Regulatory Alerts2019-01-01
Circular No. 5: Precautions Against a Criminal Method
The Palestine Monetary Authority issued Circular No. 5 (2019) to mandate that all Palestinian banks implement enhanced preventive controls and supervisory measures against a North American criminal method involving ATM and POS card cloning. Banks are required to establish strict card usage standards, integrate this risk into comprehensive insurance policies, verify transactions via SMS alerts, educate customers, and immediately report any operational incidents to the regulator. Additionally, banks must inspect ATMs for hidden cameras, skimming devices, and counterfeit keypads during cash replenishment, monitor external CCTV footage regularly, and submit their implemented procedures and controls to the Authority by February 15, 2019.
Palestine Monetary Authority
PALESTINE MONETARY AUTHORITY
Circular No. (5 / 2019)
To all banks operating in Palestine Date: Thursday, January 10, 2019
Subject: Precautions Against a Criminal Method
The Palestine Monetary Authority urges banks to exercise caution and adopt preventive measures and controls sufficient to avoid the criminal method used in North America, which consists of "cloning customers' bank cards at ATMs and point-of-sale terminals", based on the Purple Notice issued by Interpol.
Specifically, this method is summarized as follows:
➤ Use of hidden electronic devices, keyboards, and cameras to steal personal information stored on bank cards swiped through ATMs.
➤ The cloning process is carried out by installing automatic card reading and bypass devices in the card slot of the ATM and over any type of POS card reader, and once the card is swiped through the counterfeit reader, the information recorded on the magnetic stripe is scanned and recorded.
➤ Installation of hidden cameras on or near ATMs to film the keypad in order to determine the victim's card PIN.
➤ Installation of counterfeit keypads that mimic and completely cover the original keypad.
➤ Criminals, immediately after finishing stealing the information recorded on the cards, issue cloned bank cards without the victim's knowledge to make purchases, withdraw funds, or sell that information online.
Palestine Monetary Authority
PALESTINE MONETARY AUTHORITY
Emphasizing the necessity to strengthen controls and procedures to mitigate exposure to this type of risk, which includes at a minimum the following:
- Establish standards and controls on the use of bank cards of all types, especially those used outside the borders.
- Include this type of risk within the bank's comprehensive insurance policy.
- Verify withdrawal and purchase transactions conducted via the bank's customers' cards, by communicating with customers through sending SMS messages to their phone numbers.
- Raise awareness and alert customers to the risks of such practices.
- Notify the Palestine Monetary Authority and competent authorities immediately upon discovering such operational incidents, in accordance with the mechanism in place for reporting operational risk events.
Regarding the bank's ATMs, it emphasizes the need to strengthen preventive and supervisory controls, including verifying the absence of hidden cameras, counterfeit keypads, or installed devices in the bank card insertion slots of ATMs during cash replenishment, as well as the necessity for periodic monitoring of external CCTV recordings of the ATM environment.
Noting the necessity to provide them with the work procedures and controls adopted in this regard by no later than 15/02/2019.
Supervision and Inspection Department
Palestine Monetary Authority
Note:
Ramallah and Al-Bireh - Palestine P.O. Box 452
info@pma.ps | Fax: +970 2 2415310 | Tel: +970 2 2415251
Gaza - Palestine P.O. Box 4026
Fax: +970 8 2844487 | Tel: +970 8 2825713
www.pma.ps