We Tested ScamCheck.ph, the Banks' New Anti-Scam Checker. Here's How It Did
Philippine banks are pushing ScamCheck.ph, a free AI checker for suspicious texts and screenshots. In our small test it flagged all six fake scam messages and none of three genuine ones. The one gap worth fixing: it doesn't yet say who handles your data.
Got a text saying your Maya wallet will be shut down unless you reply with your OTP? The banking industry now wants you to stop and check it first. On October 12, the Bankers Association of the Philippines (BMAP) used the Philippine launch of Scam Ready ASEAN at the Bangko Sentral ng Pilipinas head office in Manila to push ScamCheck.ph, a free website where you paste a suspicious message or upload a screenshot and get an AI-assisted risk assessment (Context.ph, Daily Guardian). The campaign line is "Ang Mahal ma-Scam, i-scamcheck.ph Mo Muna": check before you click a link, reply, send money or share personal details.
We like the idea, and we wanted to see how it holds up, so we put it through a quick test of our own. The short version: it did well. There is also one thing we hope its backers fix soon, which we get to below.
ScamCheck.ph is not brand new. Rappler reports that it was first developed by Metrobank and the civic tech group BetterGov.ph in late 2025, and BMAP is now promoting it across the industry. Jennifer Ng, a BMAP director and program lead for the Scam Check Movement, told Rappler that banks, government agencies, telcos and other organizations are encouraged to feed in their legitimate messages and promos so the tool can learn to tell real communications from impersonations. Besides the checker, the site has plain-language explainers on smishing, vishing, phishing, fake sellers, Ponzi schemes and job and loan scams, plus victim stories and a reporting guide. You can also forward a suspicious email to check@scamcheck.ph and get an automated reply, usually within minutes.
The bigger program behind the launch is Scam Ready ASEAN, led regionally by the ASEAN Foundation with backing from Google.org and first launched in Kuala Lumpur in April (Context.ph). Google.org has committed US$5 million to it for 2025 to 2027, covering interactive learning tools and the training of 2,000 master trainers across the region (GMA News, Rappler). In the Philippines, an initial 105 master trainers have been mobilized, mostly from banks and financial institutions, and they go through 10 hours of training before workshops roll out later this year (GMA News). BMAP programs director Catherine Villanueva said the local goal is one million Filipinos (Philstar), and a localized Scam Ready game is targeted for full release around December to January.
BSP Deputy Governor Mary Anne Romulo-Puyat was candid about why another push is needed. "We keep coming up with the same messages over and over again and yet people are still scammed," she told reporters, adding that it is "not enough" to keep posting reminders not to share personal information or tap links (Rappler). BSP Governor Eli Remolona Jr., in a video message, said that "as digital finance becomes more accessible, it must also become safer" (Philstar). ASEAN Foundation executive director Piti Srisangnam called the Philippines one of the hotspots for scam operations in the region, and Google Philippines country manager Prep Palacios shared that he once lost PHP 90,000 to an online seller scam. "I'm a tech executive, and I was still fooled," he said (Rappler).
We tested it
On the evening of October 15, THE JDNEER ran nine messages through ScamCheck.ph's paste box, without logging in. All nine were made up by us in the style of scam examples from public Philippine advisories, with no real names, numbers or accounts. Six were scams and three were the kind of genuine messages you get every week.
It flagged all six scams as HIGH RISK. A fake LTO traffic violation with a payment link scored 80 out of 100, and the tool pointed out the link inside a financial message, the fee request and the odd web address. A BDO-style "your account is locked, send your OTP" text also scored 80, flagged for brand impersonation, urgency and a request for verification details. A fake GCash cashback link and a PHLPost parcel redelivery fee each scored 80 too. A Telegram job offer promising PHP 3,000 to 8,000 a day for liking videos scored 90 and was labeled a likely scam and a suspicious job offer. The highest score, 96, went to a Maya message telling the user to reply with a six-digit OTP or have the wallet deactivated.
Just as important, it did not cry wolf. A bank OTP notice that warned the user never to share the code scored 0. A telco data load confirmation and a credit card statement reminder each scored 1. All three were labeled "Likely routine."
A few touches stood out. The tool never calls a message "safe." Low scores come with a note that few scam signals were found, "but that does not prove the message is safe," which is exactly the right message for a tool like this. It also lists the specific red flags it spotted, so it teaches as it checks. Text is capped at 12,000 characters, and you can upload one PNG, JPEG or WebP screenshot of up to 5 MiB, three per minute. We hit a rate limit on our seventh check within about two minutes ("Too many checks. Please wait a minute"), and it worked again a minute later.
Please read this as a quick hands-on look, not a verdict. It was a small test with nine made-up samples, not a benchmark, and it says nothing about an accuracy rate. Real scams are messier and change fast. We also could not find any independent accuracy testing of ScamCheck.ph yet, which would be a welcome next step for its backers to commission and publish.
The one thing we would fix first: who handles your data
ScamCheck.ph asks people to paste their texts and upload screenshots of their phones, often of bank and e-wallet messages. So it matters who sees them. Right now, the site does not say. As of October 15, there is no privacy policy or terms page (its /privacy and /terms addresses return errors, as does /about), and the site does not name the organization that runs it. The footer reads "© 2026 ScamCheck Philippines" next to BMAP and BetterGov.ph logos as campaign partners.
The only data-handling text is a short notice on the homepage: "Hide names, account numbers, passwords and OTPs first. Submitted images and text are processed by AI providers. ScamCheck does not save your uploads." That is an honest start, but it leaves real gaps. "Does not save your uploads" describes ScamCheck itself, not the outside AI providers that receive each submission. Readers cannot tell which AI providers those are, whether they keep the messages or use them to train their models, where the data is stored or for how long, or who is legally responsible for it.
The Philippines' Data Privacy Act of 2012 (RA 10173) is built around exactly this kind of transparency. Section 16 says people should be told, before their information is processed, the purpose, the recipients it may be shared with, how long it will be stored, and the identity and contact details of whoever controls it. Section 21 makes that controller accountable even when the processing is handed to a third party. A tool built to protect Filipinos deserves to set the example here.
The fix is simple and cheap: publish a short privacy notice that names the operator and a contact for privacy questions, lists the AI providers used, and states their retention and training terms. That one page would make ScamCheck.ph much easier to trust and to recommend.
Until then, follow the site's own advice. Before you paste or upload anything, hide names, account numbers, card numbers and OTPs, and crop screenshots down to the message itself. And whatever score you get, the safest move is still the old one: contact your bank, e-wallet or agency through its official app or hotline, never through a link or number in the message.
