part 1

COMPUTER FRAUD AND FINANCIAL CRIMES

It involves the use of computers, networks, or digital systems to unlawfully obtain money, property or financial advantage through deception, manipulation or breach of trust.

Computer-Related Fraud

Unauthorized input, alteration, or deletion of data to gain benefit or cause loss.

Example of Computer-Related Fraud

Manipulating online banking records to transfer funds.

Phishing & Social Engineering

Deceiving victims into revealing credentials or financial info.

Example of Phishing & Social Engineering

False bank emails requesting login details.

Credit/Debit Card Fraud

Using stolen card data for unauthorized purchases.

Example of Credit/Debit Card Fraud

Skimming devices or hacked e-commerce sites.

Online Investment & Ponzi Schemes

Fraudulent offers promising high returns.

Example of Online Investment & Ponzi Schemes

Crypto “pump-and-dump” scams.

Business E-mail Compromise

Impersonating executives to trick staff into wiring funds.

Example of Business E-mail Compromise

False supplier payment instructions.

Identity Theft

Using stolen personal data for financial gain.

Example of Identity Theft

Opening loans under another person’s name.

Computer Fraud Laws

RA 10175 (Cybercrime Prevention Act of 2012), RA 8795 (Electronic Commerce Act of 2000), Revised Penal Code, RA 9160 as amended (Anti-Money Laundering).

Computer-Related Fraud (Penalty Table)

Unauthorized input, alteration, or deletion of computer data to cause loss or gain.

Law & Provision for Computer-Related Fraud

RA 10175 (Sec. 8 in relation to Sec. 6)

Penalty for Computer-Related Fraud

Prision mayor (6 yrs 1 day–12 yrs) + fine ≥ P200k, higher if committed against critical infrastructure.

Scenario for Computer-Related Fraud

Altering e-banking transaction logs to redirect funds to own account.

Computer-Related Forgery

Input/alteration of data to produce inauthentic info presented as authentic.

Law for Computer-Related Forgery

RA 10175, Sec. 7

Penalty for Computer-Related Forgery

Same as computer-related fraud.

Scenario for Computer-Related Forgery

Creating forged e-land titles uploaded to government database.

Phishing / Social Engineering (Penalties)

Deceiving user into revealing credentials via false emails/attachments.

Law for Phishing / Social Engineering

RA 10175 + RPC estafa provisions.

Penalty for Phishing / Social Engineering

RPC Art. 315: Imprisonment of 5 yrs–20 yrs + fine up to triple the value defrauded.

Scenario for Phishing / Social Engineering

‘Bank’ email with spoofed link collecting ATM PINs.

Credit/Debit Card Fraud (Penalties)

Use of stolen card data for purchases or cash advance.

Law for Credit/Debit Card Fraud

RA 8484 – Access Devices Regulation Act.

Penalty for Credit/Debit Card Fraud

Fine up to P50K + imprisonment.

Scenario for Credit/Debit Card Fraud

Skimming ATM cards in mall kiosk.

Online Investment / Ponzi Schemes (Penalties)

Offering unreal returns via digital platforms.

Law for Online Investment / Ponzi Schemes

Securities Regulation Code (RA 8799) + RA 10175 if computer used.

Penalty for Online Investment / Ponzi Schemes

Prison mayor + fine.

Scenario for Online Investment / Ponzi Schemes

Crypto ‘pump-and-dump’ via social media groups.

Business Email Compromise (Penalties)

Impersonating executives/suppliers to order fund transfers.

Law for Business Email Compromise

RA 10175, Sec. 8; RPC Estafa.

Penalty for Business Email Compromise

Prison mayor + fine ≥ P200k.

Scenario for Business Email Compromise

Finance officer wires P5M on ‘supplier’ email that was spoofed.

Identity Theft for Financial Gain

Using stolen personal data to open accounts or secure loans.

Law for Identity Theft for Financial Gain

RA 10175, Sec. 4(b).

Penalty for Identity Theft for Financial Gain

7–14 yrs + fine P3M–P4M.

Scenario for Identity Theft for Financial Gain

Loan approved using hacked gov’t ID data.

Money Laundering (linked to cybercrime)

Concealing origins of criminal proceeds via e-transfers.

Law for Money Laundering (linked to cybercrime)

RA 9160 (AMLA) as amended.

Penalty for Money Laundering (linked to cybercrime)

7–14 yrs + fine P3M–P4M.

Scenario for Money Laundering (linked to cybercrime)

Routing hacked bank funds through online wallets.

Cyberterrorism

A premeditated use of cyberspace and digital tools to conduct attacks or threats that cause, or aim to cause grave harm to life, property, critical infrastructure, or public order in pursuit of political, ideological, religious or social objectives.

Methods of Cyberterrorism

Overwhelming a target’s server to disrupt services.

Example of DDoS

2007 Estonia attacks on government and banks.

Malware & Cyberweapons

Infiltrating systems to sabotage or damage.

Example of Malware & Cyberweapons

Stuxnet worm targeting Iran’s nuclear program.

Subscription & Propaganda

Hijacking websites to spread extremist messages.

Example of Subscription & Propaganda

Terror group propaganda on hacked news sites.

Critical Infrastructure Intrusion

Accessing and manipulating control systems.

Example of Critical Infrastructure Intrusion

Ukraine power grid attacks (2015-2016).

Data Breach & Leak

Stealing sensitive data to intimidate or destabilize.

Example of Data Breach & Leak

Sony Pictures hack linked to political retaliation.

Cyberterrorism Laws

Human Security Act of 2007 (RA 9372) or Anti-Terrorism Act of 2020 (RA 11479) and Cybercrime Act of 2012 (RA 10175).

Cyberextortion

Also known as Digital Blackmail or Ransomware.

Characteristics of Cyberextortion

Criminal Leverage – holding data, systems, or services hostage.

Threat of Harm in Cyberextortion

Could be reputational, operational, financial, or physical.

Digital Delivery in Cyberextortion

Conducted entirely via online or networked systems.

Anonymity Tools in Cyberextortion

Use of crypto wallets, TOR or anonymizing services.

Ransomware

Malware encrypts files; attacker demands payment for decryption key.

Example of Ransomware

WannaCry (May 2017).

Scenario for Ransomware

Ransomware+Worm Hybrid – Self-spreading worm, no user interaction needed once inside a network.

Ransom DDoS (RDooS)

Flood with traffic; attacker demands payment to stop.

Example of Ransom DDoS (RDooS)

2020 attacks on NZ stock exchange.

Scenario for Ransom DDoS (RDooS)

Trading halted for the rest of the day. Attacks resumed on subsequent days.

Data Theft & Threat to Leak

Stealing sensitive data and threatening public release unless paid.

Example of Data Theft & Threat to Leak

2021 ACER breach.

Scenario for Data Theft & Threat to Leak

Threatened to leak the data unless paid.

Email-based Extortion

Threatening to release compromising material unless paid.

Example of Email-based Extortion

Sextortion scams targeting individuals.

Scenario for Email-based Extortion

Victims are told the material will be sent to family unless they pay.

Cyberextortion Laws

Cybercrime Prevention Act of 2012 (RA 10175) – Computer-related fraud.

Cyberwarfare

It is the use of cyberattacks by a state or state-sponsored actors against another state’s digital infrastructure.

Key Characteristics of Cyberwarfare

State-linked actors – often military units, intelligence agencies or proxy hacker.

Critical Infrastructure Focus in Cyberwarfare

Focus on power systems, defense networks, communications.

Potential Kinetic Link in Cyberwarfare

Cyber operation may accompany or trigger physical military action.

Espionage

Stealing classified or sensitive data from governments or military systems.

Example of Espionage

2020 Solar Winds breach (suspected state espionage).

Sabotage

Damaging or disabling systems to hinder operations.

Example of Sabotage

Stuxnet worm targeting Iranian Nuclear centrifuges.

DDoS Attacks

Overwhelming servers to disrupt services.

Example of DDoS Attacks

2007 Estonia attacks on government and banks.

Attacks on Critical Infrastructure

Targeting power grid, transport or water systems.

Example of Attacks on Critical Infrastructure

Ukraine power grid outages (2015-2016).

Economic Disruption

Attacking financial markets or payment systems.

Example of Economic Disruption

2020 NZ stock exchange DDoS extortion campaign.

Propaganda & Influence

To influence public opinion.

Example of Propaganda & Influence

Social media influence campaigns during elections.

Cyberwarfare Legal Provision

Illegal Access, Data Interference, System Interference.

Cyber Fraud

A form of fraud committed through ICT to deceive individuals or organizations for unlawful gain.

Phishing/Spoofing

Fake E-mails, SMS or Websites to steal credentials.

Example of Phishing/Spoofing

“Bank” e-mail asks you to log in via a fake link.

Business E-mail Compromise (BEC)

Impersonating executives to request fund transfers.

Example of Business E-mail Compromise (BEC)

Fraudster poses as CEO instructs urgent payment.

Online Loan/Investment Scams

Fake offers requiring “processing fees” for a non-existent loan/investment.

Example of Online Loan/Investment Scams

Victim pays fees for a non-existent loan.