Transaction Authorization Must Verify Payee and Amount
Bank SinoPac's new online banking system was hacked, resulting in deposits of 418 customers being transferred away, involving as much as NT$41.76 million, drawing high public attention. Yun-Tse Hsieh, Managing Director of KPMG Advisory, recommended that for high-risk remittances, banks should verify customer identity, devices, transaction details, payees and amounts together, rather than relying only on a verified result passed from an earlier system. He stressed that the last line of defense for online banking security is not just confirming who logged in, but confirming before debiting to whom the funds are transferred, how much is transferred, and whether it truly reflects the customer's intent.
Guard Against Mistaken Identity Leading to Unauthorized Debits
Hsieh noted that online banking transactions are like over-the-counter bank services: even if account information is retrieved, the bank must still confirm whether the customer is entitled to use the deposits, and check whether the customer has agreed to the payee and amount of the transaction. Attackers may identify valid accounts through repeated trial and error, and when a bank system mistakes the operator's identity, fails to properly verify transaction authorization, or treats instructions sent by other programs as already confirmed by the customer, transactions not intended by the customer may be released. Banks therefore cannot merely confirm whether the previous process shows verification as completed, but should reconfirm before actual debiting whether the transaction was truly authorized by the customer.
Full End-to-End Testing Should Be Implemented Before Launch
On why the incident still occurred even though banking apps usually undergo functional and security testing before launch and may be tested by third parties, Ta-Kuei Lin, Executive Director of KPMG Taiwan, said the key lies in the depth, breadth and effectiveness of testing. Testing should not only confirm that normal transfers can be completed and check source code and individual component security, but also cover the complete transaction flow after the app, authentication services and debiting systems are integrated. He reminded that priority should be given to reviewing identity authentication, device management, transaction confirmation, and whether customer authorization status is correctly transmitted and checked between the bank and transaction-related systems.
Both New and Legacy Systems Carry Cybersecurity Risks
Hsieh analyzed that, judging from Taiwan's past major financial-sector cybersecurity incidents, risks often appear at two extremes: systems that have operated for many years, and new systems or components just launched. Legacy systems may have unpatched vulnerabilities, while new systems may carry higher risk because administrators are not yet familiar with security settings or because they went live without sufficiently complete testing. The bank has said the incident was related to security settings of its new online banking transaction system vendor, and has adopted measures including stronger authentication and abnormal-transaction monitoring. The full attack method still awaits further investigation.
Users Should Turn On Notifications for Early Self-Protection
For users, Hsieh believes the general public in Taiwan does not need to panic and avoid using online banking because of this; under financial regulator supervision and bank cooperation, confidence in Taiwan's fintech applications should remain. But he also reminded that online banking users should turn on transfer-out or debit notifications provided by banks. Although transaction notifications cannot replace banks' own security controls, they can help users detect anomalies early. If a non-personal transaction is found, it should be reported directly through customer service channels provided by the bank's official app or official website.