What If a Scam Text Knows Your Name? The 2022 Smishing Wave Explained

Another Day, Another "Congratulations, You Won!" Text

Three scam texts before lunch. A job offer promising P500 to P900 a day for work you never applied for, a prize alert from a raffle you never joined, and a shortened link nobody sane would tap. We get the same screenshots from our clients' group chats every week, and lately the same question: what happens the day one arrives as a spam text with my name on it? In the Philippines, August 2022, that is a fair question.

The word for this is smishing, from SMS plus phishing: texts that bait you into tapping a link, replying with details, or sending money through an e-wallet. Same instincts as email, so how to spot phishing red flags before they cost you is worth a re-read. What is new is the volume: an industrial wave building since late 2021, now colliding with the busiest family spending season.

Where the 2022 Smishing Wave Came From: An Organized Syndicate, Not Lone Scammers

On November 23, 2021, the National Privacy Commission said an organized global crime syndicate was behind the surge of scam texts and summoned telcos, banks, and e-commerce platforms over it.

In plain English, this is a business with staff, databases, and bulk-SMS infrastructure. Blocking senders barely dents it: you block one disposable SIM, not the operation.

The bait has a very 2021-2022 flavor: almost always a job. "Earn P500-P900 daily, work from home, no experience needed" exploits pandemic-era job hunting and the online-selling boom.

Why Scam Texts Are Untraceable: The Philippines Still Has No SIM Registration Law

On April 15, 2022, President Duterte vetoed the SIM Card Registration bill citing "dangerous state intrusion and surveillance" over a last-minute provision that would also have registered social media accounts.

So prepaid SIMs here are anonymous: anyone can buy one at a sari-sari store for pocket change without an ID, blast thousands of messages, throw it away, and start again tomorrow.

Blocking numbers is whack-a-mole, and law enforcement has no registry to trace senders through. Refiled bills are pending in the new Congress, but nothing has passed. Plan as if anonymity is permanent.

For a business, defense moves to your end: how staff are trained, how systems are set up. That is most of what our cybersecurity services for small businesses involve.

Could a Scam Text Know Your Name? How Scammers Harvest Personal Data

Now imagine opening one of these and finding your complete name at the top. Not "Dear customer." Your name.

With the data these syndicates hold, that is entirely possible. The NPC summoned telcos, banks, and e-commerce platforms precisely because the surge pointed at channels holding names, numbers, and order histories together. A spam text with your name on it is the logical next step.

Where your name and number leak together

The two already sit paired in ordinary places:

• Parcel waybills on every Shopee or Lazada box, printed with your full name and number.
• Raffle and promo slips in a mall fishbowl, guarded by nobody.
• Facebook Marketplace and group-buy sheets, where buyers post name and number publicly.
• Loyalty sign-up sheets with ten other customers' details on one page.
• Data breaches at companies you have handed your details to.

What to do if a text ever addresses you personally

Treat it as confirmation that your name and number leaked somewhere as a pair. Your response does not change: do not reply, do not tap, block, report.

You have a legal backstop. Republic Act 10173, the Data Privacy Act of 2012 requires organizations to handle personal data proportionately and keep it secure, answerable to the National Privacy Commission, where you can complain.

Back-to-School Season Is Scam Season: What to Expect from August 22

Scammers follow the calendar. DepEd Order No. 34, s. 2022 sets School Year 2022-2023 to open on August 22, with all schools on five-day in-person classes by November 2 — the first large-scale return to face-to-face since 2020, and parents are spending on it now.

Expect matching bait: enrollment-fee phishing, "school supplies promo" links, fake e-wallet load promos for parents budgeting allowances, and parcel-redelivery texts riding on back-to-school orders.

August is rainy season too, and generic "donation drive" bait follows bad weather. Give through channels you seek out yourself.

How to Protect Your Family and Make Sure Your Business Isn't the Leak

For the household, the rules on spam texts stay short:

• Never tap a link inside a text message.
• Real banks and e-wallets never text clickable links asking you to verify an account.
• Block and report senders through your telco's spam channel. Globe, Smart, and DITO each have one.
• Turn on your phone's built-in spam filtering. Android 12 and iOS 15 both have it.
• Say it out loud to whoever at home would believe a job offer.

Now the part for owners. If you collect customer names and numbers through delivery lists, promo forms, loyalty sign-ups, or visitor logbooks, the Data Privacy Act expects you to secure them in proportion to the risk. A leaked customer list feeds this machine.

• Limit who can export the customer list, and know who already has.
• Stop pasting names and numbers into public group chats.
• Shred paper forms once encoded, or digitize and lock the file down.
• Refresh staff habits with remote workers: work-from-home security habits every Filipino employee needs suits a team huddle.
• No in-house IT? Have someone review how customer data is stored, part of our managed IT support work.

If your business holds customer names and numbers, you hold the data that feeds these spam texts. Book a free call and we will review how that data is collected, stored, and secured, and what the Data Privacy Act expects from a business your size.