Understand what a fake payment gateway looks like

A fake payment gateway is a page that looks like a legitimate payment processor but is controlled by scammers. You might land on it after clicking a link in an SMS, a chat message, or an ad. The page may copy the logo, colors, and layout of GCash, Maya, or a bank, but the URL is different. In the Philippines, digital payments are common, but you must always verify the destination before entering details. A fake gateway often has a slight misspelling in the domain (like gcas.h-pay.com) or uses a subdomain like secure-gcash.payment-redirect.xyz. Always check the full domain before typing. If you see a pop-up asking for your OTP or a screenshot of your transaction, that is a major red flag. Legitimate payment pages do not ask for screenshots or OTP over chat. Be cautious of pages that redirect you multiple times or have no visible contact information. Always verify that the payment page URL matches the official domain you typed earlier. If in doubt, close the page and contact the payment provider directly.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Check the URL and domain carefully

Start by checking the payment page URL. Criminals create lookalike domains. Compare the exact spelling: official GCash is gcash.com, Maya is maya.ph. Any variation—like gcash.com.ph.billing.com—is suspicious. The domain should match your current site, too. If you are on a gaming site and the payment page takes you to a different domain than the one you saw, that is a sign. Look for 'https://' and a padlock icon, but remember that a padlock does not mean the site is safe. Many fraudulent sites have SSL certificates. The most reliable check is to compare the domain against the official one by typing the official address yourself instead of clicking. Also, use WHOIS lookup services to see the domain's registration date—very new domains (under a month) are a red flag. A legitimate gaming site in the Philippines would have a consistent domain with its brand. Always go to the site by typing the address or using a saved bookmark. For more tips, see our guide on identifying fake gaming domains.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Verify the gaming site with PAGCOR Guarantee

Before you even reach the payment page, you should verify that the gaming site is listed on the PAGCOR Guarantee website. The Philippine Amusement and Gaming Corporation (PAGCOR) launched pagcorguarantee.ph to help the public check whether a site is legitimate. If the site is not listed, that is a red flag. However, do not assume that being listed means the payment page is safe. Even on a legitimate site, scammers may replace the payment page with a fake one. So, after verifying the site, you still need to do a payment-specific check. For PH88K, we provide verification guidance on our platform page, but for any site, always use the official PAGCOR Guarantee page and your own domain checks.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Inspect payment options and requests

Look at what the payment page asks you to provide. A legitimate payment page for a Philippine digital wallet should only ask for your mobile number and one-time PIN (OTP). It should never ask for your full PIN, password, or a screenshot of your transaction. If the page asks for a 'withdrawal fee' or 'verification fee' before you can play, that is a scam. Check the payment methods: a fake gateway might show only one obscure method or a bank transfer to a personal account. In the Philippines, official gaming sites typically offer multiple payment options like GCash or Maya through authorized channels. You can verify if the gaming site actually supports your preferred wallet by checking the official help center of GCash or Maya, but avoid saying that a site supports them—instead, mention you can check what methods are listed. Always check transaction records after any payment: in GCash, view the transaction history; in Maya, check your activity. If you see an unauthorized transaction, contact the provider immediately. For more on verifying payment instructions, see our guide on confirming GCash payment authenticity.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Use a mobile checklist to test before paying

Use this checklist on your phone before entering any payment details: 1) Check the site URL: type it manually, not clicking the link. 2) Verify the domain: compare with official spelling. 3) Look for PAGCOR Guarantee listing: use the official page. 4) Check the payment page URL: it should match the site's domain, not a third-party domain. 5) Look for misspellings or odd subdomains: e.g., 'secure-gcash.com.example' is bad. 6) See if the payment page asks for OTP only, not PIN or password. 7) Check for any request to pay a 'processing fee' to activate your account—this is a scam. 8) After payment, verify the transaction in your wallet app within minutes. 9) If anything feels off, stop and do not enter any additional details. 10) Contact your payment provider via official support for help. Save this checklist to your phone notes so you can use it before every deposit.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Know what to do if you think you entered details on a fake page

If you suspect that you entered your details on a fake payment gateway, act immediately. First, do not enter any further information. If you already provided your OTP or password, call your bank or wallet provider’s official hotline right away. For GCash, use the in-app help center or call their hotline; for Maya, similarly, use the official support channel. Do not reveal your OTP to anyone. Change your passwords for email and any accounts linked to your payment method. Monitor your transaction history for unauthorized charges. Report the incident to the payment provider and also consider reporting to PAGCOR or the NBI Cybercrime Division. Even if you think it is minor, reporting helps others. Keep records of the site URL, screenshots, and transaction IDs. For more help, see our guide on detecting fake GCash deposit confirmation messages.

Sources for this section: BSP electronic payments measurement report, GCash official help center, Maya official support, PAGCOR platform verification guidance, PAGCOR and ASC advertising standards

Sources checked

  1. BSP electronic payments measurement reportChecked 2026-08-21
  2. GCash official help centerChecked 2026-08-21
  3. Maya official supportChecked 2026-08-21
  4. PAGCOR platform verification guidanceChecked 2026-08-17
  5. PAGCOR and ASC advertising standardsChecked 2026-08-17

Related PH88K guides

Understanding PH88K: A Safer Way to Navigate Online GamingLearn PH88K basics: what it is, how to verify domains, use promo codes, and play responsibly on mobile in the Philippines.How to Detect a Fake GCash Gaming Deposit Confirmation Message in the PhilippinesLearn to spot fake GCash deposit confirmation messages for gaming. Verify transaction records and account safety with official help center steps and reminders.Check a gaming app before installing itCheck the download source, Android package, permissions, updates and account route before installing a third-party gaming application in the Philippines.Maya Gaming Payment Security Checklist Philippines 2025Secure each Maya payment to a gaming destination in the Philippines. Follow this checklist to verify recipient details, check records, and protect your account.Verify every payment instruction before you sendUse GCash and Maya as verification examples when checking current payment availability, recipient details, fees, references and transaction records on a destination.How to Confirm GCash Payment Instruction Authenticity in the PhilippinesLearn how to verify GCash payment instructions from gaming sites in the Philippines. Step-by-step guide to detect phishing, check recipients, and protect your account.How to Check Gaming Website WHOIS Information Privacy in the PhilippinesLearn how to check gaming website WHOIS information privacy in the Philippines. Step-by-step guide to verify domain ownership, spot red flags, and stay safe.