Quick answer

If you suspect a scam, act immediately. Contact the bank, e-wallet, card issuer, remittance company, or cryptocurrency platform involved through its official fraud channel; ask it to secure your account, trace the transaction, and place a temporary hold on any remaining disputed funds. Then report the incident to law enforcement and preserve every piece of evidence.

Philippine law allows covered financial institutions to hold funds connected with a disputed transaction while they investigate. Under the Anti-Financial Account Scamming Act, the hold may last only for the period prescribed by the Bangko Sentral ng Pilipinas (BSP), which cannot exceed 30 calendar days unless a competent court extends it. A report does not guarantee a freeze, refund, arrest, or recovery: the result depends on whether the money is still traceable, the available evidence, the payment method, and the applicable contract and law.

Do not pay anyone who promises “fund recovery” for an advance fee, asks for an OTP or PIN, or claims that another payment is needed to release your money. That may be a second scam.

What to do in the first few hours

1. Stop further access

Using a trusted device:

Call the financial provider using the number on its official website, app, card, or account statement.
Lock or suspend affected cards and accounts.
Change the passwords for your email, banking, e-wallet, shopping, and social-media accounts.
Sign out unknown devices and revoke unfamiliar app permissions.
Replace reused passwords and enable multi-factor authentication.
If you disclosed an OTP, PIN, card security code, recovery code, or remote-access permission, say so clearly when reporting.
Ask your mobile network to secure your number if your SIM stopped working or you suspect a SIM-swap.
If identity documents were exposed, notify the issuing agency and ask what protective action is available.

Do not continue negotiating with the suspected scammer. Do not remotely wipe or factory-reset a device until important evidence has been preserved, unless leaving it connected creates an immediate security risk.

2. Notify every financial institution in the payment chain

Report the transaction to both the sending provider and, if identifiable, the receiving bank, e-wallet, remittance company, payment gateway, or virtual-asset service provider.

Use precise language:

“I am disputing this transaction as suspected fraud or financial account scamming. Please secure my account, preserve transaction and access records, trace the funds, coordinate with the receiving institution, and assess whether a temporary hold may be placed under Republic Act No. 12010 and applicable BSP regulations.”

Provide:

transaction reference numbers;
date, time, amount, and currency;
sending and receiving account details;
the recipient name displayed before payment;
a short explanation of how you were deceived or how the transaction became unauthorized;
whether you entered the payment yourself because of deception, or did not authorize it at all;
when you discovered and reported the incident; and
any police, CICC, NBI, or prosecutor reference number already available.

Ask for a written acknowledgment and case number. Keep screenshots of the submission and note the representative’s name, the date, and the exact response.

Under the BSP’s AFASA regulations, covered institutions have fraud-management, information-sharing, and temporary-hold mechanisms. These powers do not create an automatic right to reimbursement. A provider may distinguish among an unauthorized transaction, a transaction authorized under deception, an erroneous transfer, and a legitimate commercial dispute.

3. Report the crime

For an online or technology-assisted scam, promptly report to one or more of the following:

the Philippine National Police Anti-Cybercrime Group or the nearest police station;
the National Bureau of Investigation, including its Cybercrime Division or the appropriate regional or district office; and
the Cybercrime Investigation and Coordinating Center’s 24/7 Inter-Agency Response Center hotline, 1326.

A hotline or online report can provide an early incident record, but investigators may still require personal appearance, identification, an affidavit-complaint, original or certified records, and access to the affected device.

For a criminal case, the complainant will ordinarily need to execute a sworn complaint and submit supporting evidence for investigation and, where appropriate, preliminary investigation by the prosecutor. The investigator or prosecutor—not the complainant—determines which offense the evidence may establish.

Which laws may apply

“Scam” is a general description, not a single criminal charge. Depending on the evidence, conduct may fall under one or more laws.

Estafa or other fraud

Article 315 of the Revised Penal Code covers specified forms of estafa involving deceit or abuse of confidence that cause damage. The prosecution must prove the elements of the particular form charged. A broken promise, failed investment, unpaid debt, or bad business outcome is not automatically estafa; evidence of deceit, fraudulent conversion, or another legally defined mode is essential.

Computer-related fraud and online offenses

The Cybercrime Prevention Act of 2012 penalizes computer-related fraud and other defined cybercrimes. It also applies special rules where certain offenses under the Revised Penal Code or special laws are committed through information and communications technologies. Investigators may use the procedures and court-issued warrants available under the Rule on Cybercrime Warrants.

Financial-account scamming and money-mule activity

The Anti-Financial Account Scamming Act addresses money-mule activity, social-engineering schemes, and related financial-account offenses. It applies not only to principal organizers: knowingly allowing an account to be used, transferring access to it, or receiving or moving illicit funds may create criminal exposure.

A person whose account was used without consent should report that fact immediately and preserve proof of the compromise. A person who knowingly rented, sold, lent, or surrendered an account should obtain legal advice before making a statement.

Access-device and card fraud

Unauthorized or fraudulent use, possession, trafficking, or production of cards and other access devices may fall under the Access Devices Regulation Act of 1998. The applicable offense depends on what the person possessed, represented, used, or intended.

Electronic evidence

Electronic records are not disregarded merely because they are digital. Their admissibility and weight depend on relevance, authenticity, integrity, and compliance with applicable evidentiary rules. The Electronic Commerce Act and the Supreme Court’s Rules on Electronic Evidence provide the governing framework.

Evidence to preserve

Keep the original files whenever possible—not only cropped screenshots. Preserve:

complete chat histories, emails, SMS messages, voice notes, call logs, and voicemail;
usernames, profile links, account IDs, phone numbers, email addresses, and website addresses;
advertisements, posts, product listings, investment presentations, and promised returns;
receipts, transfer confirmations, QR codes, account numbers, wallet addresses, and transaction hashes;
bank and e-wallet statements showing the debit;
delivery records, invoices, contracts, identification documents, and certificates supplied by the other party;
the exact sequence of events, including dates, times, amounts, and representations made;
fraud-report acknowledgments and case numbers;
device alerts showing logins, password changes, OTP requests, or new-device registration;
names of witnesses and what each personally observed; and
proof of later demands for additional payments or threats.

Export chats using the platform’s own function if available. Take screenshots that show the account name, date, time, and surrounding conversation. Save copies in at least two secure locations. Do not alter filenames, edit images, annotate originals, or delete the conversation after reporting. If you prepare a chronology or highlighted copy, keep it separate from the original evidence.

Record the source of every item and how it was obtained. Investigators may need the actual device or platform records to authenticate evidence and identify the account holder.

Choosing the right additional complaint channel

A regulatory complaint supplements—but normally does not replace—a police, NBI, or prosecutor complaint.

Bank, e-wallet, lender, payment provider, or BSP-supervised institution

Complain first through the provider’s official consumer-assistance mechanism. This is generally required before escalating the matter to the BSP.

If the provider’s final response is unsatisfactory, or the provider does not properly address the complaint, use the BSP Consumer Assistance Mechanism. The BSP process can facilitate or, for matters within its authority, adjudicate financial-consumer complaints. It is not a substitute for reporting a crime and does not guarantee that already-withdrawn funds can be recovered.

Investment solicitation

Report an unregistered or suspicious investment solicitation through the SEC iMessage system. A company’s SEC registration does not, by itself, authorize it to solicit investments or sell securities. Check both the entity’s registration and whether the offering and persons selling it have the required authority.

Consumer transaction

For a dispute involving goods or services supplied by a business, the Department of Trade and Industry may provide consumer redress within its jurisdiction. Use only the current complaint channel published on the DTI Consumer Care page.

A DTI complaint may address a consumer dispute, but criminal deception, account compromise, and urgent fund tracing should also be reported through the appropriate financial provider and law-enforcement channels.

Misuse of personal information

If personal information was unlawfully collected, disclosed, or used, consider a separate complaint to the National Privacy Commission. The NPC requires a properly completed and notarized complaint or verified complaint, supporting evidence, and any required witness affidavits. Its official filing guidance lists the accepted submission methods.

The NPC addresses data-privacy violations. It does not replace a fraud report or automatically recover transferred money.

Possible paths to recovery

Reversal, recall, chargeback, or provider reimbursement

Ask the payment provider which remedy applies to the specific transaction:

reversal of a pending transaction;
transfer recall or inter-institution recovery;
card chargeback;
unauthorized-transaction investigation;
temporary holding of disputed funds; or
reimbursement under the account agreement and applicable consumer-protection rules.

These remedies have different requirements and contractual time limits. Report immediately even if you do not yet have all the evidence, then supplement the complaint. Do not assume that a card chargeback applies to bank transfers, e-wallet transfers, cash deposits, cryptocurrency, or a payment that you personally authorized after being deceived.

Restitution through a criminal case

When a criminal action is instituted, the civil action for recovery of civil liability arising from the offense is generally instituted with it unless the offended party waives it, reserves the right to sue separately, or has already filed the civil action. The correct choice is fact-sensitive. Filing overlapping cases or making an incorrect reservation can create procedural problems, so obtain advice before commencing a separate civil suit.

A criminal judgment may include restitution or damages, but collection still depends on a final enforceable award and the defendant’s identifiable assets.

A separate civil action

A victim may have a civil claim against the scammer or another legally responsible person. Possible claims and defendants depend on the transaction, the evidence, contractual terms, and whether negligence, unjust enrichment, breach of contract, or another recognized cause of action can be proved.

A financial institution is not automatically liable merely because its system was used to receive or transmit scam proceeds. Liability must be established under the governing law, regulations, contract, and evidence—including the security measures used, warnings given, authentication records, response to the report, and the customer’s conduct.

For eligible money claims of ₱1 million or less, excluding interest and costs, the Supreme Court’s current small-claims procedure may offer a simplified route in a first-level court. The claim must fall within the categories covered by the rule; it is not suitable where the defendant cannot be identified or served, or where the requested relief is not an eligible money claim. Official forms and guidance are available from the Supreme Court small-claims page and the Rules on Expedited Procedures in the First Level Courts.

Barangay conciliation may be a required pre-filing step in some disputes between individuals who reside in the same city or municipality, subject to statutory exceptions. Confirm the proper venue and prerequisites before filing.

Preservation or court orders

Where funds or assets have been located, counsel or investigators may consider the appropriate court process to preserve them. Under AFASA, a financial institution’s temporary hold cannot simply continue indefinitely: an extension beyond the statutory maximum requires an order from a competent court.

A victim should not attempt to obtain confidential account-holder information directly through threats, impersonation, hacking, or public exposure. Banks and platforms ordinarily disclose protected records only through lawful processes.

Time limits: do not wait

There is no single deadline for every scam-related remedy.

A bank recall may become practically impossible within minutes or hours. Card-network, platform, insurance, administrative, civil, and criminal remedies each have different notice, filing, or prescription periods. The period may depend on the offense charged, the amount, when the violation was discovered, where it occurred, the contract, and whether another proceeding interrupted prescription.

Report immediately. If substantial money, real property, business funds, retirement savings, or a vulnerable person is involved, ask a Philippine lawyer to identify all applicable deadlines instead of relying on a general limitation period.

Common mistakes that reduce the chance of recovery

Waiting for the scammer’s promised refund before reporting.
Sending a “verification,” “tax,” “unlocking,” “AML,” or “recovery” fee.
Giving an alleged investigator or recovery agent an OTP, PIN, password, seed phrase, or remote access.
Reporting only to the social-media platform and not to the payment provider or law enforcement.
Describing an induced payment as simply “unauthorized,” without explaining exactly what happened.
Deleting chats, resetting the device, or editing original screenshots.
Posting accusations, identification documents, account details, or unverified names publicly.
Threatening or arranging a personal confrontation with the suspected scammer.
Filing against a bank, account holder, or company without evidence connecting that party to wrongdoing.
Assuming an SEC certificate, DTI registration, business permit, verified badge, or professional-looking website proves that an investment or seller is legitimate.
Signing a waiver, quitclaim, settlement, or acknowledgment without understanding its effect.
Withdrawing a complaint merely because part of the money was returned.
Hiring a supposed “hacker,” “inside bank employee,” or “asset recovery specialist” who promises guaranteed recovery.

When legal help is urgent

Seek prompt assistance from a Philippine lawyer if:

a substantial amount or several victims are involved;
funds, cryptocurrency, vehicles, land, or other traceable assets may need preservation;
the bank denies the dispute or attributes the transaction to your credentials;
you are asked to sign a settlement, waiver, affidavit, or admission;
investigators request access to devices containing confidential personal or business information;
the suspect threatens violence, blackmail, exposure of intimate material, or harm to a child;
your identity or account was used to receive or move other victims’ money;
the scheme involves an investment, corporation, overseas actor, recruitment, or public officer;
you need to decide whether to reserve or separately pursue the civil action; or
a filing or prescription deadline may be approaching.

If you cannot afford private counsel, inquire with the Public Attorney’s Office about eligibility and available assistance. Law-school legal-aid clinics and the Integrated Bar of the Philippines may also be able to identify available services.

If there is an immediate threat to life or safety, call 911 or go to the nearest police station.

Frequently asked questions

Can the bank immediately return my money?

Not necessarily. The bank must first determine what happened and whether the funds remain available or recoverable. A temporary hold preserves disputed funds; it is not a final ruling that the money belongs to the complainant.

What if I personally pressed “send” because the scammer deceived me?

Report it anyway. State that you initiated the transfer because of specific false representations or social engineering. Do not inaccurately call it an account takeover if you actually approved the payment. The distinction may affect the investigation and available remedies.

What if I sent money to the wrong account by mistake?

An erroneous transfer is not automatically a scam or an AFASA disputed transaction. Contact the provider immediately and request its mistaken-transfer procedure. Do not threaten the recipient or attempt unauthorized access to the account.

Is a police blotter enough?

Usually not. A blotter records the report but may not contain the sworn allegations and supporting evidence needed for investigation or prosecution. Ask what affidavit, documents, device examination, or follow-up appearance is required.

Can I file even if I know only a username, phone number, or account number?

Yes. Give investigators every available identifier and transaction record. Identification may require preservation requests, lawful disclosure from service providers, and further investigation. Recovery or prosecution becomes harder if the account is foreign, fictitious, compromised, or emptied.

Should I warn others by posting the suspect’s name and photograph?

Give the information to investigators and platforms first. Public accusations can expose private data, compromise an investigation, alert the suspect, misidentify an innocent account holder, or create separate legal risk. If you share a warning, stick to verified facts and avoid publishing sensitive records.

Can I recover cryptocurrency?

Possibly, but recovery is difficult and time-sensitive. Preserve the wallet addresses, transaction hashes, exchange account details, network used, timestamps, and all communications. Notify any regulated exchange involved and law enforcement immediately. A blockchain transaction generally cannot be reversed merely because it was fraudulent.

Will reporting to the BSP, DTI, SEC, or NPC start a criminal case?

No. Each agency acts within its own mandate. Regulatory or consumer proceedings may help address provider conduct, investments, trade practices, or privacy violations, but suspected criminal conduct should also be reported to the police, NBI, or prosecutor.

What if the scammer returns some of the money?

Document the payment and do not destroy evidence. A partial return does not necessarily settle all claims or erase possible criminal liability. Obtain advice before signing a quitclaim or withdrawing a complaint.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the facts, documents, institutions, and current rules. Official sources were checked as of 15 September 2026.