(UPDATE): Ellard Chua posted on his Facebook, saying that his name was used in one of the hacking incidents. In addition to that, Chua added that his account was compromised, losing over Php 50k in an unauthorized bank transfer to a Unionbank account allegedly belonging to Mark Nagoyo.

Multiple BDO customers have allegedly been targeted by a sophisticated online campaign to steal the contents of their accounts, with the perpetrators seemingly able to easily bypass security measures previously thought to be ironclad like 2FA. Searching “BDO HACK” on Facebook shows several viral posts of users who have allegedly lost several thousands of pesos in their savings account from the cyber thieves.

Facebook user Keith Andres detailed how the hack happened, citing that the unauthorized money transfer happened without receiving OTP notifications that usually precede fund transfers. This was the same predicament faced by Justine Leigh Sy, who also had their account drained without getting an OTP notification. What’s interesting in both Sy and Andres’ stories is that both of their bank accounts allegedly transferred money to a Unionbank account allegedly belonging to one Mark Nagoyo.

More and more people are losing money as of writing this article, with user Jem Mendoza also had their accounts drained by an unauthorized money transfer to a Unionbank account allegedly belonging to Ellard Chua. To further corroborate these claims, the sister of one of the writers for This is Hype was also affected, losing Php 50,000 in her BDO account due to an unauthorized bank transfer.

Crypto expert Luis Buenaventura theorizes that one of the reasons why the BDO hacking incident involved money transfers to a Unionbank account is that most peer-to-peer (P2P) traders in the Philippines use Unionbank to convert Peso to Bitcoin. As for the username Mark Nagoyo (and other variations), Buenaventura adds that Instapay does not disclose the actual name of the account that receives the money, so Mark Nagoyo is most likely a fake name. Buenaventura also pointed out that these unauthorized transactions usually happened during the weekend.

BDO, Unionbank, and Instapay have yet issued a statement on the hacking issue.