GCash Fraud or Scam – What to Do if Victimized?

Today, I became a victim of GCash fraud or scam via the American Express Virtual Pay card – an addition to the growing number of digital fraud or scam incidents in the country today.

As we become more and more geared towards applying cashless transactions in our daily lives, more and more fraudsters and scammers are becoming savvy in trying to access our online accounts and perform unauthorized transactions.

As someone who constantly reads and shares articles on digital security, I am very much careful in handling my digital footprint to protect my accounts.

Then, this happened.

Seven unauthorized transactions in my GCash account were done by the fraudster. The first 5 happened while I was still asleep. The last 2 of which I experienced right in front of me.

I received the last 2 notifications of the unauthorized transactions after I reported the incident (first 5 transactions) to GCash support. And I saw that my GCash wallet was being deducted by Php500. Then, another Php500.

A. GCash fraud or scam – what happened?

Just like any Sunday, I woke up today a little late than usual. I did the usual morning routine. Then I checked my smartphone. To my surprise, there were 5 SMS notifications coming from GCash. Hmmm, this is unusual. I opened the text messages and was shocked! There were 5 messages that begin with the words “You have paid…” The transactions happened in just 2 seconds. The total amount is more than Php4,000.00.

I am not aware and did not perform those transactions. Therefore, all of those were unauthorized. While I was sleeping, the fraudster was busy accessing my account and doing unauthorized transactions.

Here’s the list of the GCash transactions based on the SMS I received. I cannot rely on GCash transaction history as those are not updated. The first 5 were the transactions that happened before I woke up as I described above. The last 2 transactions occurred right after I reported the fraud incident to GCash support via call.

• SERVICES – Php62.81 – via GCash American Express Virtual Pay
• STRIPE – Php1,000 – via GCash American Express Virtual Pay
• STRIPE – Php1,000 – via GCash American Express Virtual Pay
• STRIPE – Php1,000 – via GCash American Express Virtual Pay
• STRIPE – Php1,000 – via GCash American Express Virtual Pay
• STRIPE – Php500 – via GCash American Express Virtual Pay
• STRIPE – Php500 – via GCash American Express Virtual Pay

B. GCash fraud or scam via American Express Virtual Pay

As you may have noticed from the above list, the gateway that was used was via the American Express Virtual Pay. I wondered how the scammer was able to use that account since Security Code/CVV is requested within the GCash app and sent thru SMS. I did not receive any notification or text message with a Security Code/CVV.

Another thing is that I never used the GCash American Express Virtual Pay card. I just linked and activated it in the past and then forgot about it. Therefore, it’s data – account number and CVV – has not been entered in any website.

C. What to do after a GCash fraud or scam

1. Transfer your GCash funds and change MPIN immediately!

The initial reaction that I felt was to be shocked but that was normal and temporary. I immediately reported the unauthorized transactions to GCash Support.

We always thought that the first thing to do after an unauthorized transaction is to call GCash support right away. That’s what I did. Now, I would admit that it was a mistake.

The first thing to do is to deplete your GCash wallet so that any further fraudulent activity would be avoided. You should also modify the MPIN right away.

After calling 2882 and more than 2 hours after the first 5 transactions, I thought that the fraudster was done. Sorry to say but he/she was not yet satisfied. Two unauthorized transactions happened again worth Php500 each. I immediately transferred the funds in my wallet to my GCash GSave account.

2. Call GCash Support – 2882

Reporting will take a few hours of your time. I called 2882, then I was told to email a form along with screenshots as additional proof.

When calling 2882, an automated voice will initially attend to you. Just be patient in responding to the prompts like entering the digits in order to talk to a real person. If I remember it right, I agreed to provide details so I pressed #1, then went to GCash transaction concern (#2), then Cash in concern (#2), then Agent assistant (#3). This is not the best path but I was able to finally talk to an agent.

The following are the need details that the agent might request from you. I would recommend preparing some of the details beforehand so you will not be looking for the information while you’re on the phone.

• Full name
• GCash Account Number
• Birthday
• Registered email address
• Current balance
• Exact date and time of unauthorized transaction/s
• Amount of unauthorized transaction/s
• Was this one time or multiple transactions?

State clearly the details during the call. Remember that the member of the GCash support team on the other end is entering the information on his or her computer so your answers are vital to make the report accurate. You may repeat some details if needed.

Before the end of the call, the agent will provide information on the next action that you should take. For this particular concern on unauthorized transactions, the next thing to do is to open your registered email, fill out a form, and send it back to them along with screenshots you have as proof.

3. Check the email sent by the GCash Support Team

After the call with the GCash Support Team in 2882, open your registered email right away. You need to provide the following and send the information back to the support team.

• GCash Dispute Form
• Date and Time of disputed transactions
• Target Wallet (if available)
• Transaction IDs
• Amount
• The first six digits and the last four digits of their GCash MasterCard

Fill out the GCash dispute form

The most important item in the above list is the GCash Dispute Form. The following are the details needed in the form:

• Subscriber’s GCash Card Number – I entered here the American Express Virtual Pay card number
• Subscriber’s GCash registered mobile number
• Your full name
• Table of unauthorized transactions – with columns Transaction Date, Merchant Name, Transaction Amount, Transaction Reference)
• Reason – I selected the option Unauthorized Transaction (It says in the form that “This transaction was neither made nor authorized by me / my supplementary cardholder. The card was in my possession at the time of the transaction and at all times.”)
• Registered email address
• Signature

Due to the COVID-19 pandemic, I cannot go out and print the form. What I did was fill out the form on my personal computer. The challenging part is creating the signature and placing it on the document. I created a signature online and placed it on the document.

4. Reply to the email sent by the GCash support team

Once your GCash dispute form is ready, reply to the email sent by the GCash support team. Make sure that the details in the body of the email are correct. Also, don’t forget to attach the dispute form and screenshots of the unauthorized transactions.

D. The waiting game

GCash support did not give the exact date when the dispute will be resolved. When I asked about it, I was just told that this matter will be referred first to their partner, American Express.

So I just though of a time frame when I will follow up. I’ll give them a week.

Update: The money was returned to my GCash wallet after 9 days. The transactions were reversed.

Final Thoughts

We can be so careful with our online accounts but fraudsters and scammers can improve their skills and find loopholes in any system – GCash, PayMaya, Coins.ph, or any other Fintech apps.

In the case I reported here, they were able to use American Express Virtual Pay, a feature linked to GCash.

When fraudulent activities happen in our account, we should report it to official support and not to any account in social media. Reporting it to unofficial channels will exacerbate the problem instead of solving it