*******************************************
Following is a question by the Hon Tommy Cheung and a reply by the Acting Secretary for Financial Services and the Treasury, Ms Julia Leung, in the Legislative Council today (May 26):
Question:
Automatic teller machines (ATMs) fraud cases which had quietened down for several years occurred again at the end of April this year, affecting around 100 customers of two banks and causing a total loss of some $300,000 to at least 12 customers. The Hong Kong Monetary Authority (HKMA) issued a circular to all authorised institutions as early as October 2003 to advise them to take precautionary measures such as installing closed-circuit televisions and keypad covers, so as to enhance the security of ATMs. Yet, it has been reported that some of the banks have not even installed keypad covers after the lapse of seven years and have only recently indicated that they would complete the installation work as soon as possible. This incident has aroused concern about the security of ATMs. In this connection, will the Government inform this Council:
(a) of the banks' implementation of the various measures recommended by HKMA in 2003 to enhance the security of ATMs, as well as the progress;
(b) whether HKMA will impose any sanction on those banks which have not yet installed keypad covers in accordance with its recommendation after the lapse of seven years; if so, of the details; if not, the reasons for that; and
(c) given that it has been reported that HKMA received reports on the aforesaid incident from the bank concerned on April 23 (Friday), and yet it did not contact the bank concerned to obtain further information until April 26 (Monday), whether such situation was attributed to the implementation of the five-day week initiative by government departments; if so, whether it will review the handling of the matter; if not, why HKMA did not contact the banks concerned as early as possible?
Reply:
President,
The Administration's reply to the question is as follows:
(a) The Hong Kong Monetary Authority (HKMA) issued a circular in October 2003 requiring banks to implement a number of measures to enhance the security controls of ATMs. These measures included:
1. installing anti-skimming devices to prevent fraudsters from capturing customer data stored on the ATM cards using card reading devices attached to the ATMs in order to create counterfeit cards;
2. installing closed-circuit televisions at ATMs;
3. performing more frequent patrols of ATMs during and after office hours and inspecting ATMs for any suspicious devices attached to the machines;
4. implementing mechanisms to promptly and effectively detect unusual ATM transactions such as large amount transactions that happened during midnight, repeated ATM withdrawals with the requested amount close to the daily limit (in particular, transactions conducted at overseas ATMs); and
5. enhancing public education such as:
* reminding the public to cover the keypad when entering their personal identification numbers (PINs) into the ATMs;
* keeping the PIN secret and not to disclose it to anyone;
* if an ATM card is suspected of being compromised, contact the card issuing bank for card renewal;
* encouraging the public to report to banks any suspicious devices on ATMs or any unusual transactions in their bank accounts.
According to the review conducted by the HKMA in mid-2004, banks had implemented appropriate security measures to protect their ATMs. However, no security measure can completely eliminate all ATM tampering. As such, the HKMA and the banking industry will continue to review from time to time the need to introduce additional security measures taking into account emerging fraudulent techniques. In addition, the "Code of Banking Practice" provides that card issuers are responsible for bearing the full loss incurred by their customers when transactions are made through the use of counterfeit cards. I want to stress that bank customers affected by ATM frauds will not suffer any monetary loss.
(b) As set out in the response to part (a), the review carried out by the HKMA in mid-2004 indicated that banks had already implemented the security measures as required in the HKMA's circular issued in 2003. Subsequently, individual banks continued their review of ATM security measures and some banks took their own initiatives to implement additional measures, for example the installation of keypad cover. Although the HKMA's circular issued in October 2003 did not require banks to install keypad covers on ATMs, all banks are planning to complete the implementation of this additional security measure by end of May 2010.
(c) Upon receiving notification of the incident from the bank concerned in the evening of April 23 (Friday), the HKMA immediately requested the bank to provide additional information relating to the case. At the same time, the HKMA understood that the bank had already taken necessary action to contain the incident and to protect the affected customers' interests. The HKMA received the required information from the bank concerned in the morning of April 27 (Tuesday), and promptly issued a press release in the afternoon of the same day reminding the public to remain vigilant and beware of any abnormality when using the ATM service to reduce the risk of falling victim to ATM frauds.
Thank you, President.
Ends/Wednesday, May 26, 2010
Issued at HKT 15:15
NNNN
