Mark Nagoyo' Hacked BDO While Clients Were Sleeping, You Shouldn't Be Next
Hacker News
Dona Amisola Beriña withdrew all that was left in her BDO savings account after she lost P100,000 to one Mark Nagoyo in a hacking incident that showed how even the Philippines' largest bank is vulnerable to fraud.
Now, Beriña hopes the Sy-led bank would return her money, which she needs to keep her online selling business going and to pay for therapy of a child with autism and another with depression.
Beriña could not understand how her account was used to "donate" money to Mark Nagoyo when she availed of full protection via OTP or one-time password. One of her friends alerted their chat group to the hacking on Dec. 9. The theft happened sometime between 2 p.m. when she last checked her account to past midnight the following day.
"Paggising ko ng Friday, nakita ko 'yung shared post ng friend ko galing din sa isang victim. So nag-check ako ulit, nagulat ako na nabawasan na ko ng P100,000," she told reportr.
When Beriña checked her text inbox, she found two text messages from BDOALERT. The first transaction happened at 11:45 p.m. Thursday and another one at 12:12 a.m. Friday. It was a sent as "donation" to a certain "Mark Nagoyo D", to a Unionbank account.
Beriña said she didn't receive any request to "add device" or one-time password (OTP), security features used to ward off fraudsters. She didn't click any phishing link too, "maingat ako sa ganyan," she said.
To avoid another incident, she withdrew all her savings and transferred it to a different bank. "Sana lang maibigay agad ang pera namin, kasi online selling lang po kinabubuhay namin. May mga anak akong nag-therapy for autism at anak na nagkaron ng depression. Recently diagnosed din ako with anxiety disorder," she said.
What happened at BDO?
By the weekend social media was buzzing with complaints from BDO clients, who claimed thousands of pesos from their accounts were transfered to a Unionbank account under the name Mark Nagoyo. Nagoyo in street slang means one had been duped.
On Facebook, netizens who claim they were hacked formed a group "MARK NAGOYO BDO HACKED" with more than 5,300 members as of Tuesday morning.
A "surge" in complaints started since the week of Dec. 6, said Bangko Sentral ng Pilipinas Governor Benjamin Diokno, assuring BDO clients that they would be reimbursed for their losses.
READ: Who Gets Reimbursed After BDO Hacking? Central Bank Explains
"An important reminder: you will never be a victim of cybercrime if you would never give your personal information, such as one-time password, to other people. If you do not give your personal information to others, cybercriminals will never be able to steal your money," the Bankers Association of the Philippines said in a statement.
Clothing importer Nica Cifra-Vega, who lost P50,000 while she was sleeping, told reportr she did not open any e-mail, click on any link, nor received "add device" or "change password" prompts before the incident.