BDO Unibank, Inc. said on Thursday that a viral social media post alleging there was system compromise and insider involvement in unauthorized transactions is baseless,
“BDO has put in place different features intended to protect clients’ accounts. These controls will not work if clients ignore warning signs and messages sent by the bank through official channels,” the Sy-led bank said in a statement.
On Sept. 15, a content creator Maria Jamila Cristiana Gonzales Berenguer, known as Jana Berenguer, claimed that three of her bank accounts were allegedly hacked after she saw a significant decrease in her balance.
Ms. Berenguer said that she did not receive a one-time password (OTP) for the transaction that happened around noon.
“The maximum amount for an online transaction is P50,000 to P100,000 per day, but they were able to withdraw almost P200,000,” she added in Filipino.
In her initial call with the bank, the client said that the case was dismissed as a hacking incident because she used her account’s QR Code for her business.
In a statement, BDO said it repeatedly tried to engage with Ms. Berenguer but was declined.
Through its own investigation, the bank said that a password reset was recorded on the client’s account on September 14, followed by a device registration.
A day before the reported incident, the reset and device registration were validated through an OTP on the registered device.
“There was no change in the mobile number used to receive the OTP. The client’s official device remains to be the device that receives official client communication,” BDO said.
It added that log-in and registration alerts were also sent to the client, along with transaction alerts sent six hours before the incident was reported via the BDO hotline.
The bank also noted that the client admitted in another media interview that her mobile device was “in the hands of other people at some point in time.”
“The Bank reiterates that transfer limits were not bypassed, and our security controls remain in place,” it said. “BDO’s system remains secure, with no evidence of any breach or insider involvement.” — Almira Louise S. Martinez