New GCash phishing wave: fake 'account suspended' texts asking for your OTP

Since late July 2026, our tipline has received several near-identical reports of the same GCash phishing pattern. Here's what to watch for and what to do if you already tapped the link.

The pattern

Victims receive an SMS from a normal-looking 11-digit number that reads something like:

GCash: Your account has been temporarily suspended due to unusual activity. Verify within 24 hours to avoid permanent closure: gcash-verify-ph[.]com/login

The link opens a page that looks exactly like the real GCash login — same logo, same green header, same "Forgot MPIN" link. Once you enter your mobile number and MPIN, it asks for the 6-digit OTP that GCash just sent you for real. The moment you type it in, the scammer uses it to log in on their own device and drain your wallet, often within 60 seconds.

Why this one is working

• The domain (gcash-verify-ph.com) looks plausible to non-technical users.
• The SMS arrives from a regular Globe/Smart number, not an obvious shortcode, so it slips past the "official sender ID" instinct.
• The scam page is a pixel-perfect clone — even the loading spinner matches.
• The 24-hour deadline creates panic and short-circuits critical thinking.

Red flags (memorize these)

• GCash will never send you a link via SMS to log in. Real GCash security messages tell you to open the app yourself.
• No legitimate company will ever ask for your OTP — not GCash, not Maya, not your bank, not Lazada, not Shopee.
• URLs with extra words like -verify, -ph, -secure, or hyphenated brand names are almost always fake.
• Real GCash notifications inside the app appear in the Inbox section. If it's not there, it isn't from them.

If you already entered your details

Move fast. In this order:

1. Open the real GCash app and change your MPIN immediately (Profile → Security → Change MPIN).
2. Turn on Face ID / fingerprint login if you haven't.
3. Call GCash Support at 2882 (from your registered number) and ask them to freeze the account.
4. Screenshot the SMS and the fake site, then file a report with the National Privacy Commission at privacy.gov.ph and the NBI Cybercrime Division at cybercrime.nbi.gov.ph.
5. If money left your account, request a chargeback through GCash Dispute (Help → Report an Issue → Unauthorized Transaction).

Share this with your titos and titas

The people most at risk here are relatives who aren't chronically online. Forward this post — or just the red-flag list above — to your family group chat. One conversation now is cheaper than a drained e-wallet later.

Have you received a version of this scam? Report it here so we can warn others.