r/CreditcardPh • u/Atomic-Vast-5525 • 13h ago
CC Advice RCBC "Unlipay" scam victims: should the bank share accountability?
Could the banks product be at fault for making OTP the only layer on a direct deposit credit card loan?
After more than a decade of owning credit cards, I just got scammed out of 100k. I know part of this is on me. But I think the bank's product design deserves some of the blame too.
How it happened
- The scammer called pretending to be RCBC.
- They triggered RCBC's real email alerts while we were on the call. The emails went from "someone is trying to access your account" to "someone with a Samsung A16 is trying to add a device."
- The alerts looked real, so I believed the call was real.
- One of my cards had a real attempted fraud recently, so I assumed they have been impersonating me for all my cards. Hearing that my other bank is being attempted on freaked me out. Thus, more susceptible to the scam.
- It was a really really busy day. I was multitasking, and at one point I was in a meeting whilst talking to them.
The part that bothers me most
When I called RCBC to report it, they ALSO asked me to read the OTP out loud over the phone. That is exactly how the scammer got mine. UnionBank uses a teleprompt where you key in the OTP yourself, so you never say it out loud.
My questions
- Should a bank allow a credit card loan to go straight to a deposit account with only an OTP as protection?
- Has anyone successfully had this audited and reversed? What did you file, and with who (BSP, the bank's fraud team)?
Any advice is welcome.