They probably used application to person messaging services which allows you to edit the sender ID to whatever you want. Since the phishing text also has the same "GCash" sender ID, it will be nestled along legitimate messages from actual GCash which can be a bit tricky for unsuspecting users. Same thing happened with singapore postal service years ago, see: https://mothership.sg/2019/03/scammers-phishing-links-singpost/
But good job on making it a habit to check your balance on your app! Some tips from hodlhodl apply in general so I recommend this reading as well, see: https://medium.com/hodl-hodl/trading-security-guide-2f35c20e58f4