WALK PAST any BPO office or bank in Davao or Cagayan de Oro, and you will see one of Mindanao’s biggest success stories. Thousands of young Mindanaoans now serve customers not just locally but also around the world, handling bank accounts, payments, and personal information every day.
But the same trust that makes our BPO and finance industry workers valuable has also made them a target. Today’s scammers are not the clumsy fraudsters of the past. They are now armed with artificial intelligence.
The numbers should get every business owner’s attention. In just the first half of 2026, the Philippines recorded 16,619 phishing attacks, and more than 19.2 million local account passwords and logins were stolen. Reported scam calls reached 477,302 cases in those six months alone, compared with about 125,000 for the whole of 2025.
What has changed is how real these scams now look and sound. With only about three seconds of someone’s voice, taken from a phone call or a social media video, AI can copy that voice with roughly 85% accuracy. Fake videos of real people, known as deepfakes, have become the most common type of AI-driven attack.
Imagine an agent receiving a call from someone who sounds exactly like a client, a team leader, or a bank officer, asking for an urgent account change or fund transfer. The scammer is not trying to break into your computers. He is trying to convince your people.
This is why human error remains the biggest weakness in any business. Around 62% of data breaches worldwide involve a person making a mistake, like clicking a fake link or trusting a fake caller.
For BPOs and financial institutions, the risk is even bigger. Our companies serve both local and foreign clients, and nearly half of breaches today come through outside service providers. One successful scam on a Mindanao business floor can damage a client relationship built over many years, and in this industry, lost trust often means lost contracts and credibility.
So how should Mindanao businesses respond? It helps to look at three areas: technology, process, and people.
On technology, the rule is simple: trust no one by default and check everyone every time. Make sure staff log in with more than just a password, limit access to only what each person needs for their job, and use tools that stop sensitive client data from leaving the company.
Business owners should also watch out for employees using free, personal AI apps for work and pasting customer information into them. Instead of banning AI outright, provide approved and secure AI tools so people do not look for risky shortcuts. For smaller rural banks without their own security team, which is common given the country’s shortage of cybersecurity experts, outsourcing monitoring to a trusted managed security provider is often faster and more affordable than hiring.
on process, build safety checks into daily work so that no single person or phone call can move money or change records. Any request to change bank details should be confirmed by calling back on a number already on file, never the number given by the caller. Larger transactions should require two approvals.
Most importantly, make it company policy that no instruction is ever accepted based on a voice or video call alone. These steps cost very little. Testing should also happen regularly throughout the year, not just once during the annual audit.
With people, upskilling is the best investment any Mindanao employer can make. Training must be practical, relatable, and frequent, not a once-a-year lecture that staff sit through and quickly forget. Use real stories, short videos, and simple reminders. Run regular practice tests using fake phishing emails or calls so agents learn to spot scams in a safe setting. Teach them the tricks scammers rely on: creating a sense of urgency, offering something too good to miss, or pretending to be someone in authority. When people understand how they are being manipulated, they are far less likely to fall for it.
Upskilling also gives our workers a future. As AI takes over routine and scripted tasks, agents who can detect fraud, verify identities, and use AI safely become more valuable to clients.
Business owners can partner with local schools for training and internships and reward employees who report suspicious activity. Leaders must also set the example. If bosses ask for exceptions to security rules, their staff will do the same.
Mindanao is no stranger to disruption. Typhoons, earthquakes, and periods of unrest have taught our businesses to adapt and recover. Today, with ongoing geopolitical conflicts around the world, disruptions and cyber-attacks are no longer rare events. They are a regular part of doing business, and every organization should expect them to happen.
Cybersecurity, business continuity plans, and IT disaster recovery plans are no longer nice-to-haves. They are now essential to whether a business survives. An untested plan cannot be trusted. Mindanao businesses that prepare their systems, tighten their processes, and, above all, empower their people today will be the ones still standing tomorrow.
Leonard Duque is the Chief Information Officer and the director for the Technology Solutions Group at P&A Grant Thornton. One of the leading audit, tax, advisory, and outsourcing firms in the Philippines, P&A Grant Thornton is composed of 29 Partners and 1,500 staff members. We’d like to hear from you! Connect with us on LinkedIn and like us on Facebook: P&A Grant Thornton and email your comments to business.development@ph.gt.com. For more information, visit our website: www.grantthornton.com.ph.
