A real problem, a coordination fix
On 19 October 2026, the Tribune reported that the Department of Justice's Office of Cybercrime (OOC) took part in a high-level coordination meeting hosted by the National Telecommunications Commission (NTC). Also at the table were the Credit Card Association of the Philippines, Globe, Smart and DITO. The stated aim is to simplify incident reporting and improve referral procedures in online financial fraud cases, along with faster transmission of electronic evidence.
The problem is large. The State of Scams Philippines 2026 report, as covered by the Tribune, estimates that Filipino adults lost P121.8 billion to scams over the past year, about P10,427 per victim. It also found that 84 percent of adults encountered at least one scam attempt, up from 77 percent in 2025. Those figures are survey extrapolations from 1,160 respondents, not an official tally of reported losses, and the Tribune says as much. Vera Files, covering the same report, adds that 15 percent of those who encountered a scam lost money, and that most attempts (68 percent) arrived by text or SMS.
The strongest case for the coordination effort is simple. Fraud moves in minutes, while inter-agency referrals move in weeks. A scam number that is still live, a wallet that has not been frozen, and a telco log that has not been preserved are all perishable evidence. A shared reporting channel is a sensible, low-cost fix, and nothing in it requires new surveillance powers. We support it.
The legal line already exists
The reports we reviewed do not mention SIM registration. But telcos hold the most useful investigative asset in any SMS-scam case, which is the registered identity behind a mobile number. That makes the privacy rules for that data the central design question.
Republic Act 11934, the SIM Registration Act, signed on 10 October 2022, answers it. Section 9 says information obtained in registration "shall be treated as absolutely confidential and shall not be disclosed to any person," with four exceptions. Those are compliance with the Data Privacy Act (Republic Act 10173), a court order or legal process "upon finding of probable cause," compliance with Section 10, and the subscriber's written consent. Section 10 allows disclosure only on a subpoena from a competent authority, issued in an investigation based on a sworn complaint that a number was used in a crime and that the complainant cannot ascertain the perpetrator's identity. Breaches by telcos or their staff carry fines of P500,000 to P4 million under Section 11.
The Cybercrime Prevention Act of 2012 (Republic Act 10175) adds a second layer. Under Section 14, law enforcement, "upon securing a court warrant," can order a service provider to disclose subscriber's information, traffic data or relevant data within 72 hours. The order must relate to a "valid complaint officially docketed and assigned for investigation." Section 12 says that other data to be collected or seized or disclosed requires a court warrant.
So the legal pipeline is already specified: a sworn complaint, a docketed case, a subpoena or warrant, and a 72-hour response clock. Any framework that speeds transmission should make that pipeline faster by standardising forms, secure channels and points of contact. It should not shorten the pipeline by dropping the judicial or prosecutorial gate.
Where the risk sits
The risk is mission creep through informality. Three failure modes deserve attention.
- Voluntary disclosure by phone or message. Under pressure to help, a telco compliance officer may share a subscriber's name because an investigator asks. That would sit outside Sections 9 and 10, and the penalty falls on the telco, which gives it every reason to insist on paper.
- Retention without purpose limits. Section 10 requires telcos to keep registration data for ten years after a number is deactivated. A decade-long store of identities is exactly what a breach or an overbroad request will target. The NPC's oversight under the Data Privacy Act matters most here: purpose limitation, access logging and breach notification.
- Scope drift into speech cases. The same Section 14 order mechanism serves cyberlibel, which Section 4(c)(4) defines as libel under Article 355 of the Revised Penal Code committed through a computer system. A channel built for financial fraud could quietly become the fastest route to unmasking an anonymous critic. We take no position here on whether any such use is planned, and nothing we reviewed suggests it is. But a framework without a stated scope invites it.
The Supreme Court has already shown the sensitivity of this ground. In Disini v. Secretary of Justice (G.R. No. 203335, 11 February 2014), it struck down Section 12 of the Cybercrime Prevention Act for lack of specificity and definiteness, finding it violated the right to privacy by authorising warrantless real-time collection of traffic data. It also struck down Section 19, which let the DOJ restrict access to computer data, because it precluded judicial intervention. The lesson is that speed-oriented powers drafted loosely do not survive scrutiny.
What a proportionate framework looks like
The fix is not to slow the coordination effort, but to publish its terms. Four design commitments would let it be fast and trusted.
- Fraud-only scope, in writing. Limit the channel to financial-fraud offences, and state that requests concerning expression offences, including cyberlibel, follow the ordinary warrant route.
- Judicial or subpoena gate preserved. Every identity disclosure should cite the Section 10 subpoena or the Section 14 warrant, with a standard form and encrypted transmission.
- NPC visibility. Have the National Privacy Commission review the framework, and require telcos to keep request logs it can audit.
- Aggregate transparency. Publish annual counts of requests, grants and refusals. A scam-fighting tool that discloses its own usage earns the public legitimacy that makes enforcement easier.
The prize is real. Faster evidence handling can shorten the window in which scam numbers stay live and wallets stay open. But the Philippines already wrote its privacy bargain into law in 2012 and 2022. The coordination effort's job is to make that bargain run faster, not to renegotiate it in an operating agreement.