BDO Unibank 'Mark Nagoyo' account-takeover fraud

In late 2021, BDO Unibank (Banco de Oro) — the largest bank in the Philippines by assets — suffered a wave of fraudulent online transfers that drained money from the accounts of more than 700 customers. The funds were funnelled into multiple UnionBank accounts opened under the alias "Mark Nagoyo," a play on Filipino slang for "just joking."

What happened

Between late November and early December 2021, victims reported that money had vanished from their BDO online-banking accounts. Individual losses ranged from roughly ₱25,000 to ₱50,000, and in at least one case a single compromised account was used to receive ₱5 million, which was promptly converted into Bitcoin on 11 December.

What unsettled customers and investigators alike was that many victims insisted they had not clicked any suspicious links and had received no one-time password (OTP) alerts — yet transfers exceeding normal daily limits still went through. This pointed to compromised credentials combined with weaknesses in transaction authentication and fraud monitoring.

How it worked

Investigators concluded the scheme was driven primarily by phishing and social engineering: harvested online-banking credentials were used to log in and initiate transfers to a network of mule accounts at another bank. The recipient accounts under "Mark Nagoyo" served as a relay before funds were dispersed or converted to cryptocurrency, complicating recovery.

Arrests

On 21 January 2022, the National Bureau of Investigation (NBI) arrested five suspects tied to the scheme: two Nigerian nationals — Ifesinachi Fountain Anakwe and Chukwuemeka Peter Nwadi — and three Filipino accomplices. The Bangko Sentral ng Pilipinas (BSP) had earlier identified two to four core perpetrators, and fewer than ten receiving accounts were frozen during the investigation.

Impact and response

On 12 December 2021, BDO publicly acknowledged the fraud and, two days later, pledged to reimburse all affected customers and strengthen its security infrastructure. The BSP — the central bank and banking regulator — launched its own investigation and pressed banks to harden authentication and fraud controls.

Why it matters

The "Mark Nagoyo" incident is the Philippines' defining digital-banking fraud case. It struck the country's largest bank during a pandemic-driven surge in online banking and exposed gaps in credential protection, transaction monitoring and OTP-based authentication. The case accelerated BSP-led reforms — including stricter fraud-management and customer-reimbursement expectations — and remains a reference point for account-takeover risk in Philippine retail banking.