DURING the critical days of June 7 and June 8, one of the immediate concerns of the management of Bank of the Philippine Islands (BPI) was to assure the public as well as the regulator -- the Bangko Sentral ng Pilipinas -- that no hacking was involved.
Why was the clarification very important?
Because hacking is a malicious attack from the outside which can really wreak havoc on a bank’s system, or for that matter, any institution that is highly computerized.
What actually happened was a glitch caused by a lapse in judgement by a programmer, explains BPI President Cezar “Bong” Consing, hence the potential damage could be contained more readily.
Here is the closest analogy I can use to demonstrate the difference between a hack and a glitch.
When a robber forcibly gains entry into your home, ransacks your kitchen and runs off with your oven toaster and other appliances, that’s a hack.
But when your trusted kasambahay, who has been with you for ten years, mistakenly plugs your 110-volt oven toaster into a 220-volt outlet, that’s a glitch.
In the latter case, you immediately know the extent of the damage and the specific remedial action you need to take.
June 7-8 and the immediately following days were, indeed, trying times for both BPI management and its clients. But as the saying goes, out of the hottest fire comes the finest steel.
From the incident, BPI’s mettle, as well as its relationship with its clients, was really tested. I would say that BPI even came out a stronger institution.
Here are just some of the reasons why:
1. Not a single bank client lost a centavo as a result of the glitch.
2. The bank knows that its clients, with two noteable exceptions, are honest. Quite a few volunteered the information that their accounts were erroneously padded and refrained from taking advantage of the situation. This not only minimized undue withdrawals to P46 million but also helped hasten the normalization of operations.
One notable exception, however, was a depositor who falsely claimed that his account was credited P12 billion. For reasons unknown, this guy even had himself interviewed by mainstream TV, and that started the myth about the billion peso credits. EVP Mon Jocson, BPI’s top IT guy, told the Senate and House committees that this claim was a physical impossiblity.
Another client, again for reasons unknown, hiding in anonymity provided by social media, advocated that it was time to transfer deposits to Security Bank. Security Bank, bless them, immediately disowned the attempt to discredit BPI. Moreover, the banking community immediately came out in full support of BPI.
By the way, Mon Jocson identified the malefactors in no time. These guys will be hearing soon from the NBI!
3. The bank has further confirmed that its clients are a loyal bunch. One would have expected massive withdrawals during the critical period. But the withdrawals during the period June 7-8 did not even come close to peak withdrawals year-to-date. The comparable period of high withdrawals coincided with the banking days immediately prior to Holy Week this year.
4. The bank’s shareholders are just as steadfast. No significant selldown of bank shares was reported by the Philippine Stock Exchange. Share prices even slightly increased as the situation began to normalize.
5. It was a shining moment for front-line bank staffers who walked the extra mile to service client needs. It was doubly difficult, of course, because processes had to be executed manually. But deliver, they did.
My friend Ichu Villanueva, who writes for the other No. 1 newspaper, recounted several anecdotes of BPI’s front-line heroes and heroines. (Stories from behind the bank teller’s counter, Philippine Star, June 21, 2017).
Senator Chiz Escudero, who chairs the Senate committee on banks, financial institutions and currencies, in effect praised the speed with which BPI manually corrected close to 1.5 million entries in less than 36 hours.
Senator Frank Drilon, on his part, said: “It’s under control. There is no reason to worry. It’s a glitch, human error, no malice. The important thing is the bank is able to respond.”
The Bangko Sentral ng Pilipinas still has to come up formally with the result of its own investigation.
But given the pro-active colloboration of BPI’s management and BPI’s own track record, I am convinced that BSP would find BPI’s systems and corporate governance standards better than par.
(Disclosure: The writer has known BPI both as a regulator and as a “regulatee”. He previously served with the Monetary Board of the Bangko Sentral ng Pilipinas. He is currently an independent director and a member of the Corporate Governance Committee of BPI.)