JILILUCK Smishing: Handling a Text That Asks for a Code

Smishing is phishing delivered by SMS: a short text that tries to make you open a link, enter your details or read out a code. It works because a text feels personal and arrives on the device you trust most. The notes below show how to recognise one, what to do with the code it wants, and how it connects to the rest of the PAGCOR online safety pages.

Red flags in a smishing text

A smishing message has a job to do in very few words, so it leaves the same marks every time. Check the message against this list before you do anything else.

1. It pushes a deadline. “Account locked in 24 hours” or “claim now” is there to stop you thinking.
2. It carries a short or odd link. A shortened link hides where you are going.
3. It uses a brand name loosely. The sender may name a casino, a wallet or a bank you do use, which is guesswork that happens to land.
4. It asks for a code, a password or a fund password. No real step asks you to send these back in a text.
5. It comes from a number you do not know, or from a sender name that looks right but is not in the conversation thread you already have.
6. It offers money for nothing. A prize, a refund or a “bonus ready to withdraw” is bait.

The text scam routes to expect

A text scam has a handful of storylines, and each one ends at the same place: your login or your code. Match yours to the right-hand column.

The copied pages those links lead to are the subject of the phishing scam red flags page.

OTP scam: why a code is never for sharing

An OTP scam targets the one-time password that proves it is you. On the JILILUCK lobby, the registration form sends an SMS code only after you press Kunin ang code, and the code goes into the form you are filling in. The same logic applies to any wallet or bank: a code you did not just ask for means someone else is trying to log in as you, and a person asking you to read a code out is the thief.

1. Stop. Do not reply and do not tap the link.
2. If you did not request the code, someone has your password or is guessing it. Change the password in the real lobby or wallet at once.
3. If you already read a code out, treat the account as taken and go to the account hacked first-hour steps.
4. Add a second step that does not rely on SMS where the service allows it: the two step verification setup shows the options.

What to do with a text that links to a casino page

Do not use the link. Opening it is the risk, because the page may be a copy of the login screen.

1. Type the lobby address into your browser yourself. The lobby opens at jililuck.com, and you can read the page checks on the phishing scam page.
2. Log in there and look inside your account or the Customer Services menu for the matter the text mentions.
3. If nothing is there, the text was bait. Customer Services in the lobby menu is the only support channel the Terms of Service recognise, and any other channel claiming to be support is fake.
4. Delete the message and block the sender.

Texts that claim to be from a wallet

A wallet text is the same trick with a different logo. Open the wallet from its own program or an address you typed, and read the notice there. The e-wallet payment pages explain how Philippine wallets and banks move money, so you know which notices are normal and which are not.