Scams to Avoid: Look-Alike Sites and the Things They Cannot Fake

The three things a clone cannot copy

1. The address you type yourself. A clone must be reached; it cannot intercept a correctly typed address.
2. The regulator's own published list. A clone can print a company name, but the name will not appear on PAGCOR's list, or it will belong to someone else.
3. A withdrawal that actually arrived. Money that reached your own account from an operator is evidence no screenshot can manufacture.

Everything else in this market is copyable. Build the habit around those three and the look of a page stops mattering.

How a clone gets reached

• A search or social advertisement bought on the brand's own name, placed above the real result.
• A link in a group chat, described as the new address or a faster mirror.
• A QR code or short link, which hides the address entirely until you have arrived.
• A reply to a public complaint, offering to sort out your problem on another site.
• An old bookmark or home-screen icon saved once from a bad source, which then never looks suspicious again.

Keeping one safe route in

1. Type the address once, carefully, reading it character by character.
2. Log in and confirm it is your account, with your history in it.
3. Save that as your only bookmark, and delete every other saved route to the brand.
4. Use it every time. If it ever fails, type the address again rather than searching for an alternative.
5. Treat any message announcing a new address as the scam itself. Operators announce changes on the site you already use.

The padlock is worth one sentence: it proves the connection is encrypted and nothing about who owns the site. Any clone can obtain a certificate in minutes.

What the address bar is telling you

Four more traps

• The fake agent on Telegram or Facebook, offering to deposit for you into a personal wallet number. Operators take deposits only through their own cashier, into a company account.
• The release fee, where an approved withdrawal supposedly needs a tax or unlock payment first. Nobody legitimate asks you to pay in order to be paid.
• The predictor app, sold as a way to read a slot's next result. Outcomes are generated at spin time and are independent, so there is nothing to read.
• The fake promo code, which leads to a login page or a small activation payment. Real promotions live on the operator's own promotions page and inside your account.

What a genuine verification request never asks

A request for documents is ordinary; licensed operators have to confirm identity before paying out. Judge it by where it arrives and what it wants. Inside your own account, asking for a government ID, a selfie and perhaps proof of address, is the genuine shape of it.

• Never your password.
• Never a one-time PIN, by message, by phone, by email or by screen share.
• Never your e-wallet MPIN, or a card's CVV and expiry.
• Never a payment to complete verification.
• Never remote access to your phone or an accessibility permission.
• Never papers sent to a personal chat; documents are uploaded in your account only.

If you think you logged into a clone

1. Change the password on the real site, reached by typing the address, and anywhere you reused it.
2. Turn on any extra login protection the operator offers.
3. Check your e-wallet and bank history for anything unauthorised and report it through the app's own help centre.
4. Delete every bookmark and home-screen icon for the brand, then re-add one from a freshly typed address.
5. Tell the operator so it can report the clone, and keep your screenshots.

Escalation, in order

1. The operator's own support, through its site, with the transaction reference, the peso amount and the date. Keep the ticket number.
2. Your e-wallet or bank's in-app help centre, which you open yourself. Never a number someone sent you, and never a call-back to settle a dispute.
3. If a licensed operator will not settle it, PAGCOR's published complaint channel, reached from pagcor.ph. Bring the ticket reference: the regulator expects the operator to have been asked first.
4. The PNP Anti-Cybercrime Group or the NBI Cybercrime Division for fraud or stolen credentials; both publish their complaint procedures on their own official sites. 8888 is the government's Citizens' Complaint Hotline as a general starting point.

Save the evidence before you file: the exact address you were sent to, screenshots of the chat and the sender's profile, and the transaction record with its reference.