Quick answer

If you suspect a scam in the Philippines, stop communicating and sending money, secure any affected accounts, preserve the evidence, and report the transaction immediately to the bank, e-wallet, remittance company, or payment provider involved. Ask its 24/7 fraud channel to treat the transfer as a disputed transaction, trace the funds, contact receiving institutions, and place any recoverable balance on temporary hold under the Anti-Financial Account Scamming Act.

Then report the incident to the Philippine National Police Anti-Cybercrime Group, the National Bureau of Investigation, or the Cybercrime Investigation and Coordinating Center. Reporting quickly improves the chance that funds still in the financial system can be held, but it does not guarantee reimbursement. Recovery depends on whether money remains traceable, how the transaction was authorized, the provider’s security and response, and the evidence establishing fraud and loss.

If there is an immediate threat to life or safety, contact 911 or the nearest police station.

What to do immediately

1. Stop further loss

Do not send a “release fee,” “tax,” “verification payment,” or additional investment to recover earlier payments. Do not follow instructions from anyone claiming that another transfer is necessary to reverse the transaction.

If the scammer had access to your phone, computer, email, SIM, identity documents, or financial account:

Use a different, trusted device to change your email and financial-account passwords.
Sign out other sessions and enable multi-factor authentication.
Lock affected cards and notify the card issuer.
Ask your telecommunications provider about securing or replacing a compromised SIM.
Remove unfamiliar devices, beneficiaries, forwarding rules, and recovery details.
Have a qualified technician check a device on which you installed remote-access software.
Warn trusted contacts if the scammer may impersonate you.

Do not delete the scam conversation or reset the affected device until important evidence has been copied. If law enforcement may need to examine the device, ask before making major changes.

2. Contact the originating financial institution now

Call the verified fraud number shown in the provider’s app, website, card, or account statement—not a number supplied by the suspected scammer.

Give the institution:

Your name and contact details;
The account affected;
Transaction amount, date, time, reference number, and channel;
Recipient name, account number, mobile number, or wallet identifier;
A short explanation of how the transfer occurred;
Whether credentials, an OTP, a PIN, or remote access were compromised; and
Any police, NBI, or CICC reference number already available.

Explicitly request:

Immediate restriction of unauthorized access to your account;
A fraud case or complaint reference number;
Tracing of the disputed transaction through every receiving institution;
Temporary holding of funds that remain in beneficiary accounts;
Preservation of relevant logs, authentication records, communications, and CCTV, where applicable;
Written confirmation of the report and the provider’s findings; and
Transaction identifiers and information about receiving institutions that may be disclosed under applicable rules.

Republic Act No. 12010 and BSP Circular No. 1215 authorize BSP-supervised institutions to hold disputed funds while conducting coordinated verification. Under the present rules, the initial holding may last up to five calendar days and may be extended by up to 25 additional calendar days, for a total of no more than 30 calendar days unless a competent court orders a further extension. A complaint does not automatically mean that funds will be found or held; the institution must apply the law and its verified procedures to the particular transaction.

The rules also require institutions to maintain a 24/7 fraud-reporting channel. They contemplate tracing across originating, receiving, and subsequent receiving institutions. If no money remains in the account or the transaction is outside the rule’s coverage, a hold may not produce a recovery.

3. Cooperate promptly with verification

Provide requested documents within the deadline given by the institution. Explain accurately whether you initiated the transfer, disclosed an OTP, installed software, or approved a prompt. A transfer induced by deception should not be described as a technical account takeover if that is not what occurred.

Under the Financial Products and Services Consumer Protection Act, a provider must offer a free internal consumer-assistance mechanism. For a disputed amount or alleged unauthorized transaction, the provider must suspend related interest, fees, and charges—or give a comparable reasonable accommodation—while its final investigation is pending.

Keep copies of everything submitted and record:

The date and exact time of each report;
The channel and telephone number used;
The representative’s name or identifier;
Every case or reference number;
Documents requested and submitted; and
The provider’s response and promised completion date.

Where to report the scam

A financial complaint and a criminal report serve different purposes. The provider tries to secure accounts, trace payments, and resolve the transaction. Law enforcement investigates the people and accounts involved. File both when money, credentials, or identity information has been taken.

PNP Anti-Cybercrime Group

Use the PNP Anti-Cybercrime Group e-Complaint channel or approach the nearest police station or anti-cybercrime unit. An initial online report may be followed by a request to appear, execute a sworn complaint, or present the original device and supporting records.

National Bureau of Investigation

The NBI accepts reports through its online complaint page and provides investigative assistance through its Cybercrime Division and regional cybercrime centers. The NBI’s published procedure includes the execution of sworn statements and, when relevant, examination of the device involved. See the NBI service guide for computer-crime victims.

Cybercrime Investigation and Coordinating Center

Cyber-enabled scams may also be reported through the CICC reporting channel or the government’s anti-scam hotline, 1326. Availability can be affected by maintenance, so use the PNP or NBI if the channel cannot be reached.

The relevant financial regulator

First complain directly to the provider. If its response is unsatisfactory, escalate to the regulator with jurisdiction:

Banks, e-wallet issuers, payment providers, and other BSP-supervised institutions: File through the BSP Online Buddy on the BSP website or follow the BSP Consumer Assistance Mechanism instructions. If BOB is unavailable, the BSP’s current guidance permits submission of its CIR form and proof of the earlier provider complaint to consumeraffairs@bsp.gov.ph.
Investment solicitations, securities, financing companies, lending companies, and regulated online lending platforms: Use the SEC I-Message Mo portal. Registration of a company does not by itself authorize it to solicit investments; verify both the entity and its authority through Check with SEC.
Insurance-related products: Complain first to the insurer, then to the Insurance Commission.
Financial services offered by cooperatives: Jurisdiction may belong to the Cooperative Development Authority, except for cooperative banks and other BSP-supervised institutions.

A regulator’s complaint process is not a substitute for a criminal report and may not identify or prosecute the scammer.

Evidence to preserve

Save complete, unedited copies whenever possible:

Chat, SMS, email, and social-media conversations;
The sender’s profile URL, username, mobile number, email address, and account ID;
Advertisements, websites, job listings, investment presentations, invoices, and contracts;
Screenshots showing the full screen, date, time, and URL;
Bank or e-wallet receipts, statements, reference numbers, QR codes, and recipient details;
Call logs, voicemail, audio recordings lawfully in your possession, and meeting details;
Delivery records, identification documents presented by the other party, and business permits or certificates;
The scammer’s instructions and representations;
Reports made to platforms and financial institutions;
Complaint acknowledgments and written investigation results; and
A chronological account written while events are still fresh.

Keep the original files and devices. Do not crop the only copy of a screenshot or alter message exports. Back up evidence in at least one secure location. Never publicly post your OTP, PIN, full card number, passwords, recovery codes, or unredacted identification documents.

The Cybercrime Prevention Act requires service providers to preserve specified subscriber and traffic data for at least six months from the transaction and provides mechanisms for law-enforcement preservation and court-authorized disclosure. That rule is not a reason to wait: content, accounts, CCTV, and private records can disappear sooner, and formal preservation generally requires action by the proper authorities.

What laws may apply

The charge depends on what the evidence proves. A misleading statement, failed investment, unpaid debt, or broken promise is not automatically criminal fraud.

Possible laws include:

Estafa under Article 315 of the Revised Penal Code, where the required deceit or abuse of confidence, reliance, and resulting damage are established;
Republic Act No. 10175, the Cybercrime Prevention Act, where an offense under the Revised Penal Code or another special law is committed through information and communications technology;
Republic Act No. 12010, the Anti-Financial Account Scamming Act, covering specified money-mule activities, social-engineering schemes, related attempts and assistance, and the buying or selling of financial accounts;
Republic Act No. 8484, the Access Devices Regulation Act, for conduct involving prohibited access-device practices;
Republic Act No. 11765, including investment fraud and violations by regulated financial service providers; and
Other securities, consumer, identity, data-protection, falsification, or anti-money-laundering provisions, depending on the facts.

AFASA does not make every recipient of suspicious funds automatically guilty. Its money-mule provisions require the statutory purpose and knowledge concerning criminal or social-engineering proceeds. Likewise, an adverse bank decision does not by itself prove that the customer, provider, or recipient committed a crime.

Routes to recovering money

Temporary holding and return through the financial system

This is usually the most time-sensitive route. If traceable funds remain in an account, the institutions can temporarily hold them and conduct coordinated verification. Circular No. 1215 provides procedures for releasing verified disputed funds, but the outcome depends on the evidence and the circumstances of the transfer.

Under the circular, a BSP-supervised institution that fails to hold disputed funds when the law and rules require it may be liable for resulting loss or damage, including restitution. This does not create automatic reimbursement for every scam. Whether the duty was triggered, whether funds were available, and whether the institution complied are factual questions.

Consumer redress against a financial provider

Challenge an unfavorable decision in writing. Ask for:

The factual and contractual basis of the decision;
The authentication methods and alerts relied upon;
The provider’s response timeline;
The status of fund tracing and coordinated verification; and
The process for reconsideration or escalation.

If unresolved, use the proper regulator’s consumer-assistance process. BSP procedures may include consumer assistance, mediation, or adjudication, depending on eligibility and the relief sought.

Restitution or damages in a criminal case

A person convicted of an offense may also be ordered to address the civil liability arising from the crime. Under the Rules of Criminal Procedure, the civil action for that liability is generally deemed instituted with the criminal case unless it was waived, reserved for separate filing, or filed earlier.

Before filing a separate civil case, obtain advice about Rule 111. A separate filing can affect strategy, costs, evidence, prescription, and the civil claim accompanying the criminal prosecution.

A separate civil or small-claims case

A civil action may be appropriate when the recipient is identifiable and there is evidence supporting repayment, rescission, damages, or another civil remedy. Small claims procedure may be available for qualifying money claims not exceeding ₱1 million, subject to the nature of the claim and the current Rules on Expedited Procedures in the First Level Courts.

Small claims is not a way to investigate an anonymous online identity. The defendant must be identifiable and capable of being served, and the claim must fall within the rule. Consult the court’s Office of the Clerk of Court or review the Supreme Court’s official small-claims resources before filing.

Common mistakes that reduce the chance of recovery

Waiting for the scammer’s promised refund before notifying the provider;
Reporting only to the social-media platform;
Paying a self-described hacker, investigator, lawyer, or “recovery agent” who promises guaranteed retrieval;
Deleting conversations or resetting the device;
Sending evidence only to the receiving bank and not the institution from which the funds originated;
Giving inconsistent accounts of whether the transaction was approved;
Withdrawing the complaint because the scammer issued a postdated check or made another promise;
Publicly accusing an unverified person or account owner;
Assuming a company’s SEC registration means its investment offering is licensed;
Letting someone use, rent, or buy your account to “receive salary,” “process commissions,” or route funds; and
Signing a settlement, quitclaim, affidavit of desistance, or waiver without understanding its effect.

Never knowingly move or withdraw suspected scam proceeds for another person. Preserve the funds and seek instructions from the financial institution and law enforcement.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The loss is substantial or involves several victims;
The bank or wallet refuses to trace the transaction or issue a written decision;
A temporary hold is about to expire;
You know the recipient’s identity and assets may be transferred;
You need a court order to preserve or restrain funds;
The scheme involves land, corporate shares, securities, cryptocurrency, overseas parties, or several jurisdictions;
You are being treated as a money mule or suspect;
You allowed another person to use your account;
Authorities ask you to surrender or consent to examination of a device;
You are considering a separate civil action; or
A prescriptive period or filing deadline may be approaching.

Bring the lawyer a one-page chronology, your evidence index, transaction records, and all responses from institutions and authorities.

Frequently asked questions

Can a bank or e-wallet reverse an instant transfer?

Sometimes, but not automatically. A provider may be able to hold and return funds that remain traceable and are verified as disputed. If the money has already been withdrawn, converted, spent, or moved outside participating institutions, recovery becomes more difficult.

What if I personally entered the OTP or approved the transfer?

Report it anyway and describe exactly how consent was obtained. A transaction induced through impersonation or social engineering is factually different from an ordinary purchase dispute. Approval of a prompt may affect liability, but it does not make the deception lawful or eliminate the institution’s duty to investigate under applicable rules.

Should I contact the recipient directly?

Usually, preserve the communications and let the institutions and investigators handle contact. Confronting the recipient may cause funds or evidence to disappear and can expose you to threats or further manipulation.

Is a police blotter enough?

A blotter records a report but may not complete the complaint process. Ask what is required for formal investigation, including a complaint-affidavit, sworn statement, supporting documents, and production or examination of the relevant device.

Can I report an attempted scam even if I lost no money?

Yes. Preserve the sender’s identifiers, message, link, account, and requested payment details. Report the account to the platform and an appropriate cybercrime channel. Do not click the link or continue engaging merely to gather more evidence.

Will filing a criminal complaint automatically return my money?

No. Investigation and prosecution focus on criminal responsibility. Recovery may come through a financial institution’s verification process, restitution or civil liability in the criminal case, a settlement, or an appropriate separate civil action.

How long should I keep the evidence?

Keep it until all financial, regulatory, criminal, and civil proceedings are finally resolved and any applicable review or enforcement period has passed. Do not rely solely on a platform or service provider to retain data for you.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any complaint’s outcome. The applicable remedy depends on the evidence, transaction channel, parties, and procedural history. Official sources and procedures were checked as of 16 September 2026.