The Philippines is facing a sharp rise in near-field communication (NFC)-based fraud driven by sophisticated Chinese cybercriminal groups, cybersecurity firm Resecurity said, warning the surge threatens the integrity of the country’s fast-growing digital payments ecosystem.
In a report, Resecurity said dark web activity linked to Chinese actors targeting the Philippine financial system rose 230% in the second quarter of 2025 from a year earlier, as attackers exploited vulnerabilities in contactless payment platforms such as GCash, Maya, and BDO Pay.
Cybercriminals are using Host Card Emulation (HCE) and tools like Z-NFC and Track2NFC to simulate contactless card transactions with stolen data, bypassing authentication protocols.
Fraudulent point-of-sale (POS) terminals equipped with eSIMs have processed up to $80,000 in daily illicit payments, the report said.
The firm traced many attacks to Chinese crime syndicates like the “Smishing Triad,” which operate via Crime-as-a-Service models.
Tools, phishing kits, and stolen Philippine-issued card data are distributed through Telegram bots including “Panda Shop” and “Hulk Vault.” One underground shop listed over 7,700 compromised cards issued by Philippine banks.
The report also highlighted increased collaboration between foreign cybercriminals and local operators, who recruit money mules to set up fake businesses or install rogue POS devices in retail and food outlets, facilitating the covert movement of stolen funds.
With a digital fraud rate of 13.4%—150% above the global average, according to TransUnion—Resecurity urged regulators and financial institutions to adopt behavioral analytics, tighten merchant verification, and expand threat intelligence sharing.
The firm warned that current cybersecurity defenses are struggling to keep up with the rapid evolution of NFC-related fraud, potentially eroding trust in digital payments and posing broader risks to the Philippine financial system.
Cebu Business News
