LARO77 Phishing Site: Spotting a Copied Login Page
A phishing site is a page built by a fraudster to look like the real one so you type your password into it.
Key facts and contents
- LARO77 Anti Money Laundering Rules at a Casino Cashier
- Republic Act No. 10927 added casinos, including internet casinos, to the anti money laundering law as covered persons.
- LARO77 eGames and PAGCOR's Electronic Gaming Categories
- PAGCOR does not define eGames as one product.
- LARO77 GLI Explained
- GLI is Gaming Laboratories International, an independent testing laboratory.
- LARO77 Junket Explained
- A junket is a gaming-room arrangement: a registered promoter brings foreign-passport players to a licensed casino's junket tables under a written agreement, and the casino stays answerable to PAGCOR for it.
- LARO77 Know Your Customer Checks, Step by Step
- A know your customer check is the step where a regulated business establishes your true identity from an official ID.
- LARO77 NBI Cybercrime
- Save screenshots with the address bar, your wallet's reference numbers, dates, amounts and chat messages, report to GCash or Maya in the wallet's own help, then take the case to the NBI through nbi.gov.ph.
- LARO77 Proof of Address
- The saved GCash, Maya and Bangko Sentral texts list valid IDs, not a separate proof-of-address list.
A phishing site is a page a fraudster builds to look like the real thing, so your password lands in the wrong hands. For a casino it means a copied login box, a copied sign-up form, or a copied wallet page that asks for codes. This page shows how to tell the copy from the page you meant to open, and what to do in the next ten minutes if you typed into one. It is one of the trusted online casino checks on this site, and it is for players aged 21+.
What a phishing site is, in the regulators’ words
Three public bodies in the saved files define the terms. Their wording is short, so it is quoted.
| Body | What its saved text says |
|---|---|
| CISA | “Phishing occurs when criminals try to get us to open harmful links, emails or attachments that could request our personal information or infect our devices.” |
| Bangko Sentral ng Pilipinas, fraud primer | Phishing is a message that “looks like the ‘real thing’” and asks for a PIN, account number, log in IDs and passwords; it “may be done using methods other than email”. Spoofing is “A website that appears to be legitimate but it is actually created by a fraudster.” |
| National Privacy Commission, Bulletin No. 21 | “Smishing is a type of phishing attack that targets victims through mobile text messaging or SMS.” |
So a phishing site is the spoofed website at the end of a phishing message. The message is bait, and the page is the trap.
How a copied casino login page works
A copy needs only the look of a login box, so it can imitate any of the eGames categories PAGCOR names. The sequence is the same each time.
- Bait. A text, chat message, ad or social post says you won, your account is frozen, or you must “verify” now.
- A link. It points at an address that looks close to the real one, often shortened. The NPC bulletin warns that URL shortening services “may be used by threat actors to conceal their malicious links”.
- The copy. The page shows a logo and a login box that look right.
- Your entry. Whatever you type, a username, password, MPIN or code, goes to the fraudster.
- The use. The fraudster logs in as you before you notice.
CISA gives a worked case. A customer got a message that his payment had not gone through and followed a link to a site that looked like the vendor’s. He logged in on the fake, and the criminals took his password and card details and made purchases.
Check before you type a password
Run these six steps in order, every time you reach a login or sign-up page.
- Type the address yourself. Do not follow a link from a text or chat. For LARO77, laro77.com forwards to the brand’s own link page, which lists the lobby addresses in use (read on 11 October 2026). Go from that page, not from a message.
- Read the address bar, letter by letter. CISA lists “Incorrect email addresses or links” as a common sign, such as one swapped character. A close spelling is a different site.
- Read the tab title. On 11 October 2026 the lobby’s tab title began “Laro77 leading online casino in Philippines”.
- Look at the logo. The lobby’s logo reads LARO77 with a crown on the O and flag-coloured 7s.
- Read the top bar. On a computer it shows Mag-login and Magrehistro; on a phone it shows Login and Register. The computer menu reads HOME, SLOTS, FISH HUNTER, CARDS, LIVE CASINO, SPORTS, E-SPORTS and PROMOSYON, the lanes these pages cover.
- Count the sign-up fields. The Magrehistro form asks for three things: Username, Password and Kumpirmahin ang password. It has no field for a mobile number, e-mail, ID or wallet detail. A form that asks for more is not that form.
Red flags: signs of a phishing site
Each sign below is a reason to close the page. The wallets and agencies in the saved files name most of them.
| Red flag | Why it matters |
|---|---|
| The address differs by one letter, or ends in an odd domain | CISA lists incorrect addresses and links as a common sign of phishing |
| You arrived from an SMS, chat or e-mail link | GCash’s page says it “will NEVER send you links via SMS/email”, and Maya says scammers can spoof sender names |
| The page asks for an MPIN, OTP or card number | GCash and Maya both state they never ask for these |
| It rushes you: “act now or lose your balance” | GCash lists “Pressure to Act Fast” among the signs of a scam; CISA lists urgent, emotionally appealing language |
| The link is shortened | The NPC says shortened links can hide where a link goes |
| A page claims to issue gaming licences or accreditations | PAGCOR’s advisory dated 25 February 2025 recalls its chairman’s warning about a website that purports to issue them “using fake forms and bogus content” |
| A social page offers “customer support” | GCash lists fake GCash pages on social media pretending to give support |
| A stranger asks to buy or rent your account | GCash warns they “may use your name in illegal activities” |
| You are promised a prize or high returns first | GCash lists unexpected offers and high-yield investment offers as scam signs |
Vishing and smishing: the same trick by call and text
A copy does not need a website to start. A call or a text can carry the same trap, and the Bangko Sentral’s training module names both.
| Term | Channel | What the saved text says |
|---|---|---|
| Vishing | Voice call | BSP Module 5: “Vishing – leverages Internet Protocol (IP) based voice calling”. The slide lists the pattern: the caller claims to represent a financial institution, creates a sense of urgency and asks for personal information |
| Smishing | SMS | BSP Module 5: “SMiShing – uses SMS on mobile phones”. NPC Bulletin No. 21 adds that the links can “redirect to legitimate looking but fraudulent sites” |
The wallets’ answer to vishing is plain. GCash states that it “will never ask for your MPIN, or OTP over the phone.” Hang up, then reach the wallet through its own in-app help. The BSP module gives the same advice for banks: verify by calling the hotline yourself.
If you typed your password into a copy
Speed matters more than perfection. Work down this list.
- Leave the page and type nothing more.
- Open the real page by typing its address, then use the Nakalimutan ang password link on the Mag-login form to reset. If that does not open the way you need, use the Customer Service button.
- Change the same password everywhere you reused it.
- Change your wallet MPIN or password if you typed it. In the GCash app: Profile, Settings, Change MPIN. On Maya, reset through the link in the error message, or open the Help Center icon and tap Chat with us.
- Tell the wallet through its own help: in GCash, Transactions, the payment, Get Help, Report as scam; with Maya, the Fraud Complaint Form or the hotline (+632) 8845 7788.
- Report it. The steps are on the page about reporting to NBI cybercrime investigators.
You typed a password into a copy and the real page still opens.
Reset the password now from the real page, as in step 2. Then check the account’s recent activity inside the logged-in page and tell the wallet if any payment looks wrong.
You also typed a wallet MPIN or a one-time code.
Change the MPIN at once through the wallet’s own settings. GCash’s page says a Change MPIN option sits under Profile and Settings; its page also tips changing it every 3 months and avoiding easy ones like 1234 or 1111. Then tell the wallet, because a code you typed into a copy is already in the wrong hands.
A caller says they are from your wallet and asks you to read out a code.
End the call. GCash says it never asks for an MPIN or OTP over the phone, and Maya says no one from Maya will ask for your password or OTP. Open the wallet’s app and use its help yourself.
A copy of a cashier page also borrows the language of the anti-money-laundering rules for casinos to justify asking for an ID photo. Real checks run on the screens inside your logged-in account.
FAQ
What is a phishing site?
CISA says phishing occurs when criminals try to get you to open harmful links, emails or attachments that could request your personal information. A phishing site is the page at the end of that link, built to look like a page you trust.
What is vishing?
The Bangko Sentral's training module describes vishing as phishing that leverages Internet Protocol based voice calling: a caller claims to represent a financial institution, creates urgency and asks for personal information.
Will a wallet ever ask for my MPIN or OTP?
GCash's page says GCash will never ask for your MPIN or OTP over the phone and will never send you links by SMS or e-mail. Maya's page says Maya will never ask for your password, card number or OTP.
Ano ang gagawin ko kung na-type ko na ang password ko sa pekeng page?
Umalis agad sa page, palitan ang password mula sa totoong page na tina-type mo mismo ang address, palitan ang MPIN ng wallet mo, sabihan ang GCash o Maya sa in-app help, at mag-report.