the recent alleged fraud case involving HSBC's ATMs reflected the effectiveness of the bank's surveillance system in detecting suspicious transactions and promptly identifying a possible fraudulent event. The HKMA will continue to communicate with the banks and explore ways to further strengthen the security of ATM operations.
(c) According to information available to the HKMA, ATM card with magnetic stripe is still the common technology standard adopted worldwide. ATM cards embedded with chips have only been introduced in recent years in a few jurisdictions (such as the UK and Malaysia). The HKMA has been exploring with banks since 2009 the feasibility of introducing chip cards in Hong Kong. One of the key issues to be addressed is that ATMs in many jurisdictions (including Mainland China) are still not yet fully compatible with chip cards. If Hong Kong introduces ATM cards embedded with chips only, bank customers might not be able to use their cards to withdraw cash overseas. However, if Hong Kong's ATM cards contain chips and retain magnetic stripes to enable bank customers to withdraw cash overseas, the magnetic stripes would still be vulnerable to card skimming fraud, leaving the problem of information thefts unsolved.
(d) When a bank is aware of an incident that affected its customers' interest, the bank has the responsibility to inform the customers affected or potentially affected as soon as possible. It should also consider, on a case-by-case basis, whether there is a need to make a public announcement about the incident at a suitable time. Furthermore, the bank should report the case to the HKMA as quickly as possible. Upon receiving an incident report from the bank, the HKMA will promptly follow up and obtain details about the case to understand more about its nature and implications. The HKMA will determine, taking into account factors such as the seriousness of the incident, whether there is a need to remind the public by making a further announcement.
Ends/Wednesday, May 12, 2010
Issued at HKT 12:31
NNNN
