Quick answer

If you paid an online seller and received nothing, received a fake or materially different item, or were induced to send money through a deceptive social-media account, act immediately:

Contact the bank, e-wallet, card issuer, or remittance company and request a fraud hold, recall, reversal, or dispute.
Preserve the seller’s profile, advertisement, messages, payment records, and delivery evidence before anything is deleted.
Report the account and transaction through the shopping platform or social-media service.
File a consumer complaint with the Department of Trade and Industry (DTI) when the transaction involved an online merchant or marketplace.
Report suspected criminal fraud to the PNP Anti-Cybercrime Group, the National Bureau of Investigation, or the nearest police station. You may also seek immediate reporting assistance through the government’s 1326 anti-scam hotline.

These routes serve different purposes. A platform report may suspend an account or process a refund. DTI proceedings address consumer redress and regulatory violations. Police or NBI reporting starts the criminal-investigation process. Filing with one does not necessarily replace the others.

A report does not guarantee recovery. Speed matters because transferred funds can be moved quickly and electronic records may later become unavailable.

First, secure your money and accounts

Contact the payment provider through the number or channel shown in its official app, website, or on the back of your card. Do not call a number supplied by the suspected scammer.

Tell the provider that the transaction is connected to suspected fraud and ask it to:

freeze any compromised account or card;
stop pending transactions;
attempt to recall or trace the transfer;
open a formal fraud dispute;
preserve transaction, beneficiary, device, and account records; and
provide a case or reference number.

Be precise about whether you authorized the payment. A purchase you knowingly paid for after being deceived is different from an unauthorized transfer made after someone took over your account. Do not describe an authorized payment as unauthorized.

If you disclosed a password, PIN, one-time password, recovery code, or card details, change affected credentials immediately. Sign out other devices, activate stronger authentication, and check linked email, mobile, banking, and shopping accounts. Notify your mobile provider if your SIM stopped working unexpectedly or you suspect a SIM-swap attack.

For complaints involving a bank, e-wallet, or other institution supervised by the Bangko Sentral ng Pilipinas, complain to the institution first. If its response is absent or unsatisfactory, escalate through the BSP Consumer Assistance channels. BSP escalation is not a substitute for promptly reporting the crime to law enforcement.

Preserve evidence before reporting the account

Save evidence before blocking the seller or asking the platform to remove the page. Once an account, listing, or conversation disappears, identifying the person behind it may become more difficult.

Keep:

the complete profile name, username, account ID, page link, shop link, and listing URL;
screenshots and, where available, downloaded copies of the advertisement and product description;
the full conversation, including dates, timestamps, voice messages, attachments, and deleted-message notices;
the seller’s phone numbers, email addresses, delivery address, and claimed identity;
bank account, e-wallet, QR-code, card, or remittance details used to receive payment;
payment confirmations, transaction reference numbers, receipts, and account statements;
order numbers, invoices, checkout pages, and platform case records;
courier records, tracking numbers, shipping labels, parcel packaging, and proof of delivery;
photographs or an unedited unboxing video if the parcel was empty, counterfeit, damaged, or different from what was ordered;
the platform’s responses and the seller’s refusal, excuses, or refund promises; and
a short chronology showing what happened, when, how much was paid, and what remedy you requested.

Capture both the content and its context. A cropped screenshot showing only one message may be less useful than a complete conversation that identifies the account and date. Retain original files and devices when practical. Avoid annotating or overwriting originals; make separate working copies.

Electronic conversations can be used as evidence when properly obtained and authenticated. The Supreme Court has recognized that a participant in an online conversation may preserve and submit that conversation as evidence; admissibility still depends on the circumstances and applicable evidence rules. See the Court’s discussion of chat logs and videos as evidence.

Report the seller to the platform

Use the marketplace or social-media service’s official fraud, scam, return, or buyer-protection process. Include the order number, payment reference, relevant screenshots, and the specific remedy requested.

If the purchase was made through a marketplace, keep communications inside the platform whenever possible. Payments or conversations moved outside the platform may fall outside its buyer-protection rules, but they should still be reported.

Ask the platform to:

preserve the account, listing, access, and transaction records;
restrict the suspected scam account;
process any available refund or buyer-protection claim; and
give you a written case number and decision.

Do not wait for a platform investigation before notifying the payment provider or law enforcement. Platform appeal and refund periods are contractual and can be much shorter than legal filing periods.

File a DTI consumer complaint

The Internet Transactions Act of 2023, Republic Act No. 11967, protects consumers in covered business-to-consumer internet transactions. It imposes duties on online merchants and e-marketplaces, including disclosure and internal-redress obligations.

A consumer may start through the DTI Consumer Care complaint system. Prepare:

your name and contact information;
the merchant’s or platform’s identifying details;
the order date, amount, and payment method;
a clear description of the problem;
proof of purchase and payment;
relevant messages, advertisements, and photographs;
proof that you first asked the merchant or platform to resolve the matter; and
the remedy you want, such as delivery, replacement, refund, repair, or reimbursement.

Under Section 26 of Republic Act No. 11967, the consumer may pursue damages before the court or DTI within two years from the time the cause of action arose. That period is not permission to delay: platform deadlines may expire earlier, and evidence or transferred funds may disappear.

DTI’s route is most relevant when the other party was acting as an online merchant, e-retailer, or covered e-commerce participant. Republic Act No. 11967 excludes consumer-to-consumer transactions. A one-off purchase from a private individual on social media may therefore require a criminal complaint or an ordinary civil remedy rather than an Internet Transactions Act consumer case. The true nature of the seller’s activity—not merely the label placed on the account—may require factual examination.

DTI mediation or adjudication is not the same as criminal prosecution. If the facts indicate deliberate deceit, identity theft, account takeover, fabricated payment instructions, or an organized scheme, report the matter to law enforcement as well.

Report the crime to the PNP or NBI

The Cybercrime Prevention Act of 2012, Republic Act No. 10175, designates the PNP and NBI as the principal law-enforcement authorities for cybercrime cases.

You may report through:

the PNP Anti-Cybercrime Group e-Complaint portal;
the nearest PNP station or Anti-Cybercrime Group office;
the NBI, including its cybercrime investigators; or
the government’s 1326 anti-scam hotline for immediate reporting assistance and referral.

Online submission or a hotline call may be an initial report rather than the complete filing needed for prosecution. Investigators may require you to appear, execute a complaint-affidavit, identify and authenticate evidence, or submit additional records. Bring a government-issued ID, printed chronology, payment records, and electronic copies of the evidence.

Request and retain:

the complaint, blotter, or docket number;
the investigator’s name and office;
a list of any missing documents;
instructions for executing an affidavit; and
the date and method for following up.

Report promptly even if you know only the receiving account, phone number, username, or URL. Banks, telecommunications companies, platforms, and other service providers may hold identifying or traffic information, but disclosure to investigators is governed by legal process. Under Sections 13 and 14 of Republic Act No. 10175, certain data are subject to statutory preservation periods, and disclosure of protected computer data generally requires the prescribed authority or court warrant. A victim should not attempt to obtain private subscriber information through hacking, impersonation, or threats.

What offense may apply?

The label “online scam” does not identify a single offense. Liability depends on what the person did and what the evidence proves.

A fraudulent online sale may constitute estafa by deceit under Article 315 of the Revised Penal Code when false pretenses or fraudulent acts caused another person to part with money or property and produced damage. Mere non-delivery or breach of a promise is not automatically estafa. Investigators and prosecutors examine whether fraudulent intent or deceit existed at the legally relevant time.

Section 6 of Republic Act No. 10175 covers crimes under the Revised Penal Code and special laws when committed by, through, and with information and communications technology, with the consequence stated in that provision. This does not mean that every failed online transaction is automatically a cybercrime.

“Computer-related fraud” under Section 4(b)(2) has specific elements involving unauthorized input, alteration, or deletion of computer data or interference with a computer system. An ordinary lie sent through social media does not necessarily satisfy those elements. Other facts may point to computer-related identity theft, illegal access, forgery, or offenses under different laws.

The correct charge and court depend on the evidence, the amount and nature of the loss, the conduct involved, and where legally significant acts occurred. Let investigators and prosecutors classify the offense rather than selecting a charge solely because its name sounds applicable.

Seeking a refund or compensation

Criminal reporting does not always produce an immediate refund. Recovery may instead come from:

a payment-provider reversal or chargeback;
marketplace buyer protection;
a voluntary settlement;
DTI consumer proceedings;
restitution or civil liability connected with a criminal case; or
a separate civil action.

For a qualifying money claim of ₱1 million or less, the Rule on Small Claims may offer a simplified civil procedure in first-level courts. Whether a scam-related claim qualifies—and where it must be filed—depends on the cause of action, the parties, service of process, and available proof. Consult the Supreme Court’s small-claims rules and forms before filing. A small-claims action is not a substitute for reporting a crime and may be impractical if the defendant’s true identity or address is unknown.

Do not sign a settlement, quitclaim, or withdrawal without reading it carefully. Confirm whether payment has actually cleared, what rights are being released, and whether the document requires you to withdraw pending complaints.

Common mistakes to avoid

Waiting for the seller’s next promise. Repeated assurances can consume bank, platform, or evidence-preservation time.
Deleting or blocking too early. Preserve the full account and conversation first.
Sending more money. “Release fees,” “verification deposits,” “taxes,” and “refund-processing charges” may be another stage of the scam.
Paying a supposed recovery agent. Verify anyone claiming to be from a bank or government office through the institution’s independently obtained official channel.
Submitting only cropped screenshots. Preserve URLs, usernames, dates, transaction references, and the surrounding conversation.
Misstating what happened. Distinguish an authorized payment induced by deceit from an unauthorized account transaction.
Relying only on a social-media post. Public warnings do not replace reports to the payment provider, platform, regulator, or police.
Publicly posting private data or unverified accusations. This can expose victims or innocent account holders to privacy, harassment, or defamation risks. Give sensitive information directly to the investigating authority.
Assuming the receiving-account holder is necessarily the organizer. Accounts can be stolen, impersonated, or used by money mules. Report the evidence without overstating what it proves.
Creating or altering evidence. Do not edit messages, stage conversations, access another person’s account, or impersonate the scammer to obtain information unlawfully.

When help is urgent

Seek immediate assistance if:

unauthorized transfers are still occurring;
the scammer controls your email, banking, e-wallet, social-media account, or mobile number;
you disclosed an OTP, PIN, password, recovery phrase, or full card credentials;
the scam includes threats, extortion, intimate images, stalking, or demands to meet;
a child or vulnerable person is involved;
the scammer is directing you to receive or forward other people’s money; or
you are being pressured to destroy evidence or withdraw a report.

For an immediate threat to life or physical safety, call 911. For active financial fraud, contact the payment provider first while another trusted person helps preserve records and report the incident.

Frequently asked questions

Can I report a scam even if the amount is small?

Yes. The amount may affect the available procedure or eventual penalty, but it does not prevent you from reporting suspected fraud. Multiple small reports may also help investigators identify a wider scheme.

Should I report the seller, the marketplace, or both?

Report the seller to the platform. In a DTI complaint, identify every business whose conduct or requested remedy is relevant, but do not assume the marketplace is automatically liable for everything a seller does. Republic Act No. 11967 makes an e-marketplace solidarily liable only in specified circumstances, which must be established from the facts.

What if I paid outside the shopping app?

Report the transaction anyway. Moving payment outside the platform may limit contractual buyer protection, but payment records, messages, and account information may still support consumer, civil, or criminal action.

What if the social-media account has disappeared?

Report using the URL, username, screenshots, payment destination, phone number, and transaction reference you retained. Ask the platform and investigators to preserve relevant records. Do not create a new account to harass or threaten the suspected scammer.

Can I report anonymously?

You may be able to provide an initial tip without completing a formal complaint. A criminal case will ordinarily require an identifiable complainant or witness who can provide evidence and execute the documents required by investigators or prosecutors.

Is a delayed or undelivered order always a scam?

No. It may be a delivery problem, breach of contract, or consumer dispute rather than criminal fraud. Evidence of deliberate deception—such as a fabricated identity, false stock claims, repeated use of different receiving accounts, fake tracking information, or taking payment with no intention to deliver—can materially change the assessment.

What if the seller is abroad?

Report the seller to the platform, payment provider, and Philippine authorities. Republic Act No. 10175 contains jurisdiction provisions covering certain offenses with legally significant connections to the Philippines, but identifying and proceeding against a person abroad may require international cooperation and can make recovery more difficult.

How long should I keep the evidence?

Keep it until all bank, platform, DTI, police, prosecution, and court proceedings are finally concluded. The two-year period in the Internet Transactions Act is not a universal deadline for every possible claim or crime, and it does not extend a platform’s shorter dispute period.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and outcomes depend on the evidence, transaction documents, platform terms, identities and locations of the parties, and the authorities’ findings. Official sources and filing information were checked as of 15 September 2026.