Over NT$40 Million Transferred Without Log-in
On the 3rd, reports emerged that Bank SinoPac account holders had funds automatically transferred to a designated Taipei Fubon Bank account without their knowledge and without logging into the APP, about NT$100,000 per transaction, raising high public concern over the security of financial institutions. Wang Yun-chung, Deputy Director-General of the Banking Bureau, FSC, noted that Bank SinoPac first notified by phone at noon on the 3rd, mainly involving the new version of the Bank SinoPac APP, with funds transferred even though customers had not logged in. According to Bank SinoPac statistics, there were initially 427 transactions, affecting 419 people, totaling more than NT$40 million.
FSC Requires Advance Repayment
Wang emphasized that the FSC prioritizes two levels, including protection of customer rights and the root cause of the incident, and has asked Bank SinoPac to properly handle customer rights. Bank SinoPac has proactively reported the case and is repaying customers by way of advance payment. Bank SinoPac is also investigating the cause of the system anomaly; follow-up will depend on the severity of the incident and the final findings on the cause. No presumption is made now on whether penalties will be imposed; clarifying the cause and ensuring customer rights are the top priorities.
New APP Removed, Report Due Before November 12
Bank SinoPac has removed the new APP and will direct customers to the old APP or to ATMs. Bank SinoPac is expected to file a major incidental event report on the 3rd and submit a report within seven business days after filing, that is, before November 12. Wang said Bank SinoPac will be asked to submit its follow-up review and report, and the FSC will take further action accordingly. On whether the FSC will send staff for an examination, Wang said Bank SinoPac will first be allowed to conduct its own examination, and further procedures will follow based on the bank's findings.
Taipei Fubon Account Frozen, Cause to Be Clarified
On market concerns over whether other banks have similar issues, Wang stressed that only Bank SinoPac has filed a report so far. As banks must report major information security incidents within half an hour of occurrence, no other bank had filed a report as of 4 p.m. on the 3rd. On whether the incident involved hacking that caused funds to be transferred without log-in, and why funds went to the designated Taipei Fubon account, Wang said both are still being looked into, including technical details, but the designated Taipei Fubon account has been frozen and none of the funds were transferred out further. Other bank executives believe whether anomalies occurred in device binding, identity verification, and transaction authorization, along with the impact of facial recognition and rumors about specific ID number prefixes, all need to be clarified in detail.