BDO: Client's device, not our system, was compromised
Published Sep 19, 2025 06:25 am
BDO Unibank has shifted the focus of a recent account security dispute, arguing that a client’s viral claims of a system hack are baseless and that the unauthorized transactions stemmed from a lapse in her own device’s security.
In a statement on Thursday, Sept. 18, BDO said its internal investigation found that the account of Maria Jamila Cristiana Gonzales Berenguer was not compromised.
The bank revealed that a password was reset and a new device was registered to Berenguer's account on Sept. 14, 2025, with both actions validated by an OTP sent to the client’s registered mobile device. The reported transactions took place the next day.
BDO noted that in a television interview, Berenguer admitted her mobile device had been in the hands of other people at some point.
The bank also noted that the registered mobile number on the account was not changed and continued to receive official communications, including log-in and transaction alerts.
BDO said the transaction alert for the unauthorized transfers arrived six hours before she reported the issue.
The bank clarified that its BDO Pay app requires a PIN or biometrics for transactions, while an OTP is used only for device registration—a distinction BDO said was critical to the case.
BDO stated that it made “repeated efforts to engage the client,” but she “declined and continued to post several videos that are inaccurate.” The bank stressed that its security controls and transfer limits remain secure and were not bypassed.
“These controls will not work if clients ignore warning signs and messages sent by the bank through official channels,” the statement read, reiterating that BDO’s system is secure with no evidence of a breach or insider involvement.