BDO denies breach claims, affirms system remains secure

BDO Unibank, Inc. has refuted recent claims by client Maria Jamila Cristiana Gonzales Berenguer alleging a system compromise and insider involvement in unauthorized transactions, calling them baseless.

In a televised interview with ABS-CBN, Berenguer admitted that her mobile device was at one point accessed by other individuals.

In a statement, BDO said its investigation confirmed a password reset and device registration on September 14, both authenticated through a one-time password (OTP) sent to the client’s registered device.

No change was made to the client’s mobile number, and the same device continued to receive all official communications from the bank.

BDO stated that it sent log-in, registration, and transaction alerts to the client in real time, including notifications on September 15—six hours before the client contacted the BDO Hotline.

The bank clarified that BDO Pay transactions require either a personal identification number (PIN) or biometrics, not an OTP, which is used solely for device registration.

Despite several attempts by BDO to engage with the client, she declined to cooperate and continued posting videos online that the bank described as inaccurate.

“We reiterate that transfer limits were not bypassed, and our security controls remain in place,” the bank said in an official statement.

BDO emphasized that its systems are equipped with multiple features to protect client accounts, but these are only effective if users heed security warnings and messages sent via official channels.

The bank confirmed that no breach occurred and found no evidence of insider involvement.

As the country’s largest bank by total assets, loans, deposits, and trust funds as of March 31, 2025, BDO said it remains committed to digital banking safety and client education.

BDO is regulated by the Bangko Sentral ng Pilipinas and continues to offer both local and international financial services through over 1,800 branches and more than 5,800 ATMs.