I got a scam text (smishing) or a 'you won a prize' message — what do I do?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
Do not click the link, do not reply, and never share an OTP, PIN, or card number — that is exactly what the message is designed to steal. A text claiming you won a prize, have a package to pay for, or must 'verify' your account with a link is smishing (SMS phishing); legitimate banks and agencies do not ask for credentials or fees by text link. Delete and block it. If you did click or enter details, treat it as a phishing compromise: contact your bank/e-wallet fraud unit immediately. You can report scam messages to your telco and to the PNP Anti-Cybercrime Group or NBI. Since the SIM Registration Act (RA 11934), SIMs are registered, which supports tracing and blocking scam senders.
Primary sources
Frequently asked
Is it dangerous to just open the text?
Opening a text is generally safe; the danger is clicking the link or acting on it. The link leads to a fake login page that harvests your credentials, or a prompt to send a fee or OTP. Do not click, do not reply, and do not call numbers in the message.
I already clicked the link and entered my details — now what?
Treat it as a phishing compromise. Contact your bank or e-wallet fraud unit immediately to lock the account and dispute any transactions, change your passwords/PIN, and watch for unauthorized activity. See the phishing/OTP answer for the liability rules.
Can I report scam texts, and does SIM registration help?
Yes. Report scam messages to your telco and, especially where money was lost, to the PNP Anti-Cybercrime Group or NBI. Under the SIM Registration Act (RA 11934), SIMs must be registered, which is intended to support tracing and blocking of scam senders.
Take action
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
What to do after an online scam — the first-hour playbook, where to report (PNP Anti-Cybercrime Group, NBI, DOJ Office of Cybercrime), how to spot and report investment/Ponzi scams to the SEC, phishing and OTP theft, online-shopping fraud (undelivered, fake, or misrepresented goods), romance and job scams, and the legal basis under estafa (Revised Penal Code Art. 315), RA 8484, RA 10175, RA 8792, RA 7394, and RA 8799.