Clone Domains: the Scam You Cannot See

How a clone reaches you

Copying a website is trivial, because everything a visitor sees is public. The work is in the address: a letter swapped, a hyphen added or removed, a different ending, a brand name with an extra word attached. Then the clone is pushed to where you will meet it, which is almost never a typo you made yourself.

1. An advertisement or a sponsored result above the genuine listing.
2. A link in a Telegram, Viber or Facebook group, often attached to a bonus code.
3. A page built to rank for the brand plus login, app, or not working.
4. A shortened link, which hides the address completely until you have already arrived.
5. A home-screen icon you added yourself, from a clone, which then looks identical to the real one forever.

That last route is the most durable, and it is why checking the address bar before adding a shortcut matters so much. After the icon exists, nothing on your phone will ever tell you which site it opens.

What the clone is collecting

Usually your username and password, which it may forward to the real site so that your login appears to succeed. Sometimes it sits in the middle and asks for a one-time password too, in which case it can complete a login or a withdrawal while you watch a loading spinner. Occasionally the clone's only purpose is to serve a counterfeit app installer, because a visitor who trusts the page will trust the file.

None of these produce a visible symptom at the time. The symptom arrives later, as a login that stops working, a balance that moves, or a transaction you did not make.

One detail is worth knowing because it reverses a common assumption: a padlock in the address bar means the connection is encrypted, not that the site is genuine. Certificates are free and automatic, so a clone will almost always have one. The padlock tells you nobody is reading the traffic between you and whoever owns the page, which is of no comfort when the problem is who owns the page.

The habit that defeats it

Decide the address once, from a source you trusted before today, and reach it the same way every time: type it, or use a bookmark you created yourself on a day when nothing was wrong. Never arrive from an advertisement, a chat link or a search result when money is involved, and never log in on a page you reached through somebody else's link.

Two supporting habits make it stronger. First, a password that is unique to this account, so that a clone which captures it cannot open anything else you own. Second, treat any unexpected one-time password as evidence that somebody is using a captured password right now, and change it immediately from a device you trust.

Four relatives of the same problem

What real verification asks for

A genuine know-your-customer check wants documents: a government identity document, sometimes a selfie or a short liveness check, occasionally proof of address, and a name match between the gaming account and the wallet or bank account funding it. All of it is uploaded inside the operator's own account area.

It never asks for your password, your one-time password, a card PIN or CVV, or an e-wallet MPIN, and it never asks you to send a transfer to prove ownership. It also does not arrive by chat with an upload link attached. When something claiming to be verification reaches you from outside, log in through your own address and see whether the same request is waiting inside. If it is not, you have your answer.

Why recovery is so limited here

Philippine retail transfers run on two public rails with different temperaments: one clears instantly, subject to a ceiling on each transaction, while the other collects payments and settles them in batches on banking days. Neither carries anything resembling a card chargeback, so once a transfer has been authorised, including one authorised with a stolen code, the realistic road ahead is an investigation rather than a reversal.

That is why the first minute matters more than the following week. Report inside your wallet's own app immediately, change the password, and stop talking to whoever is still messaging you, because the only thing they need now is time.

The escalation route, in order

1. Open your own account and use the operator's support channel there, with the dates, sums and references to hand.
2. Tell your bank or e-wallet through the help section inside its app, immediately, if anything moved.
3. Escalate an unresolved dispute with a licensed operator to PAGCOR using the contact details on its own website.
4. Report the phishing itself to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division through their own official sites.
5. Keep the clone's full address, screenshots of the page, and the chat or advertisement that led you to it. Phishing reports depend on that detail.

We print no hotline numbers on purpose. A number copied from a third-party article and left to age is how fake support listings acquire credibility; look the current one up on the agency's own website and verify the domain before dialling.

The common thread

Each scam on this page works by replacing one of your own routes with theirs: their domain instead of yours, their file instead of the operator's, their support number instead of the in-product channel, their code request instead of a real check. The defence is correspondingly simple and entirely within your control, which is to keep every route yours and let urgency be the signal that somebody is trying to change one.

If chasing a stuck balance has become a daily routine, that is worth noticing too. Deposit limits, cool-off and self-exclusion are free, sit in the account settings, and require no explanation to anybody.