Face Scan Fraud: Bank's $40 Million Theft Undermines Biometric Security

Bank System Glitch Leads to Millions in Unauthorized Transfers

Taipei, Taiwan – Bank SinoPac is investigating an incident where 419 customer accounts were debited for over NT$40 million in unauthorized transactions, with some transaction records indicating “facial scan confirmation.” The bank attributed the issue to a glitch in its new online banking system, stating that all funds have been returned. However, questions remain about why the money was funneled into a single account, how the verification process was bypassed, and why victims were predominantly concentrated in Yunlin County.

Facial Scan Verification Under Scrutiny

Customers reported that their accounts were debited approximately NT$100,000 each, with transaction logs showing “facial scan confirmation.” One early complainant on Threads stated they had not opened the banking app. While this does not definitively prove facial recognition was compromised, it has shaken confidence in the security of biometric authentication. The precise cause is expected to be detailed in a report Bank SinoPac is due to submit to the Financial Supervisory Commission (FSC) by November 12.

Understanding FIDO Authentication

Bank SinoPac’s website explains that FIDO (Fast Identity Online) is an international standard for online identity verification, utilizing mobile biometric login. It employs a public-key cryptography framework that “does not store passwords, private keys, or personal biometric data” and requires “prior verification of a linked mobile device before enabling biometric authentication.”

The FIDO Alliance clarifies that device unlocking via biometrics or PIN occurs locally, with biometric data never leaving the device. Online services only receive the public key and signature necessary for login verification. Therefore, a “facial scan confirmation” does not automatically confirm that a user’s face was scanned.

Victim Accounts and Official Response

The initial victim on Threads reported a NT$100,000 transfer from their account with “facial scan confirmation,” emphasizing they had not opened the app or set up any designated accounts.

Wang Yun-chung, deputy director of the FSC’s Banking Bureau, confirmed at a press conference that the commission had received customer complaints about unauthorized fund outflows from accounts without logging into the new mobile banking app. Bank SinoPac’s investigation revealed that all funds were transferred to a single account at another bank, which has since been frozen.

System Anomaly Cited as Cause

Bank SinoPac has attributed the incident to a “program anomaly” within its new online banking system. Preliminary FSC statistics indicate 427 transactions, each around NT$100,000, totaling over NT$40 million and affecting 419 customers. Bank SinoPac stated in a release, “We discovered a program anomaly in the new online banking transaction system today, causing unspecified outflows from some accounts. We have identified the cause and suspended services, and no similar incidents will occur going forward.” The statement did not elaborate on the specific cause.

Unanswered Questions Emerge

Three key questions have arisen from the incident:

• Why did all 427 transactions go to a single account at First Bank? While a system error causing fund transfers is plausible, the concentration of all funds into one external account is puzzling. A malicious actor might be expected to distribute funds across multiple accounts. The ownership of the account remains undisclosed by Bank SinoPac, First Bank, or the police. The FSC stated that the nature of the recipient account, the reason for the funds’ destination, and whether the system was hacked are still under investigation.

• Was the verification process compromised? Victims reported no app usage, no designated accounts, transactions exceeding single-transfer limits, and no login or verification code notifications. The question remains whether the recorded facial scans were genuine or system-generated. Bank SinoPac has not explained how transactions bypassed limits and designated account settings.

• Why were the victims concentrated in Yunlin County? The Criminal Investigation Bureau (CIB) reported receiving the first complaint at 10:48 AM, with 68 cases by noon, noting that “most were males with backgrounds in Yunlin County.” Online speculation suggested that the victims’ national identification numbers began with “P,” indicating initial residency in Yunlin, though officials only confirmed a majority had Yunlin backgrounds. Random system anomalies are unlikely to be so geographically concentrated. The CIB is investigating under the offense of computer crime, while Bank SinoPac maintains it was a system anomaly, indicating differing investigative directions.

Resolution and Future Measures

Bank SinoPac has stated that all funds, including transaction fees, have been fully reimbursed to customers, with the FSC confirming this was done through advance payments. First Bank has designated the recipient account as a controlled account, confirming that the deposited funds have not been transferred out. Bank SinoPac has removed the new app and is directing users to the older version or ATMs.

Bank SinoPac is required to submit a comprehensive report to the FSC within seven business days, by November 12. The FSC is prioritizing customer rights and identifying the root cause, allowing the bank to conduct its own investigation initially. The possibility of penalties will depend on the severity of the incident and its cause.

The CIB has requested information from Bank SinoPac and is assisting in notifying the recipient bank to freeze the account.

The verification method indicated in transaction records should not be taken as definitive proof of personal operation. Customers encountering unrecognized outgoing transactions, regardless of the recorded method, should immediately contact their bank.

Under Article 13 of the Financial Consumer Protection Act, banks must respond within 30 days. If a customer is unsatisfied with the bank’s resolution or if the bank fails to respond within the timeframe, they can apply for mediation with the Financial Consumer Dispute Resolution Center within 60 days.

Individuals who do not typically use non-designated account transfers can request their bank to disable this feature or lower the transfer limit. While initial market rumors suggested similar incidents at two other banks, the FSC has confirmed only Bank SinoPac has reported such an issue. Nevertheless, users of other banks are advised to review their security settings.

Finally, consumers are cautioned against unsolicited calls offering assistance with refunds, as these are likely scams.