‘Lauriat para sa barangay?’ Gatchalian says hacker used his credit card to spend P1M on Food Panda

MANILA, Philippines (Updated 5:52 p.m.) — Sen. Sherwin Gatchalian on Wednesday said his credit card was hacked and used to make an enormous purchase on Food Panda.

"My credit card has just been hacked! Someone ordered P1M worth of food on Food Panda in less than an hour. What is that, lauriat for the whole barangay?" Gatchalian said partially in Filipino on his Twitter account.

My credit card has just been hacked! May nag order ng P1M worth of food sa Food Panda in less than an hour. Ano yan lauriat para sa buong barangay??? pic.twitter.com/pfpcck9tG6

— Sherwin Gatchalian (@stgatchalian) January 6, 2021

He also tweeted a breakdown of the Food Panda charges to his card— three worth more than P300,000 and the fourth worth over P96,000. In total, the alleged hacker racked up a bill of P1.07 million.

All four orders were made from 4:47 p.m. to 5:49 p.m. on Tuesday.

"The hacker managed to change my registered phone number so he got the OTPs. He knew what he was doing. I just don't know how he will eat a million worth of food," Gatchalian added.

It is not yet clear what exactly the alleged hacker ordered from Food Panda.

Gatchalian to file a complaint at NBI

Gatchalian later on Wednesday said he plans to file an incident report on the matter, with his office later adding that the complaint would be filed at the National Bureau of Investigation's main office along Taft Avenue, Manila, the following morning. 

"I want to file a police report first [to] make this official, so that there will be basis for asking Food Panda for more information. It is important that we make it official first. But definitely, it must be pursued," Gatchalian told reporters partially in Filipino during a virtual briefing. 

Gatchalian said he has not been in touch with Food Panda and does not yet know which restaurants fulfilled the orders placed by his alleged hacker. He also said that Union Bank has acknowledged that the payment was "fraudulent" and confirmed that he would not be charged for the purchase. 

Asked if he intended to file a measure to probe or propose security measures for delivery and shopping apps following his experience, Gatchalian said: "I'm doing my own investigation first." 

"Let's look into where the gaps were. Let's also look into the laws which cover consumer protection and let's also look into what the process of reporting is like," he added in Filipino. 

"Reporting is also very important. Good for us that we are in a position where its easy to report. What about our ordinary consumers who are hacked? For example, [if] he was hacked [and the hacker spent] P10,000? Is that easy to report? Is he given attention and what is the process?" Gatchalian also said in a mix of Filipino and English.

Under Republic Act 11449, practices covered by "access device fraud," — such as skimming or counterfeiting credit cards, payment cards and debit cards, making or processing software or hardware for illegal access to information, illegal online access to online and ATM banking cards, and hacking — are punishable with the maximum penalty of life imprisonment and a fine which could go as high as P5 million pesos.

— Bella Perez-Rubio with a report from James Relativo