12 Christmas scams to watch out for

The Philippine National Police (PNP) warns the public about various scams prevalent during the Christmas season, including smishing, vishing, and quishing. Common tactics used by scammers include impersonating trusted entities, using fake QR codes, and offering too-good-to-be-true deals to steal sensitive information. The PNP advises consumers to verify sellers, avoid sharing personal information, and be cautious of unsolicited messages and offers. This is AI-generated. Read the article for full context. Report any errors. Christmas is right around the corner, and so are scams. The Philippine National Police (PNP) cautioned the public to be wary of their online transactions and the notifications they receive. The PNP stressed the importance of verifying the legitimacy of sellers and the products and services they are offering. But scams aren’t just in online shopping anymore; they are in text messages, calls, and even in everyday physical stores. Here are the usual scams and their tactics to look out for this Christmas. Smishing Smishing is phishing, but through text messages. Attackers use portable International Mobile Subscriber Identity (IMSI) catchers to spoof the sender ID of legitimate banks, digital wallets, and government agencies. This device acts like a fake cell tower, blasting messages to devices that connect to its signal. Since it can spoof the sender ID, the messages may appear in existing conversations. These messages often include links that lead users to a spoofed website with a premise that you have a reward, a deadline to meet, or that your account is at risk of hacking. They ask for your information, passwords, and sometimes, one-time PINs (OTPs). Once given, attackers can make unauthorized transactions. In 2022, the Bangko Sentral ng Pilipinas (BSP) released BSP Memorandum No. M-2022-015, requiring financial institutions not to include links in their messages and emails. Government agencies and financial institutions also send messages reminding consumers to never interact with links in text messages. Vishing Voice phishing, or vishing, uses calls or voice messages to imitate trusted entities and trick victims into revealing sensitive information, according to the BSP. The Cybercrime Investigation and Coordinating Center (CICC) says scammers introduce themselves as a bank, digital wallet, or government agency personnel. They use the same tactics as other forms of phishing. They conduct “verification procedures” by asking for your information and OTP, which banks and government agencies consistently remind customers to never share. Quishing The rise of e-wallets and digital banking has allowed users to pay through QR codes. However, the BSP began warning the public about QR code fraud, or quishing. In this case, fraudsters use QR codes to steal money and sensitive information from unsuspecting users. The code leads to fake login pages for e-wallets or banks, automatically downloads harmful content, or transfers money to unknown recipients. QR codes usually don’t show website links. This makes it difficult for users to check. The BSP warned users to be cautious and scan QR codes from verified stores. It added that most smartphones display the link before opening the webpage, which can help in verifying the site. The institution also warned that attackers may alter or tamper with stores’ QR codes, placing a different code over legitimate ones. Fake online sellers This is the most frequent online scam. PNP chief General Jose Melencio Nartatez Jr., at a press briefing on November 9, said people should be skeptical of offers that seem too good to be true. The PNP also reminds people to verify the seller’s credibility, keep communication on the same platform, and never share sensitive information. Holiday travel, booking Similar to fake online sellers, fraudsters offer unusually cheap tickets, booking deals, and vacation packages. This also leads users to phishing sites, allowing attackers to steal information and make unauthorized transactions. Fake cash aid, gifts Scammers pose as government agencies, such as the Department of Social Welfare and Development (DSWD), and spread links to surveys or registration to receive cash aid or gifts. Though the department now offers digital payouts, it does not offer an open online application portal or form. Similarly, these fake portals are often phishing sites. ‘High-Yield’ investments Investment frauds travel faster on social media because of Filipinos’ high usage. It depends on a “trust” mechanism and referrals, allowing users to transact or cooperate with people online with assurance. Cryptocurrency is also used to lure victims with the promise of high yields. In the 2026 book The Rogue Compound, these platforms use a “pump-and-dump” scheme where fraudsters artificially inflate the currency’s price and spread false hype to sell their shares. Once people invest, the price crashes, leaving investors with heavy losses. Fake charity, donation drives Fraudsters also use charities, donation drives, and generosity to steal money. This does not only happen during disasters. The CICC included this scam in its list last year. The PNP Anti-Cybercrime Group (ACG) advises users to verify the organization before donating, check official announcements, verified social media pages, and official bank accounts, and be wary of personal accounts soliciting donations and vague or unverifiable details. Impersonation Also known as “hijack profile scam.” This happens when scammers gain unauthorized access to social media accounts and message contacts, asking for urgent financial assistance. Oftentimes, attackers gain access through phishing, hacking, or social engineering techniques. Hackers can also get banking details from those accounts, leading to unauthorized transactions. Fake raffles, giveaways Apart from smishing scams telling users that they won in a giveaway, this scam is also prevalent on social media. The PNP says the usual red flags of these messages is you’re told you won a prize you never registered, asks for sensitive information, pressures you to act immediately, or instructed to make a transaction of investment. Online gambling The Rogue Compound book also explained how online gambling lures users through its architecture. According to one source, it operates in a “God-mode panel,” where operators configure the game’s parameters to tailor the user’s experience. It tricks players into thinking they’re playing fairly by fluctuating between two settings: Newbie Setting and Kill Mode. The Newbie Setting tricks new accounts and first-time depositors by designing early wins to boost their confidence. Kill Mode activates when the victim keeps depositing money despite their losses. Task/job scams The book also states that the scam only needs people who look for a quick source of income. “Receptionists” send messages at random on platforms such as Telegram, Viber, or WhatsApp. It begins by instructing victims to do basic tasks for low-value commissions they can withdraw, which range from P100 to P200. They then instruct victims to deposit a small amount to gain access to an online platform that assigns them tasks. There, the cycle begins, helping establish trust. Once the user makes bigger investments, the operators will demand more payment for various reasons before disappearing with the invested money. – Rappler.com