Table of Contents
Key Takeaway
- 📊 16,619 phishing attacks hit the Philippines in H1 2026: The Viettel Cyber Security Cyber Threat Landscape Report recorded 16,619 phishing incidents nationwide in the first half of 2026, alongside 255 data breaches and approximately 335 million exposed records.
- 🔑 19.2 million credentials compromised: Filipino users’ login credentials — emails, passwords, and account details — were exposed in bulk, giving attackers ready-made access to banking, e-wallet, and social media accounts.
- 🤖 AI is making phishing more dangerous: Cybercriminals now use AI to create convincing deepfake voices, videos, and personalized phishing messages impersonating bank personnel, government officials, and even family members — making scams harder to detect.
- 🏦 Financial sector is the #1 target: Globally, financial services face 28% of all deepfake and AI-driven fraud attacks, with healthcare (19%), government (17%), and legal services (15%) following closely behind.
- 🛡️ Action plan: Never share OTPs, verify through official channels, set a family safe word, and enable multi-factor authentication on all financial accounts.
The numbers are in, and they are alarming. A new cyber threat report by Viettel Cyber Security has revealed that the Philippines endured 16,619 phishing attacks Philippines incidents in the first half of 2026 alone. The report, covering January through June 2026, also documented 255 data breaches, approximately 335 million exposed records, and more than 19.2 million compromised credentials nationwide. These are not projections or estimates — they are confirmed incidents recorded by one of Southeast Asia’s leading cybersecurity monitoring firms. For Filipino professionals who manage bank accounts, e-wallets, and online identities, the message is clear: phishing attacks Philippines are no longer a rare threat. They are a daily reality, and the tools used to launch them have become more sophisticated than ever.
What the Viettel Cyber Security Report Found
The Viettel Cyber Security Cyber Threat Landscape Report is a periodic analysis of cyber incidents across Southeast Asia. Its H1 2026 findings for the Philippines paint a picture of a country under sustained digital attack:
| Metric | H1 2026 Value | What It Means |
|---|---|---|
| Phishing attacks | 16,619 incidents | Attempts to steal credentials via fake websites, emails, and messages targeting Filipino users |
| Data breaches | 255 incidents | Confirmed cases where attackers accessed and exfiltrated data from Philippine organizations |
| Exposed records | ~335 million | Individual data records — names, emails, phone numbers, passwords — made accessible to attackers |
| Compromised credentials | 19.2 million | Login usernames and passwords stolen or leaked, providing direct access to user accounts |
To put these numbers in perspective: the Philippines has an estimated 86 million internet users. With 335 million exposed records, that averages nearly 4 exposed records per internet user. Not every record maps to a unique person — many are duplicates or partial entries — but the scale indicates that most Filipino internet users have had at least some personal data exposed during the first half of 2026.
How Phishing Attacks Philippines Work in 2026
Phishing is the practice of tricking someone into revealing sensitive information — passwords, one-time passwords (OTPs), banking details — by impersonating a trusted entity. In 2026, phishing attacks Philippines have evolved beyond the crude email scams of the past. Attackers now use a combination of social engineering, AI-generated content, and compromised infrastructure to create convincing lures. The phishing attacks Philippines data shows that these campaigns are increasingly sophisticated and targeted.
Common phishing vectors targeting Filipinos include:
- Fake GCash and Maya links: Phishing messages mimicking GCash account security alerts, asking users to “verify” their account via a link that leads to a fake login page. GCash has responded by replacing SMS OTPs with in-app OTPs as of June 22, 2026.
- DSWD e-fuel voucher scams: Messages claiming to be from the Department of Social Welfare and Development, offering “e-fuel vouchers” via clickable links. The DSWD has confirmed these are scams and never distributes assistance through unsolicited texts.
- Bank impersonation via SMS and Messenger: Messages from fake bank Facebook pages or Messenger accounts, complete with spoofed logos and verified-looking badges, directing users to phishing sites.
- Fake National ID and eGovPH apps: GCash has warned against scams involving fake National ID registration apps and fake eGovPH platforms designed to steal personal information.
- AI-generated voice calls: Deepfake voice technology clones the voice of a family member or boss, creating urgent requests for money transfers. These calls sound authentic and bypass traditional spam filters.
The AI Factor: Why Phishing Got Harder to Detect
The Viettel report highlights a critical shift: AI is now actively used by cybercriminals to enhance phishing attacks. According to the report’s findings, criminals are using AI to create convincing deepfake voices, videos, and personalized phishing messages that impersonate bank personnel, government officials, and even relatives.
This is not theoretical. In July 2026, security firm Sysdig documented the first known case of agentic ransomware — a ransomware attack where an AI agent autonomously executed the entire attack chain, from reconnaissance to encryption, without human intervention. The JadePuffer ransomware exploited a vulnerability in Langflow (CVE-2025-3248) and used a Large Language Model (LLM) to conduct credential theft, lateral movement, and data encryption. If AI can autonomously run a ransomware operation, it can certainly generate convincing phishing emails at scale.
Deepfake detection firm Pindrop estimates that three in 10 retail fraud attempts are now AI-generated, with some large chains reporting more than 1,000 AI bot calls per day, according to Fisher Phillips. The same technology that powers deepfake detectors is being used to create the very fakes those detectors are trying to catch — an arms race where defenders are always one step behind.
Which Sectors Are Most Targeted?
According to ZeroThreat AI’s 2026 deepfake attack statistics, the sector breakdown for AI-driven fraud and phishing attacks is:
| Sector | Share of Attacks | Primary Attack Method |
|---|---|---|
| Financial Services | 28% | Deepfake voice calls impersonating executives; AI-generated invoices and BEC scams |
| Healthcare | 19% | Fake patient portals and telehealth sessions; credential harvesting via AI-tailored emails |
| Government & Public Sector | 17% | Disinformation campaigns using deepfake videos; phishing attacks against civil servants |
| Legal & Professional Services | 15% | Law firms targeted for client data via AI-powered spear-phishing |
For the Philippines, the financial services sector is especially vulnerable. With over 50 million GCash accounts, millions of Maya users, and a rapidly growing digital banking sector, the attack surface is enormous. The smishing text scams that plagued Filipino users in 2025 have evolved into AI-personalized phishing that can reference specific bank names, account types, and even recent transactions — details attackers obtain from prior data breaches. This is what makes phishing attacks Philippines so dangerous: attackers combine stolen breach data with AI to create messages that look authentic.
The 19.2 Million Compromised Credentials Problem
Perhaps the most dangerous finding in the Viettel report is the 19.2 million compromised credentials. These are not just emails — they are username-password pairs that attackers can use to directly access accounts. Many Filipino internet users reuse the same password across multiple accounts, meaning a single compromised credential can unlock an email account, a GCash wallet, a BPI online banking profile, and a Facebook account simultaneously.
This is why email phishing scams targeting OFWs are so effective: attackers already have the credentials from a previous breach, and they use phishing to capture the one remaining barrier — the OTP or 2FA code. Once they have both, the account is theirs.
The 255 data breaches recorded in H1 2026 mean that Philippine organizations — banks, government agencies, e-commerce platforms, healthcare providers — are losing data at a rate of roughly one breach per day. Each breach feeds the credential pool, making the next round of phishing attacks Philippines more targeted and more convincing. The cycle is self-reinforcing: breaches feed phishing, phishing feeds account takeovers, and account takeovers lead to more breaches.
What Filipino Professionals Should Do Right Now
The threat is serious, but it is not unmanageable. Filipino professionals who take the following steps can significantly reduce their risk:
1. Enable Multi-Factor Authentication Everywhere
Turn on 2FA or MFA on every account that supports it — especially GCash, Maya, online banking, email, and social media. Use app-based authenticators (Google Authenticator, Authy) rather than SMS-based OTPs, which can be intercepted by SIM-swap attacks. GCash’s move to in-app OTPs as of June 22, 2026 is a direct response to SMS OTP interception — make sure your app is updated and push notifications are enabled.
2. Set a Family Safe Word
Choose a random phrase — not a pet’s name, not a PIN, not something that appears on social media. “Purple Octopus” or “Lego Teapot” — something you would never say in normal conversation. If someone calls claiming to be a family member in an emergency, ask for the safe word immediately. If they cannot provide it, hang up and call back on the known number. Voice spoofing depends on you staying on the line — breaking the connection breaks the attack.
3. Never Click Links in Unsolicited Messages
If you receive a text or message claiming to be from your bank, GCash, DSWD, or any government agency, do not click the link. Open your browser and type the official website address directly. If the message claims to be from GCash, open the GCash app — if there is a genuine alert, it will appear in the app. The DSWD has confirmed it never distributes assistance through unsolicited texts containing clickable links.
4. Check If Your Credentials Are Compromised
Visit HaveIBeenPwned.com and enter your email address. If it appears in a known breach, change your password immediately — not just on the breached account, but on every account that uses the same password. Use a password manager (Bitwarden, 1Password, or your browser’s built-in manager) to generate and store unique passwords for each account.
5. Report Phishing Attempts
Report phishing messages to the Cybercrime Investigation and Coordinating Center (CICC) or the PNP Anti-Cybercrime Group. GCash users can report scams directly through the GCash app’s GShield feature. Reporting helps authorities track phishing campaigns and shut down malicious infrastructure.
How the Philippines Is Responding
The Philippine government is not sitting idle. The CICC is proposing a budget of ₱1.5 billion for 2027, nearly double its ₱835-million allocation in 2026, amid the rising threat of AI-driven cyberattacks. The Cybersecurity Council of the Philippines, chaired by Donald Patrick Lim, has emphasized that cybersecurity is now an issue of national resilience — a cyberattack on one organization can quickly affect thousands more.
The Philippines has also launched a broad crackdown on deepfakes as AI drives identity fraud surge, with authorities coordinating with international partners to track and dismantle phishing operations. Republic Act No. 11930 explicitly covers AI-generated or deepfake sexual content, and the Cybercrime Prevention Act of 2012 (RA 10175) provides the legal framework for prosecuting phishing, identity theft, and online fraud.
The Bottom Line: Vigilance Is Your Best Defense
16,619 phishing attacks in six months. 335 million exposed records. 19.2 million compromised credentials. These are not numbers to scroll past. Every Filipino professional with a bank account, an e-wallet, or an online identity is a potential target. The tools have evolved — AI-generated phishing messages, deepfake voice calls, and automated credential stuffing — but the defense remains the same: verify before you trust, never share OTPs, and assume that any unsolicited message asking for your information is a scam until proven otherwise.
The phishing attacks Philippines recorded in H1 2026 are a warning. The second half of the year will likely be worse, as AI tools become more accessible and more powerful. But awareness is the first layer of defense against phishing attacks Philippines — and now you have it.
Frequently Asked Questions About Phishing Attacks Philippines 2026
How many phishing attacks hit the Philippines in 2026?
According to the Viettel Cyber Security Cyber Threat Landscape Report, 16,619 phishing attacks Philippines incidents were recorded in the first half of 2026. The report also documented 255 data breaches, 335 million exposed records, and 19.2 million compromised credentials.
What is the most common phishing scam in the Philippines?
The most common phishing scams in the Philippines target GCash and Maya users with fake “verify your account” messages, DSWD e-fuel voucher scams, and fake National ID registration links. AI-generated voice calls impersonating family members are also rising rapidly in 2026.
How can I protect myself from phishing attacks Philippines?
To protect yourself from phishing attacks Philippines, enable multi-factor authentication on all accounts, use app-based authenticators instead of SMS OTPs, set a family safe word, never click links in unsolicited messages, check your email on HaveIBeenPwned.com, and use a password manager for unique passwords on each account.
What should I do if I clicked a phishing link?
If you clicked a phishing link, immediately change your password for the affected account, enable 2FA if available, monitor your bank and e-wallet for unauthorized transactions, and report the incident to the CICC or PNP Anti-Cybercrime Group. If you entered your OTP, contact your bank or e-wallet provider immediately to freeze the account.
Why are phishing attacks getting harder to detect in 2026?
Cybercriminals now use AI to create convincing deepfake voices, videos, and personalized phishing messages that reference specific banks, account types, and even recent transactions. AI tools can generate thousands of unique phishing emails in minutes, making traditional spam filters less effective against phishing attacks Philippines.
Is GCash safe from phishing attacks?
GCash has improved security by replacing SMS OTPs with in-app OTPs as of June 22, 2026. However, no platform is fully immune to phishing. Users must still avoid clicking suspicious links, never share their MPIN or OTP, and only use the official GCash app from the Apple App Store, Google Play, or Huawei AppGallery.
What is the penalty for phishing under Philippine law?
Phishing is punishable under the Cybercrime Prevention Act of 2012 (RA 10175), which covers computer-related identity theft, fraud, and unauthorized access. Penalties include imprisonment of up to 12 years and fines of up to ₱1 million. AI-generated deepfake content involving minors is covered under RA 11930. Law enforcement is actively pursuing phishing attacks Philippines cases.
