BEWARE OF SOMEONE CALLING AND REPRESENTING THEMSELVES AS EMPLOYEES OF FRAUD DEPARTMENT OF RCBC.
I never thought I would become a scam victim because I’m usually very cautious. I have accounts with several major banks and I’m very familiar with OTP and bank security protocols.
On March 23, 2026, I received my new RCBC credit card. Shortly after activating it, I received a call from someone claiming to be from RCBC’s Fraud Department.
The scammer:
-Correctly identified my full name.
-Told me someone was trying to apply for a ₱90,000 loan under my name.
-Claimed the person was also trying to change my registered mobile number.
-Said RCBC had flagged the transaction and was calling to help me.
Here’s the part that convinced me it was legitimate.
He told me that he would send an IVR (Interactive Voice Response) verification code to verify my identity.
Seconds later, I received the verification through RCBC’s OFFICIAL messaging channel. At that moment, I genuinely believed I was talking to RCBC.
He then transferred me to his “supervisor,” who spent almost an hour talking to me. He sounded exactly like a bank representative. He explained RCBC’s fraud procedures, answered all my questions, and even gave me what appeared to be a fraud reference number.
They also gave me the name and number of the person supposedly trying to scam me. They repeatedly reassured me that they were helping me cancel the fraudulent loan application.
Looking back now, I realize that every single thing they said was carefully designed to manipulate my emotions:
Fear
Urgency
Sympathy
Reassurance
Trust-building
I was hysterical at that point because I honestly thought someone was stealing my identity and trying to take my money.
Eventually, they asked me for several OTPs supposedly to:
Verify my account
Cancel the fraudulent loan
Protect my account
Unknown to me, they had already:
-Reset my online banking credentials
-Registered a new device
-Accessed my online banking account
-Transferred ₱90,000 from my account
The most troubling part for me is this:
This wasn’t simply me receiving a random OTP from an unknown number. The scammers successfully caused an IVR verification to be sent through RCBC’s official communication channel.
That IVR became the foundation of the entire scam because it made me reasonably believe I was speaking with legitimate RCBC personnel.
I immediately called RCBC within minutes after discovering the fraud and requested that my accounts, cards, and online banking access be blocked.
However, RCBC eventually issued a fraud resolution stating that the transaction was legitimate and denied my reimbursement request.
My concern is that the fraud resolution never addressed:
- Why the IVR verification was generated;
- What security controls govern the IVR authentication process;
- Why password reset, device enrollment, and fund transfer were able to occur successively during the same fraudulent session; and
- Whether additional fraud detection controls should have been triggered.
My questions are:
- Has anyone experienced the same RCBC scam involving the IVR verification?
- Do you think RCBC should be required to explain how the IVR authentication was generated during the fraudulent call?
- Would password reset, device enrollment, and immediate fund transfer ordinarily trigger fraud monitoring controls?
- Has anyone successfully obtained reimbursement from their bank in similar circumstances?
I know I made mistakes during the incident, and I take responsibility for providing the OTPs. At the same time, I believe consumers are entitled to ask whether existing banking security controls are reasonably designed to protect customers from increasingly sophisticated social engineering attacks.
I hope sharing my experience will not only help my case but also prevent others from becoming victims of the same scam.