Social engineering drives 39% of PH banking fraud -

Social engineering scams account for 39% of fraudulent transactions and 36% of fraud-related losses in the Philippine banking industry, with fraudsters increasingly relying on deception to trick customers into transferring money or revealing sensitive information, according to the Bank of the Philippine Islands (BPI).

Citing year-to-date industry data during Cybersecurity Awareness Month 2026, BPI said voice phishing, or vishing, accounted for 21.3% of reported fraud incidents.

Malware and rogue applications represented 7.5%, followed by SMS phishing, or smishing, at 3%, and email phishing at 2%.

The figures point to the growing use of social engineering, in which scammers impersonate legitimate institutions or create a sense of urgency to persuade victims to disclose confidential information or authorize financial transactions.

BPI also flagged so-called authorized scams, in which victims are manipulated into transferring money themselves. Impersonation scams accounted for 10.3% of reported incidents, followed by investment scams at 2.7% and romance scams at 0.6%.

Emerging threats include artificial intelligence-assisted scams, deepfake impersonation, synthetic identities, and targeted fraud that uses personal information to make fraudulent communications more convincing.

The risks come as more Filipinos conduct banking transactions digitally. BPI has 10 million digital banking users, and more than half of its retail payment transactions are conducted through digital channels. Its platforms have facilitated more than 377 million transactions.

BPI said it is strengthening fraud monitoring, authentication, and account protection through additional security technologies.

One measure is Mobile Key Authentication, which replaces SMS-based one-time passwords with authentication tied to a trusted device and secured by a PIN or biometric verification.

The BPI app also imposes mandatory cool-off periods for certain high-risk account changes, giving customers time to identify and report potentially unauthorized activity.

Other safeguards include integrity checks that restrict access from rooted devices and certain VPN-enabled environments, as well as masked recipient names for transfers between BPI accounts.

The bank also warned customers against installing malicious Android application packages, or APKs, disguised as delivery notifications, government forms, and promotional offers.

Lost or stolen phones pose another risk because physical SIM cards can be transferred to other devices to intercept authentication codes.

BPI advised customers to enable SIM locks, consider switching to eSIMs, and secure their phones with strong passcodes and biometric authentication.

The bank is also working with the Philippine National Police Anti-Cybercrime Group and the Department of Information and Communications Technology on cybersecurity awareness and efforts to combat online fraud.

BPI said it is implementing safeguards under Republic Act No. 12010, or the Anti-Financial Account Scamming Act, which addresses financial account scams and related offenses.

“Cybersecurity is not responding to threats after they happen. It requires financial institutions to anticipate risks, continuously strengthen their defenses, and work together with the broader ecosystem to address fraud,” said Jon Paz, BPI head of enterprise information security and fraud risk management.

Sign-Up To Our !