GCash, Maya and bank scams: how phishing works and how to stay safe

Most digital money fraud doesn't hack the app. It tricks the person. Scammers send a convincing text, email or chat, and the victim hands over an OTP, MPIN or password, or taps a fake link. Phishing and smishing make up most reported digital fraud, and fake QR codes (“quishing”) are growing. The good news: a few simple rules stop almost all of them.

The golden rules

1. Never share your OTP, MPIN or password with anyone, including people claiming to be from GCash, Maya, your bank or a courier.
2. Don't click links in texts, emails or chats about your account. Open the official app yourself instead.
3. E-wallets and banks will never ask for your OTP or MPIN by call, text or chat.
4. Check QR codes before paying: the name shown in your app should match the store or person you're paying.
5. If it's urgent, emotional or too good to be true, stop and verify first.

Common scams to watch for

• Smishing: “Your account will be suspended, click here to verify.”
• Fake rewards: “You won ₱10,000! Pay a small fee to claim it.”
• Wrong send: someone 'accidentally' sends you money and asks you to return it to a different number, sometimes using stolen funds.
• Fake sellers: online sellers who ask for payment first, then disappear.
• Impostors: messages from a 'relative' with a new number asking for urgent money.
• Fake QR codes stuck over real ones in stores or sent in chats.

If you've been scammed

1. Act fast: report to your e-wallet or bank through its official app or hotline, and ask them to block the receiving account.
2. Change your MPIN or password and log out of other devices.
3. Save screenshots, reference numbers and the scammer's details.
4. Report to the CICC hotline 1326 or the PNP Anti-Cybercrime Group.
5. If the provider doesn't help, you can raise a complaint with the BSP through its consumer assistance channels.

The law is on your side

The Anti-Financial Account Scamming Act (Republic Act No. 12010, 2024) makes social engineering, account takeover and acting as a 'money mule' crimes, and requires banks and e-wallets to have stronger fraud controls. Never lend your account or e-wallet to anyone to receive or move money for them; you could be held liable.

How to do it in Iponista

1. Log every e-wallet transaction, then review History once a week: anything you don't recognize stands out immediately.
2. Turn on App lock in Settings so no one can open your finances on your phone.
3. Keep a small 'daily' balance in your e-wallet and the rest in savings, and track both in Wallet, so a scam can't reach all your money.
4. Record any scam loss as an expense with a clear note, so your numbers stay honest while you pursue a refund.

Remember this

No one legit asks for your OTP or MPIN. Open the app yourself instead of clicking links, check the name before paying a QR, and report fast.

Do this today

Save your e-wallet's and bank's official hotline numbers in your phone, and the CICC hotline 1326.