Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

SEVENTEENTH CONGRESS

Second Regular Session

House Bil No. 6355

Introduced by Representative Jose Enrique S. Garcia IIL

EXPLANATORY NOTE

Article 2, Section 9 of the 1987 Constitution states that “The
state shall promote a just and dynamic social order that will ensure the
prosperity and independence of the nation and free the people from
poverty through policies that provide adequate social services,
promote full employment, a rising standard of living, and an improved
quality of life for all.”

With the rapid advancement in information technology and the
continually expanding use of access devices in commercial financial
transactions, there is now a growing need for the State to strengthen
the protection accorded to persons using access devices, such as credit
cards, in their financial transactions.

The amount of losses in fraudulent credit card transactions
spiked to Php 506.8 Million and the number of online scam cases rose
to over 500 in 2016. Credit-card fraud has many forms, of which the
most common type involves "cloning" or a scheme where individuals
or syndicates would connive with some employees of stores or
restaurants, including waiters or cashiers, to duplicate or copy vital
information from a legitimate credit card. These people obtain card
information by swiping the card in an electronic skimmer that will
read the confidential information stored in the credit card's magnetic
strip. After sufficient information has been accumulated, the same is
given to syndicates which then use the information for fraudulent
transactions.

Section 9 of Republic Act (RA) No. 8484, otherwise known as
the "Access Devices Regulation Act of 1998", provides that "[a]ny
person who possesses one or more counterfeit access devices or uses
the said access device with intent to defraud financial transactions is
punishable by law.” It further provides that obtaining money or
anything of value through the use of a device, with intent to defraud or
with intent to gain financial advantage is also punishable by law.


Despite the existence of R.A. No. 8484 for almost two decades
now, critics have pointed out that the implementation of said law is
ineffective because the agencies tasked to implement it lack the
technical capabilities, technology and know-how to effectively catch up
with the developments in computer and information technology (IT).

In view thereof, there is an urgent need to amend the provisions
of R.A. No. 8484 and give the implementing agencies the legal basis to
create and utilize tools to address the issue of credit card fraud in the
country in order to protect the public from this unscrupulous
undertaking. It is likewise timely and appropriate to include credit
card fraud committed through the use of computer system among the
cybercrime offenses defined under R.A. No. 10175 and provide a
tougher penalty therefor.

‘The passage of this bill is earnestly and sincerely sought.

JOSE IQUE S. GARCIA IIT

id District, Bataan


aw

ESecumudau

13
14
15

16
7
18
19
20

Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City
SEVENTEENTH CONGRESS

Second Regular Session

5
House Bill No. 63855

AN ACT STRENGTHENING THE MEASURES AGAINST CREDIT CARD
FRAUD, AMENDING FOR THE PURPOSE REPUBLIC ACT 8484,
OTHERWISE KNOWN AS THE “ACCESS DEVICES REGULATION ACT
OF 1998” AND REPUBLIC ACT 10175, OTHERWISE KNOWN AS THE
“CYBERCRIME PREVENTION ACT OF 2012”

Be it enacted by the Senate and House of Representatives of the Philippines
in Congress assembled:

SECTION 1. Section 3 of Republic Act 8484 is hereby amended to read as
follows:

“Section 3. Definition of terms. — For purposes of this Act, the
terms:

(a) Access Device — means any card, plate, code, account number,
electronic serial number, personal identification number, or other
telecommunications service, mobile software application,
equipment, or instrumental identifier, or other means of account access
that can be used to obtain money, goods, services, or any other thing of
value or to initiate a transfer of funds (other than a transfer originated
solely by paper instrument);

(b) Counterfeit Access Device — means any access device that is
counterfeit, fictitious, altered, or forged, or an identifiable component
of an access device or counterfeit access device, or any unauthorized
copy or reproduction of a valid access device;

() Unauthorized Access Device — means any access device that is
stolen, lost, expired, revoked, canceled, suspended, or obtained with
intent to defraud; Provided that, an unauthorized copy or
reproduction of a valid access device shall be considered as
an unauthorized access device;


26
27
28
29
30
31

32
33
34

35
36
37
38

39
40

XXX

(m) Hacking - refers to the unauthorized access into or
interference in a computer system/server or information and
communication system; or any access in order to corrupt,
alder, steal, or destroy using a computer or other similar
information and communication devices without the
knowledge and consent of the owner of the computer or
information and communications system, including but not
limited to the introduction of computer viruses and other
machinations, resulting in the corruption, destruction,
alternation, theft or loss of electronic data messages or
electronic documents.

(n) Online Banking — refers to the use of the internet by bank
customers in order to manage their bank accounts and
perform account transactions.

(0) Merchant — refers to a business that accepts payments by
debit or credit cards.

(p) Mobile Payment — generally refer to payment services
operated under financial regulation and performed from or
via a mobile device.

SECTION 2. Section 9 of Republic Act 8484 is hereby amended to read as
follows:

“Section 9. Prohibited Acts. — The following acts shall constitute
access device fraud and are hereby declared to be unlawful:

XXX

(q) copying or counterfeiting any credit card, and obtaining
any information therein with the intent of accessing the
account and operating the same whether or not cash is
withdrawn or monetary injury is caused by a perpetrator
against the account holder, partner merchant, or the
depositary bank;

(©) possession of any type of skimming device or any
electronic gadget or equipment that is used to perpetuate any
of the foregoing acts; and,

(s) accessing, with or without authority, any application,
online banking accounts, credit card account in a fraudulent
manner, regardless of whether or not it will result in
monetary loss to the account holder.”

SECTION 3. Section 10 of Republic Act 8484 is hereby amended to read as
follows:


eIAWE WH

©

10
i
12
13

14
15
16
17
18

19
20
21
22
23
24
25
26
27

28
29
30
31
32
33
34
35
36
37

38
39
40
41
42

43
44
45

47

“Section 10. Penalties. — Any person committing any of the acts
constituting access device fraud enumerated in the immediately
preceding section shall be punished with:

(a)-a-fine-of Fen—thousand-peses-(P10,000-00)-or_twieethe-value
5 a is Hee f

(a) imprisonment for not less than twelve (12) years and not
more than twenty (20) years and a fine twice the equivalent
of the aggregate amount of all affected or exposed bank
accounts, but the fine shall not be less than five hundred
thousand pesos (Php 500,000.00), in the case of an offender
who is in possession of ten (10) or more counterfeit access
devices and/or unauthorized accessed devices and was able
to access at least one (1) account or had gained credit by the
fraudulent use of any such access device in his possession;

(b) imprisonment for not less than six (6) years and not more
than twice (12) years and a fine twice the equivalent of the
aggregate amount of all affected or exposed bank accounts,
but the fine shall not be less than two hundred and fifty
thousand pesos (Php 250,000.00), in the case of an offender
who is in possession of ten (10) or more counterfeit access
devices and/or unauthorized accessed devices but was not
proven to have accessed any account nor had gained credit by
the fraudulent use of any such access device in his
possession;

(c) imprisonment for not less than four (4) years and not
more than six (6) years and a fine twice the value of the
fraudulently obtained credit, without prejudice to the civil
liability of the offending party, in the case of an offense
involving fraudulent use of a credit card;

(d) imprisonment for not less than six (6) and not more than
ten (10) years, and a fine of five hundred thousand pesos
(Php 500,000.00) or twice the amount obtained by the
offender, whichever is higher, without prejudice to the civil
liability of the offender, in the case of an offense under


wre

Secor dss

12
13
14
15
16
17
18

19
20
21
22

23

24
25
26
27
28

29
30

31
32

33

34
35
36
37

38
39
40
41
42
43

section 9 (b), (c), (4), (e), (g), (h), @, @, GO, @, (m), @),
(0), (p), (r), (s), which does not occur after a conviction for
an offense under section 9.

(e) imprisonment for not less than ten (10) and not more
than twelve (12) years, and a fine of five hundred thousand
pesos (Php 500,000.00) or twice the amount obtained by the
offender, whichever is higher, without prejudice to the civil
liability of the offender, in the case of an offense under
section 9 (a), (f), (q) which does not occur after a conviction
for an offense under section 9.

(® imprisonment for not less than twelve (12) and not more
than twenty (20) years, and a fine of eight hundred thousand
pesos (Php 800,000.00) or twice the amount obtained by the
offender, whichever is higher, without prejudice to the civil
liability of the offender, in the case of an offense under
section 9, which occurs after a conviction for another offense
under said subsection, or an attempt to commit the same;
and

(g) the penalty of life imprisonment and a fine of not less
than one million pesos (Php 1,000,000.00) but not more
than five million pesos (Php 5,000,000.00) shall be imposed
upon an offense involving economic sabotage.

There is economic sabotage:

() If any of the prohibited acts in Section 9 involve
hacking of a bank system; or

(2) If the offense under Section 9(s) affected fifty (50) or
more online banking accounts, credit cards, ATM
cards, and debit cards.

SECTION 4. Section 14 of Republic Act 8484 is hereby amended to read as
follows:

“Section 14. Presumption and prima facie evidence of intent
to defraud. ~ The mere possession, control or custody of:

XXX

(8) a genuine access device, not in the name of the possessor, or not in
the ordinary course of the possessor’s trade or business, shall be prima
facie evidence that such device or equipment is intended to be used to
defraud.

A cardholder who abandons or surreptitiously leaves the place of
employment, business or residence stated in his application or credit
card, without informing the credit card company of the place where he
could actually be found, if at the time of such abandonment or
surreptitious leaving, the outstanding and unpaid balance is past due
for at least ninety (90) days and is more than


41
42

43

44

(Pi0,000.00) Two Hundred Thousand Pesos (P200,000.00),
shall be prima facie presumed to have used his credit card with intent
to defraud.

SECTION 5. Section 16 of Republic Act 8484 is hereby amended to read as
follows:

“Section 16. Reporting requirements. — All companies engaged
in the business of issuing access devices, including banks, financing
companies and other financial institutions issuing access devices, as
well as all partner merchants, shall conduct initial
investigation on any reported access device fraud and furnish
annually-real-time,-on-or-before-the-31st-of Mareh-of the-sueeeeding
year, reports on the result thereof to-the-Credit Card-Association-of
the Philippines regarding aecess device frauds committed against the
holders-of sueh-entities in-the-preeeding-ealendar-year, to the National
Bureau of Investigation (NBI) and the Anti-Cybercrime Group of
the Philippine National Police (PNP). The report shall
contain a narration about the fraud committed and an
identification of the perpetrator, if feasible. The report shall
further constitute the complaint necessary for the NBI or the
Anti-Cybercrime Group of the PNP to pursue further
investigation and prosecution of the fraud.

Notwithstanding this requirement, banks, financing companies and
other financial institutions, including their subsidiaries and affiliates,
issuing access devices shall continue to be regulated and supervised by
the Bangko Sentral ng Pilipinas while other companies issuing access
devices shall continue to be regulated and supervised by the Securities
and Exchange Commission.

The NBI and the Anti-Cybercrime Group of the PNP may
compel access device issuers and partner merchants to
cooperate and assist in investigations on access device frauds
as well as the submission of additional data as needed on a
case to case basis.

Failure to comply with the orders from law enforcement
authorities shall be punished as a violation of Presidential
Decree No. 1829 with imprisonment of prison correctional in
its maximum period or a fine of One hundred thousand pesos
(Php 100,000.00) or both, for each and every noncompliance
with an order issued by law enforcement authorities.”

SECTION 6. Section 4 of Republic Act 10175 is hereby amended to read as
follows:

“SEC. 4. Cybercrime Offenses. — The following acts constitute the
offense of cybercrime punishable under this Act:

XXX

(c) Content-related Offenses:


SSonwua w sun=

13
14
15
16
17
18
19
20
21
22
23
24
25

(1) Cybersex. — The willful engagement, maintenance, control, or
operation, directly or indirectly, of any lascivious exhibition of sexual
organs or sexual activity, with the aid of a computer system, for favor or
consideration.

XXX

(5) Access devices fraud — The unlawful or prohibited acts
defined and punishable by Republic Act No. 8484 or Access
Devices Regulation Act of 1998, committed through a
computer system: Provided, That the penalty to be imposed
shall be (1) one degree higher than that provided for in
Republic Act No. 8484.

SECTION 7. REPEALING CLAUSE - All laws, presidential decrees,
executive orders, letters of instruction, administrative rules and regulations or
parts thereof which are contrary to or inconsistent with the provisions of this
Act are hereby repealed or modified accordingly.

SECTION 8. SEPARABILITY CLAUSE - Should any part or provision of
this Act be held unconstitutional or invalid, all other provisions hereof which
are not affected thereby shall continue to be in full force and effect.

SECTION 9. EFFECTIVITY. - This Act shall take effect after fifteen (15)
days following its complete publication in the Official Gazette or in two (2)
newspapers of general circulation whichever is earlier.

Approved.