Scams to Avoid: OTP and Password Phishing

What an OTP actually does

An OTP, or one-time password, is a code sent to your registered number to confirm that the person making a request holds your phone. In an e-wallet it approves logging in on a new device, linking the wallet to a merchant, or sending money. The MPIN is the standing secret that unlocks the wallet. Together they are everything a thief needs.

One fact defeats most phishing: you never need an OTP to receive money. A code is only ever required to send, link or log in. Anyone who says a code is needed so that a payout, refund or prize can be credited is describing the opposite of how it works.

How the phishing arrives

A text message that appears in the same thread as genuine wallet messages, warning of a locked account and giving a link.
A call from 'customer service' who already knows your name and asks you to read the code 'for verification'.
A chat from a casino 'agent' offering to fix a withdrawal if you confirm the code just sent.
A login page reached from an advert or message that looks like the casino or wallet and collects whatever you type.
A request to 'link your wallet' for a bonus, which in fact authorises a merchant or device you do not control.

Messages can be made to display a trusted sender name. The thread a message lands in is not proof of who sent it.

Claims, the truth, and your response

Claim	Why it is false	What to do
"Read me the OTP so I can verify your identity"	Staff never need your code; it authorises an action on your account	Hang up. Do not share it
"Enter the code to receive your withdrawal"	Receiving money needs no code	Close the page; check your wallet history
"Your account will be closed today unless you log in here"	Urgency plus a link is the standard phishing form	Open the app or site directly instead
"We sent a code by mistake, please forward it"	The sender triggered a login to your account and needs the code to finish	Ignore, and change your MPIN
"Confirm your password in chat to restore the account"	Passwords are never requested in chat	Refuse; reset through the official site

Habits that block it

Open casino and wallet sites from your own bookmark or by typing, never from a message.
Read the text of every OTP message. It normally states what the code is for; if that does not match what you are doing, stop.
Use a different password for the casino account than for email or anything financial.
Turn on biometric lock in the wallet app.
Do not keep passwords in your notes or screenshots.
End any call in which someone asks for a code, and contact the company yourself through its app.

Four other scams

Phishing sits alongside other tricks that target the same players.

Release fees. A site or agent demands payment before a withdrawal can be released. Licensed operators deduct charges from the balance and do not ask for fresh transfers.
RTP and 'max win' predictors. Tools or channels claiming to know when a slot is about to pay. RTP is a long-run average and each spin is independent, so there is no moment to predict.
Fake agents. Accounts imitating an operator that take deposits into personal wallets.
Look-alike domains. Copies of a real site at an address that differs by a character.

What a genuine KYC request never asks for

Licensed operators verify identity, and that is legitimate. They do it on their own upload pages with an ID and a selfie. They never ask for:

OTPs, MPINs, passwords or card security codes.
A payment to verify, activate or unfreeze.
Documents sent through a messaging app.
Screen sharing or remote control of your phone.
Your email password or access to your SIM.

The escalation route

The operator's own support, opened from within its website, for anything involving the casino account.
The e-wallet's in-app helpline for anything involving the wallet. Find it in the app's help section. Never use a number someone sends you, even one that arrives in an official-looking message.
PAGCOR's published complaint channel, located on the regulator's own website, for unresolved disputes with a licensed operator.
The PNP Anti-Cybercrime Group or the NBI Cybercrime Division for fraud. The Cybercrime Investigation and Coordinating Center's 1326 hotline also takes scam reports; confirm contact details on the agency's official site.

Keep the phishing message, the number or link it came from, and any transaction references.

If you gave a code or password away

Change the wallet MPIN and the casino password immediately, from a device you trust.
Check the wallet for unfamiliar linked devices or merchants and remove them.
Report through the wallet's in-app help and ask for the account to be secured.
Review recent transactions and note the reference numbers of any you did not make.
File a report with the cybercrime authorities.

Acting within minutes matters more than acting perfectly.