Banking Board of Ecuador

RESOLUTION No. JB-2015-3407

THE BANKING BOARD

CONSIDERING:

THAT according to the last paragraph of the Second Transitional Provision of the Organic Monetary and Financial Code, published in the Official Register Second Supplement No. 332 of September 12, 2014, the Banking Board will continue to act until it resolves all appeals it was hearing as of the date of entry into force of that Code, for a period of one hundred and eighty days;

THAT Mr. Rodrigo Acosta filed a complaint with the Superintendency of Banks and Insurance on October 15, 2013, stating that he had filed a complaint with the Bank of Guayaquil regarding a charge recorded on his credit card on February 27, 2013, which he claims he did not make, attaching a copy of the complaint filed with said bank in which he requests the elimination of the values for the consumption of $2,177.62 and the Tax on Capital Exports of $108.88;

THAT the Bank of Guayaquil S.A. through a letter dated November 27, 2013, responded to the information request of the Superintendency, accompanying the "Internal Audit Report" which states in the main: "Our Claims and Requirements application registers cases No. 7115894 and 7187092 dated May 17 and June 4 of the current year (...) The consumption belongs to a purchase made through the internet, on February 27 of the current year, which was made with the data of the referred credit card delivered to the client.- To access this online shopping service, it is necessary to register the card brand, the card number, expiration date, and the respective security code (CVV). It is important to indicate that the objected consumption was made on February 27 of the current year; however, we proceeded to request an exception from the foreign merchant to send us the supports for this charge on the credit card; however, the merchant did not provide what was requested because it was outside the time limit for chargeback;

THAT through letter No. DNAE-SAU-2013-7583 of December 18, 2013, the Subdirector of User Attention resolved to unfavorably attend the claimant's request and declared the administrative procedure concluded, arguing in the main that there is no evidence of non-compliance or non-observance of legal regulations, nor procedures or policies, nor affectation to his financial rights by the Bank of Guayaquil S.A., since the claimed consumption was accepted and validated through information provided on the web page with the data contained in the card, which was under his custody. That no indications or proofs were found that demonstrate that in the unrecognized transaction, omissions of the operational risk control and mitigation responsibilities that the financial entity was obliged to fulfill occurred; for which there is no evidence allowing the Superintendency to impute administrative responsibilities to the bank, a circumstance under which it is not possible to order the entity to return money;

THAT the claimant, through a document presented on January 8, 2014, filed an appeal for reconsideration against the aforementioned resolution, which was denied through

Resolution No. JB-2015-3407

Page 2

letter No. DNAE-SAU-2014-02370 of April 16, 2014, signed by the Subdirector of User Attention, which ratifies the provision contained in letter No. DNAE-SAU-2013-7583 of December 18, 2013, consequently denying the appeal for reconsideration proposed;

THAT through a review appeal presented on May 2, 2014, the claimant challenges the administrative act indicated in the previous paragraph;

THAT through resolution No. JB-2015-3251 of February 4, 2015, the Banking Board resolved to reject the review appeal filed by Mr. Rodrigo Medardo Acosta Cansino and consequently confirm the administrative act contained in letter No. DNAE-SAU-2014-2370 of April 16, 2014, with which the appeal for reconsideration was denied and letter No. DNAE-SAU-2013-7583 of December 18, 2013 was ratified, by which the Subdirector of User Attention resolved to unfavorably attend the claimant's request and declared the administrative procedure concluded, arguing in the main that from the bank's Internal Audit Report it is evident that the cardholder, upon registering his signature in the Credit Card Issuance and Use contract issued by the Bank of Guayaquil S.A., declared to know and accept the offered product, which constitutes a payment method to acquire goods and services within and outside the country, notwithstanding that security corresponds to each of the contracting parties, that the referred report indicated that the work consisted of verifying the claims history application, the review in the Sys Cards program, the general data of the credit card, review of the limit which at that time maintained an amount of USD 3450; the statement of account for the month of March where the objected consumption was registered, among others; as well as that the technical report contained in memo DNAE-SAU-2014-0727 of June 23, 2014, has not determined non-observance by the Bank of Guayaquil S.A. in the process of the claimed transaction; that the claimed transaction corresponds to a purchase executed via the internet and according to what was stated by the bank, to access this online shopping service it is necessary only to register the card brand, its number, expiration date, security code CVV, in such a way that no additional information entry is required as stated by the appellant;

THAT through a document dated March 4, 2015, Mr. Rodrigo Acosta files an appeal for reconsideration against resolution No. JB-2015-317 of February 4, 2015, indicated in the previous paragraph, based on the fact that he has gathered information from the company COPA indicating that on February 27, 2013, through the web page with the Visa Banco de Guayaquil credit card, the purchase of two airline tickets to the city of Nassau – Bahamas was made, for a total of $2,177.62, and as payer and owner of the card appears Edwin Roger Bravo Lavezzari, so the bank did not observe meticulous handling of the information because it failed to verify the name of the credit card holder in the validation process, which it was supposed to do to authorize the payment. He attaches copies of two communications dated August 13, 2014, signed by the attorney-in-fact of COPA, addressed to Dr. Pablo Basantes, Prosecutor of Pichincha, as well as a copy of letter FPG-3160 of September 17, 2014, signed by the Executive Vice President – General Manager

Resolution No. JB-2015-3407

Page 3

of the Bank of Guayaquil S.A. indicating that on August 18, 2014, the establishment COPA AIR COM PURCHASE proceeded with the reversal of the charge, cancellation of the voucher related to the consumption indicated for $2,177.62. However, the appellant states that the $108 value, which was charged to his account for the concept of tax on capital exports, is not taken into account, and that since they were not cancelled, they continued to generate interest during the time elapsed since his claim;

THAT in the communication of August 13, 2014, signed by José Rafael Rosales Kuri, General Manager of Corral y Rosales Cia. Ltda., in turn attorney-in-fact of COPA, addressed to Dr. Pablo Santos, Prosecutor of Pichincha, it indicates that after reviewing the COPA system, the entered data are the following: The tickets were acquired through the COPA web page with the VISA Banco de Guayaquil card number 4540 6408 2955 0005, for $2,177.62, destined to Nassau – Bahamas, acquired in the name of Lucia Robles and Edwin Roger Bravo Lavezzari, as owner of the card the latter, who has entered the information where he will receive his account statements in Guayaquil Ecuador, phones, and email;

THAT in communication FPG-3160-2014 of September 17, 2014, signed by the Executive Vice President – General Manager of the Bank of Guayaquil S.A., addressed to the Prosecutor of Pichincha, it indicates that on August 18, 2014, COPAAIR COM PURCHASE proceeded with the reversal of the charge, that is, with the cancellation of the voucher related to the consumption for the amount of $2,177.62; as well as that for the reasons exposed on the same date, a credit note was made for that value, in favor of Rodrigo Acosta, with description cancellation of voucher – promissory note on the VISA Credit Card;

THAT from what is exposed, it is evident that on August 18, 2014, the Bank of Guayaquil S.A. proceeded to issue a credit note for $2,177.62 in favor of the claimant Rodrigo Acosta, for the concept of the impugned consumption, based on the information sent by COPA AIR PURCHASE. However, the value of $108.88, which was charged to the statement of account for the concept of tax on capital exports, is not taken into account; and that since they were not cancelled, they continued to generate interest during the time elapsed in the claim process;

THAT the referred values charged to the cardholder are justified with the statement of account cut to March 15, 2013, in which the item for the impugned consumption “COPAAIR COM PURCHASE” for $2,177.62 is recorded; and, additionally the item: “RETENTION 5% ISD” for the value of $108.88; as well as the value of “Financing Interest” on that date, for $17.75;

THAT the aforementioned documents evidence that in the internet transaction object of the complaint, the credit card number of the now claimant has been used, but the owner of the same has been registered as another person, that is, Edwin Roger Bravo Lavezzari, a situation that has not been detected in time by the security systems of the card issuer, for which the transaction has been processed and the consequent charge in the statement of account of the true holder of the same, not only of the value of the impugned consumption, but of the value of the Tax on Capital Exports ISD, consequence of that; which in turn have generated

Resolution No. JB-2015-3407

Page 4

financing interest, as recorded in the statement of account issued on March 15, 2013;

THAT the Bank of Guayaquil S.A., based on the information provided by the company COPA, has proceeded to issue a credit note for $2,177.62 in favor of the claimant Rodrigo Acosta, for the concept of the impugned consumption; however, no credit note has been issued for the value of the tax corresponding to such transaction, nor for the financing interest generated and recorded in the statement of account;

THAT the Constitution of the Republic in its article 213 establishes: “The Superintendencies are technical bodies for surveillance, auditing, intervention, and control of economic, social, and environmental activities, and of the services provided by public and private entities, with the purpose that these activities and services are subject to the legal framework and attend to the general interest. The superintendencies will act ex officio or by citizen request. The specific powers of the superintendencies and the areas that require the control, auditing, and surveillance of each of them will be determined according to the law”;

THAT the Organic Monetary and Financial Code establishes in its article 60: “The Superintendency of Banks will carry out the surveillance, auditing, intervention, control, and supervision of the financial activities exercised by public and private entities of the National Financial System, with the purpose that these activities are subject to the legal framework and attend to the general interest”;

THAT in section II, chapter V, title X, book I, of the Codification of Resolutions of the Superintendency of Banks and the Banking Board it is established: “4.3.5 Security measures in electronic channels.- In order to guarantee that transactions made through electronic channels have the controls, measures, and security elements to avoid the commission of fraudulent events and guarantee the security and quality of user information as well as the assets of clients in charge of controlled institutions, these must comply at minimum with the following: 4.3.5.1 Financial system institutions must adopt and implement the international security standards and best practices in force worldwide for the use and handling of electronic channels and card consumptions, which must be permanently monitored to ensure their compliance; 4.3.5.2 Establish procedures and mechanisms to periodically monitor the effectiveness of the security levels implemented in hardware, software, networks, and communications, as well as in any other electronic or technological element used in electronic channels, in such a way as to permanently guarantee the security and quality of the information; 4.3.5.8 Establish procedures to monitor, control, and issue online alarms that inform timely about the status of electronic channels, in order to identify unusual, fraudulent events, or correct failures; 4.3.5.13 Institutions must establish control procedures and mechanisms that allow registering the profile of each client regarding their behaviors and transactions that imply money movement in the use of electronic channels and cards and define

Resolution No. JB-2015-3407

Page 5

procedures to monitor online and allow or reject in a timely manner the execution of transactions that imply money movement that do not correspond to their habits, which must be immediately notified to the client via mobile messaging, email, or other mechanism”;

THAT article 5 of chapter IV, of title XX, of book I of the Codification of Resolutions of the Superintendency of Banks and Insurance and the Banking Board establishes: “If the result of the analysis carried out by the Superintendency determines the need for the controlled institution to introduce corrective measures to regularize the situation that motivated the complaint, the Superintendent of Banks and Insurance or the official who has the delegation of said authority, will issue the corresponding disposition. If the situation that motivated the complaint referred to in the previous paragraph originated in an incorrect procedure of the controlled institution, which caused harm to the claimant, the Superintendency of Banks and Insurance may order the return of the claimed values, in exercise of the functions and attributes contemplated in letters b) and o) of article 180 of the General Law of Financial System Institutions (...)”;

THAT in this case, Banco de Guayaquil S.A. argued at the time that in its Sentinel Prevention tool, no fraud alert signals are registered, since these are transactions that do not have unusual behaviors, as they were made with credit card information; however, according to the information issued by COPA in its communication addressed to the Prosecutor dated August 13, 2015, as indicated above, the information entered in the system of the referred company for the objected transaction indicates as owner of the card used Edwin Roger Bravo Lavezzari;

THAT this fraudulent event was not detected by the security systems of the issuing bank, for which they did not alert nor prevent the commission of the same, evidencing that procedures have not been established to monitor, control, and issue online alarms that inform timely about the status of electronic channels, in order to identify unusual, fraudulent events, or correct failures, incurring in this way the bank in an incorrect procedure, as established in articles 4.3.5.8 and 4.3.5.13 of section II, chapter V, title X, book I, of the Codification of Resolutions of the Superintendency of Banks and the Banking Board, previously transcribed, which has caused harm to the claimant by having charged in his statement of account the values for the impugned consumption, taxes, and interest;

THAT although the Bank states that on August 18, 2014, a credit note for $2,177.62 was made in favor of the claimant; however, it is not recorded that it proceeded to credit the other values related to the referred consumption and recorded in the statement of account issued on March 15, 2013, as “RETENTION 5% ISD” for $108.88; and “FINANCING INTERESTS”, which derive from the impugned consumption;

Resolution No. JB-2015-3407

Page 6

THAT through a report contained in memo No. IG-2015-092 of April 27, 2015, the Legal Advisor of the General Intendency recommended to the Banking Board to accept the appeal for reconsideration filed by the appellant; and,

IN exercise of its legal attributions,

RESOLVES

SINGLE ARTICLE.- ACCEPT the appeal for reconsideration filed by Mr. Rodrigo Acosta Cansino; and, consequently, DECLARE WITHOUT EFFECT the administrative act contained in resolution JB-2015-3251 of February 4, 2015, by which the Banking Board rejected the appeal for reconsideration filed by the said gentleman and confirmed the administrative act contained in letter No. DNAE-SAU-2014-2370 of April 16, 2014; and in its place, order that the Bank of Guayaquil S.A. proceed to credit in favor of the appellant the values charged in his statement of account of the VISA card, related to the impugned consumption and recorded as RETENTION 5% ISD; and FINANCING INTERESTS.

NOTIFY.- Given at the Superintendency of Banks and Insurance, in Quito, Metropolitan District, on the eighth of May of two thousand fifteen.

Econ. Rodrigo Landeta Parra
GENERAL SUPERINTENDENT (S)
PRESIDENT OF THE BANKING BOARD SESSION (E)

I CERTIFY.- Quito, Metropolitan District, on the eighth of May of two thousand fifteen.

Lcdo. Pablo Cobo Luna
SECRETARY OF THE BANKING BOARD