BDO Unibank, Inc. cautions against scammers who use SIM cards

BDO Unibank, Inc. cautions against scammers who use SIM cards to deceive and steal their victims’ money. One modus is called SIM Swapping, where scammers disguise as telco agents offering upgraded network connection in exchange for SIM cards.

More prevalent is the SIM Upgrade modus. Scammers purchase 4G SIM cards, register their victims’ mobile number, and fool their victims into giving the One-Time PIN (OTP) needed to own the mobile number.

In both modus operandi, scammers takeover their victims’ mobile number to control their victims’ online bank accounts.

BDO urges clients to call BDO Customer Care to deactivate their accounts if they get SMS notifications or emails about suspicious online transactions.

How SIM Swapping and SIM Upgrade work

Scammers identify then gather their victims’ personal information through phishing or from the internet. They mention personal information such as birth date and mother’s maiden name when they call their victims to sound convincing and credible. Once they win their victims’ trust, they are able to convince them to surrender their SIM card or OTP to activate a 4G SIM card.

For protection, BDO advises clients to be prudent in sharing personal information online and to keep their social media accounts in private mode.

With their victims’ personal information and mobile number, scammers can more easily outsmart banks’ multifactor authentication (MFA) and transfer money from their victims’ online bank accounts to their own. Common MFA consists of using a username and password to log in an online bank account, and receiving one-time PINs on a registered mobile number to confirm a transaction.

How to protect yourself

While scammers continue to take advantage of today’s challenging new normal to con people, there are ways to protect against their attacks. Bangko Sentral ng Pilipinas’ (BSP) share the following tips in a recent advisory:

·      Never give out personal information and SIM card details in response to unsolicited calls/texts from unknown individuals.

·      Always check SMS and email alerts for unusual transactions and/or activities involving your bank/e-money accounts.

·      In case you’ve already provided your SIM and other personal details, contact your bank/mobile phone provider immediately.

BDO encourages clients to report suspicious incidents to ReportPhish@bdo.com.ph, or get in touch with its representatives by logging in Messenger and looking for BDO Customer Care with the blue verified checkmark from Facebook. Clients may also call its hotline at 8631-8000.

BDO warns against fake social media sellers

BDO Unibank cautions clients who shop online against fake sellers. Some of these scammers, often pretending to be page administrators of online shops, bait victims with attractive deals. They lure interested buyers in social media and messaging app communities, and urge them into making a deposit immediately to seal the deal. After getting the payment, they become unreachable.

Other fake social media sellers post “PM is key,” which means buyers should send them a private message to know the product’s price and other details. BDO says that this tactic is a red flag and against the law. The Republic Act (RA) No. 7394 or the Consumer Act as well as RA No. 7581 require all sellers to display product prices explicitly. 

Non-compliance, according to the Department of Trade and Industry (DTI), can result in a fine from P5,000 to P2 million and may face maximum imprisonment of 15 years. Consumers may report vendors, online or otherwise, who violate this law to the DTI.

With the new normal driving more people to shop online, BDO reminds its clients to be wary of vendors they negotiate with on social media. While not all are scammers, some are—so it’s urgently crucial to stay vigilant and get to know them well before sending them money.

Spotting scammers

There are red flags to identify a fake social media seller:

1.         They offer branded products with prices that are unbelievably lower than their market prices. “All in na po ‘yan!” is a common assurance. As the saying goes: “If it sounds too good to be true, it probably is.”

2.         They build big expectations to entice and excite the buyer, but do not provide sufficient information about the product’s history and features. “Orig po ‘yan, galing sa US, good quality!” Oftentimes, they give inconsistent answers when buyer clarifies.

3.         They are vague and elusive. They provide little to no information about deliveries or return/refund policies. “Ipa-deliver po namin sa address inyo pag napadala nyo na ang print screen ng bayad” is a usual promise. They also do not have contact information on their profiles.

4.         They insist on immediate payments and outside the legitimate shopping website or platform, often via direct deposits to their accounts. “Last stock na po ‘to! Para po masiguradong makuha nyo po ‘to, ipadala nyo na po yung bayad sa bank account ko po imbes po sa shopping website.” They may even offer additional discounts to be more persuasive and rush the purchase.

5.         As an alternative payment method, they may ask for the buyer’s credit card numbers to make the transaction themselves. They may even ask for personal information, including birth dates, mother’s maiden name, and other unique details. 

Protecting personal information

BDO reminds clients to never allow anyone to make transactions on their behalf by providing their personal information. “Never give your personal information to anyone because this can be used to steal your identity and money from your bank account. Personal information includes your One-Time Pins (OTPs) which serves as another layer of protection when you bank online,” the bank said.

OTPs can be used once and only within a short span of time. They are unique six-character codes sent by the bank to complete a mobile number’s registration to BDO Online Banking, and confirm an online transaction.

#BDOAntiScam:BDO will NEVER send you links through text messaging or email and ask you to provide your personal information

Clicking on a link, no matter how harmless the link looks, is like opening your house’s front door to robbers. Once you click a link, you are letting scammers do all sorts of harm, not only to your computer, but to your life as well.

Scammers send links to gather your private data and using your identity, access your savings, credit card, or online shopping accounts to make transactions on your behalf.

Remember this: BDO will NEVER send you links through text messaging or email and ask you to provide your personal information or complete a transaction.

Don’t share your personal information with anybody, online and offline.

Personal data should always be private. Information like our names, birthdays, anniversaries, home and office addresses, passwords, ATM pins, One-Time Pins (OTPs), social security, bank or credit card numbers, and even data related to our education and schooling or our workplace—these and more can be used by hackers to break into our bank account.

With that level of potential harm, we should never carelessly share our personal information to a website, or send these to someone via text message, email, or chat.

Nowadays, scammers are able to create fake websites that pretend to be BDO’s, online shopping sites, or other legitimate institutions. Once we get tricked to log-in to these fake websites, they will be able to get more of our data and use it for illegal transactions.

So, never click on any links to websites if these are sent through email. Instead, check on the supposed sender of the email and type the web address of the bank, institution, or agency.

For example, if the sender is supposedly BDO, do an online search of the bank’s official website. BDO’s one and only website, www.bdo.com.ph, will provide you with the genuine and official email address.

But, let’s say you’ve already opened a website that looks genuine; just remember this rule of thumb: BDO will NEVER ask you to give your bank account numbers; credit card numbers as well as its expiry date and CVV; online banking login information, such as username and password; or even OTPs.

If you encounter a website that asks you to input such personal information, you can be sure that it’s fake. Don’t share your data.

We Filipinos believe that “sharing is caring.” But that doesn’t apply for usernames, passwords, OTPs, and other sensitive personal information. In this case, it’s best to keep such information only to yourself. And yes, even from your loved ones.

Eye on the ball

Remember, you are the first line of defense against scammers. If you do your part, we can reduce the cases of bank fraud and other illegal online transactions, and save each other from heartache, stress, and financial losses. If you have concerns regarding bank fraud and related matters, go to www.bdo.com.ph for more information.

6 Tips to be Smarter than a Scammer

For the banking public, the importance of online banking is more pronounced in today's social distancing-mandated reality. With all the convenience of banking from home, however, we need to be also aware of the lurking online adversary—scammers who lure their victims to fake websites, steal their bank information and then eventually their money. 

Here are six tips to outwit these scammers and avoid being a victim of their fake websites:

1.     Be wary of messages from a “concerned client”

There is a text message currently circulating that reads like this:

BEWARE

I just received a call from BDO. For those who are using BDO for online transactions, please DO NOT DO IT FROM YOUR PHONE or APP. Do it from your desktop or laptop. I am no techie but they said that there is a malware that is affecting such transactions. This is also the reason why BDO was inaccessible most of the time yesterday. Be careful pls.

This is fake and could be a ploy to drive away clients from using the bank’s mobile banking facility (especially from the BDO Mobile app) to a channel where scammers can better exploit their would-be victims and lure them to fake websites through the latter’s personal computer. Banks never call its clients to advise them on what to use or not to use. To be sure, check with the bank first for any official advisory and announcement, and refrain from sharing unverified news you have received via email or text.

2.     Never click on links

You could also receive an email that reads like this:

Dear valued client,

Greetings from BDO Online Banking.

Please be advised that we will deactivate the access of your account/s in BDO Online Banking if we don't hear any actions from you.

It's usually pretty easy to take care of things like this. Most of the time, we just need a little more information about your account or latest transactions. You can verify your account at https://online.bdo.com.ph/

These communication channels are available to you 24 hours a day, 7 days a week.

Thank you for banking online with us!

The BDO Online Banking Team

Important: Please save this message for future reference

This is fake. Banks will never send you an email asking you to log-in through an embedded link. If ever you received such an email, do not click on that link. It will lead you to a fake website where your personal information will be stolen.

3.     Never enter your login details

If ever you do click on that link, don't enter your login details such as username and password. If clicking on the link is essentially opening your door to scammers, logging in is akin to putting one foot through that door by sharing your personal banking information with them.

4.     Never share your OTP

Now is not the time to share. Your login details and One-Time PIN (OTP) are yours and yours alone. Once you logged in your username and password, you will receive an OTP from your bank as its final security measure. Do not share this OTP to anyone else, especially to the scammers through their fake websites. If you do, this is essentially putting both feet through that door. This is a bad, bad move.

5.     When in doubt, hover

All emails asking you to click on links are scam attacks—even if it includes the spelled out BDO website as a hyperlink. To double check, hover your cursor on the weblink without clicking on it. A preview will reveal that it leads to a different site and not www.bdo.com.ph.

6.     When in doubt, ask

If you are unsure of what to do, you can visit BDO Unibank on Facebook for official advisories and reminders. If you suspect that you have been scammed, you can get in touch with BDO by logging in Messenger and looking for BDO Customer Care with the blue verified checkmark from Facebook.

BDO reiterates fight against account verification scam

Scammers are stepping into high gear with their attacks as the country continues to observe the enhanced community quarantine. A prevalent scam has them posing as a bank personnel and urging clients to verify their bank accounts by clicking on a link. This link then opens a website that looks exactly like a bank’s official website. On this fake website, they trick clients into divulging their personal information.

Personal information includes account numbers, credit card information, online banking login details like usernames and passwords, and One-Time PINs (OTP). It enables scammers to use clients’ identities, access their online bank accounts, and steal their money.

BDO Unibank reiterates that it will never ask their clients to verify their bank accounts. Legitimate bank officers, it says, will never reach out via SMS, call, email, or social media to ask for personal information for account validation.

Banking from home

The Bangko Sentral ng Pilipinas (BSP), alongside the various banks, have been encouraging clients to bank online over visiting their branches particularly at this time when the entire country is moving to flatten the COVID-19 curve. 

Online banking, the BSP adds, promotes social distancing and helps accountholders avoid face-to-face interactions. Above all, staying at home allows them to protect themselves and their loved ones from the virus.

BDO, for its part, continues to encourage its clients to bank from home and enroll to BDO Online Banking. To guide clients who may be banking online for the first time, the bank promotes how-to videos on its YouTube page and has helpful posts on its Facebook page and official website.

Staying vigilant against scammers

Scammers however are taking advantage of the lockdown situation and the added online banking usage. Upping their ante, their attacks now are more sophisticated than ever—their grammar is correct; their communication style is convincingly professional; their fake websites look exactly like their legitimate counterparts. As a result, many, especially first-time users of online banking, are getting victimized and losing their money.

The Bankers Association of the Philippines (BAP) already called on accountholders to be more vigilant: “There have been emails going around informing clients of account deactivation and asking clients to click on a link to prevent deactivation due to COVID-19. We would like to advise against doing so since it will compromise your account security… Banks will never request for your sensitive information.”

Meanwhile, through its #BDOAntiScam campaign, BDO empowers its clients with information that teaches them how to be smarter than scammers. It exposes scam attacks, reminds about the things legitimate bank officers will never do or ask for, and shares defenses such as never sharing personal information and never clicking on links to verify their bank accounts.

Clients who have been scammed, or even just suspect of being scammed, can get in touch with BDO by emailing customercare@bdo.com.ph. They can also log in Messenger, look for BDO Customer Care with the blue verified checkmark from Facebook, and chat with a bank representative.