Rapid adoption of real-time digital payments in the country has triggered a corresponding surge in cyber fraud, as criminals exploit the instantaneous nature of systems like InstaPay to move and withdraw illicit funds before they can be traced.
In a briefing on Wednesday, March 11, Jasmine Alansalon-Gonzales, head of products at CIBI Information, Inc., said that InstaPay, which facilitates immediate electronic fund transfers for retail transactions, has become the primary target for fraudsters due to its lack of clearing delays.
Unlike PESONet, which processes transactions in batches, InstaPay moves money in seconds, making the recovery of stolen funds nearly impossible once a transaction is initiated.
“With InstaPay, transferring to any wallet is instantaneous. Once you send it, it happens in a second,” Gonzales told reporters.
Gonzales noted that the speed of the system—while convenient for consumers—is precisely what creates the security vulnerability.
When funds are received and withdrawn instantly, the window for financial institutions to intervene effectively closes, she said.
Recall that digital payment transactions in the Philippines surged to nearly ₱25 trillion in 2025, as the volume of electronic fund transfers more than tripled year on year. This was a notable shift in how consumers and businesses navigate the post-pandemic economy.
Data from the Bangko Sentral ng Pilipinas (BSP) showed that combined transactions through the PESONet and InstaPay clearing houses reached ₱24.74 trillion last year, a 42 percent increase from ₱17.42 trillion in 2024.
Transactions channeled through InstaPay surged by 57.3 percent to ₱11.553 trillion. The rapid adoption is clear as transactions more than tripled to 4.7 billion, showing growing reliance on real-time transfers for daily business.
InstaPay facilitates real-time transfers for smaller amounts, typically capped at ₱50,000, making it a staple for retail remittances and online shopping.
To curb the surge in financial fraud, the BSP—under the Anti-Financial Account Scamming Act (AFASA)—ordered all financial institutions it supervises to adopt a more sophisticated mode of verification and eliminate the usage of one-time passwords (OTPs), where cybercriminals gain a foothold.
Citing recent data, FinTech Alliance Ph Founding Chairman Lito Villanueva reported that the value of cyber fraud in 2025 “would already be equivalent to the first quarter of 2026,” tagging it as an “alarming” growth.
Money muling—transferring illegally obtained funds for others, knowingly or not—has become the most common type of fraud, as criminals use these accounts to create layers in the money trail, making the funds harder for authorities to trace.
The fintech industry is complementing AFASA with the creation of the Fraud Intelligence Data Sharing (FIDS) Network, a CIBI-led consortium of institutions, including banks and other financial institutions (FIs), telecommunications firms, and others.
This fraud bureau will help detect fraud, provide alerts, generate fraud scores, and offer case management tools. Villanueva said local banking and fintech giants are part of the pilot of the bureau.
According to the credit bureau, the first batch of institutions includes BDO Unibank Inc., RCBC, Salmon Bank, HSBC, GoTyme Bank, Uno Digital Bank, Maya Bank, and SB Finance, while other entities are also in the pipeline.
“The major banks and leading fintech companies are part of the initial pilot, which will be free for the first six months,” Villanueva said, who is also the executive vice president and chief innovation and inclusion officer at Rizal Commercial Banking Corp. (RCBC).
CIBI President and Chief Executive Officer (CEO) Pia Arellano said this platform is the one used in Korea and Malaysia, which has saved $2 billion in fraud over a span of around a decade, a feat the Philippine fintech industry intends ti replicate.