Threat Watch PH

The Peso Pipe

An unlicensed casino sat in the Weather category of the App Store. It paid me ₱20 to prove it was real, then billed me ₱6,400 to release ₱20,000. Congress wants to ban the ads. The ads are not the problem. The funding is.

Twenty pesos.

That is what it cost the operator to make me believe. I asked a farm-themed app to send ₱20 to my GCash. It arrived. No friction, no verification theatre, no hold. Ordinary pesos moving on ordinary rails, the same way a suki pays for tilapia.

Then I asked for ₱20,000, and the machine changed shape. The withdrawal queued for over a thousand hours. A “VIP channel” appeared at ₱2,000. A bank charge, about ₱1,000. “Taxes,” about ₱1,400. And then, best of all, the system decided my account number was incorrect — the same account number that had just successfully received ₱20 — and offered to correct it for ₱2,000.

I stopped paying. That is the whole review. The scam is not inside the product. The scam is the product.

But the fee ladder is the smaller story. The bigger one is the ₱20 itself: how effortlessly it moved, in both directions, between a Filipino’s everyday wallet and an operation with no license, no registered entity, and no address you could serve a subpoena to.

This is not an attack on GCash or Maya. I want both of them to succeed — they have done more for ordinary Filipino financial access in a decade than the banking system managed in fifty years. This is an argument about one specific door they have left open, and about the fact that Congress is right now preparing to legislate the billboard instead of the door.

Friction was never the enemy. Friction was the regulator.

Hold this thought through everything that follows, because it is the entire argument.

Every form of gambling Filipinos have lived with for generations came with friction built into it by accident, not by design. Nobody legislated that friction. It was simply a property of the physical world, and it did more consumer protection work than any regulation ever written.

Then we digitised the activity and kept the licensing framework — and quietly deleted every gram of friction that was actually doing the protecting.

I want to be concrete about what was deleted, because I went and looked.

What a casino floor actually looks like

I walked into a physical casino. Not as an investigator — as a citizen who wanted to see the thing he was writing about.

Three observations, and all three are load-bearing.

One: it runs on cash, and cash runs out. You bring what you brought. When the wallet is empty, the session ends. There is a hard stop welded into the physics of the evening. You have to stand up, leave the floor, find an ATM, come back — and somewhere in that walk, a certain number of people go home instead.

Two: you are visible. Every walk of life is on that floor, and every one of them is being seen. The staff see you. Other players see you. Your fourth trip to the cashier is witnessed. Shame is a crude instrument and I am not romanticising it, but social observation is a control mechanism, and the floor is saturated with it.

Three: there is always a cashier in the loop. A human being converts your money into chips. Around the cockpits it is the same shape — you text an affiliate, send ₱1,000 on GCash, he credits your player ID, then you play. The holder is a person. People notice things.

Now transpose that floor into a phone.

The cash never runs out, because the wallet is not a wallet — it is a live connection to your salary account. Nobody sees you, because the floor is a screen at 2am in a room where everyone else is asleep. And the cashier is gone, replaced by a plus-button that clears in under three seconds.

That is not the same product with better distribution. That is a fundamentally different product wearing the old one’s license. Every protective property of the original — the hard stop, the witness, the human — was a side effect of geography. We moved the activity somewhere geography does not apply, and we did not replace a single one of them.

And people still say accessibility improved. Accessibility did not improve. Accessibility became total.

The ₱50 player

Here is who is actually on the other side of this, and it is not the high roller you are picturing.

Capstone-Intel survey data reported by the Inquirer found that 69% of Filipino online gamblers spend less than ₱1,000; another 20% spend ₱1,001–₱3,000. Roughly half play weekly or more. The reporting profiles people like a low-income worker earning ₱450 for several days’ labour, now indebted through online platforms. The psychologist quoted in that piece, AJ Sunglao, puts it plainly: online gambling “has weaponised” the addictive properties of the activity through 24/7 access, cashback bonuses and prize multipliers.

Sit with the shape of that distribution. This market is not built on whales. It is built on volume — on the ₱50 and ₱100 loads of people betting the bottom of their wallet against a x1000 multiplier, several times a week.

That business model only works if the ₱50 can move instantly, at zero cost, with no minimum, at any hour, from the account where the person’s actual money lives. Introduce any meaningful friction into that specific transaction and the unit economics of preying on the poorest players stop working. Not because ₱50 players are blocked — because the compulsive twelfth ₱50 of the night is no longer frictionless.

Friction is regressive-proof in a way that almost no other control is. It barely inconveniences someone gambling ₱5,000 once a month. It substantially interrupts someone gambling ₱50 twelve times a night. That is precisely the right incidence.

The Philippines already did the hard legislative work

This is the part that should frustrate you, because on paper the country has moved decisively.

Offshore operators are banned by statute. Executive Order 74 shut the offshore regime, and Republic Act 12312 — the Anti-POGO Act of 2025, approved 23 October 2025 — criminalised establishment, operation, betting, hubs and facilitation. Not a memo. A law with teeth.

Remote e-sabong is still suspended. Executive Order 9 (2022) kept the nationwide suspension in force. Traditional sabong inside an LGU-authorised cockpit remains under cockpit law. PAGCOR has repeatedly said it has no authority to revive the remote version while the order stands.

The central bank went after the shortcut. In August 2025, BSP Memorandum M-2025-029 told supervised institutions — e-wallets explicitly included — to strip in-app links and icons redirecting users to gambling sites. GCash and Maya complied. PAGCOR reported roughly a 50% drop in online gaming transactions within days.

And the biggest wallet has been policing merchants. In March 2026, GCash and the Cybercrime Investigation and Coordinating Center announced they had blocked more than 3,200 merchants misusing QR Ph toward fake pages and illegal gambling sites.

Four serious interventions. Statute, executive order, central bank memorandum, private enforcement at scale.

And a 4+ rated Weather app still paid me ₱20.

What the store promised, and what actually opened

On the Apple App Store, the listing (App ID 6804582732) is sold as a farm-themed casual game: catch eggs, dodge rain. Category: Weather. Age rating: 4+. No registration required, the copy says. Just open and play.

Open it and you are in a casino. PG, JILI, PP, JDB and MG tiles. An 18+ badge the store listing never mentioned. A peso balance. A deposit plus-button. A Withdrawals tab. My test account read player378178 / ID 40011126, showing roughly ₱36,135.50 at capture — after the balance had been allowed to climb to around ₱50,000.

Sit with the category for a second. Weather. 4+. That is not sloppy metadata. That is camouflage engineered so the icon can sit on a phone between a banking app and a messaging app without provoking a single question — from a store reviewer, from a parent, from a spouse checking a screen.

The game is the wrapper. The casino is the payload. And the payload is not even the business.

The ladder

Philippine legal practitioners have documented this fee ladder for years — let the balance grow, then freeze the payout until the user pays to unfreeze it. My run matched the pattern step for step.

  1. Let the user win. The displayed balance climbed to around ₱50,000. Treat on-screen winnings as set dressing until money lands in an account you control.
  2. Prove the rail with a small cash-out. ₱20 to GCash. It cleared. This is the trust shot, and it is the cheapest marketing spend in the entire operation.
  3. Ask for a real amount. ₱20,000. The queue appears. The invoices begin.
  4. Stack the fees. 1,000+ hours queued. “VIP channel,” ₱2,000. Bank/finance charge, ~₱1,000. “Taxes,” ~₱1,400. Then the account-number error — ₱2,000 to fix details that had already worked.
  5. Stop. I did not pay. Roughly ₱6,400 of demands to release ₱20,000 that was never going to move.

Memorise the tell: a licensed operator does not invoice you a second time to release money you already won. Whatever BIR and AML require is deducted before payout, not billed to you afterwards. The moment a platform asks you to send money in order to take money out, it has stopped being gambling and started being estafa.

The class is well documented: frozen withdrawal after a large win, VIP fees, “tax” and “verification” charges paid to the platform itself, KYC rejection on details that already cleared a smaller payout, support that unlocks only after another transfer. PAGCOR has warned about sites that steal its logo or invent certificates outright. Unlicensed operations sit under PD 1602 and RA 9287 — and under estafa, once withholding the withdrawal is the revenue model.

I am naming one app because I hold the screenshots for it. I will not name others without primary evidence.

Which rails fund which funnels

Think in layers, not villains.

Licensed funnels, attested. Casino Plus’s own FAQ states that after GLife shortcuts were removed, GCash remains available inside its Cashier. DigiPlus says it partners only with BSP-accredited channels; its materials cite Bayad over-the-counter cash-in for BingoPlus, ArenaPlus and GameZone across 800+ centres, Pay&Go, 130+ BingoPlus branches, and a MannyPay partnership. Operator guides describe binding GCash and Maya. Where a cashier UI says only “bank transfer,” those credits most likely settle over InstaPay or PESONet — but I am not naming a clearing brand without a primary screenshot, so treat that as inference.

Unlicensed funnels, softer language by necessity. Open-web reporting and regulator statements describe mule merchant accounts, person-to-person loads, and QR masking that makes a gambling payee look like a goods purchase. PAGCOR Chairman Alejandro Tengco has publicly described illegal operators using “mule merchant” accounts. My specimen needed none of the sophisticated version. It needed one ordinary P2P-shaped peso movement that cleared.

Clearing layers. InstaPay, PESONet and QR Ph are national infrastructure. Wallets and banks ride them. Delinking an icon does not delete a rail. Licensed brands use GCash and Maya too — and that is the point, not a contradiction. The same national pipe serves the PAGCOR-licensed cashier and the Weather-app casino.

Now notice the asymmetry hiding in those three paragraphs, because it decides everything that follows.

The licensed operator has many doors. Over-the-counter cash-in at 800+ Bayad centres. Physical branches. Bank transfer. Accredited payment processors. Cash agents. If you close the e-wallet door on a licensed operator, you slow it down and you make it more supervised — you do not kill it.

The unlicensed operator has exactly one door. It cannot get a Bayad partnership. It cannot open a corporate bank account in the Philippines. It has no branch network and no accredited processor, because every one of those requires a registered entity that can be found, fined and shut. What it has is the e-wallet, entered through personal accounts and mule graphs.

Close the wallet door on gambling and the licensed industry gets slower. The unlicensed industry gets amputated. That is not an unfortunate side effect of the policy. That is the policy’s entire case.

It proved the shortcut mattered. BSP ordered icons and redirect links removed. Compliance followed. PAGCOR tied delinking to roughly a 50% fall in online gaming transactions in the first days, and the pressure persisted — Philippine gross gaming revenues fell about 20% year-on-year in Q2 2026, to ₱88.13 billion from ₱110.63 billion, with the e-games segment down to ₱2.90 billion, or 3.30% of total GGR. PAGCOR now projects an 18% income decline for the year. Something real was removed.

It also proved the shortcut was not the pipe. In Senate hearing coverage from September 2025, BSP testimony was reported to the effect that transactions to licensed online-gambling merchants remained possible — the prohibition covered redirect links and icons, not wallet-to-operator settlement. Meanwhile a Fourth Wall survey reported licensed participation down and illegal or unregulated participation up. Treat that as a survey signal, not a census.

So: fewer doors on the front of the building, same foundations, and a measurable share of demand relocating to the part of the market with no licence to lose.

Merchant blocks are real work and I will not diminish them. But blocking 3,200 merchant IDs is not the same as closing person-to-person and mule graphs. BSP has circulated an exposure draft for online gambling payment services — separate gambling wallets, transaction limits, prior authority. Draft is not final. Until those rules land, and until mule and P2P patterns are treated as product crime rather than support tickets, CluckSprint-class apps keep finding a wallet-shaped hole.

Why GCash is the lever, not the villain

Scale is the reason this is Mynt’s problem whether Mynt likes it or not.

BSP’s 2025 Consumer Finance and Inclusion Survey put adult bank account ownership at 23%, e-money at 36%, and formal financial account ownership at 50% — down from 56% in 2021. A March 2026 SWS survey commissioned by BSP (fielded 24–31 March, n=1,500) found 58% formal ownership, 43% with e-money, 21% with a bank account. Different instrument, different number, same unmistakable direction: for a large share of Filipinos, the e-wallet is not a supplement to a bank account. It is the account.

Mynt’s draft IPO prospectus reports 40.4 million monthly active users as of 31 March 2026 — which Frost & Sullivan, cited in the filing, puts at roughly 55% of the Philippine adult population and about four times the next-largest competitor — plus 2.1 million QR Ph merchants. Maya is pipe number two: Maya Bank doubled to 10.7 million bank customers in 2025 on a ₱68 billion deposit base.

Read those together and the conclusion is unavoidable. The peso account funding a deposit into an unlicensed casino is, for most victims, a GCash balance. Not because GCash is complicit — because GCash is where the money is. That is what financial inclusion means once it succeeds: you become the floor everyone else builds on, and you inherit responsibility for what gets built.

Reach is leverage. Maya carries the identical expectation at number two.

Congress is about to regulate the billboard

Here is where the timing gets interesting, and where I think the national conversation is one step short of the answer.

Senate Bill 2347, filed by Senator Francis Escudero, would prohibit gambling advertising and sponsorship across television, radio, print, online and social media, and explicitly bar celebrity endorsements and influencer campaigns — with a one-year transition and penalties escalating from ₱200,000 and a year’s imprisonment to ₱500,000 and three years. His framing is the tobacco framing: regulate gambling the way we regulated tobacco two decades ago. In the House, Representative Karen Hope Garcia’s House Bill 10982 takes the same aim, with the line that smartphones have become “24-hour casinos.”

He is right. That is exactly what they have become, and I have just described the mechanism by which it happened.

But look at what an ad ban actually binds.

Industry analysis of the bill makes the gap explicit: licensed operators are identifiable and sanctionable, while offshore and unlicensed operators keep reaching Filipinos through accounts, affiliates and websites outside Philippine jurisdiction. An advertising statute is enforced against entities that can be served. CluckSprint cannot be served. It has no Philippine entity, no compliance officer, and no advertising budget you can subpoena.

So the ad ban lands, in practice, almost entirely on the licensed, taxpaying, KYC-running half of the market — the half that is already shrinking, already supervised, and already nameable. And the unlicensed half, which is the half that scammed me, carries on advertising through Telegram groups, seeded TikToks, SMS blasts from unregistered numbers, and a Weather-category App Store listing.

That is the second-best answer. Here is the first-best one.

Gate the money and the advertising dies without a speech fight.

Every peso of gambling ad spend, influencer fee and SMS blast in this country is a customer-acquisition cost underwritten by expected lifetime value. LTV is a function of how much money a player can push into the platform, how fast, how impulsively, and how often. Cap and gate the cash-in, and you have not banned a single advertisement — you have made most of them unprofitable to buy.

An operator whose average player can no longer dump twelve unthinking ₱50 loads a night does not keep paying influencer rates. An unlicensed operator that cannot receive a P2P peso at all does not run SMS campaigns, because there is nothing for the click to land on. The ads stop because the funnel stops paying for them.

Regulating the persuasion is a fight about speech, enforceable only against people who answer summons. Regulating the funding is a fight about payments infrastructure — enforceable against everyone, because everyone needs the pipe. Run both if you like. But run them in the right order, and understand which one actually binds the operator who took my ₱5,000.

What gating actually looks like

“Remove GCash and Maya from gambling” is a slogan until somebody specifies it. So let me specify it, at the level a payments risk team could actually build from.

  1. A separate, opt-in gambling sub-wallet — already contemplated in the BSP exposure draft. Gambling funds move only from that sub-wallet, never directly from the main balance where salary lands. Funding it requires a deliberate transfer with a cooling period. That single design choice restores the walk to the ATM.
  2. Hard daily and monthly cash-in caps, set low enough to bite on compulsive small-load behaviour and high enough that the monthly recreational player never notices. Caps set by the user upward-adjustable only after a delay, downward-adjustable instantly.
  3. Self-exclusion that is honored at the rail, not at the operator. A Filipino who self-excludes should be excluded from funding any gambling payee from their wallet — not obliged to self-exclude platform by platform, which is a control designed to fail.
  4. Treat the payout-then-invoice pattern as a fraud signature. A small inbound from a counter party, followed within days by larger outbound transfers to the same graph tagged “VIP,” “tax,” or “fee,” is a mathematically detectable ladder. It is not a support ticket. It is an in-progress estafa, and it is visible in data both wallets already hold.
  5. Score the person-to-person graph, not just the merchant list. Blocking 3,200 merchant IDs closes the door marked qualified. My pesos went through the door marked personal. Mule wallets have a distinctive signature — high fan-in from unrelated senders, rapid sweep-out, thin transaction history, device reuse — and that signature is computable at Mynt’s scale.
  6. Publish the numbers quarterly. Mule accounts closed, P2P gambling flows interdicted, fraud-ladder cases detected, pesos prevented. A firm about to trade on the PSE can afford a metric it is willing to be measured against.

None of that bans gambling. None of it touches a single legal bettor’s right to lose their own money at a licensed operator. It restores, by design, the friction that geography used to provide for free.

The honest counter-argument

I will make it myself, because the piece is weaker if I do not.

Constrain the wallets and some demand displaces — to over-the-counter cash-in, to bank transfer, to crypto, to new mule graphs built in the gap. Abuse does not vanish. It relocates.

Fine. Three answers.

Relocation is not failure; it is friction, which was the objective. Every displaced channel is slower, more expensive, more traceable, or all three. The ₱50 impulse load does not survive a trip to a payment centre. That is a feature.

Displacement is asymmetric, and it favours the honest side. Licensed operators relocate to OTC and banks and stay identifiable, taxed and supervised. Unlicensed operators cannot relocate anywhere legitimate, because every alternative channel demands a registered entity. Gating the wallet closes the licensed industry’s fast lane and the illegal industry’s only lane.

We already ran the weak version and watched it fail. Icons came off. Licensed activity fell. Reported participation shifted toward unregulated channels. And a Weather-category app still cleared ₱20 into my GCash. The lesson of delink is not that intervention does not work — it is that we intervened on the shortcut and left the pipe alone.

My test moved about ₱5,000, roughly US$100. Run a hundred similar wallets in a day and that is half a million pesos a day into fly-by-night operations. That is arithmetic on one small experiment, not a market estimate. Do not quote it as one.

The qualification gap

Here is what a legitimate Philippine business does to accept GCash as a merchant: DTI or SEC registration, Mayor’s Permit, BIR Form 2303, a bank account in the business name, a verified signatory wallet, GCash for Business review, beneficial owners disclosed on a GIS if incorporated. Mynt’s prospectus puts 2.1 million QR Ph merchants through that gate. Named, documented, revocable counterparties.

So how does a Weather-category casino get paid?

It never applies. The ₱20 that came back to me, and the ₱1,000 a sabong holder takes, travel as ordinary person-to-person transfers. Same app. Different door entirely.

And P2P is not invisible. Every send carries a name, a number, a device, a timestamp, a graph. What it lacks is someone whose job is to treat “tiny test cash-out, then VIP-fee inbound to the same counterparty” as a fraud signature rather than a customer complaint.

A firm at Mynt’s scale can staff that. Maya, same minimum. Keep qualifying sari-sari stores and bakers through six documents while P2P casinos skate, and the qualification regime is theatre — expensive for the compliant, irrelevant to the criminal.

If you are in this trap right now

Do not pay. Not the VIP fee, not the tax, not the “correct your account” charge. No additional payment releases a balance that was never yours.

Preserve everything: screenshots of the balance and the fee demands, GCash receipts, recipient account names and numbers, timestamps, URLs.

Report the recipient wallet to GCash or Maya fraud channels. Report the app to CICC (1326), the PNP Anti-Cybercrime Group, or NBI Cybercrime. Report to PAGCOR if the app claimed a licence.

And know the second bite: recovery agents who promise to retrieve your money for a fee are the same business model wearing a rescuer’s costume.

The ask

To Mynt and to Maya: you built the most important financial infrastructure in this country’s modern history, and I mean that without qualification. Forty million Filipinos moving money who previously could not is not a marketing claim, it is a structural achievement.

Gate the gambling cash-in anyway.

Not because you are guilty of anything. Because you are the only institution positioned to restore the friction that the physical world used to provide for free — and because the alternative already arrived at my phone, wearing a chicken costume, filed under Weather, rated 4+, and it paid me ₱20 to prove how easy it was.

This piece is commentary and technical documentation, not legal advice and not a recovery service. I do not endorse any gambling operator, licensed or otherwise; the distinction drawn here concerns legal status and cash-out design only. I describe one app I installed and tested — not every unlicensed app, and no inference is drawn about any operator I did not examine.

Method: a controlled test funded with roughly ₱5,000 of my own money, with the app installed, played, and probed for withdrawal behaviour at two amounts. Screenshots retained. Observations of a physical casino floor are my own, made in person. Where a figure comes from a survey I have labelled it as a survey; where a settlement rail is inferred rather than seen, I have said so; where I could not source a number, I left it out rather than estimate it.

Related articles

Not sure where to start?

Start with a fixed-scope cyber health check: recommendations before licences.

Usap Tayo