Love Scams and Business Email Compromise: The Costly Cons Targeting Filipinos

Valentine's Week in the Philippines: Two Cons, One Script

Valentine's Day is a week behind us, but the love-scam warnings that filled Philippine news feeds all month are still running. Here is the part that did not make the headlines: the same con arrives in company inboxes under a different name. Business email compromise in the Philippines runs the identical script — patient trust-building, a manufactured emergency, a demand for secrecy, one irreversible transfer — except the mark is a finance clerk and the prize is an entire supplier payment.

On 31 January 2024 the Cybercrime Investigation and Coordinating Center (CICC), a DICT-attached agency, launched the #UnmatchPH campaign against love scams with Scam Watch Pilipinas and private partners, covered by Manila Bulletin. Scam Watch Pilipinas named the "Sad Boi, Sad Gurl" ploy: a fabricated sad life story, an appeal to pity, then a request to borrow money.

Now swap the actors. The romance scammer works on a lonely person's heart; the business email compromise operator works on a finance staffer's obedience. Neither needs malware — only a believable story and a payment channel that cannot be reversed.

The damage is best documented in the US: the FBI's Internet Crime Complaint Center logged 21,832 BEC complaints and over $2.7 billion in adjusted losses in one year — about 27% of reported cybercrime losses, second only to investment fraud — in its 2022 Internet Crime Report. We know of no comparable published Philippine total, and would rather say so than invent one.

This is for owners, finance and admin staff, and whoever may approve a payment.

What Business Email Compromise Is — and Why It Is Not Ordinary Phishing

Business email compromise, or BEC, is simple: an attacker impersonates someone your business trusts — the boss, a supplier, a lawyer — and asks by email for a payment or a change of bank details.

Phishing hunts for passwords with a fake login page and a link you should not click. A BEC message often has no link, no attachment and no malware — nothing to scan, no signature, no bad URL to block. It costs businesses billions a year precisely because there is nothing for a filter to catch, which is why we treat payment process as part of cybersecurity services for Philippine SMEs rather than something software handles alone.

Philippine SMEs are attractive for reasons unrelated to weak technology: business runs in English, money moves by bank transfer, InstaPay, e-wallet and remittance counter, and approval chains are short. We see it constantly — whoever receives the email is whoever releases the payment.

The Five BEC Setups You Will Actually Meet

• CEO or owner fraud. "I'm in a meeting, process this urgently, don't call me."
• Supplier or invoice fraud. A real-looking invoice with new bank details — for SMEs, the costliest variant.
• Payroll diversion. An "employee" emails HR to change their payout account before cut-off.
• Attorney impersonation. A confidential deal that must be funded today.
• Mailbox takeover. The attacker replies from inside a real mailbox — no spoofing needed, which is why mailbox security matters.

The Shared Playbook: Four Moves That Work on a Heart or a Bank Account

Move 1 — Research. The romance scammer reads your Facebook profile; the BEC operator reads your team page and LinkedIn to learn who approves payments. Then add breached data: PhilHealth confirmed in October 2023 that at least 13 million members were affected after the Medusa gang published stolen records. Stop treating "they knew my details" as proof of anything — see our lessons from the PhilHealth ransomware attack.

Move 2 — Rapport and authority. Weeks of sweet messages, or a display name that reads exactly like your boss's over an address nobody checks. Or a lookalike domain: rn where you expect m, .com for your supplier's .com.ph, one extra letter in a long name. On a phone they all read as correct.

Move 3 — Urgency plus secrecy. "Don't tell your family yet" becomes "don't discuss this until it closes." Scammers hide inside legitimate rushes, and we just lived through two — Chinese New Year on 10 February and Valentine's week. The next are on the calendar: the 29 February month-end, then the 15 April ITR deadline.

Move 4 — An irreversible channel. Bank transfer, e-wallet, remittance center, over-the-counter deposit — chosen because once the money is out, getting it back is slow and usually impossible. That is why the fake supplier reply, sent inside a real thread with new bank details, so often lands on a Friday afternoon.

Does SIM Registration Stop This?

Partly. RA 11934, the SIM Registration Act approved on 10 October 2022, requires all SIMs to be registered to curb text scams and smishing — real progress, and we covered the SIM Registration Act and what it actually covers as it passed. But BEC lives in email, and a criminal registering a domain overseas needs no Philippine SIM. A fence, not a roof.

Red Flags a Filipino Finance Team Can Spot in Thirty Seconds

Print this and tape it beside the monitor where payments are released.

What the email says or does	What it should trigger
Changed bank details for an existing supplier	Stop. Call back on your old number
Reply-to differs from the visible From address	Treat as spoofed until proven otherwise
Domain one letter off, or .com for .com.ph	Compare it against an old email
"I can't take calls right now"	The refusal to talk is the flag
Asks you to keep the transaction confidential	Escalate to a second person
E-wallet or remittance for a corporate supplier	Wrong rail for a business payment
Deadline lands on a Friday	Deliberate timing. Slow down
Invoice from a slightly different address than before	Check your master file

Bad grammar is no longer a reliable tell; our guide on how to spot fake emails before they cost you inspects a suspicious message in detail. The same lesson works at home: a romance that will never video call, a partner who needs money for a hospital bill, a story that escalates every time you pay.

One rule beats every flag above. Verify any payment change out-of-band, on a phone number you already had — never one supplied in the email.

The Controls That Actually Stop BEC: Authenticate, Lock the Mailbox, Enforce a Callback

Google and Yahoo announced new bulk-sender rules in October 2023, enforced this February: senders of more than 5,000 messages a day to Gmail addresses must authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints under 0.3%. Most Philippine SMEs are far below that — but Google's sender guidelines require SPF or DKIM of every sender, at any volume. The deliverability work marketing funds this month also stops criminals spoofing your domain.

• SPF lists which servers may send email as your domain.
• DKIM signs each message so tampering shows.
• DMARC tells receiving servers what to do with mail that fails, and reports what is sent in your name.

Publish SPF and DKIM first, run DMARC at p=none and read the reports, then quarantine, then reject. Include the accounting app, the CRM and the website form mailer — they all send as your domain.

Then harden the mailboxes. In Microsoft 365 or Google Workspace: MFA for everyone who touches money, an audit of forwarding and inbox rules — a hidden rule filing supplier mail into a folder is the fingerprint of a hijacked account — a review of app grants, and no legacy sign-in that bypasses MFA.

The control that beats all of them costs nothing: a two-person callback rule. Any new or changed bank detail above a peso threshold you set is verified by a second named person, on a number you already had, before payment. It works even when the attacker sits inside a legitimate mailbox, because the verification never travels by email. Rehearse the line — "we always call back, it's our policy" — and never punish anyone for verifying.

Who Watches This When You Have No IT Department

Somebody has to read the DMARC reports and spot the forwarding rule that appeared last Tuesday. In a 10-to-40-person office that is nobody's job by default, which is where managed IT support that watches your mailboxes and DMARC reports earns its keep. After the 22 September 2023 Medusa attack on PhilHealth, DICT led the forensics and restoration and out-of-date antivirus was publicly blamed. Unmaintained basics are what get exploited.

If the Money Already Left: The First 24 Hours in the Philippines

First, drop the shame — careful, experienced people fall for these. Then move fast, in this order.

1. Call the sending bank or e-wallet immediately. Ask for a recall or hold. Speed decides whether anything comes back; once funds are cashed out, recall usually fails.
2. Preserve evidence before anyone cleans up. Keep the original emails with full headers — in Gmail, "Show original" under the three-dot menu; in Outlook, File then Properties — plus screenshots, invoices, receipts and a timeline.
3. Report it. The PNP Anti-Cybercrime Group and the CICC both accept cybercrime complaints. Conduct like this falls under the Cybercrime Prevention Act of 2012 (RA 10175) and estafa provisions; counsel advises on charges.
4. Contain the account. Reset passwords, revoke sessions, remove rogue forwarding rules and app grants, and check which other threads were read. Warn everyone that mailbox talked to — your customers may be next.
5. Check your data-protection duties. If personal data was exposed, the Data Privacy Act of 2012 (RA 10173) and the NPC's breach-notification rules may apply. Ask counsel or the NPC rather than guessing at a deadline.

On policy: RA 11967, the Internet Transactions Act of 2023, was signed on 5 December 2023, creating a framework for online consumers and merchants and an E-Commerce Bureau under the DTI. The law is signed; the machinery is still being stood up.

A 30-Day BEC-Hardening Plan for a 10-Person Philippine Office

Start next Monday — better still, before your next payment run.

Week	What you do	Owner	Done when
1	List the systems that send mail as your domain, name the one person who may change vendor bank details, write the callback rule	Owner or GM	Everyone has signed it
2	Publish or fix SPF and DKIM, set DMARC to p=none, read the reports	IT provider	Reports reviewed weekly
3	MFA on every money and admin account, audit forwarding rules and app grants, close ex-employee accounts	IT provider, HR	Zero accounts without MFA
4	Run a fake "urgent supplier bank change" drill, debrief with no blame, move DMARC to quarantine	Finance lead	Drill done, repeat booked

None of it is expensive. All of it is boring. And it is the difference between a strange email somebody deleted and a supplier payment nobody can find.

Most BEC cases we get called into at Philippine SMEs were stoppable by two unglamorous things: an authenticated email domain and a callback rule nobody may skip. If you want a second pair of eyes, book a free 30-minute call — we will check your domain's SPF, DKIM and DMARC, confirm every money-touching mailbox has MFA and clean forwarding rules, and help you write the payment-verification rule. We are in Biñan City, Laguna, and work with SMEs nationwide.