Quick answer

If you paid an online seller or social-media account and believe you were scammed, act immediately:

Contact your bank, card issuer, or e-wallet through its official fraud channel. Report the transaction as disputed, ask whether the funds can be traced or temporarily held, secure the account, and obtain a case-reference number.
Preserve the evidence before anything disappears. Save the seller’s profile, listing, messages, payment details, receipts, delivery records, and the full web addresses of relevant pages.
Report the account and transaction to the shopping platform or social-media service. Request a refund, account preservation, and removal of the fraudulent listing.
Report the incident to the government’s 24/7 National Anti-Scam Hotline by dialing 1326, or email report@cicc.gov.ph.
File a criminal complaint with the NBI Cybercrime Division, a regional NBI cybercrime center, or the PNP’s cybercrime unit if money, an account, or personal information was taken.
For a consumer transaction with an identifiable business or online merchant, use the seller or platform’s internal complaint process and, if unresolved, file with the DTI.

Reporting does not guarantee recovery. Speed matters because scammers may withdraw or transfer funds through several accounts within minutes.

First, protect your money and accounts

Call the financial institution immediately

Use only the telephone number, mobile application, or website printed on your card or published by the bank or e-wallet provider. Do not use a contact number supplied by the seller, caller, text message, sponsored search result, or social-media account.

Tell the institution:

that the payment or transfer is connected with suspected fraud;
whether you personally authorized the transaction, were deceived into authorizing it, or did not authorize it at all;
the amount, date, time, transaction-reference number, and destination account;
the recipient’s name, account number, mobile number, or e-wallet identifier;
whether your password, PIN, one-time password, card details, identification document, or device may have been compromised; and
whether additional transactions are pending.

Ask the institution to:

secure or temporarily restrict the affected account;
initiate its disputed-transaction and coordinated-verification procedures;
send any appropriate request to hold or trace funds sent to another institution;
replace compromised cards or credentials;
preserve transaction, access, device, and communications records; and
provide a written acknowledgment and case-reference number.

Under the Anti-Financial Account Scamming Act, Republic Act No. 12010, covered financial institutions must initiate coordinated verification upon receiving a complaint or detecting a disputed transaction. The BSP’s implementing rules permit an initial hold of identifiable disputed funds for up to five calendar days and, when justified under the rules, an extended hold subject to a total maximum of 30 calendar days. A report does not automatically mean that funds will still be available, that a hold will be imposed, or that reimbursement is due.

Make an accurate report. Knowingly filing completely unwarranted or false information in bad faith that causes funds to be held can result in liability under the same law.

Secure compromised access

If you clicked a suspicious link, installed an application, disclosed credentials, or allowed remote access:

disconnect the affected device from the internet if someone may still control it;
contact the bank or e-wallet before changing anything that could delay an urgent account restriction;
change passwords using a clean device, beginning with the affected email account;
sign out unknown sessions and remove unfamiliar devices;
enable multi-factor authentication;
change reused passwords on other accounts;
ask the mobile provider to secure the SIM if it stopped working unexpectedly; and
review recent transactions, recovery addresses, forwarding rules, and linked accounts.

Never disclose a PIN, password, card verification value, or one-time password to someone claiming that it is needed to process a refund or recover stolen money.

Preserve evidence before blocking the scammer

Do not rely on screenshots alone. Preserve the underlying records when possible.

Save:

the seller’s account name, username, profile link, user ID, telephone number, email address, and displayed business address;
the complete listing, product description, advertised price, photographs, livestream, and seller representations;
the entire conversation, including timestamps, voice messages, emails, and call logs;
order numbers, invoices, electronic receipts, courier records, and parcel labels;
bank or e-wallet receipts showing transaction-reference numbers, destination details, amount, date, and time;
the payment instruction and any request to move the conversation or payment outside the platform;
proof of what arrived, including an unedited unboxing video where available, photographs of the parcel, its seals, contents, and shipping label;
the platform complaint, its acknowledgment, and every response;
the full URL of each page, not merely a cropped image;
names and contact details of witnesses; and
a short chronological account written while events are fresh.

Export chats or download account data where the service permits it. Keep original files and make a separate backup. Avoid editing, annotating, or repeatedly converting the originals; use copies when highlighting relevant portions.

Do not delete the conversation, return a device used in the incident, or factory-reset it before asking investigators whether examination may be necessary. Do not publicly post unredacted account numbers, identification documents, private conversations, or other people’s personal data.

Report the seller to the platform

Use the marketplace or social-media service’s built-in reporting and dispute tools. Clearly request:

cancellation or refund, if available;
preservation of the seller’s registration, login, payment, and communications records;
suspension of the account and removal of the listing;
disclosure of merchant contact information through lawful procedures; and
a written case or ticket number.

For covered internet transactions, Section 24 of the Internet Transactions Act, Republic Act No. 11967, generally requires an aggrieved party to use the digital platform’s, e-marketplace’s, or e-retailer’s internal redress mechanism before filing a consumer complaint with a government agency or court. That mechanism is deemed exhausted when the complaint remains unresolved for seven calendar days.

The seven-day rule should not be treated as a reason to delay an urgent fraud report to a bank, e-wallet, CICC, NBI, or PNP. A victim can protect funds, preserve evidence, and report possible crime while the consumer dispute process is running.

The merchant is ordinarily the party primarily responsible for consumer loss arising from the transaction. A marketplace or platform may also incur subsidiary or solidary liability in circumstances specified by the Act, but platform liability is not automatic and depends on matters such as notice, diligence, the seller’s Philippine presence, the nature of the goods, and the platform’s response.

Report the scam to government authorities

CICC National Anti-Scam Hotline

Dial 1326, the government’s 24/7 National Anti-Scam Hotline operated through the Cybercrime Investigation and Coordinating Center’s inter-agency response system. Reports may also be sent to report@cicc.gov.ph. Scam messages and suspicious accounts may additionally be reported through the eReport feature of the eGovPH application.

Provide a concise timeline, transaction information, the scammer’s identifiers, and copies of the most important evidence. Keep the reference number. A CICC report may support referral, coordination, or disruption of scam accounts, but it does not necessarily commence a criminal prosecution or a DTI consumer case.

Official information about the hotline is available from the Department of Information and Communications Technology.

NBI Cybercrime Division

A victim may approach the NBI Cybercrime Division or an NBI Regional Cybercrime Center. The NBI’s published procedure requires the complainant to complete a complaint form and ordinarily execute a sworn statement or submit a prepared affidavit together with the relevant documents and, when necessary, a device for examination.

Bring or prepare:

a government-issued ID;
a chronological affidavit stating what was represented, why it was false, how you relied on it, and what loss resulted;
printed and electronic copies of the evidence;
proof of payment and the financial institution’s case number;
the scammer’s account and contact details;
the platform and CICC report numbers; and
the original device, if investigators request it.

The NBI lists ccd@nbi.gov.ph for its Cybercrime Division and publishes its offices and complaint services on the NBI website.

Philippine National Police cybercrime unit

You may also report to the PNP unit handling cybercrime or seek assistance at the nearest police station for referral. Ask what form of affidavit, electronic evidence, device, and identification the investigating unit requires.

Report immediately if the scammer is still communicating, another payment is being demanded, the recipient account remains active, or the suspect’s location or identity may be ascertainable. Do not arrange a confrontation, controlled delivery, or entrapment on your own.

DTI consumer complaint

Use the DTI route when the matter concerns an online merchant or business transaction—for example, non-delivery, a materially different or counterfeit product, deceptive representations, a refused lawful refund, or another unfair sales practice.

After using the merchant or platform’s internal redress mechanism, submit a complaint through the DTI Consumer Complaints Assistance and Resolution System. The DTI also accepts complaints at consumercare@dti.gov.ph and through the appropriate regional or provincial office.

Include:

the complainant’s complete name, address, email address, and contact number;
the respondent’s name, address, online account, email address, and contact number, as available;
a clear narration of the facts;
the remedy requested, such as refund, repair, or replacement;
proof of purchase and payment;
the listing, communications, and delivery evidence;
proof that internal redress was attempted and either failed or remained unresolved for seven calendar days; and
a copy of a government-issued ID.

DTI mediation is generally the first stage. If mediation fails, a Certificate to File Action may be issued for a formal administrative complaint. Formal adjudication has additional requirements, including a verified complaint and a certification against forum shopping. DTI may refer or decline matters outside its jurisdiction.

Under the Internet Transactions Act, an online consumer may pursue repair, replacement, refund, or other remedies for a defect, malfunction, loss without the consumer’s fault, or failure to comply with a warranty or contractual obligation. A claim for damages under that Act must be filed in court or with the DTI within two years from the time the cause of action arose. Other possible claims or crimes may be governed by different prescriptive periods, so do not assume that every deadline is two years.

A fake social-media seller with no genuine business operation may present mainly a criminal-fraud case rather than an ordinary consumer dispute. DTI reporting can still be useful where an identifiable merchant, e-retailer, or platform obligation is involved, but it does not replace a report to law enforcement.

What law may apply?

The proper charge depends on the evidence and should be determined by investigators and prosecutors.

A typical online selling scheme may constitute estafa under Article 315 of the Revised Penal Code when a person uses false pretenses or fraudulent acts to obtain money and causes damage. When a crime under the Revised Penal Code or another special law is committed through information and communications technology, Section 6 of the Cybercrime Prevention Act of 2012, Republic Act No. 10175 may apply and provides for a penalty one degree higher than the penalty under the underlying law.

Computer-related fraud, computer-related identity theft, illegal access, and other offenses under Republic Act No. 10175 may apply in suitable cases. Social-engineering schemes, money-mule activity, and the buying, selling, lending, or deceptive use of financial accounts may also fall under Republic Act No. 12010.

Not every failed sale is automatically a crime. Delay, poor service, a product defect, or a genuine contractual dispute does not by itself prove criminal deceit. Investigators will examine whether fraudulent intent existed, what representations were made, whether the victim relied on them, and whether loss resulted.

Common mistakes that reduce the chance of recovery

Waiting for the seller’s promised refund before contacting the bank. Continue communicating only if safe, but report the financial transaction immediately.
Reporting only to the social-media platform. Platform enforcement is different from a bank dispute, consumer complaint, or criminal investigation.
Sending another payment. “Release fees,” “verification deposits,” “taxes,” and “recovery charges” are common follow-up scams.
Paying a supposed hacker or recovery agent. No private person can guarantee retrieval of transferred funds.
Deleting or blocking too early. Preserve the account, conversation, links, and identifiers first.
Submitting cropped or incomplete evidence. Keep context, timestamps, URLs, transaction references, and original files.
Describing a deceived but personally authorized transfer as technically unauthorized. Explain exactly what happened; the legal and bank treatment may differ.
Posting accusations with personal data online. Public shaming may expose the victim to privacy, defamation, or evidence-preservation problems without recovering the money.
Using unofficial “customer service” accounts. Scammers often impersonate banks, e-wallets, couriers, and government offices after a victim asks for help publicly.
Assuming business registration proves legitimacy. A certificate or registration number may be stolen, altered, or used without authority.

When help is urgent

Contact the financial institution and law enforcement without delay when:

the transfer happened recently and funds may still be traceable;
transactions continue or the account has been taken over;
a SIM, email account, banking credential, identification document, or biometric image was compromised;
the scammer is threatening violence, blackmail, or publication of intimate material;
a child is involved;
the victim is being directed to borrow money, surrender a device, meet a stranger, or accept and forward funds;
the scheme involves many victims, several recipient accounts, or an organized operation;
the victim’s account may have been used as a money-mule account; or
evidence is about to disappear.

For immediate danger, contact emergency services or the nearest police station. If intimate images or child sexual abuse material are involved, do not redistribute the files as proof; preserve the message and source information and obtain instructions from the proper authorities.

Frequently asked questions

Can the bank reverse an InstaPay, PESONet, card, or e-wallet payment?

Possibly, but not automatically. The result depends on the payment method, whether settlement has occurred, whether funds remain in a recipient account, the facts of the transaction, network rules, and applicable law. Report immediately and ask the institution to begin its disputed-transaction procedures.

Should I wait seven days before reporting to the police?

No. The seven-calendar-day internal-redress period under the Internet Transactions Act concerns exhaustion of the merchant or platform complaint process before pursuing the covered consumer claim. It should not delay urgent protection of funds or the reporting of possible crime.

Can I report even if I have only the scammer’s username or account number?

Yes. Supply every available identifier and preserve the original links and transaction records. A marketplace may be required to provide merchant information when a competent authority issues a subpoena in an investigation based on a sworn complaint. Disclosure to a private complainant is not automatic.

What if the seller blocked me or deleted the account?

Report the original profile URL, username, user ID if available, telephone number, payment destination, and transaction-reference number. Include archived emails, notifications, browser history, search results, and messages in which other people tagged or identified the account.

What if I paid outside the shopping platform?

Report to the platform anyway, but platform refund protection may be limited by its terms. Notify the financial institution and law enforcement immediately. Preserve proof that the seller directed you to pay outside the platform.

Is a police blotter enough?

Usually not by itself. A blotter records the report but may not contain the sworn, detailed evidence needed for investigation and prosecution. Ask the cybercrime investigator what affidavit, documents, and devices must be submitted.

Can I file with both DTI and law enforcement?

Yes, when the facts support both a consumer dispute and a possible crime. Disclose related proceedings when a form asks about them, and ensure that all accounts of the incident are accurate and consistent. The agencies provide different remedies and may refer matters outside their jurisdiction.

Will reporting guarantee a refund or conviction?

No. Recovery depends in part on whether funds remain traceable and legally recoverable. Criminal liability requires the evidence and legal standards applicable to the particular offense. A prompt, complete report improves the ability of institutions and investigators to act but cannot guarantee an outcome.

Official references

This article provides general legal information, not legal advice for a particular case. Applicable remedies and liability depend on the transaction, evidence, parties, financial institution, and procedural history. Official sources and reporting channels were checked as of September 16, 2026.