BPI Scammer asked for my CVV as a "batch code"
Want to warn everyone about a scam call I received today. It was convincing enough that I almost fell for it.
How it started:
A woman called me claiming to be from BPI. She asked if I had any issues with my card. She then brought up my rewards points, mentioning I had 4k points. I told her the minimum redemption is 20k so it wasn't enough. She then transferred me to another "agent."
The second agent was smoother:
She spoke to me in a very patronizing tone, like she was explaining things to a child. She asked if the first agent had explained the rewards clearly, then mentioned I could get a card replacement and freebies like a BPI umbrella and tumbler.
She asked me to confirm my card number. I told her my wallet was upstairs and I wasn't sure. She basically nudged me into confirming it anyway.
Here's where I should have stopped:
I actually asked her directly: "How will I know this isn't a scam call?" She responded by confirming my birthday, which was correct. That made me feel she was legit.
She then asked for my expiry date, using a term I didn't recognize at the time. Because she'd already confirmed my birthday, I trusted her and gave it. That was my mistake.
The red flag that ended the call:
She asked for a "batch code." I had no idea what that was. She told me to look next to my signature on the card. I said, "Isn't that the CVV?" She said, "It's CVV on your end, but we call it 'batch code' on our side."
She also used a fill-in-the-blank tactic to make it sound official, something like "Sa 199 na nakakuha ng card, pang-ilan po kayo?" as if she was recording my "batch code" as part of a numbered list of cardholders. It was designed to make you feel like giving the number was a normal, procedural thing.
What's even scarier is that they also knew my address, including my postal code and city. This means they had a complete profile on me — name, birthday, address, card number, and expiry date. The only thing missing was my CVV, which was the whole point of the call.
I hung up immediately and blocked the number.
What I did after:
- Locked my card through the BPI app right away
- Heading to the branch today to have the card replaced
Lessons learned:
- Scammers now call in teams. The first call softens you up, the second closes in
- Confirming your birthday does NOT mean they're from your bank. That info is available from data breaches.
- "Batch code" is not a real term. No legitimate bank agent will ever ask for your CVV under any name.
- The patronizing, overly reassuring tone is a manipulation tactic to keep you from thinking critically.
- The "pang-ilan ka sa lista" tactic is meant to normalize handing over sensitive info as if it's routine.
- Asking "is this a scam?" won't stop a scammer. They're prepared for that question.
- Your data is likely already out there from breaches on e-commerce or delivery apps. Be extra vigilant.
Edit: I called the bank and they're replacing my card and waiving the fee!
Please share this. These people are organized and rehearsed. Stay safe.