Clicked a Phishing Link? What to Do Now in the Philippines

Last materially reviewed: September 6, 2026

Direct Answer

Close the page and change the password of the account you were asked to log into — from a different device, not the one you clicked on. Then work out what you actually gave away: nothing, a password, a one-time PIN, or card details. If money moved, call your bank or e-wallet immediately and dispute the transaction, because Republic Act No. 12010 lets an institution hold disputed funds while it verifies.

Key Takeaways

Opening a page is far less serious than entering credentials or installing an app. Establish which one happened before doing anything drastic.
A one-time PIN is the most dangerous thing to have disclosed. It can authorise a login, a device enrolment, a password reset or a transfer.
If money left an account, disputing it with the institution is the only step with a time-limited window. Under RA 12010, Section 7, funds of a disputed transaction may be held for up to thirty calendar days.
Screenshot the message and copy the link as text before you delete anything — but never reopen the link to capture it.
Every financial provider must give you free consumer assistance under RA 11765, Section 8(f), and there is a regulator above it if it fails you.
Clicking a link is not a crime you committed. Sending it is the offence, and it is chargeable under RA 10175 and related laws.

Keep a private account incident log of suspicious activity, security changes and support ticket numbers while you work through these steps.

The first hour, in order
Decision snapshot
Governing law and authorities
What the law criminalises, element by element
Exceptions, boundaries and no-jurisdiction situations
Hypothetical scenarios
Evidence and documentation
Reporting procedure
Remedies and realistic outcomes
Common mistakes
First-hour containment checklist
FAQs

The First Hour, in Order

Close the page. Enter nothing further. Do not complete a form “to see what happens,” and do not tap any button on the page, including one that says cancel.
Put the device on a different network or offline if you installed anything or the page pushed a download. If you only viewed a page, this is not necessary.
Establish what you disclosed. Nothing? A username and password? A one-time PIN or authentication code? A card number, expiry and CVV? Your identification details? Each answer leads to a different response, and guessing wastes the window.
Change the password from a second, trusted device. Do not change it on the device you used if you suspect software was installed — a compromised device can capture the new password too.
Sign out of all other sessions and revoke unknown devices. Almost every major service has this in its security settings. Changing a password without ending existing sessions can leave an attacker logged in.
Change the same password everywhere else you used it. Credential reuse is how a single phishing click becomes five compromised accounts.
Check your recovery settings. Confirm the recovery email address and phone number are still yours, and that no unfamiliar authenticator or backup method has been added. Attackers change these to lock you out.
Enable multi-factor authentication if it was not already on, preferring an authenticator app over SMS.
If financial details were disclosed, contact the bank or e-wallet now. Use the official app or the number on the back of your card. Ask them to block the card or secure the account, and dispute any transaction you did not authorise.
Preserve the message before deleting it. Screenshot it in full, copy the link as text without opening it, and record the sender number or address.
Do not reply to the sender. A reply confirms the number or address is live and invites a follow-up approach.
Watch for the second wave. Someone claiming to be from your bank’s fraud team, or offering to recover your money for a fee, is the same operation continuing.

Decision Snapshot

Situation	What applies	What changes it	Next step
You opened the page but entered nothing	No account compromise indicated	Whether a download started automatically or a profile was installed	Update the device, monitor accounts, keep the evidence
You entered a username and password	Credential exposure; RA 10175 Section 4(a)(1) illegal access if the account is used	Whether multi-factor authentication is enabled and whether the password is reused	Change the password from a trusted device, end all sessions, enable MFA
You gave a one-time PIN or approved a prompt	RA 12010 social engineering conduct; RA 10175 Section 4(a)(1)	How much time has passed — codes are used within minutes	Contact the service urgently and lock the account
You entered card or bank account details	RA 8484 where an access device is used; RA 12010 fund-hold route	Whether a transaction has already posted	Block the card, dispute any transaction, request replacement credentials
You installed an app, APK, extension or profile	Potential device compromise; RA 10175 Section 4(a)(1) and Section 4(b)(2)	Whether accessibility or device-administrator permissions were granted	Stop using the device for logins; secure accounts from a second device
Money has already left your account	RA 12010 Sections 7 and 8; RA 11765 consumer assistance and escalation	Whether funds remain in the receiving account	Dispute immediately, then file a cybercrime complaint

Governing Law and Authorities

RA 12010 — what actually reaches the money

Republic Act No. 12010, the Anti-Financial Account Scamming Act, is the provision most phishing victims have never heard of and most need. Section 7 gives institutions authority to temporarily hold the funds subject of a disputed transaction for a period the Bangko Sentral ng Pilipinas prescribes, which may not exceed thirty calendar days unless extended by a court, and requires the institution to notify the BSP promptly when it does so. A transaction becomes disputed where the institution has reasonable ground to believe it is unusual, without clear economic purpose, from an unknown or illegal source, or “facilitated through social engineering schemes” — which is precisely what phishing is.

The trigger can be “a complaint, from an aggrieved party.” Your call starts it. Section 8 then requires the institutions and account owners involved to run a coordinated verification process and expressly disapplies the Bank Secrecy Law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act and the Data Privacy Act during that verification, so a sending institution can now discuss a suspect account with the receiving institution.

RA 11765 — the complaint and escalation path

Republic Act No. 11765 requires every financial service provider to establish a single consumer assistance mechanism giving free assistance to financial consumers (Section 8(f)). Section 5 identifies the enforcing regulators: the BSP, the Securities and Exchange Commission and the Insurance Commission, with the Cooperative Development Authority for cooperatives. Section 6(f) allows the BSP and the SEC to adjudicate purely civil claims solely for payment not exceeding ten million pesos, and Section 6(d)(6) permits an order for accounting and disgorgement of profits obtained or losses avoided.

In practice this means: complain to your provider, keep the ticket number and every written reply, and escalate to the supervising regulator if the provider fails to resolve it. The BSP website blocks automated retrieval, so confirm the current escalation channel and forms on bsp.gov.ph directly, or ask your provider for the escalation details it is obliged to give you.

RA 10175, RA 8484 and RA 11934

Republic Act No. 10175 supplies illegal access under Section 4(a)(1), computer-related fraud under Section 4(b)(2) and computer-related identity theft under Section 4(b)(3). Section 6 raises by one degree the penalty for Revised Penal Code offences committed through information and communications technologies, which is the route by which a phishing-enabled theft of money is charged as estafa under Article 315 with an elevated penalty. Section 13 requires service providers to preserve traffic data and subscriber information for a minimum of six months from the date of the transaction — a practical deadline on how long you can wait before reporting.

Where a card number, PIN, account number or similar credential was captured, RA 8484, the Access Devices Regulation Act, may apply. Section 3 defines an access device to include a card, code, account number, electronic serial number or personal identification number used to obtain value or initiate a transfer of funds, and Section 9 makes it unlawful to obtain money or anything of value through an access device with intent to defraud.

Where the phishing arrived by SMS, RA 11934, the SIM Registration Act, is relevant. Section 6 requires public telecommunications entities to provide user-friendly reporting mechanisms for potentially fraudulent texts or calls and, upon due investigation, to deactivate the SIM used. Section 10 allows a PTE to disclose subscriber information only on a subpoena issued by a competent authority pursuant to an investigation based on a sworn complaint that the number was used in the commission of a crime.

What the Law Criminalises, Element by Element

Illegal access — RA 10175, Section 4(a)(1)

The elements are simple: access to the whole or any part of a computer system, and that the access is without right. Consent obtained by deception is not real consent, so a person who logs into your account using a password you were tricked into typing has accessed it without right.

Computer-related fraud — RA 10175, Section 4(b)(2)

This requires unauthorised input, alteration or deletion of computer data or a program, or interference in the functioning of a computer system; damage caused thereby; and fraudulent intent. It fits manipulation of the system. Where the offender simply used stolen credentials to move money, prosecutors may instead frame the case as estafa committed through ICT under Section 6.

Social engineering — RA 12010, Sections 4(b) and 5

RA 12010 addresses obtaining sensitive identifying information of another person through deception or fraud, resulting in unauthorised access and control over that person’s financial account. The Act describes sensitive identifying information as information usable to access a financial account, such as usernames, passwords, bank account details, credit card and e-wallet information and other electronic credentials. Section 4(a) separately criminalises money muling — using, borrowing, opening under a fictitious name, buying, renting or selling financial accounts to handle proceeds of such schemes. Section 5 sets imprisonment of not less than four and not more than six years, or a fine of at least one hundred thousand and not exceeding two hundred thousand pesos, or both. Section 4(c) escalates to economic sabotage where three or more persons act together, where there are multiple victims, or where mass mailers are used.

Exceptions, Boundaries and No-Jurisdiction Situations

A click alone is usually not a compromise. Most consumer phishing depends on you typing something or installing something. Treat the click seriously, but do not wipe a phone over a page you merely opened.
You are not the offender. Being phished is not an offence. Nothing here creates exposure for you.
The fund hold is not a refund. RA 12010, Section 7 freezes funds while verification runs. It does not order money back, and it achieves nothing if the balance has already been withdrawn.
Restitution under RA 12010 is fault-based. Section 6 makes an institution liable for restitution where it failed to employ adequate safeguards. That is a claim about the institution’s conduct, not an automatic entitlement.
Regulators do not prosecute. The BSP and SEC supervise institutions under RA 11765. They will not investigate or arrest the person who phished you.
RA 11765 adjudication has limits. Section 6(f) covers claims that are purely civil, solely for payment, and not exceeding ten million pesos.
A telco will not tell you who owns a number. RA 11934, Section 10 requires a subpoena based on a sworn complaint.
Jurisdiction needs a Philippine connection. RA 10175, Section 21 gives Regional Trial Courts jurisdiction over offences by a Filipino national wherever committed, and where an element occurred here or a computer system located here was used. Purely offshore infrastructure means slow, uncertain cooperation.

Hypothetical Scenarios

These are illustrative examples, not real cases, and not predictions of outcome.

Hypothetical 1: The parcel-fee text

A text says a delivery is held pending a small fee and links to a page imitating a courier. The recipient enters card details. Within an hour two charges appear. Because a card number was used to obtain value with intent to defraud, RA 8484 is engaged alongside RA 10175. The cardholder blocks the card, disputes both transactions with the issuer, and asks for the disputes in writing. Under RA 12010, Section 7 the issuer may hold funds still identifiable in the receiving account, but card charges already settled to a merchant follow the card scheme’s own chargeback process instead.

Hypothetical 2: The e-wallet verification page

A message warns that a wallet will be suspended and links to a login page. The user enters the password and then the one-time PIN. Money leaves the wallet in minutes. Obtaining sensitive identifying information through deception to gain unauthorised control of a financial account is squarely within RA 12010, and the access itself is illegal access under RA 10175, Section 4(a)(1). The user calls the provider immediately, disputes the transfers, and files with the NBI Cybercrime Division.

Hypothetical 3: The installed app

A page persuades a user to install an APK to “verify” an account. The app requests accessibility permissions. Afterwards, banking notifications stop arriving and transfers appear. The device itself is compromised, so the user secures every account from a separate device, removes the app, and treats all credentials entered on that phone as exposed. Interference with the functioning of a computer system causing damage with fraudulent intent points to RA 10175, Section 4(b)(2).

Evidence and Documentation

A screenshot of a text message is the starting point, not the case. Collect each of these separately:

Screenshots — full-screen, showing the sender, the message and the visible date and time, not a cropped fragment.
The message export — where the messaging app or email client allows export, use it; the export retains metadata a screenshot discards.
The URL as text — copy the link into a note without opening it. The full URL, including everything after the domain, is what an investigator needs.
The sender identifier — the mobile number, sender ID, email address or account handle, recorded separately from the display name.
Email headers — if the approach came by email, save the original message with full headers rather than a forwarded copy.
Transaction reference numbers — for every unauthorised transaction: the reference, amount, exact date and time, and the receiving account or wallet name and number.
Timestamps — when the message arrived, when you clicked, when you entered anything, and when each transaction posted.
Device logs — login history, active session lists, device-authorisation records, and the install date of any app you were persuaded to add.
The institution’s written response — your dispute ticket number, every reply, and any written refusal. This is what makes an escalation under RA 11765 possible.

Preserve before you block or delete

The instinct is to delete the message and block the sender. Do it in the opposite order: capture, export, copy the URL as text, record the sender identifier, and only then block and delete. Deleting the thread destroys the sender identifier and the timestamp. Never reopen the link to take a better screenshot. Keep original files rather than photographs of a screen, and write a short chronology while it is fresh. See electronic evidence preservation and whether screenshots are admissible evidence. Bear in mind the six-month preservation minimum in RA 10175, Section 13 — delay can outlast the provider records an investigator would need.

Reporting Procedure

Report to the platform or sender’s channel. Report the message inside the messaging app or email service, and report a fraudulent SMS or call to your telecommunications provider, which RA 11934, Section 6 requires to offer a reporting mechanism and to deactivate the SIM after due investigation. Save any confirmation.
Dispute with your financial institution. Contact the provider through its official app, website or published number — never a number from the phishing message. Use the words “disputed transaction,” give the receiving account details and reference numbers, and ask what its consumer assistance mechanism requires under RA 11765, Section 8(f). GCash publishes its current support routes at help.gcash.com; for other providers, use the help centre reached from inside the official app.
Get everything in writing. Ask for the dispute reference number, the expected timeline, and the outcome or refusal in writing.
Escalate to the regulator if the provider fails you. Under RA 11765, Section 5, banks and e-money issuers sit with the BSP, investment solicitations with the SEC, insurance with the Insurance Commission. Bring the full ticket history and verify the current filing channel on the regulator’s own site.
File the criminal complaint. Go to the NBI Cybercrime Division or the PNP Anti-Cybercrime Group. The NBI’s published citizens charter for investigative assistance for victims of computer crimes lists no fee and no formal document checklist, but the process involves a preliminary interview and the execution of a sworn statement or submission of a prepared affidavit. That sworn complaint is also the precondition for a subpoena under RA 11934, Section 10 where a mobile number is involved. The NBI main office is at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, hotline (02) 8523-8231. The PNP Anti-Cybercrime Group publishes at acg.pnp.gov.ph; confirm your nearest office and its intake requirements before travelling.
Follow up in writing. See what happens after reporting cybercrime.

If the outcome was that money was taken from you by a seller or a scheme rather than by account takeover, follow the online scam complaint procedure. If your account was taken over, see unauthorized account access and, for social accounts, hacked Facebook account. If the attacker is now using your identity against your contacts, see fake accounts and impersonation.

Remedies and Realistic Outcomes

Platform and provider

A messaging service may remove the sender; a telco may deactivate a SIM after investigation under RA 11934, Section 6. Both reduce the attacker’s reach. Neither returns money and neither identifies the person.

Administrative and regulatory

Under RA 11765, a regulator may adjudicate a purely civil claim solely for payment up to ten million pesos (Section 6(f)) and may order disgorgement (Section 6(d)(6)). Under RA 12010, Section 6, an institution that failed to employ adequate safeguards may be liable for restitution. These act on the institution, not on the attacker, and they require a documented complaint history with the provider first.

Civil

A civil claim against the attacker is only realistic if they are identified and have assets. RA 12010, Section 17 provides for restitution for the damage done in favour of the aggrieved party. Article 20 of the Civil Code obliges a person who wilfully or negligently causes damage contrary to law to indemnify the injured party.

Criminal

A complaint may lead to investigation, prosecutorial review and, if an information is filed, trial. RA 10175, Section 8 sets imprisonment or a fine of at least two hundred thousand pesos for Section 4 offences, and RA 12010, Section 5 sets four to six years or a fine of one hundred thousand to two hundred thousand pesos. No one can promise an arrest, a prosecution or a conviction.

The honest position on getting your money back

The realistic best case is that you called your provider fast enough that funds were still sitting in the receiving account and could be held under RA 12010, Section 7. Once money has been cashed out, converted or layered through mule accounts, recovery is difficult and frequently impossible. Criminal proceedings punish; they do not reimburse. Report anyway — it is how mule accounts are identified and repeat operations are linked — but plan your finances on the assumption that the money is gone.

Common Mistakes

Calling the “bank hotline” printed in the phishing message, which connects you to the same operation.
Changing the password on the device that may be compromised, so the new password is captured too.
Changing the password but not ending existing sessions, leaving the attacker logged in.
Deleting the message and blocking the sender before capturing the URL and sender identifier.
Reopening the link to take a screenshot.
Ignoring password reuse, so one exposure cascades across accounts.
Waiting to see whether anything happens before calling the bank, which wastes the only time-limited window.
Paying a “recovery agent” who contacts you afterwards. That is the second stage of the same fraud.
Factory-resetting a phone immediately, destroying device evidence when nothing was installed.

First-Hour Containment Checklist

Work down the list. Do the capture steps before the delete steps.

Page closed; nothing further entered.
What was disclosed identified and written down: nothing / password / OTP / card details / identification.
Second trusted device in hand for the security changes.
Password changed on the targeted account.
All other sessions signed out and unknown devices removed.
Recovery email, recovery phone and authenticator settings checked for unfamiliar entries.
Multi-factor authentication enabled.
Reused password changed on every other account that shared it.
Bank or e-wallet contacted from the official app; card blocked if card details were given.
Every unauthorised transaction disputed, with a written reference number obtained.
Message screenshotted in full; URL copied as text without reopening.
Sender number or email address recorded separately.
Any suspicious app, extension or configuration profile removed, and its permissions reviewed.
Device operating system and browser updated.
Fraudulent SMS or call reported to the telecommunications provider.
One-page chronology written with dates and times.
Agency complaint filed if money was lost or an account was taken over.

Credential-fraud authority: When phishing captures or uses a card number, PIN, account code or similar credential, review the amended Access Devices Regulation Act.

Governing authority: When phishing results in a fraudulent transfer or the use of mule accounts, the RA 12010 financial-account scamming framework may apply alongside cybercrime and fraud laws.

Frequently Asked Questions

Can my phone be hacked just by opening a link?

It is possible in sophisticated attacks, but ordinary consumer phishing still relies on getting you to enter credentials, approve a prompt, or install something. Focus on what you actually gave or granted.

Should I factory-reset my phone?

Not for a page you merely opened. Consider it if malicious software was installed, security settings were altered, or problems persist after removing the app — and preserve evidence of the app first.

I gave an OTP. Is it too late?

Not necessarily, but the window is minutes. Contact the service immediately and ask it to lock the account and reverse any device enrolment. Then dispute any transaction that appears.

Will my bank refund me?

There is no automatic refund. RA 12010, Section 7 lets an institution hold disputed funds for up to thirty calendar days while it verifies, and Section 6 makes an institution liable for restitution where it failed to employ adequate safeguards. Outcomes depend on the facts and on how fast you reported.

Do I need a police report before the bank will act?

No. RA 12010, Section 7 lets the institution act on a complaint from an aggrieved party. Contact the institution first and run the criminal complaint in parallel.

Can the telco tell me who sent the message?

Not on request. RA 11934, Section 10 requires a subpoena from a competent authority pursuant to an investigation based on a sworn complaint.

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.