DICT Secretary Ivan John Uy. (Screengrab from PTV)
MANILA – The Department of Information and Communications Technology (DICT) and its attached agencies are looking into the recent spate of unauthorized deductions on GCash accounts to find out whether the incident stemmed from a security breach or phishing attacks.
In a Laging Handa briefing on Friday, DICT Secretary Ivan John Uy said the DICT is joined in the investigation by the Cybercrime Investigation and Coordinating Center (CICC) and the National Telecommunications Commission (NTC).
Uy said several complaints from different individuals have been lodged with the DICT.
“We’re looking into it whether it’s a breach, a leak, a hack or a phishing,” he said.
GCash, he said, claimed that the deductions were the result of phishing attacks on its users.
“[They claimed] ang nangyari is from the user end, medyo nakuha iyong credentials, login credentials ng GCash user at ginamit iyon ng mga cyber-criminals upang makapasok sa mga account (They claimed that what incident stemmed from the user end, cybercriminals got the login credentials from users and they used it to access their accounts),” he said.
If the investigation finds lapses in GCash’s security, he said recommendations will be made to improve their cyber-security infrastructure and personnel to ensure the safety of the public.
For users affected by similar attacks, he advised filing a claim for lost funds with GCash.
“Kung ang loss ay dahil sa pabaya ng GCash, siyempre dapat bayaran iyan ng GCash. Pero kung ang kapabayaan ay nasa user, wala na hong kinalaman ang GCash diyan dahil ang user po ang nagpabaya at naibigay ang account name at ang access credentials nila sa isang unauthorized person (If the loss was GCash’s fault, of course they should pay for it. But if it’s because of user actions, GCash has no responsibility since it was the user who gave away access to an unauthorized person),” he said.
On Tuesday, GCash said an investigation during scheduled maintenance found that the deductions did not result from a “hacking” incident.
“Any deduction from a GCash account will be adjusted before 3 p.m. [Tuesday],” it said. (PNA)
