BDO denies online breach, points to client actions in fraud claim

Insider Spotlight

• BDO denies claims of insider role in unauthorized transactions
• Bank cites client’s admission that others accessed her device
• Investigation showed password reset and OTP-validated device change

BDO Unibank Inc. rejected allegations circulating on social media that its system was compromised and that insiders were involved in unauthorized fund transfers from the account of client Maria Jamila Cristiana Gonzales Berenguer.

The country’s largest lender issued a statement on Sept. 18, stressing that its system “remains secure, with no evidence of any breach or insider involvement.”

What BDO found

• BDO said its probe showed the client’s password was reset on Sept. 14, followed by the registration of a new device.
• The reset was validated through a one-time password (OTP) sent to the client’s registered mobile number.
• Alerts on the reset, device registration, and subsequent transactions were sent before the unauthorized activity was reported.
• On Sept. 15, six hours before the client called the hotline, transaction alerts had already been issued.

The client’s admission

The bank pointed to an ABS-CBN interview where the client acknowledged that her mobile phone had been in the possession of other people.

BDO emphasized that transaction security protocols rely on customer vigilance. “These controls will not work if clients ignore warning signs and messages sent by the bank through official channels,” it said.

How BDO Pay works

The lender clarified that transactions on its BDO Pay service require a PIN or biometric verification. OTPs are used only during device registration, not for executing transfers.

The bank also stressed that transfer limits had not been bypassed, contradicting online claims.

“Despite the bank’s repeated efforts to engage the client, she declined and continued to post several videos that are inaccurate,” BDO said.

Why it matters

The case highlights the growing risk of digital fraud tied to customer device handling rather than system flaws. For banks, such incidents can quickly erode trust if not addressed swiftly.

By issuing a firm denial and outlining its investigation, BDO sought to contain reputational risk while reminding customers of their role in safeguarding accounts.

The dispute underscores a wider challenge for lenders: even when systems hold, customer lapses can fuel online narratives that damage confidence in digital banking.

— Edited by Daxim L. Lucas