BSP sanctioned BDO and UnionBank after a December 2021 hack drained client accounts

In December 2021, hackers gained unauthorized access to BDO Unibank client accounts through a compromised web service and moved money mostly into UnionBank accounts. The National Bureau of Investigation said about 700 clients were affected; around P1.2 million was cashed out, and the total could have exceeded P50 million if the transfers had not been flagged.

In April 2022 the Bangko Sentral ng Pilipinas completed its investigation and the Monetary Board approved sanctions on both banks. The BSP did not disclose the penalties, but UnionBank's CEO said there were no monetary fines — instead the banks were asked to raise their capital charge for operational risk; BDO said it would comply, and the BSP credited BDO for reimbursing affected clients.

The incident exposed how both banks relied on post-transaction monitoring rather than stronger authentication and fraud controls. The 'Mark Nagoyo' persona used in the scheme became shorthand in the Philippines for identity-theft attacks on online banking.

About 700 BDO accounts hit; ~P1.2M cashed out with P50M+ at risk. BSP sanctioned both banks, BDO reimbursed clients, and the capital charge for operational risk rose.

The breach began at a compromised web service, meaning session and authentication controls failed before any fraud flag existed.

Transfers were funneled through UnionBank accounts, so the receiving bank's own risk checks did not catch the pattern either.

The banks leaned on reimbursement and regulatory sanctions instead of real-time controls that could have stopped a P50M-scale theft.

The BSP's response made clear that cyber incidents are supervisory failures, not just criminal cases for the NBI.

A bank can be sanctioned for the attacker's actions: the December 2021 breach was stopped only after fraud flags, and regulators punished both banks for weak controls.

BDO reimbursed affected clients and both banks promised to strengthen cybersecurity, anti-money-laundering and anti-terrorism controls. The sanctions carried no disclosed monetary fine, but the higher operational-risk capital charge became a direct financial cost to both lenders. The NBI and the Department of Justice pursued criminal charges against the individuals behind the transfers, and the episode fed a broader push for stronger e-banking authentication in the Philippines.