August 27, 2025
4:02 pm
4107




1 
2 
Republic of the Philippines 
HOUSE OF REPRESENTATIVES 
Quezon City, Metro Manila 
Twentieth Congress 
First Regular Session 
HOUSE BILL NO.____ 
Introduced by Representatives JOCELYN P. TULFO and RALPH WENDEL P. TULFO 
AN ACT STRENGTHENING PROTECTIONS AGAINST ONLINE FINANCIAL FRAUD
AND AI-GENERATED DECEPTIVE CONTENT, ESTABLISHING A NATIONAL CYBER
FRAUD FUSION CENTER, IMPOSING DUTIES ON DIGITAL PLATFORMS, TELCOS,
AND FINANCIAL SERVICE PROVIDERS, PROVIDING SWIFT CONSUMER REDRESS,
AMENDING REPUBLIC ACT NOS. 10175, 11934, 11765, 10173, AND FOR OTHER
PURPOSES 
Be it enacted by the Senate and House of Representatives of the Philippines in Congress 
assembled
SECTION 1. Short Title.  
1 
This Act shall be known as the "Online Fraud and AI-Deception Prevention Act." 
2 
SEC. 2. Declaration of Policy.  
3 
It is the policy of the State to (a) protect consumers and the integrity of the financial 
4 
system from online fraud, scams, and identity theft; (b) deter the malicious use of 
5 
artificial intelligence to fabricate deceptive content (deepfakes) that facilitates crime 
6 
or public harm; (c) ensure rapid cross-agency response; and (d) require reasonable, 
7 
risk-based safety, authentication, and takedown measures from covered 
8 
intermediaries while upholding constitutional rights to privacy, free speech, and due 
9 
process. 
10 
SEC. 3. Definitions.  
11 
As used in this Act: 
12 
(a) Online Financial Fraud – Any scheme conducted through information and
13 
communications technologies (ICT) to unlawfully obtain money, property, data, or
14 
access credentials, including social-engineering, phishing/smishing/vishing,
15 
account takeover, SIM-swap, fake investment solicitations, mule-account
16 
operations, synthetic-ID fraud, and unauthorized electronic fund transfers.
17 
(b) AI-Generated Deceptive Content (Deepfake) – Audio, image, or video
18 
materially altered or synthetically generated by automated means to falsely depict
19 
a person’s identity, voice, likeness, or endorsement, where such content is used to:
20 
(1) obtain a monetary or digital asset; (2) compromise security; (3) impersonate a
21 
4107


public official or institution; or (4) materially mislead the public regarding a financial 
1 
solicitation or service. 
2 
(c) Covered Intermediaries – Digital platforms (social media, marketplaces, 
3 
messaging, content-sharing), telecommunication companies (telcos) and public 
4 
telecommunication entities (PTEs), e-wallets, banks and other financial institutions 
5 
(POFIs), virtual asset service providers (VASPs) and cryptocurrency exchanges, 
6 
payment system operators, and domain/hosting providers operating in or serving 
7 
users in the Philippines. 
8 
(d) High-Risk Account – An account exhibiting fraud typologies identified by the 
9 
National Cyber Fraud Fusion Center (NCFFC) under Sec. 4. 
10 
(e) Rapid Preservation – The immediate, non-reversible freezing of suspected 
11 
proceeds, mule accounts, or related content for a period not exceeding seventy-two 
12 
(72) hours upon the issuance of a preservation order by the NCFFC based on a 
13 
sworn complaint and a finding of probable cause. This preservation is intended to 
14 
prevent the dissipation of assets pending the securing of a judicial freeze order. 
15 
(f) Mule Network – A group or system of bank accounts, e-wallets, or other financial 
16 
accounts used as conduits for the fraudulent transfer, layering, or concealment of 
17 
illicitly obtained funds. 
18 
SEC. 4. National Cyber Fraud Fusion Center (NCFFC).  
19 
(a) Establishment.  
20 
A permanent NCFFC is hereby created under the Department of Information and 
21 
Communications Technology (DICT) as an inter-agency task and data-sharing hub 
22 
composed of DICT, Bangko Sentral ng Pilipinas (BSP), National Privacy 
23 
Commission (NPC), National Bureau of Investigation-Cybercrime Division (NBI-
24 
CCD), Philippine National Police-Anti-Cybercrime Group (PNP-ACG), Securities 
25 
and Exchange Commission (SEC), National Telecommunications Commission 
26 
(NTC), Department of Justice (DOJ), Department of Migrant Workers (DMW), 
27 
Department of Foreign Affairs (DFA), and other agencies as needed. 
28 
(b) Functions.  
29 
(1) Real-time coordination, threat intelligence, and takedown referrals for online 
30 
fraud and deepfakes. (2) Operation of a 24/7 One-Stop Consumer Portal (hotline, 
31 
web, mobile) for reporting, status-tracking, and coordinated freezing requests. (3) 
32 
Issuance of official Typology Advisories and Risk Flags to covered intermediaries, 
33 
which shall be considered in evaluating compliance with their duties under this Act. 
34 
(4) Management of a secure Fraud Indicators Repository (hashes, models, mule 
35 
patterns) with privacy-by-design safeguards. (5) International cooperation and 
36 
Mutual Legal Assistance (MLA) requests for cross-border recovery. 
37 
(c) Data Governance.  
38 
Sharing shall be limited to fraud-mitigation purposes with role-based access, audit 
39 
logs, and retention limits consistent with Republic Act No. 10173, otherwise known 
40 
as the Data Privacy Act of 2012. 
41 
SEC. 5. Duties of Covered Intermediaries.  
42 
(a) Know-Your-Counterparty (KYCP).  
43 


Platforms enabling financial solicitations, marketplace sales, or paid promotions 
1 
shall verify Philippine business registration and beneficial ownership for merchants 
2 
or investment-soliciting pages; display verified badges and legal names; and 
3 
maintain a public reporting channel. 
4 
(b) Risk-Based Account Integrity Controls.  
5 
Implementation of risk-based multi-factor authentication; SIM-swap alerts and port-
6 
freeze options; velocity limits for new payees; confirmation holds for first-time, high-
7 
value outward transfers; and anomaly detection for mule activity. 
8 
(c) Content and Identity Abuse Response.  
9 
Implementation of hash-matching and model-based detection for known scam 
10 
assets and deepfakes; rapid labeling of suspected AI-generated media as 
11 
“synthetic/altered”; and a four-hour takedown window upon lawful NCFFC referral 
12 
for clearly fraudulent content or cloned pages. 
13 
(d) Incident Support.  
14 
Providing victims with dispute channels, case IDs, and human review; and 
15 
maintaining a Philippine contact point reachable 24/7. 
16 
(e) Transparency.  
17 
Semi-annual public Fraud Risk Reports with metrics on reports received, 
18 
takedowns, disputes, reversals, and consumer education reach. 
19 
(f) Consumer Education.  
20 
Covered intermediaries shall implement and promote regular, accessible, and multi-
21 
channel consumer education campaigns on online fraud prevention, deepfake 
22 
detection, and safe digital practices, in coordination with the NCFFC. 
23 
SEC. 6. Rapid Fund Freezing and Return.  
24 
(a) Freezing.  
25 
Upon a sworn complaint and a finding by the NCFFC of probable cause that a 
26 
financial account holds proceeds of a fraudulent scheme, the receiving institution 
27 
shall immediately freeze said funds for up to seventy-two (72) hours and notify the 
28 
depositor/holder. Within said period, law enforcement shall secure a judicial freeze 
29 
order. 
30 
(b) Reversal and Restitution.  
31 
Where funds are traceable and uncontested or by order of a competent authority, 
32 
institutions shall process expeditious reversals to the victim, without prejudice to the 
33 
civil or criminal liability of offenders. 
34 
(c) Shared Liability.  
35 
In cases where the gross negligence of a covered intermediary, as determined by 
36 
a competent administrative agency or a court of law, substantially enabled the loss, 
37 
said intermediary may be held proportionately liable for restitution to the victim, 
38 
subject to due process. 
39 


SEC. 7. Anti-Money Laundering (AML) and Beneficial Ownership.  
1 
(a) Online financial fraud and large-scale deepfake-enabled fraud are hereby 
2 
expressly recognized as predicate offenses under Republic Act No. 9160, otherwise 
3 
known as the Anti-Money Laundering Act of 2001, as amended. 
4 
(b) Covered intermediaries shall implement enhanced due diligence for High-Risk 
5 
Accounts and promptly file Suspicious Transaction Reports (STRs) to the Anti-
6 
Money Laundering Council (AMLC). 
7 
SEC. 8. SIM-Related Protections and One-SIM-One-ID Safeguards.  
8 
(a) Telcos shall provide port-freeze and SIM-swap delay options; and notify 
9 
subscribers via multi-channel alerts prior to SIM swaps or high-risk changes. 
10 
(b) Republic Act No. 11934, otherwise known as the SIM Card Registration Act, is 
11 
hereby amended to mandate periodic re-validation for bulk/enterprise SIMs and 
12 
require verifiable live identity checks for SIM replacement. 
13 
(c) Unauthorized SIM-swap to facilitate online fraud is penalized under Sec. 11. 
14 
SEC. 9. Crypto and Digital Assets.  
15 
VASPs shall (a) geofence non-compliant counterparties; (b) implement blockchain 
16 
analytics and address-screening; (c) honor NCFFC freezing referrals subject to 
17 
lawful process; and (d) provide consumer-grade warnings for transfers to flagged 
18 
addresses. 
19 
SEC. 10. Investment Solicitations and Clone Pages.  
20 
(a) Platforms shall block paid ads and boosted posts for unlicensed investment 
21 
solicitations and promptly remove clone sites/pages of regulated entities upon 
22 
NCFFC referral. 
23 
(b) The SEC may order platforms, registrars, and hosts to suspend domains or 
24 
pages used for illegal investment solicitations, with prompt judicial review. 
25 
SEC. 11. Offenses and Penalties.  
26 
Without prejudice to Republic Act No. 10175, otherwise known as the Cybercrime 
27 
Prevention Act of 2012, and other existing laws: 
28 
(a) Operating a Mule Network (managing or renting accounts for fraud): prisión 
29 
correccional to prisión mayor and a fine of ₱500,000–₱2,000,000 per network tier 
30 
involved; proceeds shall be forfeited in favor of the government. 
31 
(b) Unauthorized SIM-Swap for Fraud: prisión correccional and a fine of ₱200,000–
32 
₱1,000,000; the penalty shall be higher by one degree if committed by an insider of 
33 
a telco or intermediary. 
34 
(c) Deepfake-Enabled Financial Fraud: The penalty for estafa qualified by ICT use 
35 
under RA 10175 shall be increased by one degree; mandatory restitution and 
36 
takedown. 
37 
(d) Platform Non-Compliance with Sec. 5 or 10 (willful or grossly negligent): 
38 
Administrative fines by the relevant regulatory body, up to the greater of 
39 


₱50,000,000 or 2% of Philippine-sourced revenue. Repeat violations may trigger 
1 
the suspension of operations related to the offending feature. 
2 
(e) Obstruction (refusal to preserve, alter, or delete logs post-lawful request): 
3 
Penalties under RA 10175 and contempt sanctions. 
4 
SEC. 12. Due Process, Privacy, and Free Expression.  
5 
Measures under this Act shall be narrowly tailored, content-neutral where feasible, 
6 
and subject to notice, adversarial challenge, and judicial oversight. All takedown, 
7 
freezing, or suspension orders are subject to judicial review as provided for by law. 
8 
Labeling of synthetic media is not a prior restraint and shall not apply to satire, art, 
9 
or public-interest uses absent intent to defraud or cause material harm. 
10 
SEC. 13. Appropriations.  
11 
The amount necessary for the effective implementation of this Act shall be sourced 
12 
from the appropriations of the Department of Information and Communications 
13 
Technology (DICT) in the annual General Appropriations Act. 
14 
SEC. 14. Implementing Rules and Regulations (IRR).  
15 
Within ninety (90) days from effectivity, DICT, in consultation with BSP, NPC, NBI, 
16 
PNP, SEC, NTC, DOJ, and stakeholders, shall promulgate the IRR. 
17 
SEC. 15. Separability Clause.  
18 
If any provision of this Act is declared unconstitutional, the remainder of the Act or 
19 
the provision not otherwise affected shall remain valid and subsisting. 
20 
SEC. 16. Repealing and Amending Clause.  
21 
Inconsistent provisions of Republic Act No. 10175, Republic Act No. 11934, 
22 
Republic Act No. 11765, Republic Act No. 10173, Republic Act No. 11127, Republic 
23 
Act No. 8792, and related issuances are hereby amended or repealed accordingly. 
24 
SEC. 17. Effectivity.  
25 
This Act shall take effect fifteen (15) days after its publication in the Official Gazette 
26 
or in a newspaper of general circulation. 
27 
Approved, 
28