SOCIAL ENGINEERING SCAM | Bangko Sentral warns Western Visayans: human deception biggest cybercrime threat

ILOILO City — Cybercriminals are increasingly exploiting human trust rather than breaking into banking systems, with social engineering and identity theft accounting for 68 percent of reported cyberthreats nationwide in 2025, prompting the Bangko Sentral ng Pilipinas (BSP) to warn residents of Western Visayas against sophisticated financial scams that can empty bank accounts with just a few clicks.

The BSP sounded the alarm as nationwide data showed that 77 percent of Filipinos had encountered cyber scams, while 30 percent lost money to digital fraud in the past 12 months.

Despite accounting for less than four percent of the country’s reported cyberthreat and financial scam complaints in 2025, Western Visayas remains vulnerable to fraudsters who manipulate victims into surrendering sensitive banking information or transferring money voluntarily.

Alvin A. Tolosa, deputy director of the BSP Consumer Protection and Market Conduct Office, said the region’s share of complaints has remained relatively stable entering 2026.

“Sa Western Visayas, there is less than 4% of the entire complaints received for the entire Philippines in 2025, at sa QR 26 it’s almost the same volume share,” said Tolosa.

However, he warned that the relatively low number of complaints should not create a false sense of security, particularly as criminals increasingly employ psychological manipulation to deceive unsuspecting consumers.

“Common scams dito sa Western Visayas, prevalent pa rin ‘yung social engineering scams. For example, phishing and smishing or Q-shing or the QR code phishing,” said Tolosa.

HUMAN TRUST UNDER ATTACK

Perlita B. Montemayor, deputy director of the BSP Technology Risk and Innovation Supervision Department, said cybercriminals have shifted from technically sophisticated attacks against financial institutions to schemes that exploit the behavior and vulnerabilities of ordinary account holders.

“Lahat tayo…i-manipulate lang or i-compromise lang as specific biller. Nagiging ganyan na po ang cyber attacks sa atin ngayon. Based on surveillance, there is also a shift from pure hacking to scam-driven human centered attacks. Nag-aaral ang mga attackers and highly technical hackers natin to compromise the system of financial institutions,” Montemayor added.

BSP figures showed that hacking and system manipulation accounted for 23 percent of reported cyberthreats nationwide in 2025, while card-not-present fraud represented six percent.

Montemayor explained that the widespread use of digital financial services has made fraudulent transactions easier to execute and potentially more damaging because money can be transferred almost instantly between accounts.

“Merong lugar or timing kung saan ka nawawalan ng pera. Sa digital space, lahat tayo ngayo ay makaka-access ng isang digital app. Cyber threats are becoming more frequent and scalable. Before ang meron lang tayo ay ang high technical hackers. They hack and manipulate ‘yung systems ng bangko to victimize. Now, digital financial services na…because interconnected na at isang pindot lang transfer agad yung pera, nakapagbayad…mas frequent at mas scalable na, at mas pwede tayong maging victim ng online scams,” said Montemayor.

She said criminals have evolved from physically tampering with automated teller machines to exploiting digital payment systems, impersonating legitimate institutions and inserting malicious links into seemingly authentic text-message conversations.

“Ang uso po noong pre-pandemic, ATM, binuksan, sinira at kinuha ang pera. Now, nag-evolve sa kino-compromise ‘yung technology just to bring it to the system,” she added.

HOW SCAMMERS STEAL MONEY

According to the BSP, modern financial scams generally follow two methods: deceiving victims into authorizing fraudulent payments or tricking them into disclosing confidential banking credentials.

Fraudsters commonly use fake text messages, telephone calls, websites and social media accounts to impersonate banks, government agencies, businesses or individuals known to their intended victims.

Among the schemes identified by the BSP are phishing, smishing, fraudulent investments, bogus employment opportunities, online shopping scams, fake loan offers, romance scams and impersonation of government officials.

“Threat actors only need you to do one of two things,” Montemayor warned.

“They either manipulate you into divulging your sensitive credentials—such as your password, username, OTP (One-Time Password), or personal information—or they convince you to voluntarily transfer your own funds. Once you provide an OTP or click a link, malicious applications can be installed directly onto your device,” she added.

Once money is obtained, criminal groups may immediately transfer the proceeds through mule accounts before withdrawing them through ATMs, electronic wallets or cryptocurrency exchanges, making recovery difficult.

The BSP reported that 74 percent of fraud victims nationwide informed their financial institutions about the incidents.

SENIOR CITIZENS AT RISK

Tolosa particularly urged families to protect elderly relatives, who may be more susceptible to deceptive telephone calls, fraudulent financial offers and other forms of social engineering.

“Let us all be vigilant. Mahirap po na umabot tayo sa point na na-scam na at nakuhaan ng pera, and if it’s too good to be true, kung wala tayong ini-expect na funds na darating, bakit po tayo biglang makaka-receive? Kon meron mang kakausap sa atin at biglang tatawag, let us not rather entertain..or if mag re-raise yon nga red flag,” he added.

He advised consumers to immediately terminate suspicious conversations and independently contact their banks to verify questionable transactions or requests for personal information.

“Let us all be conscious. Ingatan po natin ang pag-transact. Lagi kong sinasabi rin sa ating mga parents – mga seniors kasi ang prone – na kapag hindi ka sure, sabihin mo na lang na tatatawag na lang ako sa bangko ko. If ‘di tayo sure at kinakabahan tayo, let us end the conversation and contact our financial institution, tanungin natin,” Tolosa said.

HEAVY PENALTIES AWAIT SCAMMERS

The BSP also emphasized the provisions of Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA), which imposes stiff penalties on individuals and syndicates involved in digital financial fraud.

Under the law, money muling, which involves allowing financial accounts or electronic wallets to be used for receiving or transferring illegally obtained funds, carries imprisonment of six to eight years and substantial fines.

Social engineering schemes, including phishing, smishing, vishing and spoofing, carry prison terms of 10 to 12 years.

When the victim is a senior citizen, the penalty increases to 12 to 14 years of imprisonment and fines reaching P2 million.

Large-scale or organized financial scamming classified as economic sabotage may result in life imprisonment and fines ranging from P100,000 to P5 million.

The law also penalizes the creation of fictitious financial accounts and individuals who knowingly facilitate fraudulent transactions.

BSP URGES IMMEDIATE ACTION

To minimize financial losses, the BSP urged consumers who encounter suspicious transactions or become victims of fraud to follow its alert protocol.

The procedure calls for immediately avoiding further contact with suspected scammers, locking compromised accounts and devices, gathering evidence, reporting the incident to the financial institution concerned and informing appropriate authorities.

Victims are advised to preserve text messages, transaction records, telephone numbers, screenshots and other information that could assist investigators in tracing fraudulent transactions.

Reports may also be brought to the Cybercrime Investigation and Coordinating Center or the Philippine National Police Anti-Cybercrime Group.

The BSP stressed that vigilance remains essential as cybercriminals increasingly target the human weaknesses of digital financial transactions rather than relying solely on technological vulnerabilities./PN