BDO denies breach, says password reset requested before withdrawal

MANILA, Philippines — BDO Unibank has dismissed allegations circulating that its system was compromised and that insiders were involved in unauthorized transactions.

In response to the content creator who alleged a data breach in the bank, BDO said no transfer limits were exceeded and that its security measures are still functioning properly.

“Recent social media posts by Maria Jamila Cristiana Gonzales Berenguer alleging a system compromise and insider involvement in alleged unauthorized transactions are baseless,” BDO said in a statement released Thursday.

“An investigation by the bank indicated a password reset on Sept. 14, followed by a device registration. Such reset and device registration was validated through a one-time password on the client’s registered device, a day before the reported unauthorized transactions,” the bank added.

BDO said Berenguer admitted her mobile device had been handled by others. It was also confirmed that her registered mobile number remained unchanged, and that her official device continues to receive all account communications.

The bank claimed that they attempted to initiate a conversation with Berenguer but they were turned down. Instead, the posting of videos, which the bank described as inaccurate, continued. BDO emphasized that its system remains secure, with no evidence of any breach or insider involvement.

“Log-in and registration alerts were sent to the client for these updates. Transaction alerts were also sent promptly on Sept. 15, six hours before the client reported the issue via the BDO Hotline,” it said.

Berenguer spoke out publicly after an online banking scam supposedly wiped out her savings worth P189,000, which she had reserved for her son’s upcoming surgery and business capital. She said a one-time password was not issued prior to the withdrawal of the money.

The story gained widespread attention when she shared a video on her official page on Monday. Berenguer believes her phone may have been compromised by a QR code phishing scam at a bazaar.