According to a post on Facebook by Warren C. Dua, the alleged deposit receipt that Roxas showed to the media was a fake.
This said joint account named under Mayor Rodrigo Duterte and his daughter, Inday Sara Duterte, seems to appear fraudulent. On this photo below, according to the source, a BPI bank teller checked the account number 2433-0695-39 as stated in this receipt. Surprisingly, the said account number doesn't exist at all.
Another person posted this photo showing the difference between the actual BPI deposit receipt and the fake transaction receipt above, based on their format.
Update: Ayala Corporation, owner of BPI, breaks their silence about the issue