The National Bureau of Investigation (NBI) should maximize the use of the Access Devices Regulation Act of 1998 to better investigate text scams (smishing), House Ways and Means Chair Albay 2nd district Rep. Joey Sarte Salceda said.

During a House Committee on Information and Communications Technology on Wednesday, Sept. 14, Salceda cited the two-decade old law as something the agency could take advantage of.

Republic Act (RA) 8484 of 1998 regulates the use of access devices to prevent fraudulent activity through unauthorized access devices, which “can be used to obtain money, goods, services, or any other thing of value or to initiate a transfer of funds.”

“Arguably, online bank accounts and electronic wallets like GCash and Paymaya are access devices, in a reasonable construction of the provision of the law. That means, even without the use of the Cybercrime Law or the Data Privacy Law yet, if we cannot prove that indeed some data hacking was involved, those who perpetrate smishing attacks are still liable under Section 9 (i) (j) or (o) of the law,” Salceda said.

Sections (i), (j), and (o) of the law read as follows:

“(i) disclosing any information imprinted on the access device, such as, but not limited to, the account number or name or address of the device holder, without the latter's authority or permission.

“(j) obtaining money or anything of value through the use of an access device, with intent to defraud or with intent to gain and fleeing thereafter.

“(o) without the authorization of the issuer of the access device, soliciting a person for the purpose of: offering an access device; or selling information regarding or an application to obtain an access device."

Salceda says that “if smishing attackers are able to access online accounts due to their text scams, they should be guilty of RA 8484, regardless of whether there was a data breach or not".

“Much of our current discussions focus on how the data appearing on the text messages with names of receivers was obtained. That might not necessarily be the most important point now. It is the financial harm that these smishing attacks can cause. And RA 8484 focuses on the potential harm done, so we can really get the ball rolling with investigations,” he concluded.