Banking Board of Ecuador

RESOLUTION No. JB-2015-3410

THE BANKING BOARD

CONSIDERING:

THAT on November 14, 2013, Mr. Edgar Vicente Bastidas requested Banco de Guayaquil S.A. to verify a transfer from his savings account made on the same date, in the amount of USD 4,221.50 in favor of Mr. Bolívar Manuel Mesías Luna for the concept of direct payment to Banco Pichincha, and therefore requested the return of said value and the cancellation of his Bancontrol card;

THAT on November 27, 2013, Mr. Bastidas Guerra filed a complaint before the Superintendency of Banks against the aforementioned bank, indicating that on November 14, 2013, at 10:20 AM, he opened his institutional email and discovered the novelty of an interbank transfer, carried out through virtual banking from his savings account, which he affirms he did not perform or authorize in favor of Mr. Bolívar Manuel Mecías Luna, holder of the beneficiary savings account, in the amount of USD 4,221.00, with the concept of "transfer payment of letter," as evidenced by the respective receipt; that the bank never reported it as it has normally done on previous occasions, by telephone message or to his personal email, since according to his statement, the Bancontrol card issued by the bank has always been in his possession; that he has never left it abandoned or neglected, being the irresponsibility operated by Banco de Guayaquil S.A. that has allowed the commission of a serious crime causing him patrimonial damages and even moral damages that affect his intimate family, since these funds coming from a loan from the Banco del Instituto Ecuatoriano de Seguridad Social were destined to cancel a pending debt; that the bank's response seeks to evade responsibility; that the fact is even typified in penal legislation; that he appeals to the Superintendent of Banks so that, in exercise of its control attributes, it obliges the bank to restore the aforementioned value which is his property and credit it to his account; and that those responsible be sanctioned who cannot remain free from the penal action he requests be brought to the attention of the Prosecutor's Office;

THAT prior to the analysis of the bank's explanations, the Subdirector of User Attention, through Official Letter No. DNAE-SAU-2014-01234, of February 26, 2014, denied the complaint presented by Mr. Bastidas Guerra, on the grounds that no violation of the client's financial rights by the bank had been evidenced, nor had it failed in its obligations as custodian of the funds; and that no incorrect procedures by the bank to the detriment of the complainant had been evidenced;

THAT with a document presented on March 12, 2014, Mr. Edgar Vicente Bastidas filed an appeal for reconsideration against the administrative act contained in Official Letter No. DNAE-SAU-2014-01234, of February 26, 2014, which was rejected by the Subdirector of User Attention through Official Letter No. DNAE-SAU-2014-03886, of June 23, 2014, in which it was indicated that the disputed transfer was made with the access keys to the virtual banking system and authorized by entering the digits of the coordinate card which are unique for each client and whose custody corresponds to him;

---

Resolution No. JB-2015-3410

Page 2

THAT through a document presented on July 8, 2014, Mr. Edgar Vicente Bastidas Guerra filed an appeal for review before the Banking Board against the administrative act contained in Official Letter No. DNAE-SAU-2014-03886, of June 23, 2014;

THAT Mr. Edgar Vicente Bastidas Guerra bases his appeal on the fact that the institutional email of the Ministry of Transport and Public Works where he works is the duly and legally registered one at the bank; that he has administered it with all the technical security measures instructed by the bank, that is, with care and diligence; that he has left with absolute identification and precision the registered accounts to perform transfers authorized by him, duly encoded by the bank itself, whose recipients are: Diners Card Payment in his name; Bancard Visa Card Payment from Banco Bolivariano in his name; Visa Card Payment from Banco Pichincha in the name of his spouse; and, that all transactions are carried out from the IP of his office No. 172.21.15.133, registered by the bank; that on Thursday, November 14, 2013, at 10:20 AM, upon opening his institutional email, he found the surprising and strange novelty of the interbank transfer carried out from his savings account, which he has not performed nor authorized, nor in favor of the beneficiary, Mr. Bolívar Manuel Mesías Luna, which was made under the concept of "TRANSFER-PAYMENT OF LETTER"; that this novelty the bank never reported to him as it has normally done on previous occasions by telephone message or to his personal email, since the Bancontrol card has always been in his possession; that he has never left it abandoned or neglected; that only he uses it, being the irresponsibility operated by the bank that has allowed the commission of a crime causing him irreparable patrimonial damages and even moral damages that affect his intimate family, since these funds come from a loan from the Banco del Instituto Ecuatoriano de Seguridad Social; that the bank in its response seeks to evade its responsibility; that for the reasons stated above, he files an appeal for review and asks that the immediate repair of the economic damage caused to him by the bank be ordered, restoring to him the value of USD 4,221.00 fraudulently extracted from his savings account; that with a document presented on August 1, 2014, the appellant requested that additional documentation be considered in his appeal, in which a screen printout is contained, from which it is determined that no other authorized account appears and that the bank without prior authorization allowed the questioned transfer; that he also indicates that the letter that originally denied his claim analyzes only the bank's partialized information but does not analyze with equanimity the protection of the client taking into account that the report of item 6, item date, time, and machine ID does not correspond to his work schedule; that he insists that no one has access to his Bancontrol card and that the bank's technological and security system is what has been violated; that the bank suffered from many flaws and negligences in the year 2013 that cannot be attributed to the client, especially in preventing information and requesting authorization for operations in virtual banking; and, that only in the months of May and June did the bank implement a security access key system via cell phones to warn and prevent users to better care for the management of their accounts;

THAT the second paragraph of the Third Transitional Provision of the Organic Code of Monetary and Financial Law determines that the Banking Board will continue to act until it resolves all complaints, appeals, and other administrative procedures that

---

Resolution No. JB-2015-3410

Page 3

were being heard on the date of entry into force of this Code, within a period of one hundred and eighty days, extendable at the discretion of the Monetary and Financial Policy and Regulation Board;

THAT through Resolution No. 054-2015-F, of March 5, 2015, published in the Official Register No. 467, of March 27, 2015, the aforementioned period has been extended by one hundred and eighty additional days;

THAT regarding the grounds presented by the appellant, it must be noted that from the "Cash Transaction Log" report sent by the bank, it is appreciated that the accesses to Mr. Bastidas's virtual banking were successful, so it has been demonstrated that the transfer subject of the complaint was carried out;

THAT the bank has not managed to demonstrate that it was the client who registered the account to which the transfer subject of the complaint was made;

THAT in application of Article 51 of the General Law of Financial System Institutions, in force at the time the facts subject of the complaint occurred, the controlled entities, in this case Banco de Guayaquil, are obliged to assume the obligation to safeguard the values deposited by clients, taking care with due diligence that they return to their legitimate owner, whether through the different channels made available to them based on what was agreed between the parties; therefore, the bank cannot shift the responsibility to the client, for the fact of having delivered the aforementioned cards;

THAT the bank in its response to the complaint limits itself to affirming that the client has compromised his access key to virtual banking at some point and neglected the custody of the coordinate card, while also pointing out that the client has been a victim of the so-called "phishing";

THAT it should be noted that institutions must establish control procedures and mechanisms that allow registering the transactional profile of clients, in the use of electronic channels, to safeguard the execution of operations that do not correspond to their habits; and, that from the file it does not appear that the IP address from which the transfer was made had been previously used by the client in his virtual banking transactions, which should have alerted the bank; and, that likewise, it was not observed that the transaction was made to an unregistered account;

THAT the second paragraph of Article 5, Chapter IV, Title XX, Book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board, which governs what is inherent to the attention of complaints, provides:

"If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the complainant, the Superintendency of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributes contemplated in letters b) and o) of Article 180 of the General Law of Financial System Institutions, granting the legal representative of the entity a period that may not exceed fifteen

---

Resolution No. JB-2015-3410

Page 4

(15) days from the notification to send, under the legal warnings, the proof of compliance with the order issued";

THAT the aforementioned regulation requires the determination by the control body of an incorrect procedure of the financial institution, as a condition to order the restitution of the claimed values, which is evidenced in the present case, on the grounds that the bank did not notify through the pertinent channels, nor alerted about the transaction to an unregistered account;

THAT the National Legal Intendency, through memorandum INJ-DNJ-SAL-2015-0143 of February 9, 2015, recommended to the Banking Board to accept the claim contained in the appeal for review filed;

AND,

IN exercise of its legal attributes;

RESOLVES:

SINGLE ARTICLE.- ACCEPT the appeal for review filed by Mr. Edgar Vicente Bastidas Guerra; consequently, REVOKE the administrative act contained in Official Letter No. DNAE-SAU-2014-03886, of June 23, 2014, with which the Subdirector of User Attention denied the appeal for reconsideration filed against Official Letter No. DNAE-SAU-2014-1234, of February 26, 2014; and, ORDER that Banco de Guayaquil S.A. restore to Mr. Bastidas Guerra the claimed value, that is US$ 4,221.00 (FOUR THOUSAND TWO HUNDRED TWENTY-ONE DOLLARS OF THE UNITED STATES OF AMERICA)

NOTIFY.- Given in the Superintendency of Banks, in Quito, Metropolitan District, on May 13, two thousand fifteen.

Econ. Rodrigo Landeta Parra GENERAL INTENDENT, S PRESIDENT OF THE BANKING BOARD, E

I CERTIFY.- Quito, Metropolitan District, on May 13, two thousand fifteen. Lcdo. Pablo Cobo Luna SECRETARY OF THE BANKING BOARD