BDO ATMs compromised, officials warn

MANILA, Philippines - Some of the automated teller machines (ATMs) of BDO Unibank Inc. may have been compromised, resulting in losses to depositors and prompting an investigation by the Bangko Sentral ng Pilipinas (BSP).

The country’s largest lender is the second bank hit by technical glitches in a span of days.

Last week, a “computer glitch” almost paralyzed the operations of Ayala-led Bank of the Philippine Islands (BPI).

“Need to check it first,” incoming BSP governor Nestor Espenilla Jr. said in a text message.

The bank owned by retail and banking magnate Henry Sy said it has obtained reports of potentially compromised ATMs following reported losses from cardholders.

“Customers with unauthorized transactions could reach out to the bank via formal channels so that their cases may be properly investigated and, where confirmed as impacted, may be reimbursed,” it said in a statement.

BDO president and CEO Nestor Tan downplayed the issue and reassured clients that the bank exerts all efforts to protect cardholders and their transactions.

Tan said they are addressing the issue by shifting to the Europay Mastercard Visa (EMV) technology.

“This is nothing out of the ordinary. ATMs are compromised every now and then, and banks take the precautionary measure of disabling cards if we have reason to believe they may have been compromised. Issues on this will be addressed with EMV implementation,” he added.

The BSP has given banks one more year to fully comply with the mandatory shift to the EMV technology.

“This is a security protocol, moving cards from magnetic stripes to chips, which will make them secure. It is just a matter of time until the industry completes the implementation,” Tan said.

As early as June 11, a certain JUrbano with Twitter handle @deputycorps tweeted, “My ATM account in BDO was hacked. Lost numerous amounts in just 24 hrs. Check your BDO ATM Account guys!”

He reported last Thursday BDO reimbursed the amount that he lost in his account.

“Thank you to BDO for the quick response with this incident,” he tweeted.

The BSP is investigating BPI after an internal data processing error forced the bank to deactivate all its electronic channels, including its ATM network, as well as online and mobile banking last June 7 and 8. The error resulted in incorrect balances in the deposit accounts.

“BPI and BDO have attractive promos but they must improve their ATM and IT systems first instead of promos,” Noel Dolor tweeted.

The BSP has directed all banks to complete all EMV-related activities, including upgrading of back-end processes and systems and ATM and point of sales (POS) terminals, as well as replacement of magnetic stripe credit and debit or prepaid cards, including distribution of EMV-compliant cards by June 30 next year.

The regulator also required banks to book provisions from probable losses starting Sept. 30 until full compliance is achieved.

EMV is a global security standard for payment transactions that is more secure than a magnetic  stripe card where stored information is static and can be copied or cloned with relative ease.

Probe begins

At the Senate, the committee on banks and financial institutions has set for June 21 an inquiry into the reported glitch and security breach in some of the country’s top banks.

Sen. Francis Escudero, chairman of the committee, told reporters the probe is meant to “apprise the public of what is going on and to placate speculations on this issue that may negatively impinge upon or affect the banking sector as a whole.”

Officials of BPI, BDO, and BSP have been invited to the hearing.

The inquiry was prompted by a resolution filed earlier this week by Senate President Aquilino Pimentel III seeking an investigation into the reported “glitch” that hit the computer system of the BPI.

With the latest BDO incident, Pimentel said banking security and integrity issues have become urgent “to examine and be transparent about.”

“There is something going on in the banking sector which is not good,” he said.

He said other recent developments, including the reported arrest of foreigners tampering with local ATMs, “should be sufficient impulse and justification for us to hear and investigate this matter.”

Escudero earlier said the panel will tread carefully in its inquiry and take into consideration results of the internal investigation of BPI and the BSP.

“Without sacrificing truth and transparency, we should also be careful about the possible effects an investigation may have on the banking industry as a whole, especially given the fact that BPI is the third largest bank in the country,” he said. –  With Jess Diaz, Paolo Romero, Rainier Allan Ronda