Palestine Monetary Authority

PALESTINE MONETARY AUTHORITY

Circular No. (5 / 2019)

To all banks operating in Palestine
Date: Thursday, January 10, 2019

Subject: Precautions Against a Criminal Method

The Palestine Monetary Authority urges banks to exercise caution and adopt preventive measures and controls sufficient to avoid the criminal method used in North America, which consists of "cloning customers' bank cards at ATMs and point-of-sale terminals", based on the Purple Notice issued by Interpol.

Specifically, this method is summarized as follows:

• Use of hidden electronic devices, keyboards, and cameras to steal personal information stored on bank cards swiped through ATMs.

• The cloning process is carried out by installing automatic card reading and bypass devices in the card slot of the ATM and over any type of POS card reader, and once the card is swiped through the counterfeit reader, the information recorded on the magnetic stripe is scanned and recorded.

• Installation of hidden cameras on or near ATMs to film the keypad in order to determine the victim's card PIN.

• Installation of counterfeit keypads that mimic and completely cover the original keypad.

• Criminals, immediately after finishing stealing the information recorded on the cards, issue cloned bank cards without the victim's knowledge to make purchases, withdraw funds, or sell that information online.

---

Palestine Monetary Authority

PALESTINE MONETARY AUTHORITY

Emphasizing the necessity to strengthen controls and procedures to mitigate exposure to this type of risk, which includes at a minimum the following:

1. Establish standards and controls on the use of bank cards of all types, especially those used outside the borders.
2. Include this type of risk within the bank's comprehensive insurance policy.
3. Verify withdrawal and purchase transactions conducted via the bank's customers' cards, by communicating with customers through sending SMS messages to their phone numbers.
4. Raise awareness and alert customers to the risks of such practices.
5. Notify the Palestine Monetary Authority and competent authorities immediately upon discovering such operational incidents, in accordance with the mechanism in place for reporting operational risk events.

Regarding the bank's ATMs, it emphasizes the need to strengthen preventive and supervisory controls, including verifying the absence of hidden cameras, counterfeit keypads, or installed devices in the bank card insertion slots of ATMs during cash replenishment, as well as the necessity for periodic monitoring of external CCTV recordings of the ATM environment.

Noting the necessity to provide them with the work procedures and controls adopted in this regard by no later than 15/02/2019.

---

Supervision and Inspection Department
Palestine Monetary Authority

---

Note:
Ramallah and Al-Bireh - Palestine P.O. Box 452 info@pma.ps | Fax: +970 2 2415310 | Tel: +970 2 2415251 Gaza - Palestine P.O. Box 4026 Fax: +970 8 2844487 | Tel: +970 8 2825713 www.pma.ps