A defining moment for fintech companies

RECENT unauthorized transactions involving GCash signal the need for better security, transparency and oversight, despite the e-wallet giant’s assurances that it has resolved systemic issues that caused these transactions to occur for an undisclosed number of users.

Last week, GCash released a statement saying it had “completed the necessary wallet settings for affected users” and assured them they were safe. “Customer account security will always be our top priority,” the company added after reports of missing funds and unauthorized transactions, which it attributed to the ongoing system reconciliation process.

However, neither this announcement nor assurances are enough.

For example, GCash has not been transparent about the extent of the problem and has not even released the number of users affected by the system issues yet. In fact, the public only became aware of the problem after GCash users began complaining online about their funds mysteriously disappearing.

“One morning I woke up and my GCash account was empty,” the popular Filipino-language comedian posted on Instagram last week. She said the withdrawals were linked to 30 different numbers, adding that the mobile payment service’s unreliability could affect her condiment business. She also questioned the effectiveness of the SIM card registration law, which was supposed to reduce online fraud.

Another GCash user, a member of a band that performed on cruise ships, said her account registered 50 unauthorized transactions of P2,000 each, totaling P100,000 in just three minutes. Each message to send money registered two different numbers per transaction.

GCash acknowledged that some users were affected by the “system reconciliation process” but did not say how widespread the problem was.

“Several GCash users have been affected by errors in the ongoing system reconciliation process. This incident was isolated to multiple users and we assure our customers that their accounts are safe. We have identified the affected accounts and are contacting them. Wallet adjustments are ongoing,” – the message says.

Despite these assurances, the Department of Information and Communications Technology (DICT) and the Bangko Sentral ng Pilipinas (BSP) said they would investigate the latest system failures, although the former said it had no regulatory authority to inspect the systems of financial technology (fintech) companies like GCash .

Deputy Information Minister Geoffrey Ian Dye said the DICT was investigating the issue. He also said that as e-wallets become an increasingly popular alternative to traditional banks, GCash should strengthen its security measures, processes and technology to prevent unauthorized withdrawals from happening again.

The BSP, meanwhile, said it would also investigate GCash and ordered it to resolve the deductions immediately. He added that he was actively following the actions taken by the GCash operator G-Xchange Inc. (GXI), and required him to provide regular updates on how he was solving the problem.

The central bank urged GXI to speed up the refund process and ensure that affected users’ balances are restored without delay.

“(BSP) is further investigating the incident to identify possible vulnerabilities and verify compliance with regulations and policies,” it said.

He urged affected customers to coordinate with GXI to resolve their complaints, noting that if they are not satisfied with the firm’s handling, consumers can take their concerns to the BSP Online Buddy facility.

Announcing these investigations is a good first step that requires further completion. The public must be promptly informed of their findings and the steps taken to remedy the situation. The government should also consider strengthening supervision of financial institutions such as GCash.

The company that runs GCash also needs to do more to effectively communicate with frustrated users and the general public. That’s hard to do when there’s no human face to speak for the company, and when its customer service is not only hard to reach, but also defaults to automated response systems that rarely resolve complex user issues.

Sam Jacoba, founding president of the National Association of Data Protection Professionals of the Philippines, was on hand when he made this observation: “GCash needs to demonstrate two things in this incident: transparency and accountability. As a leader in its field, solving this ongoing issue will be a defining moment for GCash.”