Republic of the Philippines
HOUSE OF REPRESENTATIVES
Constitution Hills, Quezon City
NINETEENTH CONGRESS
Second  Regular Session
`{riousEB,LLNO.9i42
INTRODUCED HON. RUWEL PETER S. GONZAGA
EXPLANATORY NOTE
The  State's  commitment  to  provide  every  Filipino  an  accessible  gateway  to  the
internet is very vital  in  the  everyday lives of our citizens.  Digital technology and  digital
transformation play a significant role in the rapid development and changes of economic
growth,    enhancement    of   public    service,    and    empowerment    of   individuals   and
communities while getting along with new evolving trends.
On digital transformation, the  BSP's  policy agenda to include digitalization of the
country's  payments  system  seeks  to  further  promote  innovative  contactless  payment
technology and encourage more Filipinos to get onboard into the formal financial system.
The policy aims to digitalize at least 50 percent of retail payments, and at least 70 percent
for   the   integration   of   Filipino   adults   to   formal   financial   system   or   transactions.
Complementing on this reform is the recently passed  Financial Consumer Protection Act.
This   legislation   provides   regulators   more   power  to   act  on   and   improve  the
resolution   mechanisms   for  financial   consumer  complaints   including   those   involving
cybercrimes. In line with our Digital  Payments Transformation Roadmap, the BSP has also
issued  six digital  banking  licenses.  According  to  PNP  Cybercrime  Group,  telecom  fraud
scam,  ATM/credit  card  fraud,  e-wallet  fraud,  internet  fraud/scam  on  commodities  and
fraudulent schemes conducted via the  Internet are the  most common types of internet
scams.    The  Philippine  banking  industry  has  one  of  the  key  drivers  of  the  country's
economy, and the vulnerable victims of frauds.  Thus, major banks in the Philippines have
been  closely  coordinating  with  the  Philippines  National  Police  Cybercrime  division  on
filing complaint for individuals, and groups scammers.
This bill seeks to protect consumers and the banking institutions from the wrongful
act of individuals, group scammers and syndicates who are after bank accounts, e-wallets,
and other financial accounts of individuals.  To penalize and  put a stop to the fraudulent
activities  of  mules,  and  other  syndicates  who  are  involved  in  sabotaging  the  financial
stability of individuals in violation of the Data  Privacy Act.
In view of the foregoing, the passage of this bill is earnestly sought.


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Constitution  Hills, Quezon City
NINETEENTH CONGRESS
Second Regular Session
H'busE BILL No.  914 2
INTRODUCED HON. RUWEL PETER S. GONZAGA
AN ACT
DEFINING AND PENALIZING  FRAUDULENT ACTIVITIES INVOLVING  BANK
ACCOUNTS, E-WALLETS, AND OTHER FINANCIAL ACCOUNTS, AND FOR OTHER
PuRPOSES
Be  it enacted  by the  Senate and  the  House  of Representatives of the  Philippines  in
Congress assembled:
SECTION  1. Short ri.fle. -This Act shall be known as the ''Finc7nc[.a/ Account Fraud
Prevention Act."
SEC.  2.  Declarati.on  of Polfcy.  -  The  State  recognizes  the  vital  role  of  banks,
payment service providers, and the general banking public in promoting and maintaining
a stable and efficient financial system. The State also acknowledges that in the advent of
electronic commerce and digital banking, there is a need to protect the public from cyber
criminals and criminal syndicates who target bank accounts and e-wallets or lure account
holders into perpetrating fraudulent activities.
It  shall  therefore  be the  policy  of the  State to  undertake  measures  to  protect  all
persons from falling prey to the various cybercrime schemes by regulating the use of bank
accounts, electronic wallets (e-wallets), and other financial accounts, and preventing their
use in fraudulent activities.  Furthermore, due to the deleterious effect on the economy,
the  large-scale commission  of certain  crimes under this Act shall  be declared  a form  of
economic sabotage and  a  heinous crime and  shall  be  punishable to the maximum  level
allowed  by law.
SEC.  3. Dofl.nl.fi.on of Terms.  -  For purposes  of this Act,  the following  terms are
hereby defined as follows:
a)       Account Takeover -refers to a form of identity theft and fraud, where a  malicious
third party successfully gains access and control of a user's financial accounts;
b)       Account owner-refers to the owner/s ofa bank account, e-wallet, or otherfinancial
account, as registered with the bank or financial institution;
c)       Bank   Account   -   refers   to   an   interest   or   non-interest-bearing   deposit,   trust,
investment,  and  other transaction  account  maintained  with  a  bank  or  a  financial
institution;


d)       Bulk  or  Mass  Messaging  -  refers  to  the  act  of  sending  messages  by  means  of
electronic  mail   (email),  short  messaging  service  (SMS),  chat  message,   or  other
written, digital, or electronic form of communication to an aggregate or total of fifty
(50) recipients or more, counted from the first to the last act of sending;
e)       Cybercrime-refers to the punishable acts and offenses enumerated under section
4 of Republic Act No.  10175, otherwise known as the Cybercrime Prevention Act of
2012;
f)        Electronic wallet (e-wallet) -refers to an electronic account which stores monetary
value  through   a   software   or   application,   which   is   pre-funded   to   enable  the
processing of financial transactions including,  but not limited to,  payments or fund
transfers  to  other  individuals  or  entities,  top-ups  or  cash-in,  and/or  withdrawals,
among   others.   Examples  of  e-wallet  include  electronic   money  or  virtual   asset
accounts stored in mobile phones or web-based applications;
g)       Entity -refers to  natural  orjuridical  persons,  including  corporations,  partnerships,
associations,       organizations,      joint      ventures,       government      agencies      or
instrumentalities, Government-Owned and Controlled Corporations (GOCCs), or any
other legal body or structure, whether for profit or not-for-profit;
h)       Money  Mule -  refers  to  any  person  who  obtains,  receives,  acquires,  transfers,  or
withdraws  money,  funds,  or  proceeds  derived  from  crimes,  offenses,   or  social
engineering schemes on behalf of others, in exchange for a commission or fee, and
those who commit the acts under Section 4 (a) of this Act. For this purpose, money,
funds,  or  proceeds  shall  include,  but  not  be  limited  to,  coins  or currency  of legal
tender  of the  Philippines  or  another jurisdiction,  electronic  money,  virtual  assets,
securities,  or negotiable instruments,  other monetary or financial  instrument,  or all
things which are or may be the object of appropriation;
i)        Other  Financial  Accounts -refer to  new  or  emerging  forms  of financial  accounts
other than bank accounts and e-wallets;
j)        Phishing -refers to a social engineering scheme whereby a person falsely represents
himself/herself   to    another    person    as    a    legitimate    institution,    entity,    or   a
representative thereof, for the purpose of obtaining the latter's sensitive identifying
information  and/or accessing  and  transacting  the  latter's  bank,  e-wallet,  or other
financial account;
k)       Sensitive  Identifying  Information  -  refers  to  any  information  that  can  be  used  to
access  an  individual's  financial  accounts  such  as,  but  not  limited  to,  usernames,
passwords,  bank  account details,  credit card,  debit card,  and  e-wallet information,
among other electronic credentials;
I)        Social  Engineering  Scheme  -refers  to  the  use  of  deception  or  other  fraudulent
means to obtain confidential or personal information, including sensitive identifying
information,  of  another  individual  or  entity.  Social  engineering  schemes  may  be
committed  in-person  or  through  various  media  or  platforms  including,  but  not
limited to:
1)     Electronic  mail;
2)    Short message service, text messages, or other message services;


3)     Social  media sites and applications;
4)    Websites;
5)    Telephone orvoice calls;
6)     Mobile or other electronic applications;
7)    Advertisements; or
8)     Search engines.
SEC. 4. Prohi.bitedActs. -The following acts shall constitute an offense punishable
under this Act:
a)       Money  Mule.  -  lt  shall  be  prohibited  for any  person  to  act  as  a  money  mule,  as
defined under this Act. The following acts shall also constitute as an offense:
1)    Opening  a  bank  account,  e-wallet  account,  or  other  financial  account  and
using  or allowing the use thereof to  receive, transfer,  or withdraw proceeds
derived from crimes, offenses, or social engineering schemes;
2)    Opening a bankaccount, e-wallet, orotherfinancial account undera fictitious
name or using the identity or identification documents of another person or
entity   to   receive,   transfer,   or   withdraw   proceeds   derived   from   crimes,
offenses, or social engineering schemes;
3)     Buying or renting a bank account, e-wallet account, or otherfinancial account
for the  purpose of receiving, transferring,  or withdrawing  proceeds derived
from crimes, offenses, or social engineering schemes;
4)    Selling a bank account, e-wallet, or other financial account for the purpose of
receiving,   transferring,    or   withdrawing    proceeds   derived   from   crimes,
offenses, or social engineering schemes;
5)     Borrowing  and  using  a  bank  account,  e-wallet  account,  or  other  financial
account for the purpose of receiving, transferring,  or withdrawing  proceeds
derived from crimes, offenses, or social engineering schemes; and
6)     Recruiting,  enlisting,  contracting,  hiring,  or inducing  any  person  to  act as  a
money mule;
b)       Phishing  and  Social  Engineering  Schemes. -  lt shall  be  prohibited  for a  person  to
commit phishing, including any variations thereof, and social engineering schemes,
as defined under Section 3 0) and (I) of this Act: Prov[.bed, That loss, damage or injury
to  other  persons  as  a  result  of the  social  engineering  scheme  is  not  a  necessary
element of this offense, and the lack thereof may not be  interposed as a defense:
Provt.ded,  /urfher,  That  if  the  offense  was  committed   by  way  of  bulk  or  mass
messaging, the penalty to be imposed shall be one degree higher;
c)       AccountTakeover.-lt shall be prohibited fora person to commitaccounttakeover,
as defined under Section 3(a) of this Act;
d)       Economic sabotage.-Any offense defined underthis subsection shall be considered
as an offense involving economic sabotage when any of the following circumstances
is present:
1)    The offense was committed  by a syndicate;
2)    The offense was committed in large scale; or
3)    The  individual  or aggregate amount  involved  in the  offense  is  greater than
Two Million  Pesos (P2,000,000.00).


For this  purpose,  an act shall  be deemed  committed  by a  syndicate  if the  offense
was carried  out  by a  group  of three  (3)  or  more  persons  conspiring  with  one another.
Further, an act shall  be deemed  committed  in  large-scale if the offense was committed
against three (3) or more persons individually or as a group.
SEC. 5. Other Offenses. -The acts involving or having relation to the following shall
also constitute an offense:
a)       Any  person  who  willfully  abets  or  aids  in  the  commission  of any  of the  offenses
enumerated under Section 4 of this Act shall be held liable; and
b)      Any person who willfully attempts to commit any of the offenses enumerated under
Section 4 of this Act shall  be held  liable.
SEC. 6. [iobi.lfty Under Other laws. -A prosecution under this Act shall be without
prejudice  to  any  liability  for  violation  of  any  provision  of  the  Revised  Penal  Code,  as
amended, or other laws.
SEC. 7. Penoltl.es. -Any person found guilty of the prohibited  acts under Section
4(a) shall  be punished with  imprisonment of pr!.s[.on mayor in {ts mi.in.mum peri.od and  a
fine  of  at  least  One  Hundred  Thousand  Pesos  (PIOO,000.00)  but  not  exceeding  Two
Hundred Thousand  Pesos (P200,000.00), or both.
Any  person  found  guilty of any of the  prohibited  acts  under Section 4  (b)  and  (c)
shall  be  punished  with  imprisonment of pr[.sl.on mc7yor I.n {.r5 mc7xi.mLfm pen.od and  a fine
of at least Two  Hundred Thousand  Pesos (P200,000.00)  but not exceeding  Five  Hundred
Thousand  Pesos  (P500,000.00),  or  both:  Prowl.c/ed,  That  the  maximum  penalty  shall  be
imposed  if the target or victim  of the  social  engineering  scheme  is or includes a senior
citizen  aged  sixty  (60)  years  old  or  above  at  the  time  the  offense  was  committed  or
attempted.
Any person found guilty of any of the offenses that constitutes economic sabotage
under Section 4(d)  shall  be  punished  with  life imprisonment and  a fine  of not less than
One Million  Pesos (P1,000,000.00)  but not more than  Five Million  Pesos (P5,000,000.00).
Any person found guilty of any of the punishable acts enumerated in Section 5 shall
be punished with imprisonment one (1) degree lower than that of the prescribed penalty
for the offense and a fine of at least One Hundred Thousand  Pesos (P100,000.00) but not
exceeding  Five Hundred Thousand  Pesos (P500,000.00), or both.
SEC.  8. Jurisdl.ctl.on.  - The  Regional  Trial  Court,  designated  as  cybercrime  court,
shall  have jurisdiction  over  any  violation  of  the  provisions  of  this  Act,  including  any
violation committed by a Filipino national. For the purpose of this Act, jurisdiction shall lie
if any of the elements was committed within the Philippines or committed with the use of
any   computer  system   wholly   or   partly   situated   in   the   country,   or  when   by   such
commission, any damage is caused to a  natural orjuridical  person who, at the time the
offense was committed, was in the Philippines.
SEC. 9. General Principles Relating to lnternational Cooperation. ~ AIl relevarit
international instruments on international cooperation in criminal matters, arrangements
agreed based on uniform or reciprocal legislation, and domestic laws, to the widest extent
possible for the purposes of investigations or proceedings concerning criminal offenses


related to computer systems and data, or for the collection of evidence in electronic form
of a criminal offense, shall be given full force and effect.
SEC.   10.  Enforcement.  -  The   National   Bureau   of  Investigation   (NBl)   and  the
Philippine   National   Police   (PNP)   shall   be   responsible  for  the   efficient  and   effective
enforcement of the provisions of this Act. The cybercrime unit or center established under
Section 10 of Republic Act No.10175, otherwise known as the Cybercrime Prevention Act
of 2012,  shall  exclusively  handle  all  cases  involving  violations  of this Act:  Prov[.bed,  that
they shall closely coordinate with the Bongfo Sentro/ ng PI.f[.pinos (BSP) and other relevant
government agencies in the  investigation and  enforcement of cybercrime warrants and
related orders.
SEC. 11. Dutl.es of Books and fiinancl.al /nsfirutions. - Banks, non-bank financial
institutions, and other pertinent institutions shall immediately and effectively respond to
all   consumer   complaints   related   to   phishing,   social   engineering   schemes,   account
takeover,   or   other   cybercrimes   that   are   committed   on   their   platform.   They   shall
comprehensively  investigate  each   case,   exert  reasonable  efforts  to  assist  victims  in
recovering their direct monetary loss,  if any,  provide continuous updates to consumers,
and provide evidence in support of any criminal  investigations or legal actions that may
be initiated by the victims or legal authorities.
The  said  institutions  shall  likewise  adopt  and  implement  measures  to  strengthen
their online platforms, payment systems, and data security, among others.
SEC.12. /mplementl.ng #wles and flegulafions. -Within sixty (60) days from the
effectivity of this Act, the  BSP,  Department of Justice  (DOJ),  Department of  Information
and Communications Technology (DICT),  NBl, and  PNP shall jointly promulgate the rules
and regulations to effectively implement the provisions of this Act.
These agencies  shall  also formulate an Anti-Scam/Financial  Fraud  Roadmap which
shall    include    detailed    measures    on,    among    others,    education    and    information
dissemination on financial  scams and  its prevention; enhanced  detection,  reporting, and
prosecution  of  persons  behind  money  mules,  social  engineering  schemes,  and  other
financial cybercrimes; and the training of responsible officers and personnel to ensure the
effective enforcement and prosecution of cases under this Act.
Additionally,  a  cooperative  mechanism  shall  be established  among  the  concerned
government   agencies,   banks,   financial   and   other   covered   institutions,   private   and
corporate  sectors,  and  other  concerned  stakeholder  groups  to  ensure  the  effective
prosecution of cases and enforcement of this Act.
SEC.13. Appropri.aft.ons. -The amount necessary for the effective implementation
of this Act shall  be included  in the annual General Appropriations Act (GAA).
SEC.114. Separabi.lI.ty Clause. -lf any  provision  of this Act is  declared  invalid  or
unconstitutional, the other provisions not affected by such declaration shall remain in full
force and effect.
SEC.15. flepcaling Clouse. -All  laws,  decrees, orders,  and  issuances,  or portions
thereof,  which  are  inconsistent  with  the  provisions  of  this  Act,  are  hereby  repealed,
amended, or modified accordingly.


SEC.16. Eff8ctiwity. -This Act shall take effect fifteen  (15) days after its complete
publication in the Offic{.cJ/ Gazette or in a newspaper of general circulation.
Approved,