Scams to Avoid: Fake Support Numbers and Four Other Traps

The fake support number, step by step

The fraud works because it reverses the usual direction of trust. In a phishing e-mail the stranger contacts you and you are suspicious. Here you contact the stranger, so you arrive already convinced, with a problem you want solved and a willingness to co-operate.

1. A number is planted where a worried player will look: a comment under a complaint post, a cloned help page, a business listing, a Telegram channel named after the brand, or a paid search result.
2. You call it with a real problem — a pending withdrawal, a deposit that never landed, a locked account.
3. The voice is calm, scripted and sympathetic, and asks for your account name to 'pull up the ticket'.
4. Then come the real asks: the one-time password 'to authenticate you', your e-wallet PIN 'to trace the transfer', or a remote-access app 'so I can see your screen'.
5. If you hesitate, the script adds a deadline — the ticket closes, the payout is reversed, the account is frozen at midnight.
6. Everything you say is used within minutes, because the one-time password has a short life.

The defence is a rule, not a judgement call: you never give a one-time password, PIN or password to a human being, by any channel, for any reason, however convincing. And you never obtain a support number from a search result or a chat message — you read it inside your own logged-in account on the operator's real domain.

Four more traps that travel with it

• The release fee. A 'processing', 'tax' or 'unlocking' payment is demanded before a withdrawal can be sent. Legitimate deductions come out of the payout; nobody who owes you money needs you to send money first.
• The agent who messages you first. An account on Telegram, Messenger or Viber using the brand's logo offers to speed up your cashout. Real support does not cold-message players, and it does not operate from a personal account.
• The predictor or hack app. Software claiming to read a slot's next outcome. Results are generated server-side at the moment of the spin; nothing on your phone can see or change them, and installing the file is the actual purpose.
• The look-alike domain. A near-identical spelling with a swapped character or an extra word, serving a perfect copy of the login page purely to collect credentials.

Claim, reality, response

What a real verification request never asks for

• Your one-time password, authenticator code or any number sent to you by SMS
• Your e-wallet PIN, your MPIN or your account password
• A screen-sharing or remote-access session on your phone
• A payment of any kind to complete verification
• Your card's CVV or your full card number read aloud
• Documents sent to a personal e-mail, a chat account or a cloud link rather than uploaded inside your own logged-in account

Genuine KYC is dull and one-directional: you upload an identity document and sometimes a selfie or a proof of address through the operator's own verification page. The name on that document has to match the name on the receiving wallet or bank account, which is the single most common reason a payout stalls — and it is a matching problem, not a fee problem.

Checking a domain before you type a password

1. Read the address from the end backwards: the suffix first, then the brand, then anything in front of it.
2. Treat a brand name that appears before the real domain as a warning, not a reassurance.
3. Look for swapped characters, doubled letters and added words such as 'official', 'app' or 'ph'.
4. Open the site from a bookmark you created, not from history, search or a message.
5. If you are unsure, log out, close the tab and reach the site by typing the domain by hand.

Escalation, in order

1. The operator's own support, through the contact route shown inside your logged-in account.
2. Your e-wallet or bank, through its own app's help section, if money left you and never arrived.
3. PAGCOR's published player-concerns channel, reached from pagcor.ph itself, if the operator stops responding.
4. The PNP Anti-Cybercrime Group or the NBI's cybercrime route, through their own official sites, if you were defrauded.

We deliberately do not print hotline numbers here. Published numbers change, and a stale number on a guide page is the exact vulnerability this scam exploits. Read the current one off the organisation's own site each time.

If you have already given something away

1. Change the account password from a session you opened yourself, and turn on every extra authentication step available.
2. Open your e-wallet or bank app directly and report unauthorised activity through its in-app help.
3. Remove any remote-access or screen-sharing app you installed, then check your phone for apps you do not recognise.
4. Screenshot the messages, the number and the timestamps before anything is deleted.
5. Tell the operator, so the receiving account can be flagged.
6. File with the cybercrime route if money moved. Speed matters more than completeness.

Falling for a well-built script is not stupidity; these are professional operations with call centres and shift patterns. The useful response is procedural, and the next hour matters more than the last one.

Where this site stands

JILIVIP is an independent guide, not a casino. It takes no deposits, holds no balances and runs no games, so nobody writing on our behalf will ever contact you about your account, ask for a code, or offer to release a payout. Some links here may be partner links. 21+, and if the money has stopped being entertainment, our responsible-gaming page is the right page to read next.