Philippines

Most scams start on social media and messaging apps. Surveys show cybercrime highest in Metro Manila, at 13.4% of families. Of the CICC's complaints in 2025, 366 came from senior citizens. Its love scam complaints, 123 in the year, came about equally from women and men, mostly aged 18 to 29, and a quarter from Filipinos overseas.

Fake sellers and copies of brand pages advertise heavy discounts and send buyers to a website outside the real marketplace. Task scams pay small sums for simple jobs, then ask for deposits. Callers pose as bank or e-wallet staff to get one-time passwords. Hijacked Facebook accounts ask friends for money. Love scammers move victims to Telegram or WhatsApp within days. Since telcos began blocking texts with links in 2022, scammers have turned to portable fake cell towers, which need no SIM and can drop a message into a real thread from a bank: police have seized at least 5 of them and 53 text blasters in 19 operations since 2025.

Scam compounds grew inside offshore gambling firms (POGOs). After the ban, senators say some reorganised into smaller groups, and at least 244 foreign nationals were arrested at two sites in Zamboanga Sibugay in 2026. Filipinos are also trafficked to compounds abroad: 877 were brought home from Cambodia between 2022 and early 2026.

Most of the money leaves through e-wallets. In the CICC's complaints for 2024, GCash carried PHP 76 million of the PHP 198 million lost, ahead of the banks BPI and GoTyme and the wallet Maya. Banks' own reports to the BSP put gross cyber losses at PHP 5.82 billion in 2024. For 2025 the BSP gave only shares: 76% from social engineering, account takeover and identity theft.

The money moves through mule accounts, which are bought, rented or opened under false names. That has been a crime since August 2024, with six to eight years in prison.

BSP Circular 1213, in force from mid-2025 with a year to comply, sets out what must stop a payment. Every bank and e-wallet must run real-time fraud monitoring that can block suspicious transfers. After a change of phone number, email or device the account is paused for 24 hours. Customers must be offered a kill switch to suspend the account themselves, a 'money lock' that puts part of the balance out of reach of online transfers, and their own transaction limits. Institutions may not send clickable links or QR codes by text, email or chat, and must limit one-time passwords sent by SMS. Telcos block at the network: in 2024 they stopped 3.3 billion scam texts and deactivated 3.1 million SIMs, and in 2025 Globe alone blocked 967 million messages and 272,746 SIMs.

Official counts capture only part of the losses. The Cybercrime Investigation and Coordinating Center (CICC) recorded PHP 418.2 million lost in 2025 from 18,633 complaints, against almost PHP 198 million from 10,004 complaints in 2024 and 3,317 complaints in 2023. Its loss figure covers only consumer fraud, online fraud, hacking and phishing. Banks and e-wallets reported gross cyber losses of PHP 5.82 billion to the central bank in 2024, up 2.6%, led by phishing (PHP 1.8 billion) and card-not-present fraud (PHP 1.5 billion). For 2025 the central bank gave only shares: 76% of fraud losses came from social engineering, account takeover and identity theft.

Online selling scams take the most in total and love scams the most per case. In police figures for January to August 2023, online selling took PHP 68.9 million of the PHP 155.2 million lost, while 266 love scam complaints lost PHP 19.4 million, about PHP 73,000 each. GCash was the e-wallet most used by victims in the CICC's 2024 complaints.

Police records show fewer online scams, with 4,509 cases in the first half of 2026 against 5,526 a year earlier, but household surveys show the problem growing: Social Weather Stations found 8.0% of families hit by cybercrime in the six months to June 2026, a record.

Few scam victims in the Philippines get money back, and the rules for recovering it date only from 2025. What returns is mostly money caught in the receiving account and sent back, not refunds paid from a bank's own funds.

Liability depends on fault. Under the Anti-Financial Account Scamming Act (AFASA) and central bank rules, an institution that fails to hold disputed funds, or whose safeguards fall short, must make good the loss, and the central bank says a bank can no longer blame the client in such cases. A customer who gave away a password or one-time code while the bank's controls worked can still bear the loss.

A victim who reports a transfer to their bank or e-wallet sets off a hold on the money along the whole chain of accounts. The first hold lasts up to 5 days, in which the victim must give a sworn complaint or police report, and can be extended to 30 days, longer only by court order. If the check finds the money came from a scam or went to a mule account, it is sent back; otherwise it is released. Since September 2026 banks and e-wallets must report every month the funds they hold. Recovery by the authorities is reported case by case: the CICC reported more than PHP 20 million recovered in love scam cases in 2025.

In the Armidale 2026 survey, 13.5% of victims of the last 12 months told the police and 76.9% reported to some institution, such as the police, a bank or a platform. Under the anti-scam law, a complaint to the victim's bank or e-wallet through its fraud reporting channel starts a hold on the money.

Banks and other firms supervised by the central bank filed 40,780 reports of crimes and losses with it in 2024, up from 40,572 in 2023 and 16,246 in 2022. A customer whose complaint is not settled can take it to the central bank, which received more than 120,000 new consumer complaints of all kinds in 2025, up 72.6% from 70,112 in 2024; its chatbot handled about 95% of the 53,644 received in the first half of 2025, many of them about unauthorised transactions.

The Cybercrime Investigation and Coordinating Center (CICC), whose hotline was recognised as the national anti-scam hotline in 2025, recorded 18,633 complaints from more than 13,000 people in 2025, up from 10,004 in 2024 and 3,317 in 2023: 6,453 were consumer fraud and 4,243 online fraud. The police Anti-Cybercrime Group recorded 7,081 online scam cases in 2024, and 4,509 in the first half of 2026, down from 5,526 a year earlier. Agreements signed in February 2026 let the central bank share confidential account information with the National Bureau of Investigation and the CICC to build cases under the anti-scam law, and with the Securities and Exchange Commission for its handling of consumer complaints.

The figure shown here is the CICC's count of complaints, with the losses attached to them: 18,633 complaints in 2025, from more than 13,000 people. It covers every kind of cybercrime reported to the centre. Consumer fraud, mostly goods paid for and never delivered, was 6,453 complaints and other online fraud 4,243. Online harassment (2,160) and identity theft (1,626) are also in the total. The PHP 418 million of losses covers consumer fraud, online fraud, hacking and phishing. Scams reported only to a bank, an e-wallet or a police station are not counted.

The police Anti-Cybercrime Group keeps its own count of the cases it handles: 3,941 online scams from January to mid-November 2025 against 7,081 in all of 2024, and 4,509 in the first half of 2026. By offence, swindling (estafa) was the largest, 3,915 cases in the year to October 2025.

Online swindling is charged under the Revised Penal Code with the Cybercrime Prevention Act, which raises the penalty by one degree. AFASA adds the offences of money muling and social engineering, and treats them as economic sabotage, with life imprisonment, when three or more people act together or three or more people are victims. Police recorded 527 AFASA cases in 2025. Across all cybercrime, 2,933 cases were filed in court and 252 people were convicted in the year to October 2025.

On the CICC's count the largest category is consumer fraud, 35% of all complaints in 2025. It is mostly online shopping: in 2024, 86% of it was goods or services paid for and never delivered, and 8% fake advertisements. Sellers on social media take payment by e-wallet and disappear, or a cash-on-delivery parcel arrives with the wrong item. The second category, online fraud (23%), covers financial fraud, impersonation, job, investment and love scams.

Police figures give the same order: of the online scams logged to mid-November 2025, online selling was 1,630, investment and task scams 589, phone calls posing as a bank or e-wallet 431, hijacked profiles 326 and loan scams 251. The latest police breakdown of losses, for January to August 2023, shows where the money goes: online selling took 44% of PHP 155 million, fake parcel scams PHP 20.9 million, and love scams cost the most per case, about PHP 73,000 each across 266 complaints. Banks' reports to the BSP for 2025 show three quarters of fraud losses came from social engineering, account takeover and identity theft, the schemes in which a caller or message obtains the customer's own details.

The Philippines has written strong duties for banks into law and left telcos and platforms outside them. AFASA and the BSP's 2025 circulars make every bank and e-wallet in a payment chain trace and hold disputed money together, lift bank secrecy for that purpose, require real-time fraud systems, and put the loss on an institution that fails. Banks had until June 2026 to comply and the BSP says they broadly did. The BSP has signed information-sharing agreements with the NBI, the CICC, the SEC, the justice department and the police. The results for victims are still to come.

The shared system for tracing and freezing was drafted by the bankers' association in 2025 as a database of accounts linked to fraud. The first results claimed for the law are cases: 527 recorded in 2025, about 447 of them solved. Monthly reporting of money held and returned began only in September 2026.

The national hotline 1326 is a government desk with no bank or telco staff, and a scam prevention centre that would seat them together is still a proposal. Telcos have duties under the SIM Registration Act but bear no loss, and the Act is easily beaten: the NBI registered SIMs with an ID showing a monkey, pre-registered SIMs are still sold, and fake cell towers need no SIM. Platforms act under voluntary undertakings: Telegram promised a 24-hour helpdesk in 2026, and a deal with Meta was still being finalised. In 2025 complaints to the CICC rose while cases handled by the police fell.