Financial Blog

Every registered voter in the Philippines is now vulnerable to fraud after a group of hackers leaked a large chunk of sensitive voter information to an online database. While initial reports have downplayed the impact of the leak, IT Security firm Trend Micro confirms the severity of the incident.

“Our investigations showed a huge number of sensitive personally identifiable information (PII)—including passport information and fingerprint data—were included in the data dump,” Trend Micro posted on their official blog.

Even though the leak website has been taken down, the data remains available on the dark web—a secluded part of the Internet where hackers get and share their data. You’re probably asking “Why should I care?” If your data was part of the leak, then you might already be on the hit-list of these cyber thieves. All of your data–including your business and banking details–could be used by cybercriminals via phishing.

The Bangko Sentral ng Pilipinas defines phishing as a form of identity theft where someone steals or uses personal/sensitive information. By hacking into someone’s personal account, hijacking their data—and eventually taking over their identity—a fraudulent party can commit illegal activities or conduct unauthorized business transactions.

Attackers use different means such as email, fake advertisements, websites, or text messages designed to grab your attention. If someone messages you something like “Register now and win an iPad!” or “Get a free subscription when you logon your account,” don’t get excited as you’re likely being targeted by a phishing attack. You may be required to disclose personal information like account numbers, card numbers, PIN, SSS numbers, birthdays and/or other information that can be used to fake your identity.

What can you do to protect yourself from phishing?

Treat passwords like the keys to your front door. Protect it at all costs and change them if you think they’re compromised. Do not use passwords that can be used to identify you—especially data that is publicly available on the Internet—such as birthdates, passport numbers, and the like.

Make it difficult for hackers to crack your password by using a combination of letters in upper and lower cases, numbers, and special characters. It’s also a good idea to choose a different, stronger, password for your main email address. You can even add another layer of protection by using an OTP (one time password).

If your passwords are the keys to your front door, then your security questions are the keys to the back entrance. If you’ve been liberal about the information you share online, it won’t be difficult for hackers to crack your security questions and ultimately get access to your accounts. Choose security questions or create your own with an answer that is known only to you. Avoid questions related to information leaked online like your mother’s maiden name, your home town address, or even your travel details.

Make sure that old documents containing information such as bank or credit card statements and transaction receipts are properly shredded before disposing of them. Remember, hackers are persistent so don’t leave them a trail of bread crumbs to your information.

If an unknown source does contact you, think twice about providing or confirming sensitive personal information. These messages may inform you that you have participated or won a contest or rewards program, but you know better, right? Do not entertain telemarketing calls claiming to be credit card companies offering to waive requirements or fees but ask for your personal information (that they should already have). Security Bank will never send any email with links that will ask you to provide sensitive personal information like your PIN, password, or full card number.

For unexpected emails from persons or institutions that you know, call them to verify that the email is authentic. DO NOT reply to these emails because they might contain a rootkit or a virus that will compromise your system. Use contact details from a calling card or any public listing, not the number provided in the email.