Scanify
Menu
URL scannerFile scannerIP checkerPricingCompareAbout
Open scanner →
Security Guide

MMDA NCAP text scam: check the link before paying

By Karim Al Anani · First published 10 November 2026 · Updated 10 November 2026 · 5 min read
Scanify link, file and QR safety checker
Scanify link, file and QR safety checker.

If an MMDA NCAP text tells you to pay today at mmdancap-ncr[.]bond/3ou3jl, stop before entering anything. The address is different from MMDA's official checking site. This article separates what Scanify observed from what the agency's guidance says, so you can check the alleged violation independently.

The short answer

Do not pay through this text link. The Philippine Information Agency's account of MMDA guidance says genuine NCAP notifications contain no payment links and directs motorists to mayhulika.mmda.gov.ph. Scanify's quick check of the fake address returned MEDIUM RISK, 28/100. That score is a limited technical assessment, not permission to trust the page.

What MMDA says about NCAP text messages

NCAP means No Contact Apprehension Policy. MMDA does send notifications, so dismissing every NCAP text would be the wrong lesson. Its guidance reported by PIA identifies MMDA_NCAP as the official sender. Genuine alerts do not offer payment links or replies, or include the registered owner's name.

The same advisory describes a fake alert demanding settlement within 24 hours through a payment link. Its practical advice is to type the official checking address yourself. Treat an unexpected demand as something to verify, not a reason to pay through the message.

Compare the addresses
mmdancap-ncr[.]bond/3ou3jl
mayhulika.mmda.gov.ph
The first address is the fake link under discussion. The second is the checking address named in the official guidance. The fake address is deliberately written so it is not clickable.

What Scanify found on 9 and 10 November

Scanify's checks recorded registration on 5 November 2026 through NameMart Pte. Ltd. The domain was only days old during reports on 7 to 9 November. It also had a valid certificate that was only days old. A certificate or padlock does not establish that a page belongs to MMDA.

The link redirected twice within the same domain before loading. Its .bond ending appears on published lists of heavily abused domain endings. These are warning signs to weigh together. Neither a domain ending nor a redirect alone identifies who is operating a website. The recorded quick-check result was MEDIUM RISK, 28/100.

A 404 page does not settle the question

When Scanify's sandbox opened this address, the server returned a 404. That tells us what the sandbox received, not what every visitor would see. Scam pages can reserve their content for phones using mobile networks.

We did not establish that this particular server used that filtering technique. The 404 neither proves the page is harmless nor confirms what information a working version might request. Do not visit it on your phone to investigate. Verify the traffic record through the official channel instead.

How to check a link like this yourself

  1. Copy the address without opening the destination. Keep the message for reference.
  2. Use Scanify's fake website checker to examine domain age, certificate, redirects and look-alike names.
  3. Compare the complete address with the official advisory. The words MMDA and NCAP inside a different domain do not make it official.
  4. Type mayhulika.mmda.gov.ph independently to check the claimed violation. Do not enter vehicle or payment details into the fake page.

For an email version, use the scam email checker. If you receive a QR code instead, use the QR code checker before following its destination. A different format does not remove the need to compare addresses.

If you already opened the link

Close it and stop entering information. If you shared card details or made a payment, contact your bank using its official app or the number on your card. Explain exactly what you supplied and ask what action to take. Do not use contact details supplied by the suspicious page.

MMDA's published reporting advice is to use Hotline 136 or its official social accounts for suspicious messages. A link check cannot tell you whether details already submitted were retained. Keep that separate from checking whether a real violation exists.

Check the link with Scanify

The free link check needs no account. For multiple antivirus engines and a page screenshot, use the full scan. A free account gets one free scan in total. The detailed verdict is on Pro: $1 for the first month, then $20/month, or $5 for a 7-day pass.

See the live check

This opens Scanify, not the checked website. A quick check cannot prove a site is safe.

Frequently Asked Questions

Is an MMDA NCAP text message legit?
MMDA does send NCAP notifications. Its official guidance identifies MMDA_NCAP as the sender and says genuine alerts have no payment links. Verify a claimed violation independently at mayhulika.mmda.gov.ph.
Is mmdancap-ncr[.]bond legit?
Treat this specific domain as a fake payment destination. It is different from mayhulika.mmda.gov.ph. Scanify recorded a recently registered domain and a MEDIUM RISK result of 28/100 in its November checks.
What is the official MMDA NCAP website?
The official checking address named in MMDA guidance is mayhulika.mmda.gov.ph. Type it yourself or follow the Philippine Information Agency advisory linked in this article.
Does a padlock mean an MMDA payment link is safe?
No. This fake domain had a valid certificate. A padlock does not establish that MMDA operates the website, and a quick check cannot prove safety.