GCash: Full Explanation of Massive Phishing Incident

GCash has finally made a full explanation about the recent unauthorized transactions that happened last ay 8, 2023.

This explanation is very similar to the theory we provided earlier this week (How that GCash Hack Attempt could have been Made 43) sans the DeathNote link.

Technically, the “phishing activity” was already accomplished way before this week’s incident. There was indeed an actual transfer of funds from victims’s GCash account into the two bank accounts from East West Bank and Asia United Bank (AUB).

East West Bank has made an statement that their Fraud Team discovered the fund transfers. Money from those GCash transactions actually went to an East West Bank account and they immediately froze it.

On the other hand, AUB also confirmed that some funds were also transferred to one of their bank accounts after GCash notified them.

GCash further explains that these transactions were “illegally” authorized but thru an external system that provided the correct credentials (via MPIN and OTP). Hence, these transactions went thru the system and funds were actually transferred from GCash to the two banks.

However, since this was discovered early and both East West and AUB were alerted right away, the target bank accounts were frozen right away and funds could be returned to the respective GCash users.

What was not divulged here was the exact vector where the credentials came from. What it a fake website, a 3rd party app or something else. There’s also no lead yet as to who the perpetrators are behind this attempt.

Abe Olandres

Abe is the founder and Editor-in-Chief of YugaTech with over 20 years of experience in the technology industry. He is one of the pioneers of blogging in the country and considered by many as the Father of Tech Blogging in the Philippines. He is also a technology consultant, a tech columnist with several national publications, resource speaker and mentor/advisor to several start-up companies.

https://www.yugatech.com

2 Comments

Anthony Abayon says:

2 years ago

Diko alam na ganito sana mabalik pira ko
- Reply
JohnnyB says:

2 years ago

I do believe information from victims were gather through phishing. However as mention in the article there are still unanswered question. While the victim phone and MPIN where gather and if including OTP, does this mean their number was cloned? were there OTP indeed sent? Doesn’t gcash tokenized each transaction? While phishing is part of the modus, I strongly believe that a security hole was exploit, could be through gcash app path or if it’s through a 3rd party app.
- Reply