Billions lost to scams? Why Filipinos still trust the wrong person online

MANILA — A familiar voice asks for money. A message appears to come from your boss. A video call shows someone who looks exactly like a colleague, a relative or a company executive.

Would you know if it were a scam?

Filipinos lost an estimated P121.8 billion to scams over a year, as fraudsters exploit people’s trust and increasingly turn to digital channels to get their victims to hand over money or personal information, according to a new industry-backed study.

The State of Scams Philippines 2026 report, conducted by the Global Anti-Scam Alliance (GASA) in collaboration with Mastercard and Gogolook, found that 84 percent of Filipino adults encountered at least one scam attempt in the past 12 months, up from 77 percent in 2025.

While 58 percent of respondents said they were confident they could recognize scams, 60 percent of those exposed went on to interact with a scammer. Fifteen percent of respondents reported financial losses, including losses resulting from the theft of personal information.

According to the report, digital wallets have also become a major channel for scam payments. Among respondents who lost money, 73 percent said fraudsters received payments through e-wallets.

The figures suggest that the challenge is no longer simply warning people not to click suspicious links. It is making sure that the person on the other end of a message, phone call or video conference is really who they claim to be.

Dominic Forrest, chief technology officer of iProov, a company specializing in biometric identity verification, says increasingly convincing artificial intelligence-generated deepfakes are making that distinction harder to establish.

During an interview on ANC’s Startupwith Ron Cruz, Forrest demonstrated how a person’s face can be digitally replaced in real time during a video call, allowing someone to appear as another individual.

The technology, he warned, can undermine the trust people place in familiar faces and voices, including during seemingly ordinary business conversations.

“…you could tell it was the phone, but you couldn’t tell who was authorizing the transaction,” Forrest said, explaining the problem iProov was founded to address.

Forrest said the threat extends beyond bank accounts and government identity systems. Criminals are increasingly targeting employee identities to gain access to corporate systems and information belonging to customers.

“Instead, they are social engineering businesses, large and small, to hand over the identities of people who’ve already got access to whatever it is they are trying to hack,” he said.

Social engineering involves manipulating people into revealing information, surrendering credentials or approving actions that benefit criminals.

For businesses, that could mean an employee being tricked into resetting an executive’s password, approving a payment or granting access to a system containing sensitive customer information.

The warning has particular relevance to the Philippines, a major global business process outsourcing hub whose employees handle customer support, financial processes and sensitive information for international clients.

Forrest said attackers are increasingly targeting identities within outsourcing companies to reach the systems and information of the businesses they serve.

“The outsourcing which is done in the Philippines impacts companies all over the world,” he said.

The risk is not limited to sophisticated deepfake attacks. Stolen credentials, impersonation and manipulated employees can all provide ways into systems that criminals would otherwise struggle to access.

Forrest cited incidents involving companies in which attackers allegedly impersonated legitimate personnel to obtain access credentials or persuaded executives to transfer money after video calls with people they believed they knew.

He pointed to the 2023 MGM Resorts cyberattack as an example of how attackers can exploit the process of resetting credentials to gain access to a company’s systems.

For Philippine businesses, the implications go beyond the immediate financial loss. A compromised employee account can expose customer records, disrupt operations, and damage the trust of international clients.

Forrest said companies should pay particular attention to high-risk activities, including large financial transfers, remote password resets, and requests to change access permissions.

He also cautioned against assuming that a company is safe simply because it has not detected a deepfake attack.

Forrest explained that unlocking a smartphone with a face or fingerprint is not necessarily the same as verifying a person’s identity for a sensitive transaction.

Device biometrics generally check whether the presented face or fingerprint matches information stored on the device. That does not automatically establish who is authorizing a payment or accessing a separate online service.

Identity verification can add another layer by comparing a person’s face against a trusted reference image while checking whether the person in front of the camera is genuine.

iProov uses machine learning and multiple layers of analysis to detect potential presentation attacks, including digitally injected deepfakes, Forrest said. But he stressed that the threat is constantly evolving.

The company monitors more than 130 forums where criminals discuss attacking banking systems, identity schemes and biometric security, he said. Its science team, he added, has nearly 50 people dedicated to analyzing attacks and strengthening defenses.

His message to businesses: security cannot be treated as a one-time software installation. Defenses must continue to adapt as attackers develop new techniques.

The challenge extends beyond criminals impersonating people. As businesses increasingly use AI agents to perform tasks, companies must also determine whether a sensitive action was genuinely approved by a human.

iProov has developed the Human Approval and Presence Specification, or HAPS, an open-source protocol designed to link a human’s approval to a specific action proposed by an AI agent.

The company made the specification publicly available in September. On October 22, iProov announced a new human-authorization service with initial integrations for agentgateway and Cerbos, intended to help organizations maintain human oversight of high-risk AI actions.

The service is designed to present a proposed action to an authorized person, verify that person’s presence, and issue cryptographically verifiable proof tied to the specific action. If critical details change, such as the amount or destination of a payment, the approval should no longer authorize the altered action.

The framework remains an emerging technology, not a guarantee against every form of fraud or unauthorized activity. Its effectiveness will depend on implementation and the broader security controls surrounding it.

Still, the underlying question is increasingly relevant as AI agents gain the ability to act on behalf of individuals and businesses: who gave the instruction, and did that person actually approve what happened?

The Philippine government’s own figures underscore the broader cybercrime problem. The Cybercrime Investigation and Coordinating Center (CICC) recorded 18,633 cybercrime complaints in 2025, including 6,453 consumer-fraud complaints. Reported losses from consumer fraud, online fraud, hacking, and phishing totaled P418.187 million.

For consumers, the practical safeguards remain straightforward: verify unusual payment requests through a separate, trusted channel; never share one-time passwords or authentication codes; and contact banks or payment providers immediately if an account or transaction appears compromised.

Businesses should establish independent approval procedures for large transfers, strengthen identity checks for account recovery, and restrict access to sensitive systems according to employees’ actual responsibilities.