KMS: Phishing Emails Impersonating LANDBANK of the Philippines

Owner: OSDS – ICT Services Unit, SDO Bislig City
Version: 1.0 (Updated: 02 Feb 2026)
Audience: All DepEd personnel (teaching and non‑teaching) with LANDBANK payroll or e‑services accounts

1) Purpose

Provide a standard, division‑wide reference to detect, report, and contain phishing emails pretending to be from LANDBANK, and to protect personnel payroll accounts and DepEd ICT assets. (DepEd and LANDBANK have both issued public warnings on LandBank‑themed phishing campaigns.) [pia.gov.ph], [landbank.com]

2) Scope

Covers email and SMS (“smishing”) scams claiming to be from LANDBANK (e.g., iAccess/Mobile Banking App/Link.BizPortal notices, “account blocked,” “password reset,” “claim reward”). Includes cases where messages appear to come from compromised @deped.gov.ph accounts. [depedsorsogon.com.ph]

3) Key Facts You Need to Know

• LANDBANK does not send emails or SMS with clickable links. Any “LandBank” message containing a hyperlink is fake. [landbank.com], [rmn.ph], [gmanetwork.com]

• Official LANDBANK reporting mailbox for suspicious messages: reportphishing@landbank.com; customer care: (02) 8‑405‑7000 / 1‑800‑10‑405‑7000. [landbank.com], [lbpiaccess.com]

• Official sites to type manually in the browser (never click from email): www.landbank.com and www.lbpiaccess.com. [pasigcity.gov.ph], [lbpiaccess.com]

4) Red Flags (Indicators of Phishing)

1. Email/SMS urges urgent action (“Your account will be blocked”, “Verify now”, “Claim ₱10,000”). [depedsorsogon.com.ph]

2. Clickable links or buttons in the message; shortened or misspelled URLs (e.g., landbαnk, lbp‑iaccess). LANDBANK never sends clickable links. [landbank.com]

3. Sender looks off (free mailbox, spoofed domain, or compromised @deped.gov.ph account). [depedsorsogon.com.ph]

4. Requests for credentials/OTP or sensitive data. Legitimate bank reps won’t ask for these. [landbank.com]

5. Fake sites imitating iAccess or Link.BizPortal reached via ads or links. Use only official URLs. [pasigcity.gov.ph], [lbp-eservices.com]

5) Immediate Actions (First 10 Minutes)

If you receive a suspicious LandBank email/SMS:

A. Do not click links or open attachments; do not reply.
B. Capture evidence: screenshot the email header/URL, save the .eml if possible. (Good practice for investigations and NPC compliance.)
C. Report to: [landbank.com] [privacy.gov.ph]

1. LANDBANK – forward to reportphishing@landbank.com. [landbank.com]

2. Division ICT – forward the email to OSDS‑ICT Services Unit (ticketing or shared mailbox), for blocklisting and advisories. (Local policy alignment.)

3. National (when widespread/with data exposure): CERT‑PH/NCERT or law‑enforcement cyber units for incident handling.
   D. Delete the message from Inbox and Trash after reporting. [ncert.gov.ph], [cybersecurity.ph] [landbank.com]

If you already clicked or entered details:
E. Call LANDBANK immediately to freeze or flag the account; then change passwords from a clean device.
F. Notify OSDS‑ICT to initiate incident response (password resets, device scans, mail rules check, sender block). (NPC requires timely breach handling for potential data exposure.) [landbank.com] [privacy.gov.ph]

6) Division Workflow (Swimlane Summary)

Employee → OSDS‑ICT → Records/Comms → Finance/HR → External (LANDBANK / CERT‑PH / PNP‑ACG / NPC)

1. Employee detects & reports: forwards to OSDS‑ICT and LANDBANK; deletes message. [landbank.com]

2. OSDS‑ICT triage:

   • Validate indicators; block sender/URL/attachment in M365; purge similar messages if tenant‑wide.

   • Check if the user’s @deped.gov.ph mailbox shows suspicious Inbox rules, MFA prompts, or sign‑ins. [depedsorsogon.com.ph]

   • If credentials may be exposed, force password reset and MFA review; preserve logs/evidence for 90 days+. [privacy.gov.ph]

3. Records/Comms: issue division advisory (what happened, what to do) using standard template; avoid sharing PII. (Supports privacy‑by‑design.) [privacy.gov.ph]

4. Finance/HR: alert payroll focal to monitor for unusual transactions; coordinate with LANDBANK for dispute/escalation if needed. [landbank.com]

5. External escalation (as needed):

   • LANDBANK (reportphishing@landbank.com / hotlines) for account‑level action;

   • CERT‑PH/NCERT (DICT) for coordinated incident response;

   • PNP‑ACG/NBI‑CCD for criminal complaints;

   • NPC if personal data of staff was exposed (privacy breach workflow). [landbank.com], [ncert.gov.ph], [cybersecurity.ph], [privacy.gov.ph], [privacy.gov.ph]