What the AFASA law is and how it could shape scam recovery and the banking sector

AFASA expands banks’ authority to trace mule accounts and fast-track potential fund recovery.

Scam tactics have grown more sophisticated with new technologies over the years, to the point where previous laws have become insufficient to keep up. But the recently enacted Anti-Financial Account Scamming Act (AFASA) equips the private and public sectors with clearer authority and faster routes to identify and stop fraudsters.

AFASA was signed into law in July 2024. It essentially allows banks to investigate “mule” accounts, or accounts where stolen funds are kept and moved. The law gives banks authority to flag suspected mule accounts and conduct deeper investigations without being limited by the Data Privacy Act or other bank secrecy rules that scammers have long used to avoid detection. 

Industry officers see this as a major shift because internal investigations used to stall for days while banks sought legal clearance to access or share account information.

The AFASA law’s definition of money mules covers not just traditional bank accounts but also e-wallets such as GCash, Maya, and similar platforms. These platforms are often used to move proceeds from scams like phishing (emails) and smishing (SMS) that persuade a person to click links leading to device compromise.

Jail time of up to 14 years 

A money mulling conviction carries a sentence of six to eight years of prison, a fine that goes up to P500,000, and forfeiture of assets. The punishment for senior citizens is heavier with 12 to 14 years of jail time since scammers have been known to purchase and use their accounts to avoid suspicion. 

The law also penalizes scams by means of social engineering schemes that it defines as obtaining a person’s sensitive financial information by any means of manipulation or deception resulting in unwanted access to their accounts.

In 2024, an estimated amount of ₱460 billion is believed to have been lost to digital scams with a bulk of this credited to social engineering attacks wherein scammers would send a message or make a call either offering limited loans or pretending that there’s an emergency that requires their immediate action, ironically, such as their accounts being hacked. 

Banks said these losses highlight how fraud today relies less on breaking systems and more on manipulating people.

Concerns about opportunistic attacks remain

Banks and e-wallet companies have repeatedly warned their users about these manipulations but remain concerned with how opportunistic these attacks can be since they are usually done during the busy times of the day when people are tired or agitated, thereby making them more vulnerable to fraud. This explains why alerts are now sent more frequently across apps, SMS, and in-app pop-ups.

Those found guilty of conducting social engineering attacks can be sentenced up to 12 years in prison with a fine of one million pesos.

The AFASA law has been used to investigate accounts possibly linked to the recent corruption scandal involving the flood control projects to trace where the billions in public funds may have been funneled.

“The banks will quickly trace, on behalf of the individual, where the funds went. It won’t just be one bank working alone—the entire banking ecosystem will act together to track the money without the usual bank secrecy or data privacy hurdles,” said Jonathan Paz, BPI enterprise information security officer and data protection officer.

A hope for the financial industry

The passage and implementation of the law have been anticipated for years, as it allows for quicker recovery of funds by tracing and freezing the fraudulent account that’s keeping them. While still awaiting full implementation, the financial industry is hopeful that this will curb the scam trend and prevent billions of pesos more of the people’s hard-earned money from being stolen. 

Several banks are already preparing dedicated AFASA response teams that will coordinate across institutions once the enforcement rules are finalized.

READ: