Crypto has made hacking online banks more rewarding

Crypto has been around for a little more than a decade but it was only in recent years that we’ve seen its massive adoption in so many markets. In the Philippines, one of the first pieces of news about Bitcoin was way back in January 2014.

We’ve seen it being used for micro-payments, peer-to-peer transactions, e-commerce, payment of salaries, money remittances, and many other uses. In the United States, you can even buy a car using Bitcoin. So, it is safe to say that this technology is already integrated into many financial systems.

Cryptocurrency is a form of currency that exists digitally or virtually and uses cryptography to secure transactions. Cryptocurrencies do not have a central issuing or regulating authority. Instead, it uses a decentralized system to record transactions and issue new units.

Many would agree that crypto is both exciting and disruptive. At the same time, it has opened up a lot of new opportunities especially in the start-up ecosystem. While it initially posed a digital threat to both the banking system and government regulators, these sectors have found a way to work alongside it.

While the decentralized nature and anonymity of crypto are among its biggest strengths, it has also opened up opportunities for online fraud.

Take for example the recent BDO hacking incident that happened last December 2021. It was perhaps one of the biggest incidents or widely publicized hacking incidents in the Philippine financial system (the closest we could think of was the involvement of RCBC in February 2016 where hackers stole $81PHP 4,754INR 6,865EUR 77CNY 590 million from the Bangladesh central bank’s account with the US Federal Reserve in New York).

In essence, the strategy in this particular incident was like this — identify hackable online bank accounts (in this case, BDO), transfer funds to an intermediary bank where you can siphon money to a fictitious or dummy bank account (in this case, UnionBank) and then use the collected funds to buy crypto-currency (in this case, Bitcoin). Since the crypto account is anonymous, the true owner can no longer be traced nor the funds be retrieved. It’s a dead-end from thereon.

If crypto was not involved, the culprits would have to do any one of these final steps in order to securely get hold of the funds — make a physical bank withdrawal (over the counter or via an ATM) but that would expose their identity, transfer the funds to an e-wallet like GCash or Paymaya (slightly less exposure, but still traceable by Globe or Smart and funds can still be withheld) and withdraw at a physical outlet, or use the money to purchase goods and delivered to a safehouse (normally the MO of credit card fraudsters). In all these scenarios, the culprits have a certain level of identity exposure and the transferrable amount is also quite limited or will need multiple days to withdraw.

The beauty of crypto as the final receiving channel is that it’s completely secured, anonymous, and off-grid (no governing body can regulate it or withhold/freeze the funds) regardless of the amount stolen.

Thus, we go back to our original premise that this strategy/avenue is “more rewarding“. That’s the assurance. Think Money Heist (El Casa de Papel), only it’s a digital heist.

In the end, this incident has both damaged the reputation of the Philippine banks (especially BDO) and could also force stricter regulations with regard to crypto-currencies.