BSP: GCash downtime due to phishing, not hacking

MANILA, Philippines — The recent mess involving the unauthorized fund transfers that affected several GCash users was a phishing incident and not hacking, according to the Bangko Sentral ng Pilipinas.

BSP Governor Felipe Medalla yesterday told reporters on the sidelines of the 23rd Financial Stability Board-Regional Consultative Group in Asia Meeting in Mactan, Cebu that fraudsters were able to convince victims to reveal their one-time passwords (OTPs).

“Of course it is better if it did not happen at all. But our source of comfort is that it is not hacking. The scammers will use your own greed,” Medalla said.

Medalla said the sharing of OTPs has been repeatedly being discouraged by the BSP as well as banks.

“For some reason, they (scammers) were able to convince the person to give their OTP despite all the warnings to never share the OTP,” he said, adding that the last level of protection is the OTP.

“The only way that (access to one’s personal account) will happen is if there’s somebody talking to you on the other side (to share your OTP) that’s very convincing,” he added.

Medalla noted that a large part of the money was still lodged at the two bank accounts when GCash authorities caught the scammers.

Both Asia United Bank of the Rebisco Group and Gotianun-led East West Banking Corp. said they have frozen the accounts involved in the GCash incidents.

Medalla said GCash was able to return about 80 percent of the amount involved.

“Fortunately, GCash is fast; they traced the two bank accounts where most of the stolen money were lodged. In fact the two banks told me that they have restored the money to GCash,” he added.

He said the regulator is already looking into the legal liability of the owners of the bank accounts that received the unauthorized fund transfers.