BSP tells BDO, UnionBank to implement remedial measures

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) has directed two banks to lay down remedial measures, including the reimbursement of the losses incurred by depositors, due to unauthorized fund transfers involving several depositors of Sy-led BDO Unibank over the past few days.

BSP Governor Benjamin Diokno said the regulator is closely coordinating with BDO and Aboitiz-led Union Bank of the Philippines as multiple users were allegedly victimized by an online banking hack over the past few days.

“The BSP has been monitoring the surge in complaints posted in social media platforms since the early part of this week. We are in close coordination with BDO, as well as UnionBank, on this incident to ensure that remedial measures are being undertaken, including reimbursement of affected consumers,” Diokno told reporters via Viber.

Diokno pointed out the protection of the banking public is a top priority of the central bank.

“Rest assured that we continue to collaborate and engage stakeholders to ensure the safety and integrity of the financial system, as well as the protection of financial consumers,” the BSP chief said.

Over the past few days, several BDO depositors took to social media to report that their accounts have been hacked, resulting to massive losses of between P25,000 to P50,000 that were transferred to various accounts in UnionBank.

For one, a certain Ellard Chua said P50,025 was debited from his account at 12:30 p.m. last Saturday even if he did not initiate or authorize the transfer.

Chua claims that his name is now being used in the BDO banking breach or hacking scandal.

“I did not receive a single peso. Someone is using my name as beneficiary, but the beneficiary account is not mine. For InstaPay transfers, you only need a valid account number, the account name is irrelevant,” Chua posted on Facebook.

This was collaborated by J. EM Mendoza who said he received an email and a text message that his account sent P50,025 to a UnionBank account under Chua’s name as donation.

“I’m shocked! I was only watching Netflix at that moment, and I’m not involved with this transaction. I re-read the email as I thought someone sent me the amount, but no, my account was the one that sent it,” Mendoza said.

Mendoza immediately changed his password after discovering that P50,025 was debited from his bank account. He also immediately called the 24/7 customer service hotline of BDO to report the incident.

“I’m wondering how this incident happened… To access my account on a new device, an OTP should be sent to my registered phone number and I didn’t receive any,” Mendoza said.

Likewise, Angelene Lorraine Ong was also a victim as P50,025 was debited form her account last Thursday and transferred via InstaPay to the UnionBank savings account of a certain Mark Nagoyo.

In fact a Facebook account named Mark Nagoyo (pertaining to the account were the stolen amounts were transferred) BDO Hacked has been created for the victims of the alleged hacking incident. Close to 2,000 members have joined the group.

In a statement, BDO said the bank would reimburse the losses of affected innocent clients as it continues to implement additional security controls to block further attempts and to protect bank credentials.

“We thank our clients for their patience and cooperation in protecting their online bank accounts. We assure our affected innocent clients that we will reimburse their losses,” the bank assured.

While the largest lender has put back-end measures in place, the bank reminded its clients to exercise continued vigilance to combat fraud.

“We are aware of a sophisticated fraud technique, which has affected some of our clients. Cybersecurity is a focal point of the banking sector. We at BDO are continuously investing and working towards improving our security infrastructure to protect our clients’ money,” BDO said.

BDO has required online banking users to update their passwords.

“Changing their password improves account security and prevents fraudsters from accessing their hard-earned money,” it said.

For his part, UnionBank president and chief executive officer Edwin Bautista said the bank acted swiftly and is now coordinating with BDO to help the victims of phishing and smishing.

“We are now collaborating with BDO to ensure the safety of the accounts of the banking public,” Bautista told The STAR.

Meanwhile, Philippine banks through the Bankers Association of the Philippines (BAP) urged the banking public to be even more vigilant in the light of the rising number of cybercrime incidents.

“It is not enough to just know how to avoid cybercriminals. You are our ally when it comes to stopping them from harming other people. Whenever you encounter a cybercriminal, immediately report it to your respective banks and the police. This is so we can work together to take down cybercriminals, such as the fake bank websites they are using to trick others,” BAP president Jose Arnulfo Veloso said.

According to the BAP, no one will ever be a victim of cybercrime if they never give their personal information, such as OTP, to other people.

“If you do not give your personal information to others, cybercriminals will never be able to steal your money. We continue to work to ensure your safe banking experience – an example of this is our Cybersafe campaign,” Veloso said.

Veloso, who is also president and CEO of Philippine National Bank, urged depositors to read the newspapers, follow their banks on Facebook, and watch their favorite social media influencers to know how to be safe while banking online.

“Taking down cybercriminals does not just benefit you, but also other people as these criminals will no longer be able to harm them,” Veloso said.

On the other hand, an industry source said UnionBank has already frozen some accounts allegedly involved in the unauthorized fund transfers from several BDO depositors.

The source added there is no account under the name of Mark Nagoyo as electronic fund transfers only require the correct account numbers and not the real name of account holders.