Financial institutions are confronting a changing fraud environment in which mule accounts, account takeovers, and authorized push payment scams increasingly intersect, according to a new joint whitepaper from IDfy Philippines and CIBI Information, Inc.
The report, “Mule Hunting: Are We Chasing Ghosts?,” estimates that the Philippine economy risks losing approximately PHP 603 billion annually, nearly 3% of national GDP, without stronger safeguards against illicit mule account networks.
The findings come as the country’s digital payment infrastructure continues to expand. BSP data recorded PHP 24.74 trillion in combined transaction flows through PESONet and InstaPay in 2025.
The whitepaper estimates that PHP 1.088 trillion in transactions was at risk of digital fraud, with 55.4% directly dependent on authorized push payment (APP) scams and account takeovers (ATO) requiring mule accounts to move stolen cash.
For financial institutions, the regulatory implications are becoming increasingly significant.
AFASA and BSP Circular 1213 fundamentally shift liability for fraud losses from consumers to financial institutions. Institutions that fail to deploy real-time fraud management systems face full, unlimited reimbursement liability for customer losses.
The circular also limits SMS and Email OTPs to initial account setups. They cannot be used for high-risk actions such as fund transfers, payee additions, and credential changes.
The report therefore recommends a security architecture that combines multiple forms of protection rather than relying on a single authentication method.
These include server-side biometrics, cryptographic device binding, and real-time AI behavioral risk scoring.
“Clinging to interceptable OTPs is no longer just legacy technology; under AFASA, it is a direct financial liability for institutions,” said Raghuraman Chandrashekhar, Country Head of IDfy Philippines. “No single institution can close this gap alone. What works is layering device intelligence, real-time AI transaction monitoring, and biometric verification into a unified defense stack.”
The need for stronger controls is underscored by the Philippines’ rapid digital payment adoption. Retail payment digitalization reached 52.8% in 2023, three years before the country’s 50% target.
The whitepaper said transnational syndicates have been actively exploiting vulnerabilities arising from this rapid growth.
The report estimates that 60% to 70% of mule accounts involve voluntary participants, supported by a growing “mule-for-hire” market. NBI data cited in the report indicates that verified bank and e-wallet accounts are purchased in bulk for PHP 500 to PHP 5,000.
Another 30% to 40% are estimated to involve people coerced through sophisticated schemes such as romance-investment fraud and fake remote job scams.
At the same time, official cybercrime reporting remains under 2%, even though CICC data indicates that 34% of Filipinos have experienced financial scam losses.
Small transaction values and legal complexity can discourage victims from filing complaints, allowing weaponised mule accounts to remain active and clean for months.
The report recommends connecting Fraud Intelligence Data Sharing (FIDS), AI-driven transaction monitoring, and server-side facial authentication into a unified system.
Together with the AFASA regulatory framework, these measures are intended to provide an end-to-end defense against mule networks operating across the financial ecosystem.
For the full version of the report, visit idfy.ph/mule-hunting-whitepaper-landing.
