“Na-’hack’ ako!” – This has become a common catchphrase for the increasing number of people finding unauthorized transactions on their e-wallets and bank accounts. This comes as no surprise because according to the Cybercrime Investigation and Coordinating Center, cybercrimes increased by 152% in the first half of 2023 compared to the same period last year, and the popularity of e-wallets have made it an easy target for criminals.

However, the term ‘hacking’ is often confused with “phishing”, another notoriously common type of cybercrime activity. While both end in malicious individuals gaining control over a user’s account, it’s critical for users to know the difference to better protect themselves.

What is Phishing?

Phishing is a kind of cyber attack wherein cybercriminals pretend to be a legitimate source to trick users into giving personal information to gain access to accounts and steal the funds. For e-wallets, fraudsters may call or send a message via email, SMS or social media platforms pretending to be an employee or a company representative to get the victim’s Mobile Personal Identification Number (MPIN) and One-Time Password (OTP) or authentication code.

What is Hacking?

Hacking refers to an unauthorized attempt by a criminal to access sensitive information on a device or network. This is done by taking over a system through force or sophisticated methods.

What’s the difference?

Both phishing and hacking involve unauthorized ways of gaining sensitive information, but they are being done differently. In hacking, cybercriminals take advantage of vulnerabilities of devices and networks to gain access to sensitive information. It is therefore important for users to only use apps that are credible, reliable, and have strong security measures in place to prevent criminals from hacking the system.

On the other hand, phishing scams, derived from the word fishing, are designed to ‘bait’ victims so they will be tricked into giving sensitive information. This becomes highly dependent on the users because fraudsters rely on them to unknowingly give the information needed to access their accounts through fake websites, fake sign-up forms, or fake portals.

As cybercriminals become more creative, some phishing attempts are now designed to appear as a hacking attack. Cybercriminals ‘phish’ information from thousands of users over a certain period, but don’t immediately use these data to steal funds. All this phished information is then used to steal funds at the same time. With the large number of victims noticing that their funds have been stolen simultaneously, it would look like a massive hacking attack, especially if the victims no longer recall sharing their personal information.

The good news is that phishing scams can be prevented if you know how to spot them. Here are safety practices you can observe to protect your e-wallet account from the phishing attacks:

1.Double up on security measures

Make use of additional safety measures found in your e-wallet app. Aside from requiring you to enter your MPIN, e-wallet apps also send the OTP as an additional security measure to verify your identity. GCash also has a DoubleSafe Face ID, which prompts users for a selfie scan every time they login using a new device, to make sure that it is the Verified Account Owner who has access to the account.

2.Think and rethink before you act

Review the sender and the content of a suspicious message even before responding or clicking on the link. If you are being offered rewards or prizes, backtrack if you have indeed joined a program or raffle and verify with the company through another channel.

Remember that GCash will never send links via SMS, email and messaging apps and all legitimate rewards and promos will only be communicated through the official GCash app, so never click on links claiming to be from GCash.

3.Double-check the message that comes with the OTP

Legitimate e-wallet transactions may ask you to enter your OTP as an added security feature. If you receive an OTP through text message, make it a habit to read the entire message and make sure that it matches the request you made. If you did not make the request or if it is different from what you want to do, do not enter your OTP on any site or send it to anyone, to make sure you are not unknowingly linking your account to another device.

4.Be wary of limited time offers and urgent requests

Advisories or offers that instill a sense of urgency is almost always a sign of phishing scams. Legitimate companies will give you enough time to make a decision and will not ask you to provide your MPIN or OTP to resolve a concern, verify your identity or claim a reward.

If you are being told that your GCash account is on hold, confirm this through the official GCash app. GCash will never ask you to verify your account through a phone call or through messaging applications.

5.Never share your OTP and MPIN

Never provide your personal information if you did not initiate a request. As a rule, don’t provide sensitive information, such as your OTP and MPIN, even to your family, friends and other people claiming to be representatives of banks, companies, service providers and government agencies. Remember that GCash will never ask these details from you.

If you encounter phishing scams and fraudulent activities targeting your GCash account, you may report by visiting the official GCash Help Center at help.gcash.com/hc/en-us or messaging Gigi on the website and typing, “I want to report a scam.”

In the recent past, text scammers would claim to be an OFW relative using their new roaming number and ask for prepaid load, or pretend to mis-send load credits and ask you to return them. While we still get our share of text scams from time to time, a lot of us already associate these messages with fraud and simply ignore them.

But as the use of e-wallets and online payment channels have become increasingly popular and indispensable, scams have evolved to be much more sophisticated. A common scam is done through phishing, wherein a fraudster gathers personal information like MPINs and OTPs, and uses this to gain access to accounts and steal the funds of the user.

Targeting users of leading e-wallet platforms, phishing scams happen not just through text messages, but also through call and social media platforms. While trusted financial institutions such as GCash double up on their security measures through security features such as DoubleSafe Face ID against cybercrimes, it is also helpful to be aware of new scams, how they work, and warning signs to catch them early. Here are common phishing scams e-wallet users should look out for:

●‘Magtop-up para sa online gambling’ phishing scam

It’s very tempting to earn extra income while having fun, but that could be the opposite if you find yourself a victim of scammers that pose as online gambling sites. This phishing scam involves fraudsters leading players to a non-PAGCOR licensed gaming provider, where they will be asked to ‘top-up’ using a fake GCash portal, often using the same layout, color and logos, to retrieve credentials and access the victim’s account.

How do you spot this?

When you create an account with suspicious gambling sites, you will be given the option to use your GCash account so you could top up your account. You will be redirected to a fake website that looks like a GCash portal, and will be prompted to enter your mobile number, OTP and MPIN. Once you’ve provided your information, hackers will now be able to access your account.

How could you stop this?

When asked to link your GCash account, always check the URL or name of the link to make sure you are on the GCash portal. Legitimate GCash portals begin in https:// and only end in ‘gcash.com’ while suspicious portals may have a series of numbers in the beginning, extra characters, and have misspelled words (ex. Gccash vs GCash).

When requesting an OTP, always read the SMS to make sure you are not unknowingly linking a foreign device to your account. Never share your MPIN and OTP to anyone, including suspicious online gaming sites.

●‘Nakahold ang account mo’ phishing scam

While there are scams that exploit different forms of entertainment, there are also those that cause panic and simulate emergency situations. The ‘Nakahold ang account mo’ phishing scam involves fraudsters pretending to be from legitimate financial institutions and making up negative consequences to encourage users into immediately providing their sensitive information.

How do you spot this?

The fraudster will contact you, either through a phone call or social media platforms, and will claim to be a GCash employee, telling you that your account is on hold or frozen. They will then tell you that you can only have your account activated by sharing your MPIN and OTP. Once they have this information, they can gain access to your account and steal your funds.

How could you stop this?

GCash will never ask you to activate your account through a phone call or through messaging applications. All transactions are only done through the official GCash app, including resolving concerns related to your account.

If a notice feels rushed, it’s most likely a phishing scam! Check your account through the GCash app first to confirm if it is indeed on hold and don’t share your MPIN and OTP to anyone – even those who claim to be from GCash. Remember that GCash will never ask these details from you..

●‘Nanalo ka ng prize!’ Phishing Scam

Remember those earlier text scams telling potential victims that they've won a raffle and asking them to send a processing fee to be able to claim a prize? Just like this, a third phishing scam also notifies potential victims that they’ve won prizes to a GCash raffle they did not join. However, instead of asking them for a fee, this involves using a seemingly legitimate link to gain your credentials and access your account.

How do you spot this?

The fraudster, pretending to be from GCash, will send you an SMS or email saying you’ve won a reward, cashback or prize. You will be directed to click a link to claim the prize, leading to a fake website that looks like a GCash portal. Once you enter your mobile number, MPIN and OTP, your account can now be accessed by the cyber criminals.

How could you stop this?

Remember that GCash will never send links via SMS, email and messaging apps and all legitimate rewards and promos will only be communicated through the official GCash app, so never click on links and never share your MPIN and OTP to anyone. Always make it a habit to check any SMS or email you receive. Any communication from an unexpected or unfamiliar sender with an offer that’s too good to be true is usually a phishing scam.

Cybercriminals will continuously find ways to become more creative with their tactics and remain unsuspicious and realistic. Even if you might think you are not worthy of being the target of online predators, being a technology user will always put you as a potential target of any attack, especially if you’re one of the millions of user base of a leading e-wallet app like GCash.

Fortunately, you have one of the best defenses against any phishing scam: you. Now that you are aware of how common phishing scams work, doing your part to protect your e-wallet account only takes a simple action: Do not ever share your MPIN and OTP.

If you encounter phishing scams and fraudulent activities targeting your GCash account, you may report by visiting the official GCash Help Center at help.gcash.com/hc/en-us or messaging Gigi on the website and typing, “I want to report a scam.”

We already know how easy it is to send money online—all it takes is a few taps on your phone and you’re done. Convenient and ideal, right? Yes, but only if you’re sending money to someone with the same bank account or e-wallet as yours or else you need to pay extra fees. That’s not very practical so we’ve got a solution for you. Did you know that ShopeePay, Shopee’s integrated mobile wallet, actually lets you send money to any bank, e-wallet or Shopee user for free? Yes, no hidden fees because we want to enable all Filipinos to fully enjoy the benefits of sending money online.

It’s inconvenient to create and maintain multiple apps just to avoid additional transaction fees. To minimize the hassle, all you need is ShopeePay, which is part of the Shopee app—simply activate and verify your ShopeePay account. With ShopeePay, enjoy free and instant bank transfers with 40+ banks and e-wallet partners, including the country’s major banks like BDO, Bank of the Philippine Islands (BPI), Metrobank, Security Bank, UnionBank, and more. With this integrated service, you no longer need to jump from one app to another to make your fund transfers.