GCash revealed that a “product issue” led to a “system reconciliation process” after customers reported unauthorized transactions over the weekend.
Gilda Maquilan, Vice President for Corporate Communications and Public Affairs at GCash, explained that it all began at 11 p.m. on November 8 when the company noticed an unusual surge in the use of its Send Ang Pao feature, which lets users send money to multiple people for gift-giving, especially during holidays like Christmas.
“When you send Ang Pao as a gift, it goes into a temporary wallet and only transfers to the recipient’s main wallet after they acknowledge it,” Maquilan explained.
Seeing an increase in Send Ang Pao usage outside typical holiday periods, GCash immediately launched an investigation.
“We noticed the wallet balance was bloated, meaning the rate of money being deposited didn’t match withdrawals. No recipients were acknowledging the funds,” Maquilan said.
In the early hours of November 9, GCash began receiving customer reports of unapproved Send Ang Pao transactions on their accounts. Recognizing the link, GCash promptly disabled the feature and intensified its probe.
“Our initial investigation ruled out phishing, data breaches, or account takeovers. This was a product issue,” she stressed, clarifying that the incident was due to a technical issue, though further validation is ongoing.
GCash moved quickly to restore affected clients’ funds within 24 hours. “From detection to investigation and resolution, we acted swiftly,” Maquilan noted.
The company reported the incident to the Bangko Sentral ng Pilipinas (BSP) on Saturday and also provided updates to the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC).
Maquilan shared that the investigation is ongoing, with BSP officials now assisting in the probe. She expressed hope that users would continue to trust GCash and emphasized that the company is committed to preventing similar incidents in the future.
“We continuously improve our technology, invest in our systems, and monitor customer funds 24/7 to meet any challenge,” she assured, adding that GCash is working with the BSP, DICT, and CICC to further educate consumers on digital security.