Scams to Avoid: Protecting Your OTP, MPIN and Password
Three secrets stand between a stranger and your money: a password, a one-time password and an MPIN. Phishing is the business of collecting them. PHTTT is an independent guide, not a casino. It takes no deposits, runs no games and will never ask for any of the three. For readers aged 21+, this page explains what each secret unlocks and how each is taken.
Three secrets, three locks
| Secret | What it unlocks | How it is usually stolen |
|---|---|---|
| Password | Login to a casino or wallet account from a known device | Fake login pages; reuse of a password leaked elsewhere |
| OTP | Login from a new device, or approval of a sensitive change | A caller or page asking you to read or type it |
| MPIN | Approval of wallet transactions | Fake 'verification' forms; overlay screens from a malicious app |
An attacker rarely needs all three at once. A password plus one OTP is often enough to move an account onto their phone, after which your codes go to them.
Route one: the fake login page
You receive a link, tap it, and see a familiar sign-in screen. You enter your number and password, then the code that arrives a moment later. Behind the page, software is typing the same details into the real site in real time. By the time an error message appears, the session belongs to someone else. The only visible difference was the address at the top of the browser.
Major e-wallets and banks tell customers that they do not send clickable links by SMS or email. A message containing a link to 'verify', 'unlock' or 'claim' is therefore suspect from the start, whatever name it appears under.
Route two: the message that sits in a real thread
Sender names can be forged. A spoofed message labelled with your wallet's name can land in the same conversation as that wallet's genuine notices, directly beneath real ones. Position in a thread proves nothing. Judge the content: genuine notices inform; fraudulent ones ask you to act through a link or to share a code.
Route three: the call
A caller says they are from the casino or the wallet. There is a problem, and they are helping. In the middle of the call a code arrives, and they ask you to read it out 'to confirm your identity'. They triggered that code by attempting to log in as you. Hang up. Calling back on a number the caller offers is the same call again.
Route four: the reused password
If you use one password everywhere and any one of those sites is breached, the pair of number and password is tried automatically on wallets and casino sites. No message is ever sent to you. The defence is dull and complete: a different password for each account, with a password manager remembering them.
What they say, and what is true
| Claim | Why it is false | What to do |
|---|---|---|
| 'We sent a code to verify you; please tell us the number' | A code verifies you to the system, not to a person on the phone | Never read out a code |
| 'Tap the link to keep your account active' | Wallets and banks say they do not send links in messages | Open the app directly instead |
| 'Enter your MPIN to receive the refund' | Receiving money never requires your MPIN | Close the page |
| 'Your winnings need account confirmation here' | Winnings are in the account you already hold | Log in only at the address you type yourself |
Four related scams
Predictor apps that claim to foresee slot results; results are generated on the studio's servers at each spin and cannot be foreseen. Release fees, where a 'held' withdrawal needs a payment from outside before it is freed. Agents on social media who take deposits through their own wallets. And cloned domains, the sites on which most fake login pages live.
What real KYC never asks for
- An OTP, at any stage.
- Your MPIN or password.
- A fee to verify.
- A remote-access app.
- Documents sent to a personal chat or email.
Real verification is a government ID and usually a selfie, uploaded by you inside your own logged-in account.
Hardening, in five minutes
- Give your wallet and each casino account its own password.
- Turn on biometric or device lock for the wallet app.
- Never store MPINs or passwords in notes, screenshots or chats.
- Bookmark real addresses and stop using links.
- Tell family members who share your phone the one rule: codes are never read out.
If a secret has been exposed, and where to report
Change the MPIN and passwords from the official apps straight away, then check recent transactions. Report first to the operator's own support from inside your account if a casino account is involved. Report to the e-wallet through the helpline inside its app, not through any number sent to you. For an unresolved dispute with a licensed operator, PAGCOR publishes a complaint channel on its official website. For theft, file with the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. PHTTT cannot recover funds or intervene.
Frequently Asked Questions
What is the difference between an OTP and an MPIN?
An OTP is a one-time code sent to you for a single login or change. An MPIN is your fixed wallet PIN for approving transactions. Neither should ever be shared.
Does PHTTT ever ask for a code or password?
No. PHTTT has no accounts and no login, so it has nothing to ask for.
A code arrived that I did not request. What does it mean?
Someone entered your number and possibly your password. Do not share the code, and change your password.
The message is in the same thread as real wallet messages. Is it genuine?
Not necessarily. Sender names can be spoofed into existing threads. Do not tap links in messages.
Is a password manager safe to use?
It is safer than reusing one password, and it will not fill your login on a fake domain, which helps expose phishing pages.