GCash Account Hacked and Drained? Here's Exactly What to Do

Discovering your GCash or Maya account has been hacked and drained is frightening — but acting quickly and in the right order can make all the difference. This guide walks you through every recovery step.

Stay Calm and Act Immediately

Finding out your GCash account was hacked and drained — or that your Maya wallet has been emptied by an unauthorized party — can feel overwhelming. The most important thing to know is that the speed of your response matters enormously. Every minute you wait gives a fraudster more time to move funds further down the chain, making recovery harder. Take a slow breath, gather your device, and work through the steps below in order. If you are unsure whether an earlier message or link triggered the breach, you can verify suspicious messages or numbers on TsekMuna before you do anything else.

Screenshot every unusual transaction in your transaction history right now — before anything changes. These records will be required by your e-wallet provider and the authorities.

Step 1 — Secure Your Account Right Away

Your first priority is to cut off the attacker's access. Even if your balance is already zero, an open session can be used to receive and immediately re-send money, rack up loans through in-app credit features, or harvest more personal data.

1. Open the GCash or Maya app immediately and go to your profile or account settings.
2. Change your MPIN and password right away from a secure device — ideally one the attacker has never touched.
3. Enable or re-confirm two-factor authentication (2FA/OTP) tied to your registered SIM.
4. If you cannot log in at all, call GCash Support at 2882 or Maya Support at (02) 7795-7799 and ask them to temporarily freeze or lock your account.
5. Report the unauthorized access through the in-app Help Center so a ticket is opened on record.
6. If your registered SIM was also compromised or swapped, visit your network provider's nearest branch with a valid ID to reclaim your number.

Do not attempt to log in repeatedly with a wrong MPIN — too many failed attempts can lock you out further and complicate support calls.

Step 2 — Document Everything Before You Report

Strong documentation is what separates a successful dispute from one that gets closed with no resolution. Authorities and e-wallet providers need specifics, not general complaints.

Warning signs

• Transactions you did not initiate, even for very small amounts (fraudsters test accounts with micro-transactions first).
• OTP messages you did not request arriving on your phone.
• Sudden logout from your account with no action on your part.
• Friends or contacts saying they received a money request from your account.
• In-app loans or credit draws you did not apply for.

1. Screenshot your full transaction history, showing every unauthorized send, cash-out, or purchase.
2. Note the exact timestamps, amounts, reference numbers, and any merchant or recipient names shown.
3. Save any suspicious SMS, chat messages, emails, or links that arrived before the breach.
4. If you clicked a phishing link, note the full URL (take a screenshot — do not visit it again).
5. Write a brief timeline: when you last had normal access, when you noticed something wrong, and every action you took since.

Step 3 — File a Formal Dispute With Your E-Wallet Provider

Both GCash (operated by Mynt) and Maya (operated by PayMaya Philippines) are regulated by the Bangko Sentral ng Pilipinas (BSP) and are required to have a formal complaints and dispute process. Filing a dispute officially — not just chatting with a bot — creates a paper trail that the BSP can audit if needed. For deeper context on how fraudsters typically gain access to e-wallets, the GCash and Maya safety guide on TsekMuna covers the most common attack methods.

1. Submit a dispute through the official in-app Help Center, clearly labeling it as 'unauthorized transactions' or 'account compromise.'
2. Follow up via the official email or hotline and request a ticket or reference number for your dispute.
3. Ask specifically whether a chargeback, reversal, or account credit is possible for the drained amount.
4. Keep a log of every interaction: agent name (if given), date, time, and what was promised.
5. If you do not receive a satisfactory response within 15 business days, escalate to the BSP.

The BSP Consumer Assistance Mechanism (CAM) accepts complaints at consumeraffairs@bsp.gov.ph. Attach your dispute reference number from the e-wallet provider when you write in.

Step 4 — Report to the Authorities

Filing a report with law enforcement is not just about catching the criminal — it creates an official record that strengthens your dispute with the e-wallet provider and may be required by your bank or insurer. The Philippines has dedicated cybercrime units trained for exactly this kind of case. This guidance is advisory only and not legal advice.

1. File a complaint with the PNP Anti-Cybercrime Group (PNP-ACG) online at acg.pnp.gov.ph or visit your nearest PNP-ACG regional office.
2. Alternatively, report to the NBI Cybercrime Division — you can visit their Manila office or check for regional satellite offices.
3. Bring printed copies of all your screenshots, your timeline document, and a valid government-issued ID.
4. Ask for a copy or acknowledgment of your complaint — this reference will support your BSP escalation.
5. If the hacker used another person's linked bank account to receive funds, note those details from your transaction record for investigators.

What to do instead

• Bring at least two valid IDs to any authority or provider office.
• Bring printed and digital (USB or cloud link) copies of all evidence.
• Request written acknowledgment of your complaint at every step.
• Follow up on your complaint every five to seven business days.

Step 5 — Escalate to the BSP If Needed

If your e-wallet provider has not resolved your complaint within 15 business days (or the timeframe stated in their terms), you have the right to escalate to the Bangko Sentral ng Pilipinas. The BSP takes consumer protection seriously and can compel a regulated institution to respond. Learning how to report a scam through official channels ensures your complaint reaches the right desk the first time.

1. Prepare a summary letter addressed to the BSP Consumer Protection and Market Conduct Office.
2. Attach your dispute reference number from GCash or Maya, all screenshots, and any written responses you received.
3. Submit via email at consumeraffairs@bsp.gov.ph or through the BSP online complaint form at bsp.gov.ph.
4. State clearly that the institution has not responded within the regulatory timeframe.
5. Keep checking your email — the BSP may request additional documents.

The BSP also monitors social media complaints tagged to regulated institutions. While a public tag is not a substitute for a formal complaint, it can sometimes accelerate a response.

How Did This Happen? Understanding Common Attack Methods

Recovery is urgent, but understanding how attackers got in helps you prevent a repeat breach. Most e-wallet compromises in the Philippines follow a handful of well-worn patterns. Being aware of these is part of building lasting financial safety. To learn more about the full landscape of digital fraud, visit the scam education hub for a library of guides covering phishing, smishing, vishing, and more.

Warning signs

• Phishing links sent via SMS or Messenger that mimic GCash or Maya login pages.
• Fake 'account verification' calls where the caller poses as customer support and asks for your OTP.
• SIM swap attacks — where a fraudster convinces your telco to transfer your number to a SIM they control.
• Malicious apps or screen-sharing sessions that capture your MPIN.
• Fake prize or cashback notifications that lead to credential-harvesting forms.
• Public Wi-Fi interception when logging into your e-wallet on an unsecured network.

No legitimate GCash or Maya agent will ever ask for your MPIN or OTP — not by call, SMS, email, or chat.

Protect Yourself Going Forward

Once you have regained control of your account, hardening it against future attacks is essential. Scammers who have successfully targeted you once may try again with a different tactic, or sell your data to other fraudsters.

What to do instead

• Use a unique, strong MPIN — never birthdays, phone digits, or sequential numbers.
• Never share your OTP with anyone, for any reason, no matter how convincing the story sounds.
• Enable biometric login (fingerprint or face ID) as an extra layer of security.
• Regularly review your linked accounts and remove any cards or bank accounts you no longer use.
• Be skeptical of any unsolicited message about your e-wallet — verify the sender before clicking anything.
• Only download GCash or Maya from the official Google Play Store or Apple App Store.
• Log out of your account on shared or borrowed devices.
• Keep your registered mobile number secure and monitor for unexpected SIM deactivation.

Set a calendar reminder to review your e-wallet's active sessions and linked accounts every month — it takes less than five minutes and can catch trouble early.

Run a free scam check · More scam-safety guides