Money Drained From Your GCash or Maya After a Phishing Link or Shared OTP: Containment, Reporting and Filing a Complaint

The first hour: lock, report, preserve, in that order

Once fraudsters hold your login details they usually move money in several transfers and come back for more. The order is therefore to cut off their access, notify the provider and preserve evidence, all within the first hour.

1. Change your MPIN. If you can still log in, do it now. If you are locked out, go straight to step three.
2. Sign out all other devices and remove any linked device you do not recognise. Check the security settings in the app. Change your email password too, because wallet reset messages are sent there.
3. File an unauthorised transaction report through the in-app help centre or the official website. Use only the entry inside the app or an address you type yourself. Do not use a phone number from a search result or reply to a 'support agent' who messages you on social media. State the time, amount, reference number and recipient of each transfer and ask explicitly for restrictions on the receiving account. Get a ticket number.
4. Deal with linked funding sources. If a bank account or card is linked for automatic cash-in, ask the bank to suspend online use of that card or unlink it, and check whether money has been pulled from the bank side.
5. Take screenshots. Save the transaction history, the messages you received, the link you tapped, the sender's number and any chat. Do not delete the scam message. It is evidence.
6. Check credit and loan features. Some wallets have built-in credit lines or loan products, and a fraudster may borrow in your name and transfer the proceeds out. If you do not dispute that promptly it becomes a debt in your name.

If the other party is still talking to you, do not confront them, do not tap anything else and do not follow any instruction to 'move your money to a safe account'. Once the six steps are done, write a short timeline while your memory is fresh, because you will be asked for it by the provider, the bank and the police, and the three accounts need to match.

Can the money be recovered? An honest answer turns on two things

Nobody can promise an outcome, but the odds can be judged. Two points matter most: whether the money is still sitting in the receiving account, and whether the transfer was completed with a code you entered or disclosed yourself.

• The money is still in the receiving account. After a report, the wallet operator can restrict that account and may return the funds once the investigation supports your claim. This is why speed matters. Fraud accounts typically move money to other wallets or banks, or cash it out, within minutes or hours.
• The money has been passed through several accounts. The chances fall sharply. Tracing depends on law enforcement obtaining records from each institution, which takes a long time.
• You gave out the code. The provider is likely to argue the transfer passed the correct MPIN and OTP and was therefore authorised. You will need to explain that you were deceived into providing it, making you a fraud victim and not a willing sender. Results vary from case to case, and you should be prepared for a refusal.
• A system fault, or you did nothing at all. If no code arrived and you tapped nothing, yet the money disappeared, the provider's responsibility is heavier. Stress this in the report and ask for login and device records.

The Philippines has tightened legislation on financial account fraud in recent years. Financial institutions are required to maintain fraud controls and may temporarily hold disputed funds after a report. How this applies in a given case depends on the current law and the regulators' implementing rules. That gives you a basis for demanding action, but it does not mean the provider must reimburse you.

If you are refused, you can escalate to the central bank's consumer assistance mechanism, provided you have first complained formally to the wallet operator and hold a ticket number. Ask for the refusal in writing, with reasons, since a bare 'your request cannot be processed' message is not something a regulator can review properly.

Filing a complaint: where, with what, and what it achieves

Reporting to the provider and reporting to law enforcement are separate tracks and should run together. A police report will not bring the money back by itself, but it is the document providers and banks most often ask for before going further, and the one you will need later to deny any debt opened in your name.

1. Report to the police anti-cybercrime unit or the cybercrime division of the National Bureau of Investigation. Both accept online financial fraud. Choose whichever is nearer and can take a statement in person. For the full list of bodies and their requirements for electronic evidence, see reporting online fraud in the Philippines.
2. Bring a complete set of documents. Passport or ACR I-Card, the mobile number registered to the wallet, screenshots of the transactions with reference numbers, the scam message and link, chat logs and the provider's ticket number. Print a set and keep an electronic copy on your phone.
3. Prepare an affidavit. Set out in order what you received and when, what you tapped, what you typed, and when you noticed the balance change. Stick to facts and do not speculate about who was behind it. You can have it prepared by a notary public beforehand or complete it in the receiving unit's format on the day.
4. Obtain an acknowledgment or case number and pass it to the wallet provider and any bank involved.
5. Report the scam number to the telecom operator, and if there are signs that your own number has been reassigned, block it at the same time.

The process is the same for foreigners as for locals. If language is a barrier, bring someone who speaks English or Tagalog. A neighbourhood station will usually log the incident first and refer you to the cybercrime unit. The difference between the two kinds of record is explained in how to report to the police in the Philippines.

To be honest, the clear-up rate for this type of case is low, especially for small sums. Without a report on file, however, almost every later step gets stuck.

The losses people overlook: loans, linked accounts and your identity documents

The balance is only the most visible loss. If someone could log in to your wallet, they may also hold your ID photos, your mobile number and a way into other accounts. Check each of these in turn.

• Loans and credit lines inside the wallet. Look for any new loan, instalment plan or buy-now-pay-later order. If you find one, dispute it in writing at once, state that it arose from unauthorised access and attach the police acknowledgment.
• Linked banks and cards. Check for unfamiliar cash-ins or debits. Dispute unknown card charges with the issuer under the card fraud process; see what to do about unauthorised card charges.
• Other services using the same number or password. Change passwords on online banking, shopping platforms and social accounts and turn on two-factor authentication. Hijacked social accounts are often used to ask your friends for money; see what to do when a Facebook account is hacked.
• Leaked identity documents. If you uploaded a passport or selfie to the fake page, it may be used to open accounts or borrow elsewhere. Watch for unexpected collection calls over the following months; see what to do when a loan is taken out in your name.
• Your account used as a pass-through. Fraudsters sometimes send money into your account before moving it on. That can cause your account to be flagged or frozen. Tell the provider proactively and do not touch money that is not yours.

Working through this list and keeping a written record is worth far more than repeatedly calling support to ask when the money will be back. It also protects you later: if a lender or a collection agent contacts you months afterwards about an account you never opened, you will be able to show the date you discovered the breach, the date you reported it and the steps you took, which is usually what decides whether the claim against you is dropped.

The second scam: whoever offers to get the money back is usually the next problem

The days after a loss are when you are most likely to be defrauded again. Ignore anyone who approaches you unprompted, claims to be able to recover the money, and asks for an upfront fee or a verification code.

• The fake support follow-up. After you post about the problem or comment on a provider's page, someone posing as official support messages you with a link to 'verify your identity for the refund'. A genuine provider never asks for your MPIN or OTP by private message.
• 'Hackers' and 'recovery teams'. They claim they can locate the fraudster and freeze the funds in reverse, in exchange for a technical fee or deposit. No such service exists.
• Impersonated officers. Someone claiming to be from the police or an investigating agency says your case has progressed and a processing fee is needed to release the money. Law enforcement does not charge in this way. For how to tell, see calls impersonating officials.
• Victim groups built around 'the same scammer'. Some are real. Others are run by fraudsters to sell the services above.

The test is simple. The legitimate routes are a complaint to the provider, a dispute with your bank, a report to the police and legal action through a licensed attorney. None of them requires you to pay a stranger in advance. For the fuller sequence of stopping payments, gathering evidence and pursuing recovery, see what to do after being scammed in the Philippines.

Do not keep the incident from your family out of embarrassment. Fraudsters sometimes use your details to contact relatives and friends, and a word in advance can stop a second person being caught. If you belong to community chat groups, a short factual warning that your account was compromised, with no accusations and no personal details of anyone else, is enough. It prevents people from trusting messages sent in your name and avoids the legal risk that comes with publicly naming someone you only suspect.

Safer habits, and what Yixing can do

This type of fraud depends on one thing only: getting you to type your MPIN somewhere else or say your code aloud. One rule covers it. No genuine provider will ever ask for your MPIN or OTP by text, phone call or chat.

1. Do not tap links in text messages, whatever they say about account problems, expiring points or parcels. If action is needed, open the app yourself.
2. Keep only day-to-day money in the wallet. Leave larger sums in the bank and do not enable automatic cash-in.
3. Turn on biometrics and transaction alerts and review the list of linked devices from time to time.
4. Use different passwords for the wallet, email and online banking, and enable two-factor authentication on email.
5. Keep the registered mobile number active and properly registered. A number that lapses or is recycled leaves you unable to verify your identity when something goes wrong.
6. A point for foreigners: the verified details on the account must match your current documents. An expired ID or a new passport that was never updated makes any appeal much harder. For account opening and verification, see opening GCash and Maya as a foreigner.

Yixing is a consulting company registered with the Philippine Securities and Exchange Commission (SEC Registration No. CS202009551). It holds Bureau of Immigration accreditation (BI Accreditation No. CA-202624381-1, valid to 2027-06-30), DOLE accreditation and PRA accreditation. We are not a payment institution, a law enforcement body or a law firm, and we cannot recover funds or promise a result. We can help clients who are less comfortable in English to organise the timeline and report, prepare and translate a draft affidavit, accompany them to file a complaint and refer them to a licensed attorney where needed. See Yixing's settling-in support. A neighbouring situation such as sending money to the wrong account yourself follows different logic and should not be handled the same way.

Consult a licensed attorney for your specific case; this article is not legal advice.