DUMAGUETE CITY—The Bangko Sentral ng Pilipinas (BSP) is shifting its focus from technical firewalls to human psychology as data reveals that deceptive “social engineering” now drives more than three-fourths of all financial fraud in the country.

During a media briefing on Monday, Feb. 2, BSP Deputy Governor Lyn I. Javier reported that social engineering, account takeovers, and identity theft have eclipsed traditional hacking as the primary threats to the nation’s digital economy.

Tactics such as smishing, vishing, and “love scams” exploited user trust to bypass sophisticated security systems, accounting for over 75 percent of total cyberthreats last year.

While hacking accounted for 13 percent of overall fraud losses in 2025 and card-not-present fraud accounted for eight percent, the vast majority of financial theft was enabled by victims through manipulated disclosures.

“We are seeing that social engineering remains the biggest driver of cyber-related problems,” Javier told reporters. “Phishing, vishing, and smishing continue to persist, all of which highlight the human element by exploiting the trust of the public.”

Javier, who leads the BSP’s financial supervision sector, noted that while banks have invested heavily in technology, the “human element” remains the most vulnerable entry point.

She noted that user behavior is now as critical as software patches in maintaining the integrity of the financial system.

The consequences of these human-centered breaches extend beyond individual losses as Javier warned that if cyber incidents successfully target critical market infrastructure, they could trigger panicked, massive withdrawals.

Such a loss of public confidence carries the potential to create liquidity crises and capital instability for financial institutions.

The deputy governor also pointed to structural challenge in the country's defense: fragmented visibility. Because the threat leverages interconnected systems, no single entity has a complete view of the problem.

While banks track the Philippine peso losses and telecommunications firms track the origin of fraudulent messages, the BSP is often left to identify patterns only in hindsight.

To mitigate these risks, Javier called for scaling of regulatory strategies that prioritize defending against human manipulation as much as technical intrusion.