Still queries on cybertheft

After two Senate hearings on the $81-million cybertheft involving a local bank and casinos, more questions are cropping up and many pieces of the puzzle remain missing. First is the obvious attempt to portray the branch manager of Rizal Commercial Banking Corp. as the principal player in the heist. She is thus far the only person in this controversy facing multiple lawsuits—from the Anti-Money Laundering Council, from RCBC, and from a businessman she had implicated. If she were the principal in this crime, why would she settle for just P20 million (as claimed by an RCBC witness) out of the more than P4 billion in funds stolen from the central bank of Bangladesh?

Then there is Weikang Xu, the person identified in the first Senate hearing as the recipient of hundreds of millions of pesos from the cybertheft. In the criminal complaint filed by the AMLC at the Department of Justice, it was noted that Xu got $59.2 million of the stolen funds, and that junket operator Kim Wong received $21.6 million. (Wong returned $4.63 million last Thursday to the Bangko Sentral ng Pilipinas for safekeeping, but authorities note that such a gesture does not free him from possible liability.) At the second Senate hearing last week, Wong claimed that Xu was just a middle-level gambler and not the high roller he was earlier portrayed to be. So what was Xu’s role in this scam, and where is he?

Another person being moved to the sidelines is businessman William Go, who had denied owning the bank account into which the stolen funds initially sent to four other RCBC accounts at the bank’s branch on Jupiter, Makati City, were consolidated. Does Go really have no part in the money laundering scheme? Will the senators take his mere word that he had nothing to do with the bank account opened in his name in RCBC despite the branch manager’s claims to the contrary? Will the Senate not look deeper into Go’s dealings?

It’s strange that not much pressure is being put on Philrem, the foreign exchange trader that handled the conversion and deliveries of the stolen money from the bank branch to the casino beneficiaries. As some senators have observed, why was Philrem excluded from the suit filed by the AMLC?

And who is looking into where the thing started—the hacking—without which all of this would not have happened? The ultimate recipients of the stolen funds—two Chinese nationals who gamble in local casinos, as named by Wong in last week’s Senate hearing—ought to have been involved in the hacking. Is the US Federal Bureau of Investigation now part of the probe?

Finally, RCBC cannot escape part of the responsibility in this heist. It cannot pin all the blame on a branch and its staff as if these were independent of the head office. Besides, it has yet to explain why it failed to implement a “stop payment” order—a question raised during the first Senate hearing by Sen. Teofisto Guingona III.

After receiving the suspicious funds on Feb. 5, RCBC got a “stop payment” order from the Federal Reserve Bank of New York at 5 p.m. of Feb. 8—a banking holiday here because of the Chinese New Year. The order should have been forwarded to the branch on the morning of Feb. 9, a regular banking day, but documents filed by the AMLC showed that RCBC responded to the Bangladesh Bank’s stop-payment request only at 7:45 p.m. of Feb. 9, or the end of the day. Asked to explain why, RCBC officials invoked the Bank Secrecy Law.

The bank may now have realized that its branch manager could not have done everything by herself. Its latest statement indicates that four individuals at RCBC—from the executive vice president down—are being investigated for “possible lapses and errors in judgment.” Another independent inquiry is being conducted on RCBC president Lorenzo Tan, who is now on leave.

It’s truly difficult to believe that there is no conspiracy in this cybercrime. As Sen. Ralph Recto has validly observed, all the players involved—from the branch manager who handled the bank accounts to receive the remittance from the United States, to the client whose defense was that he did not open the dollar account in which the funds were consolidated, to the casino junket operators and high rollers who eventually were the beneficiaries of the stolen money—knew one another. And as in most conspiracy stories, the mastermind is usually the person who looks innocent, or seems to have nothing to do with the scam. The Senate blue ribbon committee alone cannot unravel the mysteries in this $81-million cybertheft.