‘Talagang nahuli ka ba?’ Fake NCAP text mimics MMDA violation notice

A text message claiming that a motorist had committed a traffic violation is raising concerns over a phishing scheme that mimics the Metropolitan Manila Development Authority’s (MMDA) No Contact Apprehension Policy system.

Jojo Ayson shared receiving an SMS informing him of an supposed NCAP violation, which initially caused alarm before he checked his vehicles through the MMDA’s official “May Huli Ka” platform.

“I just received an SMS for an NCAP violation. Panicked for two seconds then checked the official MMDA NCAP ‘May huli ka’ website. None of my cars have an infraction,” Ayson said.

The suspicious message instructed the recipient to visit a website and reply with the letter “Y.”

Ayson said several details immediately raised red flags, including the website address used in the message, the originating number, and the absence of information identifying the supposedly offending vehicle.

“The first being the URL. If you are familiar with the official MMDA NCAP Website, the ‘hens.cld’ portion of the website address seemed off,” he said.

The message also came from a number carrying the +212 international dialing code, which is assigned to Morocco. Philippine mobile numbers use the +63 country code.

Ayson also noticed that the SMS did not provide a plate number or other details that could identify which of his vehicles supposedly committed the violation.

He compared the message with his own previous experience of receiving a legitimate MMDA traffic infraction.

“Full disclosure, I did receive an MMDA Infraction once, for coding violation. So I am somewhat familiar with hyow it actually goes. They sent me a physical letter with details of my vehicle, with printouts of camera footage of vehicle,” Ayson said.

Fake site mimics MMDA portal

Ayson said he went further and examined the website contained in the suspicious message through a secure browser.

“It was a somewhat convincing copy of the May Huli Ka Website,” he said.

The MMDA currently operates an official vehicle portal where motorists can register vehicles, check traffic violations, view ticket updates and monitor case status. The agency’s portal also allows users to view violation notices and related evidence.

The imitation of an official government service is a common phishing technique designed to make potential victims more likely to trust a fraudulent link and disclose information.

Ayson also flagged the instruction asking him to reply “Y,” saying responding could potentially tell scammers that the mobile number is active.

“Lastly, the instruction to reply ‘Y’ seemed off. Doing so would probably inform the scammers that the mobile number is a valid and working number and not some dead number,” he said.

Check before you click

Ayson advised motorists not to immediately react to alarming messages and instead verify claims independently through official channels.

“The best defense is not to panic and double check vs. official websites and sources, Google is a good reference tool. Just don”t click anything in the original message,” he said.

He added that the same principle applies to suspicious messages arriving through email and social media.

“It really helps when anytime you receive a suspicious message, don’t panic, take a step back, and assess if the message is authentic,” Ayson said.