How hackers got access to OTP for BDO accounts

An informant revealed how the account of some 700 bank customers were hacked last December, according to John Consulta’s “24 Oras” report on Friday.

Alex, the informant who provided information to the National Bureau of Immigration (NBI), said he created a text blast to deceive over 700 customers of BDO Unibank Inc.

“Doon po sa message link kung saan papasok ka po sa website na doon ka magla-login ng user at password at the same time meron na po kaming OTP (one-time password) nung depositor, kumbaga hindi na po papasok sa kanya yung OTP, kundi sa panel na po namin,” Alex said.

According to Alex, he was also involved in creating the “Mark Nagoyo” account where amounts were transferred from the hacked BDO accounts.

“Dumaan po sa akin yung ID ni Mark Nagoyo para gumawa po ng account at saka gumawa ng isang online pa ng crypto para doon po itatago yung mga pera,” he said.

(We created the Mark Nagoyo account and created another online crypto so that we can store the money there.)

“Alam po namin na mas maraming depositor yung sa month ng December kasi po magpa-Pasko at Bagong Taon. Mas marami pong depositor si BDO sa ibang bansa po like OFW (Overseas Filipino Workers),” he added.

(We knew that there would be more depositors during the month of December because of Christmas and New Year. BDO has more depositors from other countries like OFWs.)

Meanwhile, one of the downloaders of the money, who was also arrested, revealed that she was also the one talking to bank customers to get their OTP.

The NBI reminded the public to remain vigilant and secure their passwords to prevent hacking.

“Kasalukuyang ine-examine ang mga gadgets ng naarestong suspect para mas maintindihan natin ang detalye ng kanilang operasyon na magamit natin para mas mapalakas ang security ng ating financial institutions,” NBI Director Eric Distor said.

(We are examining the gadgets of the arrested suspects so we can get a better understanding of the details of their operation, which we can use to further strengthen the security of our financial institutions.)

The NBI arrested four persons involved in the reported fraudulent schemes targeting BDO customers.

GMA News is trying to get the side of the BDO but has not yet released a statement on the matter.—Richa Noriega/LDF, GMA News