KARACHI:Starting with a single financial institution BankIslami Pakistan, cyber attacks on banks in the country are now being reported on a larger scale.
It has put big question marks on the findings of the Federal Investigation Agency (FIA) and the banking regulator on cybercrime as the two have taken completely opposite positions over the occurrence of fresh online frauds.
“People continue to lose money from their bank accounts … the cause for concern is that banks hide information about cyber robberies,” said FIA Cybercrimes Director (retd) Capt Mohammad Sohail in a video recording in the early hours on Tuesday.
The statement badly jolted the entire banking system and shocked their regulator – the State Bank of Pakistan.
Later in the day, they came on record individually, contradicting the FIA director’s statement.
The SBP and banks categorically denied fresh online robberies in any of the banks operating in Pakistan after October 27.
“We would like to emphasise that except for the incident on October 27, 2018 in which reportedly the IT security of one bank (BankIslami Pakistan) was compromised, no breach has been reported,” the SBP said in a written statement.
The Topline Securities reported that the FIA director’s statement triggered a massive sell-off of shares of the banking sector at the Pakistan Stock Exchange (PSX) on Tuesday.
The FIA director’s statement; however, moderately matched the findings of a Pakistani IT firm claiming to be working on cyber security since year 2000.
PakCERT Chief Executive Qazi Misbah claimed that their findings suggest “a total of 19,864 cards (banking clients’ data) of 22 Pakistan banks were compromised (on October 27).”
According to Express TV, “Former chief scientist of Khan Research Laboratories (KRL) approached the Supreme Court of Pakistan saying Rs3 million had ‘vanished’ from his back account on Monday.
“I don’t know how many cards were misused, but the bank could inform you better about this,” the IT firm chief replied to The Express Tribune.
“The data was collected through skimming devices attached with ATM machines installed in different parts of the country,” he claimed.
Earlier, the SBP reported that overseas hackers had stolen the banking clients’ data in a cyber attack which took place in late October.
In the attack, BankIslami lost Rs2.6 million, while the international financial system reported the robbery to the tune of $6 million (Rs795 million).
In the wake of the cyberattack, a number of banks temporarily or completely suspended international payment schemes on their debit and credit cards to avoid fresh frauds.
On Tuesday, however, several banks, including Habib Bank Limited, Standard Chartered Pakistan, Summit Bank, Meezan Bank and Sindh Bank, asked their clients to continue performing their banking operations through any mode of transactions, including ATMs and/or online banking without any fear.
They claimed their accounts remained well protected, secured and backed by latest technology-driven IT systems.
The FIA director said in the video recording that it is quite clear with the recent cyber attack that Pakistan’s banking security system needs improvement.
“In this regard, we have already talked to the SBP and all the banks’ (IT) security supervisors have been called for a meeting.
“We have caught many gangs, presented them in court and recovered part of the looted money … we are trying to work proactively on the issue (cyber security) and stop bank pilferage,” he said.
The SBP said that nevertheless, it has already instructed all banks to take steps to identify and counter any cyber threat to their systems in coordination with international payment schemes.
Representatives of payment schemes have also assured that all steps are being taken to help banks in identifying any cyber threat on card systems and have offered additional controls to them.
In addition, some banks are putting in place further precautionary measures while others are confident of the security of their systems and continue to make all card transactions fully available to their customers.
The precautionary measures by some banks include partial restrictions, such as, requiring customers to seek prior approval for use in cross-border transactions, or in a few banks, a total restriction on cross border transactions.
However, the SBP has been assured that all these temporary restrictions will be lifted once appropriate IT security measures are in place. It is stressed that all restrictions pertain only to cross-border transactions, and not domestic.
“The SBP is engaged with the international payment schemes, payment operators and banks to monitor the current situation continuously to ensure security of the banking system,” it said.
