SIM Swap in the Philippines: What to Do When Your Number Is Hijacked and GCash or Bank Accounts Are Drained

Recognise it: SIM swap, ordinary deactivation or a network fault

Bottom line: no service plus account activity you did not authorise, appearing together, means a hijacked number. No service on its own is usually coverage or an unpaid balance.

A SIM swap happens when someone impersonates you and persuades the carrier to move your number onto a new card in that person's hands. Your own card dies at once and every call and SMS code goes to the other phone. Three signs are typical. People around you have normal signal while only your card shows no service or emergency calls only. Restarting and moving the card to another slot change nothing. Your email or other apps show password resets, new device logins or completed transfers you never made.

Separate this from two other situations. One is a number deactivated for incomplete registration or long inactivity, which comes without any account anomaly and is covered in what to do when a Philippine SIM is deactivated. The other is a regional outage, which affects other subscribers of the same network too.

A related attack leaves the card alone and instead tricks you into reading out a code or switching on call forwarding. The result is identical: the code lands with someone else. Whatever the method, the single test is whether an account has done something you did not authorise. If it has, stop investigating causes and move straight to damage control. Many residents in the Philippines tie one number to an e-wallet, online banking, email and social accounts all at once, so losing the number sets off a chain reaction, and that is exactly what the attacker is counting on.

The first 24 hours: carrier, wallets, banks, email

Bottom line: work in the order number, money, email, other accounts, and collect a reference number at every step. The order follows how fast each loss can grow.

First, borrow a phone from family or a colleague and call the carrier's hotline, or walk into the nearest store, and state that the number appears to have been swapped without authorisation and must be suspended immediately. Note the reference number and the time of the call.

Second, contact the e-wallets. GCash and Maya both have dedicated channels for compromised accounts; ask for a temporary freeze and explain that the number has been hijacked. How to unfreeze later is covered in the guide to a frozen GCash account.

Third, contact every bank and card issuer linked to that number. Ask them to freeze online banking, block the cards and register a dispute for transactions that were not yours. The card side is explained in what to do about unauthorised card charges.

Fourth, from a safe device change your email password, move two-step verification from SMS to an authenticator app and remove that phone number as a recovery option. The mailbox is the master key to everything else; losing it undoes the earlier steps.

Fifth, go through social and shopping accounts one by one, changing passwords and signing out unknown devices. If a social account has already been taken, follow the recovery steps for a hacked Facebook or Instagram account.

Screenshot throughout: the no-service screen, each alert, and the time and reference number of every hotline call. This record becomes the backbone of your dispute.

Getting the number back: in person, with the documents used at registration

Bottom line: the number is restored after the carrier verifies you in person against the original registration documents. The hotline can usually only suspend it.

The Philippines requires SIM registration, and ownership follows the registered details. At the store, staff generally check the identification used at registration, which for a foreigner is normally the passport together with proof of status such as an ACR I-Card; postpaid subscribers are also checked against their account records. In some cases an affidavit of loss or theft is requested, and the format is described in how affidavits work in the Philippines. The exact list is whatever the carrier currently requires.

Be ready for some practical difficulties. If someone else registered the number for you, or the registered details no longer match your current documents, verification becomes hard, which is why a number should always be registered under your own identification. A prepaid card that was never registered may be impossible to attribute to you. Restoration also takes time, during which you receive no codes at all, so change the verification method on each account in parallel.

While at the store, ask for a written note or record stating when the number was swapped and when it was restored. That document is central evidence when you tell a bank or wallet that a transaction was not yours. You may also ask how the swap was processed and lodge a formal complaint. If you suspect your personal data has been leaked or used to open accounts, continue with what to do when your identity is used for loans or accounts.

Money already gone: dispute with the wallet and bank, and file a report

Bottom line: submit a written unauthorised-transaction dispute to each paying institution as early as possible, attaching the carrier's record and the police acknowledgement. Whether funds are returned depends on their investigation, and this article promises nothing.

The dispute should state which transactions are contested, when they occurred, that your phone had no service at that moment, and when you notified the carrier and the institution. A clean timeline is the strongest indication that you did not initiate the transfers. Keep every ticket number and ask for verbal answers to be confirmed by email.

The institution's finding may disappoint you. If so, the financial regulator in the Philippines operates a consumer complaint channel that can be used after the institution's internal process is exhausted, and complaints about the carrier belong with the telecommunications regulator. Entry points and requirements are those each agency currently publishes.

File a report as well. A SIM swap is a cybercrime handled by the specialised units of the police and the national investigation agency; the evidence and filing steps are in reporting online fraud in the Philippines. The acknowledgement is less about catching the offender than about being the document banks and wallets expect to see with a dispute.

If the money went to another Philippine account, early reporting improves the chance that the receiving account is frozen. The broader recovery approach is in what to do after being scammed in the Philippines. Where the amount is large or the institution refuses responsibility, consult a licensed lawyer; this article is not legal advice. Keep copies of everything you file, because you may need to present the same timeline to several different offices.

How attackers pull it off, and who gets targeted

Bottom line: a successful swap usually needs your personal details plus one failed verification step, and the details were often handed over by you somewhere else. Knowing the entry points shows what to repair.

There are four common entry points. Phishing: texts and links posing as a carrier, bank or courier that ask for your name, birthday, number and a code. Phone pretexting: a caller claiming to be customer service who offers to upgrade your SIM, re-register it or deliver a reward, and walks you into reading out a one-time code. Data leakage: passport photos, phone numbers and addresses left behind in forms, group chats, rental and job applications, later pieced together. Device loss: a phone lost or stolen and not reported, with the card simply removed and used; that scenario has its own sequence in what to do first when a phone is stolen.

Certain habits attract attention. Showing a large wallet balance or a payment code in public. Running a business with frequent money movement such as currency exchange or paying on behalf of others. Linking every account to one number. Displaying your birthday and phone number on social media.

Two rules of thumb hold up over time. Anyone who contacts you first and asks for a code is a fraudster, because legitimate institutions do not do that. And any message insisting you must act immediately or face disconnection or a freeze should be ended at once, after which you find the official hotline yourself through the official app or website and check. The registration rules themselves are covered in the SIM registration and deactivation guide. This article names no particular channel or person; it describes patterns, because patterns stay valid long after any specific list would be out of date.

Hardening your setup, and what Yixing can and cannot do

Bottom line: demote the phone number within your verification setup so that losing it does not mean losing everything. That is the single most effective defence against a SIM swap.

In practice: move two-step verification for email and social accounts to an authenticator app or passkeys and store the backup codes; set a PIN on the SIM so a lost phone does not hand over a working card; ask the carrier whether extra identity checks can be added to your account; turn on biometric login and transaction alerts in wallets and banking apps and keep limits at a level you actually need; and if you move money often, use one number for daily payments and a different one for the accounts holding larger balances.

Register the number under your own identification and keep the confirmation screenshot or receipt. When your Philippine status documents are renewed, update the records at your bank and wallet too, since consistent records are how you later prove the number is yours.

Do not post photos of your passport or I-Card in group chats. When a copy is truly required, overlay a watermark stating its purpose.

What Yixing can do. We cannot restore a number with a carrier or make any institution refund you; those steps must be taken by you through official channels. What we do is keep your identity documents, local registrations and account records in the Philippines consistent, and explain what to prepare and which type of office to approach when you need an affidavit, proof of identity or a report. Yixing holds SEC registration and Bureau of Immigration accreditation and is not affiliated with any carrier or financial institution. For any individual case consult a licensed lawyer; this article is not legal advice.