OWNERS of the recipient accounts of illicit fund transfers involving two lenders over the weekend have already been identified, according to a central bank official.

Individuals claiming to be BDO Unibank, Inc. account holders posted on social media proof that their funds were supposedly transferred to a certain Mark Nagoyo’s accounts with UnionBank of the Philippines, Inc.

“The real persons behind the Mark Nagoyo have already been identified so I think the other institutions, UnionBank, will definitely file charges if these persons allowed their accounts to be used for fraudulent activities,” Melchor T. Plabasan, Technology Risk and Innovation supervision director at the Bangko Sentral ng Pilipinas (BSP), said in an interview with The Chiefs at One News.

Mr. Plabasan said two or more UnionBank accounts received the unauthorized fund transfers from BDO clients.

“I think they are not bank employees and they just opened their account recently. Some of them opened their account last October,” Mr. Plabasan said.

He said the central bank is checking whether there were gaps in the concerned banks’ security measures.

“It’s still premature to say it right now, but if we find out that there is non-compliance to our expectations when it comes to managing cybersecurity and anti-money laundering case, then we can always resort to imposing sanctions or penalties,” Mr. Plabasan said.

BDO on Tuesday said it is already processing the reimbursement claims of about 700 clients that were affected by the fraud incident over the weekend.

UnionBank Chief Technology and Operations Officer Henry Rhoel R. Aguda also confirmed they have already identified the owners of the accounts involved in the incident. 

“We’ve already identified persons of interest and we have already filed the necessary information with the PNP (Philippine National Police) and the NBI (National Bureau of Investigation), as well as to the BSP,” Mr. Aguda said at an online briefing on Thursday.

“It’s just a handful. If my information is correct, there’s about six individuals right now,” he added.

Mr. Aguda earlier said they have already frozen P5 million in the accounts involved in the incident.

Amid the rise in fraudulent online transactions, Mr. Aguda urged the public to report money mule activities as these are criminal offenses.

“If you know anyone selling bank accounts, buying bank accounts, or trying to open bank accounts and fraudulent bank accounts, please do report that to us as well and we will coordinate with the necessary authorities,” Mr. Aguda said.

He said an update to the InstaPay by next year will require identity verification from the part of the receiver as well, which will make fund transfers more secure.

Cybersecurity firm Kaspersky said the incident is a proof that financial institutions remain of interest to cybercriminals whose main goal is to steal money.

“Groups that prey on the financial sector find vulnerabilities within the IT infrastructure of their target organizations to carry out their attacks,” Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky, said in a statement.

“From our experience investigating cyber incidents, we know that there are cyber gangs that are professionals and can really resist detection,” he added.

An earlier study by Kaspersky showed the Philippines had the highest number of users in the Asia-Pacific attacked by banking Trojans, a type of malicious software. — L.W.T. Noble

RELATED ARTICLESMORE FROM AUTHOR