The Philippines’ digital payments revolution has a dark ledger. A joint whitepaper by IDfy Philippines and CIBI Information, released in September 2026, estimates that the Philippine economy risks losing approximately PHP 603 billion annually—nearly 3% of national GDP—to illicit mule account networks without stronger identity safeguards. The report analyzed BSP transaction data showing PHP 24.74 trillion in combined PESONet and InstaPay flows in 2025. Of that, about PHP 1.088 trillion was at risk of digital fraud, with 55.4% directly tied to authorized push payment scams and account takeovers that rely on mule accounts to move stolen funds.
The Mule Account Economy
The vulnerability stems from hyper-accelerated digital adoption. The Philippines surpassed its target to digitize 50% of retail payments three years early, reaching 52.8% in 2023. But this rapid growth created a gap that transnational syndicates actively exploit. The whitepaper estimates that 60% to 70% of mule accounts involve voluntary participation, driven by a “mule-for-hire” market where verified bank and e-wallet accounts are bulk-purchased for PHP 500 to PHP 5,000. The remaining 30% to 40% are coerced through romance-investment frauds and fake remote job scams. Official cybercrime reporting remains below 2%, despite CICC data indicating that 34% of Filipinos have suffered financial scam losses. Victims rarely file formal complaints due to small transaction values and legal complexity, allowing mule accounts to remain active and clean for months.
Why AI Is the Only Scalable Defense
Manual review cannot keep pace with PHP 24.74 trillion in annual transaction flows. AI-powered fraud detection operates at the speed and scale required to identify suspicious patterns across millions of transactions in real time. Behavioral risk scoring, device intelligence, and server-side biometrics can flag mule account activity before funds are exfiltrated. The whitepaper argues that institutions must adopt a multi-layered architecture: real-time AI transaction monitoring, cryptographic device binding, and server-side facial authentication working in unison. “Clinging to interceptable OTPs is no longer just legacy technology; under AFASA, it is a direct financial liability for institutions,” said Raghuraman Chandrashekhar, Country Head of IDfy Philippines.
The Regulatory Liability Shift
The Anti-Financial Account Scamming Act (AFASA) and BSP Circular 1213 have fundamentally shifted liability for fraud losses from consumers to financial institutions. Institutions that fail to deploy real-time fraud management systems face full, unlimited reimbursement liability for customer losses. The circular restricts SMS and email OTPs to initial account setups and prohibits their use for high-risk actions such as fund transfers, payee additions, and credential changes. This regulatory shift transforms AI fraud detection from a competitive advantage into a compliance imperative.
Financial Inclusion and the Trust Dividend
The stakes extend beyond fraud losses. Digital fraud erodes trust in formal financial channels, pushing vulnerable consumers back toward cash and informal lenders. AI-driven fraud prevention, when implemented transparently, can strengthen financial inclusion by making digital banking safer for first-time users. The BSP’s voluntary AI governance principles, issued in June 2026, emphasize exactly this balance: innovation that serves customers while mitigating unintended consequences. The PHP 603 billion question is whether Philippine institutions can deploy AI fast enough to stay ahead of the syndicates. The technology exists. The regulatory framework is tightening. The only variable is execution.
