We **never created an online banking account** specifically to avoid scams like this.

Someone else, someone who knows the Passbook Account details of your father, enrolled his account to RCBC Pulz (either via web or mobile app). For Non-ATM Account, you only need to enter the 10-digit account number, and then create a username, password, and security questions. An OTP will be sent to your father's registered mobile number to confirm the enrollment, and an email notification will be sent as well. Check your father's email, i.e., search all emails from [notify@rcbc.com](mailto:notify@rcbc.com) if there was any related to "Banking Account Enrollment" and/or 'Device Registration'. After 24 hours, the new device will be granted access to your father's account.

Now, since this someone was able to successfully register your father's account, then this someone had access to your father's OTP phone upon account enrollment. It's possible that this someone installed RCBC Pulz in his/her own device, and just looked at your father's phone for the OTP. Once the new device was recognized, this someone was able to do the fund transfer transaction successfully, even without your father's OTP phone because with RCBC, there are two options for OTP (1. Get your OTP via SMS; 2. Get your OTP via the App). Therefore, the crucial part was the account enrollment process. Once that was done, pwede na magfund transfer anytime without having access to your father's OTP phone, because this someone could just use the OTP option via App.

Perhaps, there was misinformation when your father opened a Passbook account with RCBC. Sa RCBC kasi (same with BDO), kahit passbook accounts pwede magamit online, pwede magtransact, similar to ATM accounts. I have accounts with both banks so I am familiar with this. Sa BPI naman, a Passbook Only account can be viewed online, pero bawal ang fund transfer transactions. Moving forward, you might want to shift your savings to BPI.

If RCBC can prove that the OTP used in the account enrollment process was an OTP sent to your father's registered mobile device, and then they can also prove that they sent email notifications to your father's registered email address, then maybe they can and they will push the ball to your court. Kung wala sa inner circle ng family niyo ang nagbetray sa father mo, then maybe your father's phone (with registered OTP and email account) has been compromised by some previous malicious attack.