Phishing attacks surge nearly fourfold in 2025, report says

Phishing, or the fraudulent practice of sending emails or other messages purporting to be from reputable companies to induce individuals to reveal personal information such as passwords and credit card numbers, accelerated nearly fourfold in 2025, according to data from the Whoscall 2025 Philippines Scam Report by Gogolook.

The report said risky URLs, or website addresses, rose from 13,602 in the first quarter to 49,431 by the fourth quarter, marking a nearly fourfold increase over the year.

The sustained quarter-on-quarter growth points to phishing becoming the primary scam vector heading into 2026, affecting SMS, messaging apps, email, and other online channels, the report said.

Mel Migriño, general manager and country head of Gogolook Philippines, said the trend reflects how scam tactics are rapidly evolving.

“Scammers are shifting from calls and texts toward malicious links and fake social media sites because URLs are easier to spread, harder to verify, and far more scalable,” Migriño said.

While scam calls and SMS show mixed trajectories, the rise in link-based attacks is unmistakable. Scam calls fell by 21.84 percent year on year in some segments, and SMS scam volumes also declined in parts of 2025 due to improved filtering and enforcement, according to the report.

However, link-based phishing, particularly via URLs embedded in messages and social media, surged, underscoring the growing sophistication of scammers.

Cross-sector push for awareness

Migriño said addressing the phishing surge requires coordinated action across government, industry, and civil society.

“Technology alone can’t solve this — we need to empower Filipinos with knowledge and tools to recognize and avoid scams before they take the bait,” she said.

Joint campaigns, community training, and digital initiatives can help translate scam data into practical guidance while reinforcing official reporting channels and support mechanisms.

With this, Migriño urged consumers to take immediate, practical steps to protect themselves. She recommended downloading the Whoscall app, which helps users screen incoming communications and provides tools to check URLs for safety before clicking.

The app’s features also include identifying dangerous or unwanted calls by flagging numbers associated with known scams and fraud, bringing extra visibility to suspicious communications.

“Before you click a link or answer a call from an unknown number, pause and check,” Migriño said. “These tools give consumers an extra layer of protection, especially now that phishing has become more pervasive.”

The rapid growth of phishing poses heightened risks not only for individual consumers but also for banks, e-wallet providers, e-commerce firms, and enterprises whose brands are spoofed.

Once a malicious link is clicked, financial losses and reputational damage can escalate quickly.

Community reporting platforms are already reflecting this trend.

As of the end of 2025, Scam Vault PH, a community reporting initiative of Gogolook, Scam Watch Pilipinas and the Cybercrime Investigation and Coordinating Center, logged hundreds of real-world scam reports, including a growing share linked to malicious URLs and phishing attempts.

With phishing on an upward trajectory, Migriño said 2026 will require faster takedowns, stronger URL intelligence sharing, and broader consumer participation in reporting.

“Phishing is now the frontline,” she said. “If users, platforms, and institutions move together, we can slow it down. If not, it will only grow more aggressive.”