SBP asks banks for real time monitoring of card operations

The State Bank of Pakistan (SBP) has urged all banks for more measures to mitigate the risks emanating from card payment system and real time monitoring of card operations and transactions. After the cyber attack on BankIslami Pakistan's card data, the SBP on Monday called a meeting of IT heads of the all banks to discuss the issue the and risks relate to card system. During the meeting SBP asked for strict security measures and continuously upgradation of IT systems particularly related to payment to meet any challenges in future. The State Bank also advised banks for immediate action and report of any unusual incidents.
Meanwhile, BankIslami on Monday confirmed cyber-attack from unknown hackers on its card system on Saturday morning and claimed that a timely response kept the customer accounts protected.
According to information shared by BankIslami management with Pakistan Stock Exchange, on the morning of October 27, 2018 certain abnormal transactions valuing Rs 2.6 million were detected by the bank on one of its international payment card scheme.
However, the bank immediately took precautionary steps which, inter alia; included shutting its international payment scheme and all monies withdrawn from the accounts amounted to Rs 2.6 million have been credited in the respective accounts of customers.
The bank responded immediately by shutting down all international transactions originating from International Payment Scheme and signing out from inter-operability switch to avoid more financial losses.
Subsequently, after the bank was cut off from the international payment scheme, the Bank was advised by international payment scheme that some transactions were made on international ATMs allegedly using bank's issued cards.
However, no details have so far been shared with the bank as to how such transactions were processed and validated when such transactions never landed on the bank's system. These transactions, of approximately USD 6 million as claimed by international payment scheme, are not acknowledged by the Bank as the Bank was actually logged off from the international payment scheme at that time, the bank management said.
BankIslami is of the view that it was a co-ordinated cyber attack in which the payment network of the international payment scheme as well as that of the acquiring banks were possibly compromised.
There is absolutely no threat to bank's operations and all domestic ATM cash withdrawal transactions through biometric service were restored on the same day. However, as a precautionary measure, all transactions routing through international payment scheme will be shortly restored once the Bank is confident that all risks of unauthorized transactions have been mitigated.
BankIslami management has said since the connection was disconnected between the international payment switch, the amount reported by International Payment Scheme via international transactions (worth 6.1 million dollars), was neither processed by Bank's system nor deducted from any customer account.