How to Choose a Fraud Prevention Provider in the Philippines: Stop Fraud Without Turning Away Good Customers

Ask any fraud prevention provider how good their product is, and you'll hear how much fraud it catches. It's a fair question. It just isn't the first one.

The first one is this: how many of my honest customers will it stop? In the Philippines, where most adults have little or no credit history, the good customers a strict system turns away can quietly cost as much as the fraud it keeps out. And unlike fraud, they never show up in a report.

This guide is a checklist for choosing a fraud prevention provider that gets both right.

Last updated: November 2026.

Fraud has two costs, and most guides count one

The first cost is the one everyone tracks: fake accounts, account takeovers, scams. Under AFASA, it can also include restitution to customers if your controls fall short (RA 12010, Section 6).

The second cost is the honest customers your checks turn away. It never shows up in a fraud report, so it's easy to miss. We break down the hidden costs in The Real Cost of Fraud in the Philippines.

Try it with your own numbers. Say you get 10,000 applications a month. Your checks wrongly reject 5% of honest applicants, and another 10% give up halfway. If each good customer is worth ₱3,000 in profit, that's ₱4.5 million a month walking out the door. (Illustrative figures.)

Friction only where the risk is

The best fraud prevention is close to invisible for good customers and hard only for fraudsters. Someone sending ₱500 to the same family member every week shouldn't face the checks you'd want on a first ₱80,000 transfer to a new recipient from an unknown phone.

The BSP takes the same view. Since June 2026, covered banks and e-wallets can no longer rely on SMS or email OTPs for high-risk transactions, but lower-risk ones can still use them (GMA News). Your provider should help you draw that line, not erase it. For what that looks like in practice, see our rollout plan for replacing SMS OTP with face authentication.

Step 1: Know where you lose money

Before any demo, pull your last six to twelve months of fraud cases and see where they cluster. That way you buy for your problem, not for the slides.

• At onboarding: fake or edited IDs, borrowed faces, one person behind several names (more on synthetic identity fraud).
• Account takeover: a scammer gets a login or OTP through a fake text or call.
• High-risk transactions: large transfers to new recipients, often right after a device or password change.
• Money mules: accounts opened or rented out to move stolen funds, now a crime under AFASA (Section 4). Here's how mule accounts are spotted.

Write down one more number: how many customers you lose at onboarding and at high-risk steps today. That's the baseline every provider should beat.

Step 2: The checklist

At a glance

1. It works on real Philippine IDs and real phones

Your customers send worn IDs, photos taken in dim light and selfies from budget phones on weak signal. A system tuned on clean studio images will reject them. See how lenders verify Philippine IDs online, and why a retake prompt beats a decline.

Red flag: "We support all IDs" with no list, or a bad photo that leads straight to a decline instead of a retake.

2. Liveness is tested by someone other than the vendor

Printed photos, masks and deepfakes are cheap now. Ask for an independent lab report against ISO/IEC 30107, the standard for spotting fake faces. Our explainer on deepfakes and liveness detection covers what to test.

Red flag: "We test it ourselves," or a logo on a slide with no report behind it.

3. It looks across your whole customer base

Fraud rings and mule networks look normal one application at a time. The pattern only appears when the same face shows up behind five names. Here's how duplicate identities are caught.

Red flag: checks that only compare a selfie with the ID in front of them.

4. It adds friction only where the risk is

Customers accept a face check before a big transfer to someone new. They won't accept extra steps every time they pay the same bill. Walk through your top five customer journeys on the provider's system and count the steps and seconds.

Red flag: one level of checking for everything, or settings only the vendor can change.

5. It tells you how many good customers it turns away

A provider that reports only fraud caught is showing you half the picture. You should see approval, retake and drop-off rates every month.

Red flag: catch rates with no false decline figures.

6. It maps to AFASA and BSP rules, in writing

Compliance stays your responsibility. AFASA expects multi-factor authentication, fraud management systems, and account owner enrollment and verification (Section 6). It also lets you hold disputed funds for up to 30 days (Section 7), so ask how the provider supports that. Our AFASA compliance checklist lists what the rules require.

Red flag: "AFASA-ready" on a slide with nothing behind it.

7. Your team can act on what it flags

An alert nobody can explain doesn't get worked, and a decision nobody can explain is hard to defend in a BSP examination. Have one of your analysts work five alerts in the demo.

Red flag: a score with no reason, or no audit trail.

8. Support comes from people who know the market

Transaction volumes peak around payday and the holidays, and local scam tactics change fast. You need people in your time zone who know Philippine IDs, local scams and what the BSP expects.

Red flag: support only by email ticket, or a team that has never worked with a BSP-supervised institution.

9. Privacy you can check, not just read about

IDs and faces are the most sensitive data you hold, and you stay accountable for them under the Data Privacy Act of 2012. Ask where the data is stored, for the actual certificates, and what happens to your data when the contract ends.

Red flag: logos without certificates, or no clear deletion terms.

10. A real pilot and a fair exit

A long integration or a contract you can't leave eats the savings.

Red flag: no pilot on your own data, or pricing that only works at volumes you don't have.

Step 3: Test before you trust

Demos are built to impress. A short test on your own data tells you much more.

1. Shortlist two or three providers. More than that and you'll still be evaluating next quarter.
2. Give them all the same test set: your real fraud cases, a bigger sample of genuine customers, and the hard cases like poor photos, older customers and budget phones.
3. Measure both costs: fraud caught and good customers stopped, plus retakes and time to complete.
4. Call two references at Philippine institutions like yours. Ask how the provider handled its worst week.
5. Score them on one sheet. Here's a starting point; adjust the weights to match Step 1.

Score each provider 1 to 5 per row, multiply by the weight and add it up. The three heaviest rows are the ones most guides skip, and the ones your customers will actually feel.

How we approach it at Trusting Social

We've worked in the Philippines since 2019, scored more than 110 million Filipino consumers and partnered with more than 50 BSP- and SEC-supervised institutions. Our team in BGC builds every model on Philippine data. If there's one thing we've learned, it's that a bad photo is not a bad customer. That belief shapes TrustVision, our three-layer eKYC and fraud prevention platform:

Running an evaluation? We'd be glad to be one of the providers you test. Talk to our team.

Related reading: Fighting Fraud Together: Fraud Intelligence Sharing in the Philippines · What AFASA Has Changed So Far · The End of the OTP: Why Your Face Is Safer Under AFASA

This article summarises public sources and is not legal advice.

Sources

• Bangko Sentral ng Pilipinas. (2025). Circular No. 1213, Series of 2025. bsp.gov.ph
• Cabuenas, J. V. D. (2026, June 24). No more SMS, email OTPs for high-risk financial transactions starting June 25. GMA News. Link
• Republic Act No. 10173. (2012). Data Privacy Act of 2012.
• Republic Act No. 12010. (2024). Anti-Financial Account Scamming Act. Lawphil