Quick answer

If you suspect fraud or estafa, act immediately: stop further payments, contact every bank, e-wallet, remittance company, crypto platform, or card issuer involved, ask that the transaction be treated as disputed, and request preservation or temporary holding of any traceable funds. Then secure the evidence and report the incident to the police, the National Bureau of Investigation (NBI), or—if electronic communications or accounts were used—the cybercrime unit of the NBI or Philippine National Police (PNP).

A criminal complaint may lead to prosecution and may include a claim for return of the money or damages. A separate civil case may also be appropriate. However, filing a report does not automatically freeze assets, establish estafa, or guarantee repayment. Recovery depends heavily on speed, traceability of the proceeds, available assets, admissible evidence, and the exact legal relationship between the parties.

When suspected fraud may be estafa

Article 315 of the Revised Penal Code covers several forms of swindling. Common examples include:

Obtaining money or property through a fictitious name, false qualifications, imaginary business, nonexistent transaction, or similar deception;
Making a material false representation before or at the time the victim parts with money or property;
Misappropriating or converting money or personal property received in trust, on commission, for administration, or under an obligation to deliver or return it;
Denying receipt of property entrusted to the offender;
Inducing someone through deceit to sign a document; and
In specified circumstances, issuing a postdated or unfunded check to obtain money, property, or credit.

For estafa by false pretenses, the prosecution generally must establish that:

The accused made a false representation or used a fraudulent act before or at the same time as the transaction;
The accused knew the representation was false;
The victim relied on it; and
That reliance caused financial or property damage.

For estafa through misappropriation or conversion, the evidence must show, among other matters, that the accused received identifiable money or personal property under an obligation to deliver or return it and later misappropriated, converted, or denied receiving it, causing prejudice.

The controlling statutory text is Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951.

A failed deal or unpaid debt is not automatically estafa

Nonpayment, delayed delivery, a failed investment, poor business performance, or breach of contract does not by itself prove a crime. The crucial question is often whether deceit already existed when the victim released the money or property, or whether entrusted property was later deliberately converted in violation of an obligation to return or deliver it.

A person’s later inability to perform an honest agreement may create civil liability without establishing criminal fraud. Conversely, fabricated identities, forged records, false claims of ownership or authority, diversion of entrusted funds, multiple victims, immediate disappearance, or proof that the promised transaction never existed may support an inference of fraudulent intent.

The label placed on the arrangement—“investment,” “loan,” “capital contribution,” “reservation fee,” or “commission”—is not conclusive. Prosecutors and courts examine the documents, representations, flow of funds, actual obligations, and conduct of the parties.

If the fraud happened online

Estafa committed through information and communications technology may also fall under Section 6 of the Cybercrime Prevention Act. That provision covers crimes under the Revised Penal Code committed by, through, or with the use of information and communications technology and generally prescribes a penalty one degree higher. The Act designates the NBI and PNP as cybercrime law-enforcement authorities. See Republic Act No. 10175.

Depending on the facts, an online scheme may also involve computer-related fraud, identity theft, unauthorized account access, forgery, illegal use or sale of financial accounts, or other offenses. The correct charge must be based on the acts proved, not simply on the fact that a transaction occurred online.

What to do immediately

1. Stop the loss and secure your accounts

Do not send an additional “release fee,” “tax,” “verification payment,” or “recovery charge.” Do not give the suspected offender another password, one-time PIN, authentication code, selfie, identity document, screen-sharing access, or remote-control access.

Change compromised passwords using a safe device. Sign out other sessions, enable multifactor authentication, block affected cards, and notify your mobile provider if a SIM swap may have occurred.

If threats, coercion, stalking, or an immediate risk of physical harm is involved, contact the police or emergency services at once.

2. Contact the financial institutions without delay

Notify both the institution from which the money came and, if known, the institution that received it. Use the institution’s verified fraud channel—not a number or link supplied by the suspected scammer.

Provide:

Transaction date, time, amount, and reference number;
Sending and receiving account names and numbers;
The reason you believe the transaction is fraudulent;
Copies of relevant communications; and
Your police, NBI, or PNP reference number once available.

Ask for a written case or ticket number and request that relevant account, transaction, access, and device records be preserved.

Under the Anti-Financial Account Scamming Act, covered financial institutions may temporarily hold funds involved in a disputed transaction, subject to Bangko Sentral ng Pilipinas rules. The statutory holding period may not exceed 30 calendar days unless extended by a competent court. The law also requires coordinated verification among the institutions and account owners involved. A complaint does not mean the funds will necessarily still be available or will automatically be returned. See Republic Act No. 12010.

3. Preserve evidence before accounts or messages disappear

Keep the original electronic records whenever possible. Preserve:

Complete chat, email, SMS, and social-media conversations;
Usernames, profile URLs, account IDs, phone numbers, and email addresses;
Advertisements, listings, websites, proposals, contracts, invoices, and receipts;
Bank statements, deposit slips, transfer confirmations, QR codes, wallet addresses, and transaction hashes;
Audio or video files lawfully obtained;
Identification documents and business records supplied by the other party;
Delivery records, returned checks, dishonor notices, and demand letters;
Names and contact details of witnesses or other victims; and
A chronological account of every representation, payment, follow-up, and discovery.

Take screenshots that show the full screen, date, time, URL, and account identity, but do not rely on screenshots alone. Export conversations, retain original files and devices, and make secure backups. Do not edit, annotate, crop, or recompress the only copy.

Do not hack the suspect’s account, impersonate another person, secretly take property, or publicly disclose sensitive personal data in an attempt to investigate the case.

4. Prepare a clear factual chronology

A useful complaint explains:

Who made each representation;
The exact words or substance of the representation;
When, where, and through what channel it was made;
Why it was false;
What persuaded you to release money or property;
Where the money or property went;
What obligation the recipient accepted;
How you discovered the deception or conversion; and
The exact amount of loss and how it is calculated.

Separate facts you personally know from information supplied by other people. Identify documents by date and attach them in a logical order. Avoid exaggeration, unsupported accusations, and guesses about identities or motives.

Where and how to report

You may initially report the incident to:

The police station with territorial connection to the incident;
The PNP Anti-Cybercrime Group for technology-enabled offenses;
The NBI, including its cybercrime investigators where appropriate; or
The city or provincial prosecutor’s office, depending on the offense and filing procedure.

Law-enforcement investigators may conduct case build-up and refer the records to the appropriate prosecutor. A criminal complaint is ordinarily supported by a sworn complaint-affidavit, witness affidavits, and documentary or electronic evidence. Prosecutorial preliminary investigations and inquests are currently governed by the Department of Justice’s 2024 NPS rules, which apply a prima facie-evidence standard with reasonable certainty of conviction. The prosecutor—not the complainant or investigating officer—determines which charge the evidence supports.

Venue is legally important. A criminal action is generally instituted where the offense was committed or where an essential ingredient occurred. Online transfers, communications from different locations, and offenders or accounts abroad can complicate venue and jurisdiction. State every relevant location and let investigators or counsel assess the proper office.

Obtain a receiving copy, docket or reference number, and the full name of the officer who accepted the report. Keep a record of every submission and follow-up.

Barangay conciliation may sometimes be required

Katarungang Pambarangay may be a precondition when the parties actually reside in the same city or municipality and the dispute falls within the lupon’s authority. Important exceptions include offenses punishable by imprisonment exceeding one year or a fine exceeding ₱5,000, cases involving parties who do not meet the residency rule, urgent actions coupled with provisional remedies, detained accused persons, and actions that may otherwise prescribe.

Because the penalty for estafa depends on its form, amount, date, and possible use of information technology, do not assume that barangay proceedings are either always required or always unnecessary. An incorrect filing route can cause delay. Sections 408 to 412 of the Local Government Code contain the controlling general rules.

Demand letters: useful, but not a universal cure

A written demand can document the obligation, request repayment or return of property, fix a reasonable deadline, and help prove conversion or receipt of notice in cases where those matters are legally relevant. Send it by a method that produces reliable proof of delivery.

Demand is not a substitute for evidence of the offense and is not invariably a prerequisite to filing an estafa complaint. It also does not transform an ordinary unpaid debt into estafa. Do not postpone urgent bank notifications, evidence preservation, or legal advice merely to wait for a demand period to expire.

For dishonored-check cases, the governing offense matters. Article 315(2)(d) and Batas Pambansa Blg. 22 have distinct elements and notice requirements. The Revised Penal Code provision refers to failure to fund the check within three days after receipt of notice of dishonor, while BP 22 provides its own five-banking-day rule. Proof that the drawer actually received a proper written notice is often critical. Seek case-specific advice before relying on a bounced check as proof of estafa.

Routes for recovering money or property

Civil liability in the criminal case

When a criminal action is instituted, the civil action to recover liability arising from the offense is generally deemed included unless the offended party waives it, reserves the right to sue separately, or filed the civil action first. Actual loss should be supported by receipts, statements, transfer records, contracts, and a clear computation.

Avoid an unintended waiver or duplicate claim. The rules prohibit double recovery for the same injury. The framework appears in Rules 110, 111, and 127 of the Rules of Criminal Procedure.

Separate civil action

A separate civil claim may be based on contract, restitution, unjust enrichment, fraud, or another source of obligation, depending on the facts. This route may be appropriate when the evidence establishes a debt or contractual breach but not criminal deceit beyond reasonable doubt.

The correct court and procedure depend on the nature and amount of the claim, the parties’ residences, contractual venue provisions, barangay-conciliation requirements, and whether related criminal proceedings have begun. Some qualifying money claims may use the small-claims process, but not every fraud dispute fits that procedure.

Attachment and other provisional remedies

In suitable cases, the offended party may ask the court to attach property as security for a possible judgment—for example, where the accused is about to leave the Philippines, resides abroad, has concealed or disposed of property, or the claim involves fraudulently converted property in circumstances covered by Rule 127.

Attachment requires a court application and compliance with procedural and bond requirements. A police report or complaint-affidavit alone does not create a lien or authorize the victim to seize assets.

Restitution through a financial institution

Republic Act No. 12010 provides possible institutional liability and restitution where a covered institution failed to employ adequate risk controls or the legally required degree of diligence in preventing losses from specified financial-account offenses. Conviction is not always a prerequisite under that law. This does not make every authorized transfer automatically refundable: the institution’s controls, the nature of the scam, the account holder’s actions, causation, and BSP rules remain material.

Penalties and amount thresholds

For many forms of Article 315 estafa, Republic Act No. 10951 uses these current amount bands:

Not more than ₱40,000;
More than ₱40,000 but not more than ₱1,200,000;
More than ₱1,200,000 but not more than ₱2,400,000;
More than ₱2,400,000 but not more than ₱4,400,000; and
More than ₱4,400,000, with the statutory escalation subject to its maximum.

Estafa involving postdated or unfunded checks under Article 315(2)(d) has a separate penalty schedule. Technology-enabled commission may increase the applicable penalty under the Cybercrime Prevention Act. The date of the offense, exact statutory mode, amount, and favorable-retroactivity rules can affect the penalty and prescriptive period. A legal professional should calculate these issues from the actual records.

Deadlines: do not wait

Criminal offenses and civil claims have prescriptive periods. The applicable period is not a single universal deadline: it depends on the offense charged, the penalty prescribed by law, whether a special law applies, when the offense was discovered, and what legally interrupted prescription.

Filing a report with a bank, online platform, or private company does not necessarily interrupt the legal prescriptive period. Barangay proceedings interrupt prescription only within the limits provided by the Local Government Code. Negotiations and informal promises of repayment may not protect the claim.

Prompt action also matters because electronic records may be deleted, surveillance recordings overwritten, funds transferred through multiple accounts, and assets disposed of long before a case reaches court.

Common mistakes to avoid

Sending more money in the hope of unlocking or recovering the first payment;
Deleting the conversation after blocking the suspect;
Submitting only selected screenshots without the complete exchange;
Treating every unpaid loan or failed investment as criminal estafa;
Naming account holders as perpetrators without evidence of their knowledge or participation;
Posting accusations, identity documents, or account details publicly;
Accepting a vague repayment promise without documenting its terms;
Signing a quitclaim, waiver, compromise, or affidavit of desistance without understanding its effect;
Filing in the wrong place or overlooking required barangay proceedings;
Assuming arrest, conviction, or a judgment automatically produces payment; and
Paying someone who claims to guarantee fund recovery, prosecution, or insider access.

When legal help is urgent

Consult a Philippine lawyer promptly when:

A substantial amount, business funds, land, securities, cryptocurrency, or multiple victims are involved;
Funds remain traceable and an urgent preservation, holding, attachment, or court order may be possible;
The suspect appears to be transferring or hiding assets or leaving the country;
The transaction crosses cities, provinces, or national borders;
You are unsure whether the arrangement was a loan, trust, agency, partnership, investment, or sale;
A bounced check is involved;
The prosecutor dismissed the complaint or issued a resolution with a short remedy period;
A settlement, quitclaim, affidavit of desistance, or repayment agreement has been offered;
The suspect has threatened you or is using your identity or accounts; or
You have received a subpoena, counterclaim, or accusation that your report was knowingly false.

Those who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility, merit, and conflict-of-interest rules.

Frequently asked questions

Can I file estafa if I voluntarily transferred the money?

Possibly. A voluntary transfer may still have been induced by prior or simultaneous deceit. The issue is why you transferred the money and what the recipient represented at that time. An authorized transfer is not automatically a legitimate transaction.

Is a bank or e-wallet receipt enough?

Usually not by itself. It proves a transfer but may not prove the fraudulent representation, the recipient’s identity or intent, your reliance, or the obligation to return the funds. Pair it with the complete communications, transaction documents, identification evidence, and chronology.

Must I know the suspect’s real name?

Not necessarily before making an initial report. Give investigators every available identifier, including usernames, telephone numbers, account numbers, wallet addresses, profile links, transaction references, and delivery details. Do not publicly accuse an unverified person.

Will an affidavit of desistance end the criminal case?

Not automatically. Estafa is prosecuted in the name of the People of the Philippines, and private pardon generally does not extinguish criminal liability. Repayment, compromise, waiver, or desistance may affect the civil claim or the practical handling of the case, but its legal effect depends on timing and circumstances.

Can I recover from a “money mule” account?

It may be possible to trace or hold remaining funds, but ownership of the receiving account alone does not conclusively prove criminal participation. Investigators must determine who controlled the account, who benefited, and whether the account holder knowingly participated or violated laws governing financial accounts.

What if the suspect promises installment payments?

Document the admission, amount, schedule, payment method, default terms, and treatment of any existing complaint. Do not surrender original evidence or sign a broad waiver without advice. A repayment promise may assist recovery, but it may also consume valuable time while assets disappear or claims approach prescription.

Can I report the same incident to several agencies?

You may notify the financial institutions, relevant regulator, platform, and appropriate law-enforcement agency, but disclose any existing complaints and docket numbers. Multiple undisclosed criminal filings over the same incident can create confusion and inconsistent records.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Philippine law and agency procedures may change, and the correct remedy depends on the documents and facts. Official sources were checked as of September 19, 2026.