National Privacy Commission issues an Order to Telcos to cooperate on investigation of smishing attacks

September 9, 2022 | 8:25 AM GMT+0800 Last Edit: September 9, 2022

Pasay City, September 8, 2022 —-The National Privacy Commission (NPC) orders telecommunication service providers, Globe Telecom Inc., Smart Communications Inc., and DITO Telecommunity, to submit a comprehensive audit report which shall include an examination of their respective distributor frameworks for their Subscriber Identity Modules (SIM cards) used in smishing messages that contain the names of recipients.“

The Commission is proactively investigating the matter to identify the causes, and implement all possible solutions to mitigate, if not eliminate, the threats and risks brought by targeted smishing messages. This is an ongoing investigation that involves close coordination between telecommunication companies and government authorities such as the National Telecommunications Commission (NTC),“ said Privacy Commissioner John Henry D. Naga.

“We will relentlessly protect the Filipino against any unscrupulous attempt to take advantage of our personal data. We urge the full cooperation of all stakeholders involved, including the Telcos, our partners in the government, and the public, to bring this matter to a full conclusion”, the Privacy Chief added.

In addition, the Order directs telecommunication companies to report on all the mobile phone numbers involved in the smishing messages; the distributors and/or entities from where the involved numbers were distributed; the individuals and/or entities where the mobile phone numbers were disclosed by the Distributors; and other information that may aid the NPC in its ongoing investigation.

The Telcos have been given a period of ten (10) days to comply. The Complaints and Investigation Division of the NPC will also evaluate the Telcos’ submissions and probe further.

As part of its next steps, the NPC will convene a meeting with representatives from the Telcos, and government agencies which include, the NTC, the Cybercrime Investigation and Coordinating Center, the Philippine National Police, and the National Bureau of Investigation, on September 13, 2022.

The Commission prompts the public to immediately report incidents of targeted smishing at [email protected]