Quick answer

If someone says your investment profits or lost funds are “ready for release” but you must first pay a tax, verification fee, security deposit, anti-money-laundering charge, gas fee, commission, or legal fee, stop paying. Treat the demand as a likely recovery or paywall scam.

Report it immediately and in parallel:

Contact the official 24/7 fraud channel of the bank, e-wallet, payment provider, or regulated virtual-asset service provider from which you sent money. Request tracing, temporary holding of disputed funds, coordinated verification, and a case reference number.
File a cybercrime or fraud complaint with the NBI or PNP, and report the incident to the CICC through hotline 1326.
If the scheme involved an investment, trading platform, investment contract, or someone claiming SEC authority, report it through the SEC’s investment-scam complaint channel.
Preserve the original messages, transaction records, account details, URLs, and devices.

A report does not guarantee reimbursement. Speed matters because funds may be withdrawn, converted to cryptocurrency, or moved through several accounts within minutes.

What is an investment recovery or paywall scam?

These are practical descriptions, not specific offense names under Philippine law.

An investment recovery scam usually begins after a person has already lost money. Someone claiming to be a lawyer, regulator, investigator, hacker, blockchain expert, bank officer, or “asset recovery company” offers to recover the loss. The supposed recovery then requires an advance payment or access to the victim’s accounts.

A paywall scam displays a fabricated balance, profit, refund, settlement, or recovered fund but prevents withdrawal until the victim pays another amount. Common labels include:

Withdrawal or account-unlocking fee
Tax or customs payment
Verification or identity-upgrade charge
Anti-money-laundering or source-of-funds fee
Insurance or security deposit
Broker commission
Blockchain gas, mining, or conversion fee
Court, lawyer, or regulator processing fee
Minimum additional investment
“Refundable” payment needed to restore a credit score

The dashboard balance may be entirely fictional. Allowing one small withdrawal early in the scheme does not prove that later balances or recovery claims are genuine.

Some legitimate financial products have disclosed fees and taxes. The difference must be verified independently through the institution’s official website, published contact details, governing contract, and actual regulator—not through a number, link, wallet, or “case officer” supplied by the person demanding payment. A sudden request to pay a personal account, unrelated company, money mule, or cryptocurrency wallet is a serious warning sign.

Act immediately if money was just sent

Contact the sending institution first

Use only the fraud number inside the institution’s official app, printed on the card, or published on its verified website. Do not call a number supplied by the suspected scammer or shown in an unsolicited message.

Tell the institution:

You are reporting suspected investment or recovery fraud.
Whether you personally initiated the payment under deception or whether it was made without your authorization.
The exact date, time, amount, transaction reference, recipient name, account number, and receiving institution.
Why the transaction is disputed.
Whether the scammer obtained a password, PIN, OTP, card detail, government ID, selfie, or remote access to your device.
Whether additional transactions are pending.

Ask the institution to:

Secure the source account and block further unauthorized transfers;
Trace the transaction chain;
Initiate temporary holding and coordinated verification where applicable under the Anti-Financial Account Scamming Act;
Send the necessary request to receiving institutions;
Preserve transaction, login, device, and account records;
Explain what supporting documents are required;
Provide a written acknowledgment and case reference number; and
Confirm whether any funds were successfully held.

Do not describe a transaction you personally made as “unauthorized.” State accurately that you sent it because of fraudulent representations. A deliberately false report that causes funds to be held may itself create liability under the Anti-Financial Account Scamming Act.

Understand the temporary-hold rules

Under BSP Circular No. 1215 and the AFASA implementing rules, BSP-supervised institutions must provide a 24/7 fraud-reporting channel. For covered electronic fund transfers:

An initial hold may last up to five calendar days.
It may be extended for up to 25 additional calendar days when the required grounds exist.
The institutional hold generally cannot exceed 30 calendar days unless extended by a competent court.
If funds were successfully held, coordinated verification should be completed within that holding period, unless a court extends it.
If no funds were held, verification generally must be completed within 30 calendar days and may reach 60 calendar days for meritorious reasons under the institution’s policies.

For an extension, the source account owner may need to submit a sworn complaint, affidavit, police report, or other supporting document during the initial holding period, subject to the applicable industry protocol. Submit documents as soon as the institution identifies its secure channel; do not wait for the fifth day.

A temporary hold is not a final refund. After verification, funds may be returned to the source account, released to the recipient, or kept subject to a court order, depending on the evidence and applicable rules.

The Circular’s temporary-hold process applies to covered electronic transfers between financial accounts. It does not generally govern erroneous transfers, domestic remittances, or ordinary credit-card purchases, except where a credit card is used for an electronic transfer through an Automated Clearing House. Cash payments, self-custody cryptocurrency transfers, foreign platforms, and other payment methods may require different procedures. Still report them immediately and ask the relevant provider what recall, dispute, freeze, or preservation remedy is available.

Secure compromised accounts

From a clean and trusted device:

Change the password of the email account linked to your financial accounts first.
Change banking, e-wallet, social-media, exchange, and cloud-storage passwords.
Use unique passwords and activate multi-factor authentication.
Sign out unknown devices and revoke unfamiliar sessions, applications, API keys, and forwarding rules.
Contact the mobile provider immediately if there are signs of a SIM swap or lost SIM.
Remove remote-access software only after recording its name and preserving relevant evidence.
Block cards or accounts that may have been exposed.
Monitor statements and notifications for follow-on transactions.

Never give an OTP, PIN, password, seed phrase, recovery phrase, private key, or screen-sharing access to someone offering to recover money. Legitimate investigators do not need a cryptocurrency seed phrase to trace a transaction.

Where to report

NBI or PNP

Republic Act No. 10175 designates the NBI and PNP as law-enforcement authorities for cybercrime. Online deception may also involve offenses under the Revised Penal Code or special laws, depending on the facts. The investigator and prosecutor—not the complainant or scammer—should determine the proper charges.

You may:

Use the NBI online complaint portal;
File personally with the NBI Cybercrime Division or an appropriate NBI regional or district office;
Email the NBI Cybercrime Division at ccd@nbi.gov.ph, as listed in the current NBI directory; or
Go to the nearest police station or the PNP Anti-Cybercrime Group.

The NBI’s published procedure for computer-crime victims provides for a complaint sheet, preliminary interview, sworn statements or affidavits, and submission or examination of relevant devices and supporting records. The listed investigative-assistance service has no fee.

Obtain the complaint, blotter, or reference number and the investigator’s official contact details. If evidence may disappear from a platform or service provider, ask whether an official preservation request is appropriate.

CICC National Anti-Scam Hotline

Call 1326 or email 1326@dict.gov.ph, as published by the Department of Information and Communications Technology. The CICC can receive scam reports and coordinate or refer them to appropriate authorities.

A CICC report is useful, but it does not replace the urgent complaint to the sending financial institution or the sworn complaint that an investigator, prosecutor, or bank may require.

Securities and Exchange Commission

Report the matter to the SEC when it involves an investment solicitation, trading operation, investment contract, securities broker, supposed fund manager, fake SEC document, or someone impersonating the Commission.

Use the SEC iMessage portal and select the Enforcement and Investor Protection Department service for eComplaints on Investment Scams.

Under the Securities Regulation Code, securities offered or sold in the Philippines generally require an effective registration statement unless a statutory exemption applies. Fraudulent securities transactions are prohibited. Whether a particular arrangement is a security or exempt transaction depends on its actual structure and documents.

Check the entity through Check with SEC, but remember:

A corporation’s existence does not prove that its investment is registered.
A certificate of incorporation does not by itself authorize public investment solicitation.
The entity may need a secondary license, and the particular securities being offered may need registration.
Scammers may use the name, registration number, address, or documents of an unrelated legitimate company.

An SEC report supports regulatory investigation but is not a promise that the Commission will recover or reimburse the investment.

BSP escalation

If your complaint concerns how a BSP-supervised bank, e-wallet, payment provider, or other supervised institution handled the transaction, first use that institution’s consumer-assistance mechanism. If the concern remains unresolved, escalate it through the BSP Consumer Assistance Mechanism.

The BSP accepts complaints through its Online Buddy and through a Complaints, Inquiries and Requests form sent to consumeraffairs@bsp.gov.ph. Include the complaint filed with the institution, its response if any, the resolution requested, and supporting documents.

BSP escalation concerns the supervised institution’s conduct and handling of the complaint. It does not replace a criminal complaint against the scammer.

The website, app, exchange, or social-media platform

After preserving the evidence, report the account, advertisement, group, page, domain, or wallet to the platform through its official abuse or fraud channel. Request preservation of relevant records if the platform provides such a procedure.

Do not rely on a platform report alone. An account suspension may limit further harm but does not begin a Philippine criminal case or necessarily preserve every record indefinitely.

Prepare one organized evidence packet

Create a factual chronology using exact dates and times. Separate what you personally observed from what another person told you.

Preserve:

Full names and aliases used by the scammers
Phone numbers, email addresses, usernames, profile links, user IDs, and group or channel names
Website URLs, domain names, advertisements, referral links, and app names
Complete chat exports, emails with headers, SMS messages, voice notes, call logs, and recordings lawfully in your possession
Screenshots showing the full screen, URL, username, date, and time where possible
Contracts, invoices, fake licenses, IDs, certificates, demand letters, tax notices, and recovery agreements
Screen recordings of the dashboard, balance, withdrawal rejection, and fee demand
Bank and e-wallet receipts, statements, transaction references, recipient names, account numbers, and QR codes
Cryptocurrency wallet addresses, blockchain network, transaction hash, exchange name, amount, and date
Copies of every complaint, acknowledgment, bank reply, and case number
Evidence showing how the offer was presented and why you relied on it
A payment table listing each date, amount, method, source account, destination, reference number, stated purpose, and corresponding message

Keep the original files and devices. Do not crop, annotate, overwrite, factory-reset, or delete the only copy. Make a separate backup and note who created each screenshot or export. Philippine electronic evidence must still be authenticated; screenshots are useful but do not automatically prove their own authenticity. The Supreme Court Rules on Electronic Evidence require proof of the integrity and reliability of private electronic documents.

Give full account and identity information only through verified, secure official channels. Redact sensitive information from any public post.

What to put in the complaint

A clear complaint should answer:

Who contacted you, and through what account or platform?
What did the person represent about the investment or recovery?
What specific statement induced each payment?
How much did you send, when, and to which destination?
Did you authorize the transfer, or did someone access the account without permission?
What additional payment is now being demanded?
What documents, identities, licenses, or government affiliations were used?
What action do you want the receiving agency or institution to take?
What evidence is attached?

A concise opening may read:

I am reporting suspected investment recovery/paywall fraud. On [date], a person using [name, account and platform] represented that [specific claim]. Because of that representation, I transferred ₱[amount] from [institution] to [recipient and institution], transaction reference [number]. I later received a demand for ₱[amount] described as [fee] before the supposed funds could be released. I dispute the transaction because [facts]. I request immediate tracing and temporary holding where legally available, preservation of relevant records, investigation, and written acknowledgment of this complaint.

Adapt the statement to the truth. Do not exaggerate, guess at identities, or label every recipient account holder as the mastermind; an account may belong to a mule or another victim.

Which laws may apply?

The applicable offense depends on the representations, payment method, account access, investment structure, number of participants, and available proof. Possible legal frameworks include:

Estafa or other fraud offenses under the Revised Penal Code;
The Cybercrime Prevention Act of 2012 when an offense is committed through information and communications technology;
The Securities Regulation Code for unregistered or fraudulent securities activities; and
The Anti-Financial Account Scamming Act for covered money-muling, social-engineering, and related conduct.

Not every failed investment is criminal. Market losses, poor performance, insolvency, or breach of contract do not by themselves prove fraud. Conversely, a written contract, corporate registration, small initial payout, or professionally designed website does not make a scheme lawful.

Do not wait for the scammer to admit wrongdoing before reporting. Also do not assume that a bank ticket, platform report, or regulatory submission preserves every criminal or civil deadline. Prescription and the acts that interrupt it depend on the particular offense, cause of action, documents, and forum. Obtain legal advice promptly if a substantial loss or approaching deadline is involved.

Common mistakes to avoid

Paying one more “final” fee because previous payments are supposedly refundable
Borrowing money to unlock a fake balance
Trusting a recovery agent who contacted you without being asked
Using contact details supplied by the suspected scammer to “verify” the claim
Giving remote access, an OTP, seed phrase, or account password
Delaying the bank report while negotiating with the scammer
Reporting only to social media and not to the financial institution or law enforcement
Deleting chats or factory-resetting a device
Editing screenshots or losing the original files
Publicly posting unredacted IDs, account numbers, affidavits, or evidence
Paying someone who promises a guaranteed freeze, arrest, or refund
Assuming an SEC-registered company is licensed to solicit the particular investment
Filing a knowingly false unauthorized-transaction claim
Attempting to hack, threaten, entrap, or personally trace the suspect

After preserving the conversation, stop engaging unless an assigned investigator expressly asks you to maintain contact. Scammers often use continued communication to demand more money or obtain additional personal data.

When professional help is urgent

Seek immediate assistance from law enforcement, the financial institution, and a Philippine lawyer when:

A transfer has just occurred or another transfer is pending;
The scammer controls your email, SIM, financial account, or device;
Large or family funds, retirement money, business money, or borrowed funds are involved;
The recipient or assets have been identified and urgent court relief may be needed;
The bank refuses to accept or document a prompt fraud report;
You received a subpoena, demand letter, or notice concerning an account used in the scheme;
Your own account was used to receive or forward other victims’ money;
The scammer has your IDs, biometrics, intimate material, or confidential business records;
There are threats, coercion, stalking, or immediate physical danger.

For immediate danger, call the nationwide emergency hotline 911. If you allowed your account to receive or forward funds, stop all transfers and obtain legal advice before making informal explanations to other participants; money-mule liability can depend on knowledge, purpose, and specific conduct.

Frequently asked questions

I personally approved the transfer. Can I still report it?

Yes. Report truthfully that you initiated the payment because of false representations. A voluntarily entered transfer can still be evidence of fraud. Whether it qualifies for a temporary hold, refund, chargeback, or criminal case depends on the payment method and facts.

Should I pay the requested tax or verification fee?

Do not pay the requester. Verify any genuine obligation independently with the institution or government agency using contact information you found yourself. A displayed balance does not prove that funds exist.

The bank says the transfer was completed. Is reporting useless?

No. Ask the sending institution to trace the transaction chain, contact receiving institutions, preserve records, and determine whether any amount remains available for holding. Also file with law enforcement. Recovery becomes more difficult after withdrawal or conversion, but the records may still identify accounts and support an investigation.

Can the SEC, NBI, PNP, CICC, or BSP guarantee recovery?

No. Each has a different regulatory, investigative, coordinating, or consumer-protection function. Recovery depends on whether assets remain traceable and reachable, the evidence, jurisdiction, and eventual legal findings.

What if cryptocurrency was used?

Immediately contact every exchange or regulated provider involved and provide the wallet address, network, transaction hash, time, and police or case reference when available. On-chain transfers generally cannot simply be reversed, but assets held at an identifiable service provider may be subject to its fraud procedures or lawful orders. Never give anyone your seed phrase to facilitate recovery.

What if the scammer is overseas?

Report in the Philippines. The Cybercrime Prevention Act provides Philippine jurisdiction in specified circumstances, including when damage is caused to a person who was in the Philippines when the offense was committed. Cross-border investigation and asset recovery may nevertheless take longer and require international cooperation.

Is there a minimum loss before I can report?

The official channels discussed above do not impose a general minimum loss for reporting suspected cybercrime or an investment scam. Small reports can also help authorities identify linked victims and accounts.

Is there a filing deadline?

Do not wait. The most urgent practical period is the time before funds are moved. If an AFASA initial hold is achieved, supporting documents may be needed within its five-calendar-day period. Separate criminal and civil prescriptive periods vary by the possible offense, amount, relief, and procedural history, so obtain case-specific advice promptly.

Can I block the scammer and delete the account?

Preserve the complete evidence first, then block the scammer and report the account. Do not delete your own account, chat history, or device data until an investigator or lawyer confirms that the evidence has been adequately preserved.

Official references

This article provides general legal information, not legal advice or a prediction of recovery or case outcome. Procedures and legal conclusions may change according to the payment method, documents, dates, jurisdiction, and other facts. Official sources and procedures were checked as of 4 August 2026.