GCash & Maya safety tips
Your e-wallet is your money — protect it. Simple habits that stop the most common attacks on GCash and Maya.
E-wallets made paying easy for everyone, including scammers. The good news: almost every GCash/Maya scam relies on you sharing something you should never share, or trusting a screen you should always double-check. Master a few habits and you close those doors.
Never share these — not with anyone
GCash and Maya will never ask for your MPIN, OTP, or password — not by call, SMS, email, or chat. Anyone who does is a scammer, even if they sound official or know your name.
- Anyone asking for your OTP, MPIN, or password
- A “support agent” who called you (real support doesn’t cold-call)
- “Verify your account” or “claim your refund” links
- Someone telling you to install AnyDesk/TeamViewer to “fix” your account
Lock down your account
- 1Turn on biometrics or a strong, unique MPIN in the app.
- 2Use a different password for your wallet email than for anything else.
- 3Enable login/transaction notifications so you catch anything instantly.
- 4Keep your number registered to you and report sudden loss of signal (possible SIM-swap).
- 5Never save your MPIN in notes, photos, or autofill.
Before you send money to a seller
Most marketplace losses happen at the “send” screen. Slow down for ten seconds.
“You are sending ₱3,500 to JUAN D******Z. Confirm?”
- Read the recipient name on the confirmation — it must match the real seller
- Be suspicious if the account name is random or doesn’t fit the business
- For QR payments, confirm whose account the QR belongs to before you confirm
- Run the number through TsekMuna first
Watch out for QR-swap scams
In stores or with sellers, a scammer may paste their own QR over the real one so your transfer lands in their account.
- Printed QR looks pasted over or out of place
- The name on your confirmation isn’t the store/seller
- Staff can’t explain whose account the QR belongs to
- Always verify the recipient name before confirming
- When unsure, ask for the official QR or pay in cash
If your wallet is compromised
- 1Open the official app and change your MPIN immediately.
- 2Report to GCash (Help Center → report) or Maya (Report a problem) and ask to freeze the account.
- 3Change the password on the email linked to your wallet.
- 4Dispute any transactions you didn’t authorize.
- 5If you shared an OTP or installed a remote-access app, uninstall it and assume the account is exposed until secured.
- 6File a report with the PNP-ACG or NBI Cybercrime Division for significant losses.
Speed is everything. The faster you report a compromised wallet, the better the chance of a freeze before funds are cashed out.