Authorization Must Be Confirmed Before Debit
Bank SinoPac's new online banking system was hacked, resulting in deposits of 418 customers being transferred out, involving as much as NTD 41.76 million, drawing high public concern. Hsieh Yun-tse, Managing Director of KPMG Advisory in Taiwan, recommends that for high-risk remittances, banks should verify customer identity, device, transaction details, payee and amount together, rather than relying solely on a verified result passed from the previous system. The bank has said the incident was related to security settings of the new online banking transaction system vendor, and has adopted measures such as enhanced verification and abnormal transaction monitoring, with the full attack method still to be clarified by follow-up investigation.
Guard Against Transactions Released Due to Mistaken Identity
Hsieh Yun-tse noted that online banking transactions are like over-the-counter bank services: even after account information is retrieved, the bank must still confirm whether the customer is entitled to use the deposits, and verify whether the customer agrees to the payee and amount of the transaction. Attackers may identify valid accounts through repeated trial and error, and when the system mistakes the operator's identity, fails to properly verify transaction authorization, or treats instructions sent by another program as already confirmed by the customer, transactions not intended by the customer may be released. He stressed that the last line of defense for online banking security is not just confirming who logged in, but confirming before debiting to whom funds are transferred, for how much, and whether it truly reflects the customer's intent.
Testing Must Cover the End-to-End Process
Before a banking app goes live, functional and security testing is usually conducted, and third-party testing may also be commissioned. Lin Ta-kuei, Executive Director of KPMG in Taiwan, pointed out that the key lies in the depth, breadth and effectiveness of testing. Testing should not only confirm that normal transfers can be completed and check source code and individual component security, but also cover the complete transaction flow after the app, verification services and debit systems are connected. Follow-up review should prioritize identity verification, device management, transaction confirmation, and whether customer authorization status is correctly transmitted and checked among relevant systems, especially whether transactions without customer authorization can indeed be blocked.
Both New and Legacy Systems Need Stronger Controls
Hsieh Yun-tse analyzed that, judging from past major cybersecurity incidents in Taiwan's financial industry, risks often appear at two extremes: one is legacy systems that have operated for many years, and the other is new systems or components just launched. Legacy systems may contain unpatched vulnerabilities, while new systems may carry increased risk because administrators are not yet familiar with security settings or go live without sufficiently complete testing. Old systems should have clear patching and replacement plans, while new systems should fully run through end-to-end transaction processes in settings close to formal operations before launch, with anomaly monitoring and suspension mechanisms planned. Users need not panic excessively, but should turn on transfer or debit notifications, and report unauthorized transactions through official app or official website customer service channels.