Ayala-led Bank of the Philippine Islands (BPI) is cautioning clients about a sharp, pre-holiday surge in online banking fraud linked to smishing, noting that criminals’ tactics have evolved from simple text scams to using highly sophisticated tools to steal money.

“Consumer complaints are increasing… a lot of it is seasonal. During Christmas, when people receive their bonuses, these cases really go up,” Jon Paz, BPI enterprise information security officer and data protection officer, said during the bank’s cybersecurity roundtable with the media on Wednesday, Oct. 22.

Paz reported that around eight out of 10 online banking fraud cases last year were perpetrated through smishing attacks using International Mobile Subscriber Identity (IMSI) catchers and rogue apps.

He further noted that there were almost zero IMSI-catcher-related fraud cases in 2024, but incidents began appearing around December and skyrocketed by the second quarter of this year.

“Some of the authorities reported that those who were caught were reporting to Chinese nationals,” Paz added.

An IMSI catcher is a fake cell tower device used by scammers to intercept mobile signals and steal users’ personal and banking information.

Meanwhile, a rogue app is a malicious or fake mobile application that tricks users into granting permissions or entering credentials, allowing scammers to harvest personal and banking data.

Despite the increasing number of consumer complaints in the banking industry, Paz noted that BPI’s risk tolerance is “low—one incidence of fraud is one too many for us.”

While the bank cannot disclose its total allotment for app enhancements, BPI Chief Technology Officer Alex Seminiano stated that nearly 60 individuals are working across various functions—business, technology, and operations—to enhance the bank’s mobile app.

BPI said its mobile apps are equipped with an evolving security layer that can detect risky environments and devices, such as those that are jailbroken, use overlays, or allow side-loading, to prevent potential breaches.

Recent reports indicate that Filipinos received over six million scam texts and more than 600,000 phishing calls last year.

As a result, an estimated ₱460 billion was lost to fraud in 2024, translating to average losses of ₱16,000 per victim—equivalent to nearly two percent of the country’s gross domestic product (GDP).