Inside job?

Senior citizen loses

P159,000 via unauthorized online
transfer
David Dizon, ABS-CBNnews.com
Posted at Sep 19 2015 12:24 AM | Updated as of Sep 19 2015 11:31 AM
Consultant Carlos Malibiran gestures as he answers questions during an interview at the ABS-CBN headquarters on Friday. The NBI has warned banks against syndicates who are victimizing depositors in
massive fraud and phishing scams. Photo by Jonathan Cellona for ABS-CBNnews.com

MANILA - A senior citizen lost P159,000 in savings from a local bank via unauthorized online
fund transfer despite never using his account to transfer funds.
In an interview, businessman Carlos D. Malibiran said Akinto Marketing Corporation opened a
payroll account in his name at Union Bank Aurora-Balete Drive branch in July 2013.
Malibiran, 72, said he worked as a consultant for Akinto, earning P30,000 a month as
consultancy fee, which was deposited regularly to his account.
He said he used the original PIN supplied by the bank to check on his balance online via the
Union Bank website but never made a withdrawal, saying he usually withdrew his money over
the counter.
During the second quarter of 2014, the Union Bank website rejected the PIN code that Malibiran
used to check on his account.
Malibiran said he asked his secretary to call the branch manager, identified as Christian
Dumlao, who said that the Union Bank website usually asked for additional information online as
an added security measure.

"Ganyan talaga po for your additional protection," he recalled the manager as saying.
Malibiran then continued to use his account for one to two months.
He last made a P20,000 over-the-counter withdrawal from his account at Union Bank on June 5,
2014 and then decided he wanted to let the money accumulate for a while so that he would
have cash before Christmas.
Without his knowledge, the monthly consultancy fees that were being deposited to his account
twice a month were being withdrawn via online fund transfer.
As a result, a total of P159,000 were withdrawn from his account without his knowledge from
July to October 2014.
"When I asked my secretary to call the manager about the balance, the manager said: 'Bakit,
may ine-expect ba kayo na papasok na pera?' Sabi niya wala kasi ine-expect namin may
P159,000 na diyan. Ang sabi ng manager: 'Hindi ho, mam. 53 pesos na lang," Malibiran said.
A check on his transaction records showed that the online withdrawals were being done every
start of the month on July and August 2014.
The withdrawals then increased in frequency and were being done on the same day that funds
were being deposited to the account.

Consultant Carlos Malibiran gestures as he answers questions during an interview at the ABS-CBN headquarters on Friday. The NBI has warned banks against syndicates who are victimizing depositors in
massive fraud and phishing scams. Photo by Jonathan Cellona for ABS-CBNnews.com

TRANSACTIONS
JULY 1, 2014 - P39,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
JULY 14, 2014 - P15,000 - PAYROLL CREDIT
JULY 28, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 1, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
AUGUST 13, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 28, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 28, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
SEPTEMBER 12, 2014 - P15,000 - PAYROLL CREDIT
SEPTEMBER 29, 2014 - P15,000 - PAYROLL CREDIT
SEPTEMBER 29, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
OCTOBER 13, 2014 - P15,000 - PAYROLL CREDIT
OCTOBER 14, 2014 - P15,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
OCTOBER 28, 2014 - P15,000 - PAYROLL CREDIT
OCTOBER 28, 2014 - P15,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
"Hindi ito authorized. I have never authorized anybody to withdraw from my account," Malibiran
said.
Malibiran's secretary and Akinto's accounts manager also went to the bank to complain but
were told that the funds were transferred to different depositors.
When they asked for the names of these accounts, the manager refused because the bank
secrecy law disallows the release of information about depositors.
The manager also promised to forward the matter to Union Bank's anti-fraud department, which
investigated the case.
On November 2014, Malibiran also sent a demand letter through his lawyers, asking for a
reimbursement of his missing funds. A copy of the letter was also sent to the Bangko Sentral ng
Pilipinas.
PHISHING?
On January 12, 2015, the business manager of Union Bank Aurora-Balete Drive branch sent a
letter to Malibiran saying that his account's credentials were compromised, which allowed the
unauthorized fund transfers.
"You have stated that the withdrawals were unauthorized, and it is rather unfortunate that your
account's credentials were at some point compromised and made known to a third party who
then used the information to perpetrate the withdrawals," the letter read.
"Typically, the information is gathered through a phishing email which pretends to be from a
legitimate source and asking to verify the account holder's personal information for some made-
up reasons. They would then direct the client to a counterfeit website and ask to input account
credentials."
Malibiran's personal secretary Pamela Darunday, however, refuted the bank's explanation. She
said she only used the Union Bank's website to check the balance of the account.
She also said they have never received any e-mail from the bank, asking for information on
Malibiran or directing them to click on a link.
"All the withdrawals before July 2014 were done over-the-counter and never online," she said.
Akinto's accounting manager Roderick Ramos also told ABS-CBN News that they removed 41
payroll accounts from Union Bank Aurora-Balete Drive branch after discovering the theft. The
payroll accounts are now with a different bank, he said.
Malibiran said he is disappointed that Union Bank cannot protect their depositors even while
promoting their online banking system.
"They should have safety nets and explain it to their depositors. In all previous online inquiries,
they were okay. Tapos nung bandang huli, ayaw nang tanggapin. Website nila yun," he said.
He said he is also surprised that the funds were being withdrawn on the same day that the
money was credited to his account.
"The bank knows to whom the money went and yet they have not exerted any effort to inquire to
that depositor 'bakit ka nagkaroon ng ganito? Saan ba nanggaling yan? Malabnaw ang safety
net. Dapat extra effort from the bank despite the secrecy. Pakiramdam ko inside job from the
bank."
He also said he plans to make an appeal to the Bangko Sentral to make a ruling on the matter
in the interest of depositors.
OTHER BANK DEPOSITORS LOSE MONEY
Malibiran's case of missing money is not the first to be reported.
A TV Patrol report earlier described the case of Union Bank depositor Marlene Atienza who also
lost P115,000 from her account a day after she checked her balance.
Atienza said the funds were also transferred to another account via online bank transfer.
"Nagulat ako P400 na lang laman ng account," she said. "Pinakita ko sa branch manager at
agad naman na-trace nila."
Another depositor, Bernadeth Ong, lost P20,000 from her account, which was withdrawn from
Ortigas. Ong, however, lives in Davao City and has never been to Ortigas.
"Ang sabi nila baka na-skimming," she said.
Frane Ong, Union Bank depositor from Cagayan de Oro, said he also lost P90,000 from his
account right after checking his balance on the Union Bank website.
"Nagtaka ako, akala ko nung una error lang. Baka sa system. Lumampas 150 days wala pa ring
nangyayari," he said.
EXCL: Ilang depositor, nawalan ng pera sa online banking, ATM
ABS-CBN News also learned about one bank depositor whose account showed funds being
deposited and withdrawn on the same day, without his knowledge.
Union Bank Executive Vice President Genaro Lapez earlier said Union Bank, just like other
banks, has issued and continues to issue advisories to the public, warning them against these
scams.
"These can be seen in our website, in our posters, in our ATMs and in various media in order to
promote awareness to our clients," he said in a statement.
However, he also pointed out that in cases of phishing "where the client unknowingly volunteers
his/her personal information to scammers, the bank does not reimburse the cash lost by the
client."
BSP Assistant Governor Johnny Noe Ravalo said depositors who are victimized by phishing
scams should file a complaint with the Bangko Sentral so that the BSP can act on the matter.
He said the BSP is also looking into how banks protect their clients against all kinds of fraud.
"We can go to banks and rate them from 1 to 4. 3 and 4 will be passing. 1 and 2 means the
bank has big problems," he said.
Guide Questions

1. Phishing scam, otherwise known as email scam, happens when someone sends you a
suspicious email then links you to a fraudulent website. This website will then steal
sensitive information from you such as passwords, credit card numbers, account data,
addresses, and more.

However, you can only become a victim of phishing if youve responded to the
suspicious emails you received.

2. Akinto Marketing Corporation opened a payroll account on his name at Union Bank
Aurora-Balete Drive branch last July 2013.
He deposited P30000 regularly to his account.
He used the PIN only to check his balance online but said that never used the online
system for withdrawing.
During the second half of 2014, his PIN was rejected.
His last transaction was on June 5th 2014 and decided to let the money accumulate prior
to Christmas time.
Little did he know that all the time he was depositing twice a month were being
withdrawn almost at the same time via online.
He lost a total of P159000 between July-August 2014.
It is said that the withdrawal is being done on the start of the month.

TRANSACTIONS
JULY 1, 2014 - P39,000 - WITHDRAWAL VIA ONLINE FUND TRANSFER
JULY 14, 2014 - P15,000 - PAYROLL CREDIT
JULY 28, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 1, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND
TRANSFER
AUGUST 13, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 28, 2014 - P15,000 - PAYROLL CREDIT
AUGUST 28, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND
TRANSFER
SEPTEMBER 12, 2014 - P15,000 - PAYROLL CREDIT
SEPTEMBER 29, 2014 - P15,000 - PAYROLL CREDIT
SEPTEMBER 29, 2014 - P30,000 - WITHDRAWAL VIA ONLINE FUND
TRANSFER
OCTOBER 13, 2014 - P15,000 - PAYROLL CREDIT
OCTOBER 14, 2014 - P15,000 - WITHDRAWAL VIA ONLINE FUND
TRANSFER
OCTOBER 28, 2014 - P15,000 - PAYROLL CREDIT
OCTOBER 28, 2014 - P15,000 - WITHDRAWAL VIA ONLINE FUND
TRANSFER

3. Online banking in local banks are not 100% safe since scammers can access the bank easily.
Online bank can only be verified in highly secured banks such as the major banks. There should
be terms and conditions before agreeing to let the bank go online. To avoid phishing, someone
has to:

Change Passwords

If youve clicked the wrong link or provided personal information in response to a phishing
scam, change your passwords immediately. This goes for email and all accounts, including bank
accounts and PIN numbers. Create strong, complicated, new passwords that feature a
confusing slew of numbers and symbols. Such passwords are much, much harder for
cybercriminals to break.

Notify Credit Agencies

Contact one of the three (link is external) major(link is external) credit(link is external) bureaus
as soon as possible and let them know your account was potentially compromised. Place a
fraud alert on your account until the issue has been resolved.

Contact Credit Card Companies

Alert credit card companies and explain the situation. Your credit cards might not have been
used yet, but if you feel unauthorized charges are in your future, its essential to freeze or
cancel your cards. Let your bank know what happened so they can further protect your credit
line.

Update Your Software

Update your software to the newest version and run a comprehensive virus scan if you think
youve infected your system with a virus or other malware. Additionally, you should
use encryption, ensure you have a firewall enabled, and regularly back up personal information
on an external hard drive. Avoid using public Wi-Fi networks whenever possible, and if you
must use a public connection, select the most secure option, such as a Virtual Private Network
(VPN). Also, make certain to turn your computer off when not in use, as its inaccessible to
hackers when powered down.

Check Accounts Regularly

Review your bank and credit card accounts regularly to be sure no suspicious activity is taking
place. You may also opt to leave the fraud alert on your credit report for a while until youre
absolutely certain youre out of the proverbial hot water.

Reporting Resources

Numerous resources are available for reporting an email scam, including the National Fraud
Information Center(link is external). This company reports fraudulent activity to the federal
government and maintains detailed records of fraud incidents. They also provide links
concerning whom you can contact within your state for assistance.