GCash says 'product issue' caused unauthorized withdrawals
GCash said a "product issue" prompted errors in the e-wallet platform's "system reconciliation process" on the heels of several users reporting unauthorized withdrawals from their accounts.
ABS-CBN News reported that Gilda Maquilan, GCash vice president for corporate communications and public affairs, said the issue all started on Nov. 8 at 11 p.m. when they noticed a spike in the use of their "Send Ang Pao" feature.
The feature allows users to easily send money to up to 10 recipients in one transaction.
"Pag nagsend ka po ng Ang Pao na pangregalo, ito po ay papasok sa tinatawag na temporary wallet," Maquilan said. "Pagka ito ay na-receive lang po o nagpasalamat 'yung recipient, 'yung nakatanggap ng aginaldo, saka lang po ito malalapit sa wallet niya."
Maquilan flagged the increase in the feature's usage even if it's not yet Christmas or Chinese New Year, prompting the company to investigate.
"Nakita namin 'yung wallet ay bloated. Ibig sabihin noon, unusual ito," she said, adding that the incoming money doesn't match the outgoing money in accounts.
During the wee hours of Nov. 9, Maquilan said they received calls from users who said there were Ang Pao transactions in their accounts even if they didn't send any money.
"Naiconnect namin. At dahil dito, sinwitch-off kaagad namin 'yung product feature," she said.
With that, Maquilan said they ruled out phishing, data breaches, and account takeovers.
"Ito po ay isang product issue," she said. "Ito po 'yung meron pong pagkakamali doon sa produkto."
Whether it's human error, Maquilan said it's a "technical issue" that is subject to further validation.
She said the company returned the money of affected users within 24 hours.
Maquilan noted that they immediately reported the incident to the platform's regulator, the Bangko Sentral ng Pilipinas (BSP). They also gave updates to the Department of Information and Communications Technology and Cybercrime Investigation and Coordinating Center.
During the height of the issue, users received text messages from GCash urging them to change their MPIN and assuring them of a refund within 24 hours due to detected unusual activity.
Affected users included actress Pokwang, who, in a Facebook post, said around 30 unregistered cellphone numbers stole P85,000 from her account.
Eric John Salut, publicity head of production company Dreamscape Entertainment, told Pokwang in the comments section that he, too, was affected and lost P45,000.
During the incident, GCash assured its users that their money was safe as the problem was "isolated to a few users."
The BSP instructed GCash to "swiftly complete the process of refunds" amid the issue.