Three pillars of defense against scams
Most of us go about our days with the help of digital technology.
From buying a morning coffee and paying for a ride-share to checking account balances and transferring money to loved ones, essential tasks are now completed in seconds with just a few simple taps on our smartphones.
These seamless digital interactions have become so second nature that we rarely pause to reflect on the invisible foundation making them possible.
Yet, behind every tap, swipe and online transaction lies something far more valuable than technology: trust.
We trust that our hard-earned savings are safe. We trust that our personal information remains secure. And we trust that the financial institutions we rely on are working every single day to stay ahead of those who seek to exploit that confidence.
While digital technology has driven unprecedented financial inclusion across the Philippines, an expanding digital footprint creates greater exposure to cybercriminals.
As financial services become increasingly interconnected, cyberthreats are growing in scale and sophistication, making scams more convincing, criminal networks more organized and the stakes higher than ever. Today, cybersecurity is no longer simply an information technology issue, it is a vital consumer issue, a critical business imperative and a national priority.
Paradigm shift: Hacking the human, not the fortress
The common image of a bank’s cybersecurity team was that of engineers building higher digital fortress walls, including creating strong firewalls, complex algorithms and robust infrastructure.
While these safeguards remain critical, the nature of financial cybercrime has shifted: modern fraudsters are shifting from “hacking the bank” towards “hacking the human.”
Cybercriminals are now exploiting emotions such as fear, urgency and panic.
Masquerading as legitimate banking institutions, government agencies or telecom providers, they use sophisticated social engineering methods to trick unsuspecting individuals into voluntarily opening the gates from within.
Whether through convincing phishing emails, fraudulent text messages or deceptive phone calls, threat actors bypass digital parameters by tricking users into handing over One-Time Passwords (OTPs), personal identification numbers or login credentials.
As cybercriminals become more coordinated and their tactics more sophisticated, we are now seeing a fundamental truth: no single institution can defeat the ever-evolving ingenuity of cybercriminals on its own.
It is no longer enough to build higher walls around our own bank while the broader ecosystem remains exposed.
A siloed defense is a failed defense.
When stolen funds move across payment rails from one bank to another, fraud rapidly evolves from an isolated incident into a systemic problem.
To counter this, we need a whole-of-ecosystem framework that unites our entire society behind three distinct operational pillars.
Pillar 1: Empowering the public as the first line of defense
A resilient digital roadmap begins with continuous education and engagement across every level of society.
We can deploy the most sophisticated encryption in the world, but if a customer or employee is manipulated into handing over an OTP or clicking a malicious link, the perimeter is breached from within. Therefore, our primary line of defense is not a firewall; it is an informed, vigilant and empowered human network.
Empowering the public requires us to foster active digital literacy across the entire consumer spectrum, ensuring that security advocacy reaches beyond corporate borders to engage the broader business community, youth groups, academic institutions and senior citizens.
Public fora such as Bank of the Philippine Islands’ (BPI’s) 4th Annual CyberProtect Conference, held on July 30, under the theme “Defend as One: Building a United Front Towards Consumer Protection,” provide a vital platform to dissect the modern cyberthreat landscape.
As threats evolve alongside emerging technologies like artificial intelligence or AI through deepfake audio, automated phishing scripts and sophisticated identity spoofing, public education must continuously upgrade society’s collective understanding of best practices and defense mechanisms.
By transforming passive users into active guardians of their own security, comprehensive community engagement equips everyday consumers to recognize red flags, reject deceptive requests and protect their digital transactions confidently.
Pillar 2: Equipping bankers as front-line protectors
The second pillar of defense relies on collaborative defense among financial operators.
Fraudsters do not operate in silos; they function through agile, interconnected networks.
Working closely with industry bodies like the Bankers Association of the Philippines, specifically through its Anti-Fraud Subcommittee, financial institutions are institutionalizing a coordinated response to financial crime.
This includes establishing real-time protocols for rapid information sharing to track and intercept illicit fund transfers, harmonizing fraud detection algorithms and transaction controls across member banks, and enforcing consistent operational countermeasures to respond swiftly to compromised accounts.
Regulatory compliance should never be viewed as a passive, check-the-box exercise. Rather, it represents an active operational asset that builds and sustains public trust.
Harmonizing digital banking innovation with regulatory standards ensures that every new payment rail, digital feature or financial product undergoes consumer protection screening before reaching the public.
Working in close alignment with the Bangko Sentral ng Pilipinas (BSP) ensures that operational policies translate regulatory mandates into practical defense.
Grounding strategy in forward-looking BSP compliance guarantees that as digital banking expands, our growth is always backed by security, accountability and public trust.
Pillar 3: Strengthening law enforcement through active collaboration
The final pillar consists of law enforcement agencies that turn threat intelligence into decisive action.
Active collaboration connects government agencies, regulators, law enforcement and industry partners to address threats no single organization can solve alone.
An important element of this collaboration is institutionalizing technical capability through specialized training.
An example is BPI’s CyberAcademy, a public-private initiative designed to bridge the gap between banking fraud operations and legal authorities.
Through its partnership with the Department of Justice–Office of Cybercrime and the Philippine National Police–Anti-Cybercrime Group, the prosecutors and police investigators gain a shared operational language and practical understanding of financial cybercrime, strengthening their ability to investigate and prosecute these cases effectively.
In tandem with capability building, enforcing policies like the Anti-Financial Account Scamming Act empowers authorities to freeze illicit accounts quickly, target money mules and dismantle cybersyndicates.
Standardizing digital evidence protocols and establishing direct operational channels convert complex investigations into swift, successful prosecutions.
Defending as one
At its core, banking is a business built entirely on trust.
Consumer protection is about far more than securing numerical balances on a digital screen; it is about safeguarding the dreams, hard-earned savings, and livelihoods of everyday Filipinos, including small business owners, working parents, students, and retirees who rely on us every day.
This commitment to trust is more important than ever as we celebrate Cybersecurity Awareness Month this October, and all the more significant as BPI marks its 175th anniversary in 2026.
Under the theme “Protecting 175 Years of Trust in a Digital World,” we highlight how empowering the public, equipping front-liners, and strengthening law enforcement allows us to build an unbroken shield against cyberthreats.
Together, let us defend trust. Together, let us protect consumers. Together, let us stand as one.
