8 
JU8 11 P 4  
FOURTEENTH CONGRESS OF THE REPUBLIC 
First Regular Session 
OF THE PHILIPPINES 
S E N A T E  
s.~.2405 
Introduced by Senator Villa 
Explanatory Note 
Phishing is a criminal act to acquire sensitive infomation, such as 
usernames, 
passwords, 
web site details and credit card accounts, 
by 
masquerading as a trustworthy entity in an electronic communication. It is an 
example of a social engineering technique to fool users of information highway'. 
The most common form of phishing are 
1. 
2. 
3. 
link manipulation or a form of technical deception designed to 
make a link in an email and the spoofed website it leads to; 
filter evasion or the use of masquerade images and being sent to 
users with a great difficulty of deletion; 
website forgery or the act of placing a picture of a legitimate URL 
over the address bar, or by closing the original address bar and its place, a new 
legitimate URL is created but is utilized to deceive e-mail users; 
4. 
phone phishing or the act of acquiring sensitive information 
through the use of telecommunication facilities including voice over internet 
protocol WOIP). 
Phishing is a new felony, with the first phishing technique described in 
detail only in 1987 but the actual crime committed a decade later, in 1996. 
Phishers (the term referred to perpetrators of phishing crimes) target large and 
known organizations known to transact heavily through e-commerce such as 
eBay, PayPal and banking and travel institutions dealing online. 
The damage caused by phishing ranges from denial of access to one's 
email account to substantial financial loss. Fundamentally, it is an assault to a 
person's right to privacy. 
they can ruin an individual's 
trustworthiness, credit standing and worse, deny the victims access to their bank 
accounts. 
And significantly, 
' Wikipedia. www.wikipedia.org on phishing 


In the Philippines, the relevant statutes are the E-Commerce Law of the 
Philippines and the various issuances of the National Telecommunication 
Commission. But there is no specific legislation addressing this crime. 
This bill seeks to commence the discussion on the enactment of an 
effective policy against phishing and all other forms of internet and 
telecommunications fraud. 
With more than 14,000,000 internet users in the 
country2 and online transactions becoming more popular as a mode of doing 
business in the Philippines, the early deliberation of this proposed measure is 
recommended. 
MANNY V LLAR 
1 
International World Statistics wehsite citing Yahoo records for the Philippines, as of April 2007 
2 


S E N A T E  
S.B. 2405 
Introduced by Senator Villar 
AN ACT 
FURTHER PROTECTING THE INTEGRITY OF ELECTRONIC 
TRANSACTIONS, DEFINING FOR THE PURPOSE THE CRIME OF 
INTERNET AND TELECOMMUNICATIONS PHISHING, PROVIDING 
PENALTIES THEREFOR AND FOR OTHER PURPOSES 
Be it enacted by the Senate and House of Representatives of the 
Philippines in Congress assembled: 
Section 1. 
Any person who shall commit the act of phishing in the 
internet or instant messaging system shall be punished with imprisonment of not 
less than two (2) years nor more than ten (IO) years, or a fine of not less than fifty 
thousand pesos (Php 50,000.00) but not more than five hundred thousand pesos 
(Php 500,000.00) or both such imprisonment and fine, at the discretion of the 
court. 
The act of internet and message phishing involves securing or getting of 
sensitive personal information for the purpose of using it in fraud, 
or for 
participating in fraudulent business practices, or for the purpose of identity theft 
and misrepresentation. It is carried out by email or instant messaging or through 
the use of phone calls, voice over internet protocol or a combination of all those 
mentioned and other facilities of information technology. 
The act covers the development and possession of phishing kits or 
materials to commit fraud and the creation of fake websites to send bogus emails 
in order to defraud another person. 
Section2. 
The Department of Justice in coordination with the 
relevant offices shall establish a framework of 
comprehensive process of 
assisting victims of phishing and assist law enforcement agencies in obtaining 
evidence to apprehend perpetrators. 
Section 3. 
Implementing Rules and Regulations. 
Within ninety (90) 
days after the approval of this Act, the Department of Justice, shall promulgate 
the rules and regulations to supplement the enforcement of this Act. 


S F  
Section+ This Act shall take effect fifteen (15) days after its complete 
publication in the Official Gazette or in two (2) newspapers of general circulation, 
whichever comes earlier. 
Approved,