Phishing Surge in the Philippines: Stay Protected

Phishing in the Philippines Surged 423% in 2025: Top Cybersecurity Threats and How to Defend Against Them

Phishing websites detected in the Philippines rose from 731 in 2024 to 3,824 in 2025, a 423% jump, according to the Philippine Threat Landscape Report 2025 from Check Point Research. It is one of the sharpest increases recorded in the region.

Criminals are no longer relying on clever technical exploits. They use automation, social engineering and identity-based deception to run fraud at industrial scale, targeting banks, e-wallets, government agencies and everyday mobile users.

This post covers the key trends from the report, what they mean for any business that handles payments, and the practical steps you can take now, including how PCI DSS compliance and certification fits in.

Philippines Cybersecurity Statistics at a Glance

• Phishing websites detected: 731 in 2024 to 3,824 in 2025 (+423%)

• Reported ransomware cases: 9 in 2024 to 17 in 2025 (nearly doubled)

• Fake executive and brand profiles on social media: 940 in 2024 to 1,291 in 2025 (+37%)

• Third-party breach incidents: 8 in 2024 to 29 in 2025 (more than tripled)

• Source code leaks: more than doubled

Phishing and Smishing: Why a Mobile-First Economy Is a Prime Target

The Philippines has high mobile penetration and fast adoption of digital banking and e-wallets. That convenience gives attackers a large, always-connected audience.

The trend is moving from fake websites toward smishing, which is phishing by SMS. Attackers use automation and social engineering to exploit the trust people place in text messages. Check Point notes that criminals focus on identity-based deception and telecom-level manipulation rather than technical exploits.

A convincing text that mimics a bank, courier or e-wallet is now one of the cheapest and most scalable ways to commit fraud. Staff and customer awareness matters as much as firewalls.

What this means for you: if you accept, process or transmit card payments, stolen credentials are the front door to your cardholder data. Strong authentication and security awareness training are core PCI DSS controls (Requirements 8 and 12), not optional extras.

Ransomware Nearly Doubles, With Qilin Leading the Threat

Reported ransomware cases rose from 9 in 2024 to 17 in 2025. The Qilin group stands out, using cross-platform malware and double extortion: attackers steal sensitive data and threaten to publish it if the ransom is not paid.

Victims span finance, retail, healthcare, manufacturing and professional services. No sector can treat ransomware as someone else’s problem.

What this means for you: malware protection, tested backups, network segmentation and continuous monitoring are what keep an incident from becoming a data-leak crisis. These map directly to PCI DSS Requirements 1, 5, 10 and 11.

Brand Impersonation and AI-Driven Scams on Social Media

Fake executive and brand profiles grew 37%, from 940 to 1,291 cases. Scammers now pair these profiles with AI chatbots and fabricated investment schemes to persuade victims and scale their campaigns.

Banks remain a top target. Credential harvesting and account takeover attempts continue, so strong identity checks and fast takedown of fake profiles are essential parts of brand protection.

Cloud Adoption and Supply Chain Attacks: Third-Party Risk Is Growing

Third-party breach incidents rose from 8 to 29 cases, and source code leaks more than doubled. As companies move to the cloud and add vendors, their exposure grows faster than their defences.

Effective third-party risk management now means knowing which vendors touch your data, what access they hold, and how quickly they would tell you about a breach. PCI DSS treats this seriously: service providers that could affect the security of your cardholder data environment (CDE) are part of your compliance scope.

Government Websites and Critical Infrastructure Under Pressure

Public sector sites frequently face DDoS attacks and defacements, often timed with political events or linked to hacktivist groups. Critical infrastructure operators have also seen more reconnaissance and disruption attempts during periods of geopolitical tension.

Education platforms, which tend to have weaker defences, have at times served as testing grounds for new attack techniques.

How AI and NFC Fraud Will Change Cybercrime Next

Check Point Research expects AI-powered scams to speed up and polish existing fraud tactics rather than replace them, making scams more convincing and easier to scale. As contactless payments and e-wallets spread, NFC fraud exposure is likely to rise. More reliance on AI tools and cloud services may also raise supply-chain risk, which makes external exposure management more important.

How to Protect Your Business: Cybersecurity Best Practices

The report points to identity protection, third-party risk control and public awareness as priorities. These steps put that into action:

1. Turn on multi-factor authentication (MFA) for email, banking, cloud and admin accounts to blunt credential harvesting and account takeover.

2. Train staff to spot phishing and smishing with regular simulations, including SMS and chat-app scenarios.

3. Back up critical data offline and test restores, so a ransomware attack does not force a payment decision.

4. Assess vendors before you connect them by reviewing access, security practices and breach-notification terms.

5. Monitor for fake domains and profiles that copy your brand or executives, and report them for takedown quickly.

6. Apply least-privilege access and patch promptly across cloud services and endpoints.

7. Prepare and rehearse an incident response plan that covers data-leak extortion and public communication.

8. Test your defences regularly with vulnerability scanning and penetration testing, so you find the gaps before attackers do.

Why PCI DSS Compliance Is Your Strongest Framework

If your business takes card payments, many of the steps above are not just good practice. They are requirements. The Payment Card Industry Data Security Standard (PCI DSS) applies to every organisation that accepts, processes, stores or transmits cardholder data, and to service providers whose systems could affect the security of that data.

The standard groups its 12 requirements into six objectives:

• Build and maintain a secure network and systems (Requirements 1-2)

• Protect account data (Requirements 3-4)

• Maintain a vulnerability management program (Requirements 5-6)

• Implement strong access control measures (Requirements 7-9)

• Regularly monitor and test networks (Requirements 10-11)

• Maintain an information security policy (Requirement 12)

For Philippine businesses, including e-commerce platforms, fintechs, BPOs and financial institutions, PCI DSS also helps meet BSP regulatory expectations and shows customers that their payment data is protected.

'

How GTIS Helps Philippine Businesses Get Secure and Certified

GTIS (Globaltech & Infosec) provides PCI DSS compliance, certification and security services to businesses in Manila, Cebu and Davao. Our five-step path to certification takes you from scoping to a verified result:

1. Discover: we map your network to identify the cardholder data environment, so the scope of compliance is exact and unnecessary cost is avoided.

2. Gap Assess: we review your systems against PCI DSS requirements to find vulnerabilities, missing policies and technical gaps.

3. Remediate: hands-on engineering support to fix issues, including network segmentation, strong encryption and secure access controls.

4. Validate: vulnerability scans and penetration tests confirm that every fix works before the formal audit.

5. Audit: a certified Qualified Security Assessor (QSA) performs the official assessment, and you receive your Report on Compliance (RoC) and Attestation of Compliance (AoC).

Services that match the threats in this report

• Phishing, smishing and credential theft: PCI DSS certification and consulting, covering access control and awareness policies.

• Ransomware and data-leak extortion: Managed security, including managed firewall, risk management, SIEM and threat detection.

• Always-on attacks and slow detection: 24/7 SOC services for monitoring, analysis and response.

• Untested systems and exposed apps: VAPT, covering web application, API, mobile, internal and external testing, plus PCI ASV scanning.

• Third-party and supply chain risk: risk assessment and enterprise risk consulting.

Beyond PCI DSS, GTIS also supports certifications and frameworks such as ISO, SOC 2, DORA and NIS 2, which is useful if you serve international clients.

Why businesses choose GTIS

• Philippines-based specialists with on-the-ground support in Manila, Cebu and Davao.

• Certified QSAs, so you work directly with assessors, not junior analysts.

• End-to-end support from initial scoping to the final Report on Compliance.

• Modern stack expertise, including AWS, Kubernetes and serverless.

• A faster process: GTIS says its streamlined method can cut compliance time by up to 40%.

• Transparent pricing with clear quotes.

Ready to reduce your risk? Request a free quote at pcidss.ph or email sales@gtisec.com.

Frequently Asked Questions

How much did phishing increase in the Philippines in 2025?
Detected phishing websites rose 423%, from 731 in 2024 to 3,824 in 2025, per Check Point Research.

What is smishing?
Smishing is phishing carried out through SMS text messages. Attackers pose as banks, couriers or payment apps to steal credentials or money.

What is double extortion ransomware?
Attackers encrypt a victim’s files and also steal data, then threaten to leak it if the ransom is not paid. The Qilin group is named in the report as using this tactic.

Which sectors are most at risk?
Finance, retail, healthcare, manufacturing and professional services have all been hit by ransomware, and banking remains a prime target for credential theft and account takeover.

How is AI changing cyber fraud?
AI is expected to make existing scams more convincing and easier to scale, for example through chatbots used in fake investment schemes.

Who needs PCI DSS compliance in the Philippines?
Any business that accepts, processes, stores or transmits card data, including e-commerce, fintech, BPO, banking, telecom, travel and healthcare organisations, plus service providers that could affect the security of that data.

What do I receive at the end of PCI DSS certification?
After a successful QSA audit you receive a Report on Compliance (RoC) and an Attestation of Compliance (AoC).

Conclusion: A Wake-Up Call for Cybersecurity in Southeast Asia

The Philippine data shows how quickly cybercrime is industrialising: more phishing, more ransomware, more impersonation and more third-party exposure. Other emerging economies in Asia Pacific can learn from it. Strong identity protection, careful vendor oversight and ongoing public awareness are the foundation for resisting fraud at scale.

Review your defences now, before the next wave of AI-assisted scams arrives. Talk to the GTIS PCI DSS team about scoping, testing and certification.