The Philippines’ transformation into a digital-first payments environment has brought speed and convenience to financial transactions, but it has also opened new avenues for fraud networks to exploit, according to a joint whitepaper from IDfy Philippines and CIBI Information, Inc.
The report, “Mule Hunting: Are We Chasing Ghosts?,” estimates that the Philippine economy risks losing roughly PHP 603 billion every year to illicit mule account networks without stronger identity safeguards.
That amount is equivalent to nearly 3% of national Gross Domestic Product (GDP).
The scale of the potential exposure is tied to the country’s growing digital transaction volumes. BSP data shows that combined transaction flows through PESONet and InstaPay reached PHP 24.74 trillion in 2025.
The whitepaper estimates that PHP 1.088 trillion in transactions was at risk of digital fraud, with 55.4% directly dependent on authorized push payment (APP) scams and account takeovers (ATO) that require mule accounts to move stolen cash.
The Philippines surpassed its target of 50% retail payment digitalization three years ahead of schedule, reaching 52.8% in 2023.
The report said this accelerated digital adoption has also created a gap that transnational syndicates are actively exploiting.
The challenge extends beyond the technology itself. Official cybercrime reporting remains below 2%, even though CICC data indicates that 34% of Filipinos have suffered financial scam losses.
Many victims do not proceed with formal complaints because individual transaction amounts may be small and legal procedures can be complex. The result, according to the whitepaper, is that weaponised mule accounts can remain active and clean for months.
The report estimates that most mule accounts—60% to 70%—involve voluntary participants. NBI data cited in the report indicates that verified bank and e-wallet accounts are purchased in bulk for PHP 500 to PHP 5,000 through a “mule-for-hire” market.
The remaining 30% to 40% are estimated to involve people who are coerced through sophisticated scams, including romance-investment frauds and fake remote job scams.
At the same time, the regulatory landscape is becoming more demanding for financial institutions.
AFASA and BSP Circular 1213 fundamentally shift liability for fraud losses from consumers to financial institutions. Institutions that fail to deploy real-time fraud management systems face full, unlimited reimbursement liability for customer losses.
BSP Circular 1213 also restricts SMS and Email OTPs to initial account setups and prohibits their use for high-risk actions such as fund transfers, payee additions, and credential changes.
The whitepaper recommends a layered approach that combines server-side biometrics, cryptographic device binding, and real-time AI behavioral risk scoring.
“Clinging to interceptable OTPs is no longer just legacy technology; under AFASA, it is a direct financial liability for institutions,” said Raghuraman Chandrashekhar, Country Head of IDfy Philippines. “No single institution can close this gap alone. What works is layering device intelligence, real-time AI transaction monitoring, and biometric verification into a unified defense stack.”
The report said no single safeguard is sufficient to address the problem. Instead, Fraud Intelligence Data Sharing (FIDS), AI-driven transaction monitoring, and server-side facial authentication should operate together.
With the AFASA regulatory framework connecting these measures, the whitepaper calls for an end-to-end defense mechanism capable of addressing mule networks across the financial system.
For the full version of the report, visit idfy.ph/mule-hunting-whitepaper-landing.