Across the holidays, and until now, we saw a rise in even more stories of OTPs being requested out of nowhere, and scams happening through and across our banking system. It seems important to finally talk about my own story from early 2023, one that I feel is important to serve a public that is generally at the losing end of problems like this one which, by the way, is not necessarily the subscriber’s fault. Note too that I had the privilege to have legal assistance, and my lawyer had quickly sent word to the bank to contest their decision not give me back the money I lost.

That bank being Security Bank.

For a bit of context, I hold accounts across BDO, BPI, Metrobank, and Security Bank. This is not a measure of how much cash there is (haha), as it is a measure of how much interbank transfers cost (a whooping P25 pesos, at least), which is huge if you get, say, P900 peso cheques for your writing.

Now let me start by saying that across all these four banks, for the longest time, it was Security Bank that was my favorite. I thought it was the most secure bank across all the others I had. They call you to tell you when your ATM’s been cut because of questionable activity, and then tell you when the new card’s ready for pick-up. I had family who believed in Security Bank’s, uh, security, and I even got insurance with them because of it. It was for that reason that I also had most of my savings there, and have had it there for years. It’s also important to point out that when friends started to experience unauthorized transactions from other banks pre-pandemic, none of it was happening with Security Bank. So it was easy to believe that, well, it was secure.

Until it wasn’t. Early in 2023, when other banks already had multiple cases of OTPs being asked for by mobile numbers not connected with the banks themselves, I received a phone call that talked about my Security Bank account. The person knew all my details with the bank, including the last four digits of my account, the last time I did an online transaction, the last time I did a face-to-face bank transaction, even who I talked to in the bank to get my insurance. There was no reason to think this person was not from Security Bank. But here was the clincher: when the person asked for an OTP, it was not sent to my mobile number through an unknown or regular mobile number — which would have made me suspicious. Instead the OTP was sent through the number of Security Bank. The same one that sends me confirmation of my online transactions, the same number that sends OTPs.

This made me think that it was IN FACT, Security Bank. After all, they were using the same number where confirmation of my last online transaction appears. Here’s Security Bank’s standard mobile. Sometimes it’s small letters: securitybnk.

Here, an authorized transaction for March 1, using the same Security Bank number (it’s the one for Ifex Paper Exchange):

And then on March 16, the call from Security Bank, which turned out to be a scam. The scammers used exactly the same number as the one that was used by Security Bank to tell me about my successful transaction two weeks before. 

Note that while the message with the OTP warned against giving it to anyone from Security Bank, given all the private bank details that the caller knew, and the fact that it was appearing right under the SecurityBnk number, there was no reason to be suspicious.

This call with an OTP that passes through this same number would happen two times.

On March 27, I do another online transaction and the confirmation would appear under the same Security Bank number.

It was only on April 8 that I call Security Bank to report that I had lost (at that point) a chunk from my savings account across five transactions. I talked to customer service and was told right away that this was a phishing scam. I changed my passwords. I was told to wait 10 days as this case would be escalated. Once they find that I was not at fault, they would return my money.

Take note as well that while those phone calls happened in mid-March, the transactions happened in late March and early April. This means that scammers were in my account beyond that time period that they were having conversations with me.

I told customer service that the OTPs all appeared under their own number. Which means that THEIR SYSTEM was compromised. This was no standard mobile number, or unknown number. This was Security Bank’s own number, the same one that was credible to me because it is what they use to confirm my authorized transactions.

But of course over 10 days later, Security Bank got back to me to say that they had denied my request to get my money back, because it was my responsibility to make sure my account was secure. Basically, all responsibility falls on their account holders to secure their accounts, and absolutely none falls on the bank. Not even when it is the bank’s own SecurityBnk number that is used to send us OTPs, which at any other time would not be suspicious.

Now the fact that I had the privilege to have a lawyer get back to Security Bank on my case is already more than what a majority of Filipinos have. The fact that Security Bank decided to ignore my lawyer’s demand letter is telling of the state of banking in this country. They will refuse to take responsibility for anything at all, even when it is obvious that these scams are a by-product of their own failure to ensure the security of our data, the security of our accounts, and the security even of their own systems that send us our confirmation text messages and OTPs.  

Soon after this happened to me, GMA News came out with reports of how other Security Bank account holders lost huge amounts of cash from their accounts.

It’s never clear of course what happens to these cases. Is there anyone in government who even cares how the banking system can be the most unkind, most uncaring service there is? And it’s not as if this is about debt that is not paid that we should be penalized for. This is about people’s hard-earned cash getting into the hands of scammers, because the banks themselves have failed at securing our accounts for us. In fact, in this case, Security Bank itself seems to have had a breach, where even its own online banking system — how OTPs are sent, who has access to our accounts — was hacked by scammers, so that it could actually credibly represent the bank itself.

For a bank that’s named security, this bank is the least secure. ***