Under Republic Act No. 11934, otherwise known as the SIM Card Registration Act, all mobile subscribers in the Philippines are legally mandated to register their SIM cards with their respective Public Telecommunications Entities (PTEs)—namely Globe, Smart, and DITO.

While the law aims to curb text scams and criminal activities, cybercriminals have aggressively exploited the mandate. Through a social engineering tactic known as phishing (and specifically smishing when conducted via SMS), fraudsters deploy fake registration links to harvest personal identifiable information (PII). Doing so violates multiple Philippine laws:

R.A. 11934 (SIM Card Registration Act): Section 11 imposes severe penalties for providing false information or using fictitious identities during registration, as well as spoofing registered SIM cards.
R.A. 10175 (Cybercrime Prevention Act of 2012): Phishing constitutes illegal access (Section 4(a)(1)) and computer-related identity theft (Section 4(b)(3)), carrying penalties of imprisonment up to 12 years.
R.A. 10173 (Data Privacy Act of 2012): Unauthorized processing of personal and sensitive personal information is punishable by hefty fines and mandatory imprisonment.

Anatomy of a Fake SIM Registration Link

Phishing scams rely on urgency, fear, or compliance pressure. Submissions usually look like official advisories warning that your SIM will be "permanently deactivated within 24 hours" unless you click a provided URL.

To distinguish a legitimate portal from a fraudulent one, subscribers must scrutinize the Domain Name System (DNS) structure. Legitimate PTE registration portals are strictly hosted on secure corporate domains.

Provider	Official and Secure Registration URL
Globe Telecom	`[https://new.globe.com.ph/simreg](https://new.globe.com.ph/simreg)`
Smart Communications	`[https://simreg.smart.com.ph](https://simreg.smart.com.ph)`
DITO Telecommunity	`[https://simreg.dito.ph](https://simreg.dito.ph)`

Indicators of Malicious Links

Subdomain Spoofing: Attackers create URLs like [https://globe.simregistration-verification.com](https://globe.simregistration-verification.com) or [https://smart-sim-activation.net](https://smart-sim-activation.net). The actual domain is the text immediately preceding the last slash (excluding paths)—meaning these belong to independent fraud sites, not the telecom companies.
Lack of Cryptographic Protocols: Authentic portals use Hypertext Transfer Protocol Secure (HTTPS). While many modern phishing sites now obtain free SSL certificates, a site operating on a plain, unencrypted HTTP connection is an automatic red flag.
Use of URL Shorteners: Official communications rarely, if ever, use hidden URLs like bit.ly, tinyurl.com, or cutt.ly for statutory compliance procedures.

Legal Steps to Verify and Assess Suspicious Links

If you encounter a suspicious SMS or email, employ the following verification protocol before interacting with the interface:

Zero-Trust URL Examination: Do not click the link. Manually copy the text or inspect the hyperlink. Look for spelling variations, character substitutions (e.g., using a zero 0 instead of the letter O), or unusual top-level domains (such as .cc, .ru, or .xyz).
Cross-Check via Official Applications: Instead of utilizing links provided in text messages, access SIM registration tools internally through the providers' official, verified mobile applications (e.g., the GlobeOne App or Smart GigaLife App).
Use Domain Verification Tools: Utilize free domain reputation aggregators or lookups (like Whois) to verify the registration date of the URL. A domain registered just days or weeks prior is overwhelmingly indicative of a malicious setup.

Reporting Mechanisms and Legal Remedies

Reporting phishing links is a civic and legal safeguard that helps law enforcement track cybercriminal infrastructure. In the Philippines, distinct channels handle these reports.

1. Public Telecommunications Entities (PTEs)

Subscribers should report the fraudulent number and the exact text of the phishing link directly to their service provider to initiate internal network blocking.

Globe: Report via the official Globe website's "Stop Spam" portal.
Smart: Email cybersecurity@smart.com.ph or report through their official social media help desks.
DITO: Contact customer support via the DITO App or hotline.

2. Government Enforcement Agencies

For formal legal escalations, investigation, and cyber-forensic tracking, instances of smishing should be logged with state authorities:

National Telecommunications Commission (NTC): The primary regulatory body overseeing R.A. 11934. Reports can be submitted via their dedicated task force emails or through ntc.gov.ph.
Cybercrime Investigation and Coordinating Center (CICC): An attached agency of the DICT. Victims can call the Inter-Agency Response Center (IARC) Hotline by dialing 1326 to report active scams.
National Privacy Commission (NPC): If the phishing link successfully harvested your data, a formal complaint for a Data Privacy Violation should be filed via the NPC's complaints portal (privacy.gov.ph) to hold unauthorized data processors liable.
PNP Cybercrime Group (PNP-ACG) / NBI Cybercrime Division: If the phishing scam resulted in direct financial loss or identity theft, victims should personally secure a forensic copy of the message (screenshots showing the sender's details, timestamps, and full URLs) and file an official criminal complaint for prosecution under the Cybercrime Prevention Act.