NBI probes SIM card swap scam


Fraudsters use cellphone info to illegally transfer bank funds

The National Bureau of Investigation has summoned Globe Telecoms to answer allegations that scammers were allegedly using its SIM card swap scheme to illegally transfer funds via mobile phones.

In a radio interview Saturday, Ronald Aguto, head of the NBI Anti-cybercrime Division, said they have sent a letter to the management of a Globe Telecom store at SM City North Edsa asking them to provide investigators with a copy of a closed-circuit television (CCTV) footage showing the suspected scammers who went to their establishment to have a SIM (subscriber identity module) card replaced.

The scammer allegedly managed to transfer funds linked to the online bank account of a Globe post-paid subscriber through its “SIM-swap” promotion where an existing SIM card is replaced with a new one. The replacement allegedly allows the fraudster to take over one’s mobile number and use it for fraudulent activities.

The case stemmed from the complaint of Ian Caballero, a Globe post-paid subscriber, who claimed that scammers who used the scheme attempted to transfer P48,000 from his bank account.

Caballero said he sought the NBI’s help after Globe allegedly refused to cooperate in helping unmask the culprit whom he strongly believes was filmed by the store’s CCTV camera when he went there to have the SIM card replaced.

A source privy to the ongoing investigation, however, told the Times that Caballero was specifically “targeted” by the scammers.

A Globe Telecom official on Saturday said they would come out with an official statement on the issue this week.

NBI’s Aguto said he was able to talk to a Globe executive who vowed to cooperate in the investigation.

Aguto said the NBI is investigating hundreds of computer-related identity theft cases.

Caballero said he called the Globe customer service hotline last July 2 after his phone suddenly went dead. The customer service agent allegedly told him that somebody had just requested to have his SIM card replaced.

Caballero said he then told the customer service agent that he was concerned because of “possible security risks it may cause”.

“My cellphone number is associated with multiple e-mail accounts, my Facebook, and a few others. It is also set up as a recovery method for these accounts because I thought that this was indeed an extra security layer. What that means is if, for some reason, I forgot my password to any of these accounts, that I would then have the ability to restore access through my mobile number. For instance, GMail would send me a temporary password to my mobile number and voila, I can access my email again. This is how the perpetrator managed to reset the passwords of my online accounts since my SIM died and he had the activated one in his hands already,” Caballero said on his Facebook account.

Caballero claimed that Globe agreed to issue him a new SIM card with a different number, but refused his request to get access to the CCTV footage.

“After regaining my hold on those accounts, emails started to come into Outlook and then

I got the standard emails saying that my passwords were changed around the same time the Globe (representative) said that a SIM replacement request was processed. What threw me off and literally shook my core was an email from (the bank) saying that a fund transfer was completed, going out to (another bank) for P48,000.

“I made multiple calls to my banks and ensured that my mobile number is removed from their system,” he said.

‘Targeted attack’
Anton Bonifactio, vice president for information security at Globe Telecom, told radio station dzMM, that Caballero’s case was a “targeted attack”.

“That’s been a targeted attack talaga, ano. Narinig nyo naman din si chief (Aguto). Kahit sa PNP Cybercrime Unit, bago din sa kanila ito. Ang nangyari talaga, may nagpunta sa store namin sa SM North EDSA. Nag-submit ng documents, may authorization letter, SSS ID ng subscriber namin, driver’s license so talagang nag-request ng change SIM. So sinunod talaga yung verification processes namin kasi meron siyang documents eh na talagang na-target yung subscriber at na-process yung change SIM. So pag na-process na parang na-take over yung phone. Ganun nangyari,” he said.

He, however, clarified that the replacement of SIM cards is not fraudulent in itself.

“Just to be clear na yung change SIM, I guess hindi naman simula nung fraud eh. Dapat sa huli na yan. Kailangan alam ko na yung kaniyang email address, yung banking information niya, yung kopya ng driver’s license, ng SSS… nasa huling process na yung SIM fraud. Kasi kunwari naka-2-step authentication yung email mo, na kailangan yung code ise-send via SMS, dun palang papasok na eh. So talagang last in the line. Targeted talaga yung tao kasi kumpleto yung documents,” Bonifacio added.

Bonifacio said the scammer managed to present an authorization letter to have the SIM card replaced.

“Nag-submit naman ng SSS ID yung nag-pretend na sya (Caballero) so may fake authorization letter, pero may SSS and driver’s license nung subscriber eh,” he said.

Bonifacio said they could not release the CCTV footage because of privacy issues.

“Usually yung standard policies either kailangan ng court order or kailangan ng police investigation. Pero to be clear, because of the gravity of the incident– so we understand that. we are also concerned. We also feel like the victim here eh, parang natira yung store.

Two days ago, iniinvite na namin yung subscriber, si Mr. Caballero, para mapakita yung CCTV sa SM North EDSA kaso umuulan so nag-cancel sya. Kahapon din iniinvite namin sya kaso nainterview na yata sya ng ABS. Pero napakita na namin sa kanya. We have the docs, the CCTV. We’re also working with the NBI because this is a concern, not just as a Globe subscriber but as a whole,” he said.

Continuous drive
Globe Telecom, in a recent statement, said authorities have arrested at least 65 cable thieves and fraudsters as the drive against such illegal activities continue to intensify.

“Twelve individuals were apprehended and are now facing prosecution for Estafa due to illegal recontracting and subscription fraud, 31 for illegal sale of WiMax Modems, and 20 for cable theft,” the statement said.

Froilan Castelo, Globe general legal counsel, said the cases should serve as a warning that Globe, in close coordination with the PNP and NBI, remains relentless in pursuing its campaign against all types of fraud that can put the company’s name in bad light and negatively affect legitimate Globe customers.

Castelo also advised Globe customers to be wary of unscrupulous persons who may lure them with cheap prices for Globe products and services or shorter term subscription period but may cause them a lot of problems in the end.

“We encourage everyone to only transact with legitimate sellers and distributors or go directly to any of the numerous Globe Stores to ensure that they only get quality services and after-sales support. And to those who have already fallen victim to illegal activities including cyber fraud, Globe will not hesitate to bring the perpetrators to justice,” he said.

Castelo said that part of its security enhancement program, Globe has installed the most-advanced CCTV cameras in all Globe Stores nationwide. CCTV recordings will be used to present evidence in police investigations and legal prosecution against fraudulent activities such as identity theft where impostors steal personal information and assume the identity of other people for personal gain.

Castelo added, “We would like to assure the public especially our customers that cybercrime investigation is now equally sophisticated and can yield results that will hopefully prevent similar occurrences from happening”.

BDO Unibank had also issued a statement warning its customers against sharing “sensitive details” on social media accounts amid recent reports of attempts by scammers to illegally transfer funds via mobile phones.

The bank said it has intensified both its online monitoring for fraudulent threats and security measures.

“These scams occur outside the scope of the bank’s already stringent online security, hence, we continue to encourage our clients and the general public to be extra vigilant in protecting their personal information,” the bank said in a statement.

The bank also advised its customers to immediately change their online banking password and report incidents of a possible data breach.


Please follow our commenting guidelines.


  1. Larry Ebersole on

    let us all move to the registry of all sim card. in a lot of countries now, you cannot buy a sim card from anywhere other than a registered outlet. In Philippines you can buy sim card just about anywhere and very cheap; why are the telco opposing this registration of sim cards. HOY GISING mga TONGRESSMAN namin at isulong na ito makasulit manlang kaming ordinaryong tao sa ipinasusweldo sa inyo liban pa sa tongpats nyo.

  2. di_ako_engot on

    Tanggalin na lang ng Globe Telecoms yung Sim Card Swap Scheme promo nila! Ganun lang kasimple. Alam naman nating lahat na ang kriminal, kahit anu pang field of endeavor ang kanyang minamaster, ay laging naghahanap ng pagkakataon! Duon po sa 2-factor verification code system ng mga sikat na email providers tulad ng Yahoo at Gmail, puede namang magpasok ng dalawang cell phone number. Para kung mawala man yung isang sim card, may isa pang reserba ang email account owner. Hindi siguro yun ginawa ng biktima. Kaya ng madeactivate yung Globe sim nya, kailangan pa nyang pumunta sa Globe office para magreklamo. Kakatwa ang nangyare sa Globe sim nya dahil hindi nadedeactivate ang Sim card kung regular na may load! Kung yung Globe sim number nya ang active number nya, paanong nadeactivate yun ng ganun na lang?

    • di_ako_engot ang ironic naman considering your nickname :/ mukhang di mo naiintindihan yung nangyari. the whole thing HAS NOTHING to do with the sim card swap promo. i can explain more pero sa dami ng articles about the said incident, i-google mo nalang ang buong kwento.

  3. The NBI should look into the skim of text scammer. Likely these people are working at the date base of telecom company. They are familiar the terms and language used by the people they are going to victimize.