How To Spot A Fake Bank Text Message Or SMS Scam in the Philippines

"Your account has been temporarily locked. Verify now at this link to avoid suspension." Millions of Filipinos have received a text like this, and many have lost their savings in minutes because it looked exactly like a message from their real bank. The scams are getting smarter — some now show up in the very same message thread as your genuine bank alerts. The good news is that almost every fake bank text breaks at least one simple rule. This guide explains those rules in plain language, shows you how to check a message safely, and tells you exactly what to do and who to call if you have already clicked a link or shared a code.

Rule #1: Real Philippine Banks Do Not Put Clickable Links in Their Texts

The single most useful fact to remember is this: in March 2022, the Bangko Sentral ng Pilipinas (BSP), the country's central bank, issued Memorandum M-2022-015 asking all banks and other BSP-supervised financial institutions to remove clickable links from the emails and SMS (short message service, or text messages) they send to customers. Banks like RCBC publicly announced they had removed all links from client messages, and the BSP has repeated in later advisories that banks do not send text messages with clickable links.

That means if a text claiming to be from BDO, BPI, Metrobank, Landbank, UnionBank, RCBC, Security Bank or any other bank contains a link — even a short one like bit.ly — you should treat it as fake. Real bank texts usually tell you to open the official app yourself or call the hotline printed on the back of your card.

You can read the BSP's consumer advisories and verify whether a financial institution is BSP-supervised on the official Bangko Sentral ng Pilipinas website.

Why a Fake Text Can Appear in the Same Thread as Your Real Bank Alerts

Many victims say, "But it came from the same sender as my real OTPs!" This is not a sign the message is real. The BSP has warned the public about what it calls text hijacking, which works in two ways:

• Sender ID spoofing — scammers fake the name that appears as the sender (for example, "BDO" or "GCash"), so your phone groups their message together with genuine messages from that name.
• IMSI catchers (fake cell towers) — an IMSI (International Mobile Subscriber Identity) catcher is an illegal portable device that broadcasts a stronger signal than nearby real cell towers. Phones within range connect to it, and it can push text messages straight to them without passing through Globe, Smart or DITO's networks, so the telcos' spam filters never see them.

The lesson: never judge a message by its sender name or by which thread it lands in. Judge it by what it asks you to do.

The 7 Red Flags of a Fake Bank or E-Wallet Text

If a message has even one of these signs, stop and do not respond:

• It contains a link — see Rule #1 above.
• It creates panic or a deadline — "Your account will be locked in 24 hours," "Unusual login detected," "Your card has been suspended."
• It offers something too good — "Your reward points of 12,500 will expire today," "You won ₱50,000," or a pre-approved loan you never applied for.
• It asks for secret codes — OTP (one-time PIN), MPIN (mobile PIN), card PIN, CVV (the 3-digit code on the back of your card), or your online banking password.
• It comes from a regular 11-digit mobile number like 0917… or +63 9…, instead of a registered bank sender name.
• It has odd spelling or a look-alike web address — for example, "bdo-online-secure.com" or "bpi-verify.net" instead of the bank's real domain.
• It asks you to "update," "verify," or "reactivate" your account — banks handle these in the app or branch, never through a texted form.

Step 1: Check the Message Without Clicking or Replying

Your goal is to look, not touch. Do not tap the link, do not reply with "STOP," and do not call any number written inside the text — scammers often include their own fake "hotline."

Read the message slowly and compare it with the red flags above. If there is a web address, look at it carefully without opening it. Scam domains often add extra words to a bank's name ("-secure," "-login," "-ph," "-rewards") or use free website hosts and URL shorteners to hide the real destination.

Take a screenshot that clearly shows the sender's number or name, the date and time, and the full text. You will need this later if you report it. Then you can delete the message and, if it came from a mobile number, block the number in your phone's messaging app.

Step 2: Verify Directly Through Your Bank's Official App or Hotline

If you are worried the message might be real, contact the bank yourself using a channel you choose, not one the message gives you:

• Open your bank's official mobile app (downloaded from the Google Play Store or Apple App Store) and check for alerts, locked status or unusual transactions.
• Call the customer service number printed on the back of your ATM, debit or credit card, or the one listed on the bank's official website that you typed in yourself.
• Visit a branch with a valid ID if you still have doubts.

A genuine problem with your account will always show up in at least one of these official channels. If the app shows no issue and the hotline agent has no record of any problem, the text was a scam.

Step 3: Never Share Your OTP, MPIN, PIN or CVV — With Anyone

An OTP (one-time PIN) is the 6-digit code your bank or e-wallet sends to approve a login, a new device, or a transfer. It is the final "key" that lets money leave your account. Scammers who already have your username or card number only need this one code to empty your account.

Remember these absolute rules:

• No bank employee, GCash or Maya agent, courier, or "BSP officer" will ever ask for your OTP, MPIN, card PIN or CVV.
• Read the full OTP message before using any code. Banks often write "Do not share this code" and describe what the code is for (for example, "to enroll a new device" or "to transfer ₱25,000"). If you did not start that action yourself, someone else did.
• Calls that "help you cancel a fraudulent transaction" by asking for the code you just received are the same scam in a different form.

Step 4: Report the Scam Text to the 1326 Hotline and Your Telco

Reporting helps authorities trace and shut down scam numbers and syndicates. You can report through any of these channels:

• CICC hotline 1326 — the Cybercrime Investigation and Coordinating Center's Inter-Agency Response Center (I-ARC) runs a 24/7 anti-scam hotline. Details are on the CICC website.
• eGov PH app — use the eReport feature to submit the scam number and a screenshot.
• Your telco — Smart, Globe and DITO all accept spam and scam reports through their official apps and websites; check your provider's official page for the current reporting short code before sending.
• Your bank — forward the details to your bank's official fraud hotline or email so it can warn other customers.

Include your screenshot, the sender's number or name, and the date and time you received the text.

Already Clicked or Shared a Code? Do These 5 Things in the First Hour

Speed matters. Scammers usually move stolen money through several accounts within minutes, so act right away:

• 1. Call your bank's official hotline immediately (back of your card) and ask them to block your card, lock your online banking, and flag any pending transfers as unauthorized.
• 2. Lock what you can yourself — most bank and e-wallet apps have a "lock card" or "freeze account" button.
• 3. Change your passwords and MPIN from a device you trust, starting with your banking app and the email address linked to it.
• 4. Uninstall any app the scammer told you to install, especially screen-sharing or "remote support" apps, and remove unknown devices from your bank app's device list.
• 5. File a written dispute with your bank, then report to the 1326 hotline, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division. Keep copies of every screenshot, reference number and email.

If you only clicked the link but did not type anything into the page, the risk is lower — but still change your passwords and watch your account closely for a few days.

Your Rights Under AFASA (RA 12010) and How to Escalate to the BSP

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), was signed on July 20, 2024. It makes "social engineering schemes" — tricking someone into giving up information that lets the scammer control their financial account — a specific crime, along with money muling (letting your account be used to receive or move scam money) and financial account sabotage. Heavier penalties apply when the scam is large-scale or when the victim is a senior citizen. You can read the full text of RA 12010 on LawPhil.

The law also gives the BSP power to investigate these cases and requires banks and e-wallets to have stronger fraud-management systems, including the ability to temporarily hold funds involved in a disputed transaction while it is being checked.

Always file your complaint with your bank first — this is the required first step. If the bank does not resolve it or you disagree with its decision, you can escalate to the BSP's Consumer Assistance Mechanism through BOB (BSP Online Buddy), its chatbot, which is reachable through the BSP website and the BSP's official Facebook page. BOB gives you a reference number and forwards your complaint to the bank.

Extra Protection: Settings That Make Scam Texts Less Dangerous

You cannot stop every scam text from arriving, but you can make them much less harmful:

• Use app-based approvals instead of SMS OTPs where your bank offers them — many Philippine banks and e-wallets now let you approve transactions inside the app, which a texted link cannot steal.
• Set low daily transfer limits in your banking app (for example, ₱10,000–₱20,000 if you rarely send more), so a single mistake cannot empty your account.
• Turn on transaction alerts for every debit, so you notice unauthorized transfers within seconds.
• Turn off 2G on Android phones that allow it (Settings → Network → "Allow 2G"), since fake cell towers commonly rely on the older, less secure 2G connection.
• Keep a separate savings account without online transfer access for most of your money, and only move what you need into your everyday account.

Note that the SIM Registration Act (RA 11934) helps trace scam numbers but does not stop spoofed sender names or IMSI-catcher texts, so these habits still matter.

Frequently Asked Questions

Conclusion

Fake bank texts work because they create panic and look official, but they almost always break one of a few simple rules: real Philippine banks do not send links, never ask for your OTP or PIN, and never force you to act within minutes. When a message feels urgent, slow down, open your bank's official app or call the number on your card, and report the scam to the 1326 hotline. If money has already been taken, call your bank immediately and file a written dispute — then escalate through the Bangko Sentral ng Pilipinas if the bank does not resolve it.