Reporting Suspected Fraud or Estafa and Seeking Recovery

Quick answer

Report suspected fraud or estafa immediately to the police, the National Bureau of Investigation, or the prosecutor’s office with jurisdiction over the place where the offense—or an essential part of it—occurred. At the same time, contact the bank, e-wallet, card issuer, remittance company, marketplace, or other platform involved and ask it to secure the account, trace the transaction, preserve records, and attempt a lawful recall or hold.

A criminal complaint may punish the offender, but it does not guarantee repayment. Recovery may be pursued through the civil liability ordinarily included in the criminal case, an appropriate separate civil action, or both as procedural rules allow. Speed matters: transferred funds can move quickly, electronic records may be deleted, and criminal and civil claims have prescription periods.

Not every unpaid debt, failed investment, broken promise, or bad business deal is estafa. The evidence must show the elements of a recognized fraudulent scheme—not merely failure to pay or perform.

What counts as estafa?

Article 315 of the Revised Penal Code punishes specified forms of swindling. Broadly, these include fraud committed through:

• Abuse of confidence, such as fraudulently misappropriating or converting money, goods, or other personal property received in trust, on commission, for administration, or under an obligation to deliver or return it;
• False pretenses or fraudulent acts, such as using a fictitious identity, pretending to possess qualifications, authority, property, credit, business, or influence, or making other material misrepresentations that induce a victim to part with money or property; and
• Certain fraudulent means involving instruments, transactions, or property.

For estafa by false pretenses, prosecutors generally look for proof that:

1. The respondent made a false representation or used another fraudulent means;
2. The deceit occurred before or at the same time as the victim parted with money or property;
3. The victim relied on the deceit; and
4. The victim suffered damage.

For estafa through misappropriation or conversion, the important questions commonly include:

1. What money or property was received;
2. Why and under what obligation it was received;
3. Whether it had to be delivered, returned, or accounted for;
4. How it was misappropriated, converted, or denied; and
5. What loss resulted.

The exact mode must match the facts alleged and the documents submitted. The Supreme Court has emphasized that an accusation must allege and prove the essential elements of the particular form of estafa charged. See, for example, Co v. People, G.R. No. 233015.

Fraud versus an ordinary civil dispute

A case is not automatically criminal simply because:

• A borrower did not repay on time;
• A seller failed to deliver;
• An investment lost money;
• A business closed;
• A check was dishonored;
• A contractor abandoned a project; or
• A promise was not fulfilled.

A mere breach of contract ordinarily creates civil liability. Criminal fraud requires the additional facts specified by law, such as pre-existing deceit or fraudulent conversion of property received under a qualifying obligation.

Useful indicators of possible criminal fraud include fabricated identities or documents, false claims about licenses or ownership, deliberate concealment of material facts, use of several victim accounts, immediate diversion of entrusted funds, admissions of conversion, or proof that the promised product, authority, asset, or transaction never existed.

These indicators are evidence to investigate, not automatic proof of guilt. A respondent may have defenses based on the agreement, ownership of the funds, good faith, authority to use the property, later events, or the absence of reliance and damage.

What to do immediately

1. Stop further loss

Do not send additional money to “unlock” a refund, pay a supposed tax, verify an account, or fund a recovery agent. Do not provide another OTP, PIN, password, recovery phrase, or remote-access code.

Change compromised passwords using a clean device. Secure the connected email account first, then banking, e-wallet, marketplace, and social-media accounts. Enable multi-factor authentication and sign out unknown sessions.

2. Notify every financial institution involved

Contact the bank, e-wallet, card issuer, remittance service, or cryptocurrency platform through its verified official channel. Provide:

• Transaction date and time;
• Amount and currency;
• Reference or trace number;
• Sender and recipient account details;
• A short explanation that fraud is suspected; and
• The police, NBI, or prosecutor reference number when available.

Ask for written acknowledgment and a case number. Request preservation of transaction, device, login, merchant, and beneficiary records. A recall, reversal, hold, or refund is not automatic; it depends on the payment system, account status, provider rules, and lawful process.

For a complaint involving a financial institution supervised by the Bangko Sentral ng Pilipinas, complain first to the institution through its consumer-assistance channel. If unresolved, use the BSP Consumer Assistance Mechanism. A BSP complaint is regulatory or consumer-assistance action; it does not replace a criminal complaint.

3. Preserve evidence before accounts disappear

Keep the original files and devices when possible. Preserve:

• Full chat and email threads, including usernames, profile links, headers, dates, and times;
• Advertisements, product pages, investment presentations, job offers, and promises;
• Contracts, receipts, invoices, acknowledgment letters, checks, and delivery records;
• Bank or e-wallet statements and official transaction confirmations;
• Account names, numbers, QR codes, wallet addresses, and transaction hashes;
• Recorded calls or voice messages lawfully in your possession;
• Photographs, videos, identification documents, permits, and certificates supplied by the respondent;
• Witness names and contact details;
• Demand letters, delivery proof, replies, and admissions;
• Platform complaint numbers and communications; and
• A chronological account of what happened.

Take screenshots, but also export or download original messages and files where the service permits it. Screenshots alone may omit metadata and surrounding context. Do not crop out dates, account identifiers, URLs, or transaction references. Keep an untouched copy and work from duplicates.

Do not access another person’s account, impersonate the suspect, install spyware, or obtain evidence through hacking. Illegally obtained evidence may create separate legal problems.

4. Report the account or listing to the platform

Use the platform’s fraud-reporting process and request preservation of the account and transaction records. Report impersonation to the real person or organization through independently verified contact details.

Platform removal can prevent further victims, but deleting the account may also make evidence harder to retrieve. Preserve your copies first and include the relevant links and identifiers in the formal complaint.

Where to file

Local police or specialized investigators

You may initially report to the local Philippine National Police unit. For internet-enabled fraud, you may also approach the PNP Anti-Cybercrime Group or the NBI, including its cybercrime investigators.

An incident report or blotter entry records the report but does not necessarily begin the prosecutor’s preliminary investigation. Ask what additional affidavit, referral, or complaint must be filed.

Office of the prosecutor

A criminal complaint may be filed with the appropriate city or provincial prosecutor. Under Rule 110, venue is generally where the offense was committed or where any essential ingredient occurred. In an online transaction, determining venue may require examining where the representations were received, where reliance or payment occurred, and where the resulting acts took place.

The complaint should ordinarily include:

• A sworn complaint-affidavit;
• Sworn affidavits of supporting witnesses;
• The respondent’s known name, aliases, addresses, and account identifiers;
• A clear chronology;
• The exact representations or entrusted-property arrangement;
• How you relied on the conduct;
• The amount and nature of the loss; and
• Legible, organized supporting documents.

Under Rule 112, when preliminary investigation is required, the complainant’s affidavits and supporting documents must establish probable cause. The respondent generally has 10 days from receipt of the subpoena and complaint materials to submit counter-affidavits. Procedures can differ for offenses not requiring preliminary investigation, warrantless-arrest cases, and locally adopted electronic-filing arrangements. Confirm the current filing method directly with the prosecutor’s office.

Other agencies

The appropriate regulator depends on the scheme:

• Suspected unregistered securities solicitations, investment contracts, or misuse of a company: Securities and Exchange Commission;
• Complaints involving BSP-supervised banks, e-money issuers, or other supervised financial institutions: Bangko Sentral ng Pilipinas;
• Deceptive consumer transactions within its authority: Department of Trade and Industry;
• Privacy violations or misuse of personal data: National Privacy Commission.

A report to a regulator or platform does not necessarily institute a criminal action or stop prescription. If criminal prosecution is intended, confirm that the proper complaint has been filed with the prosecutor or court.

Online fraud and identity misuse

When a Revised Penal Code offense is committed by, through, or with information and communications technology, Section 6 of the Cybercrime Prevention Act may apply and provides for a penalty one degree higher than the underlying offense. The same statute separately covers conduct such as computer-related fraud, computer-related forgery, and computer-related identity theft when their specific elements are present.

The fact that parties communicated online does not by itself prove cybercrime. Investigators must determine how the computer system was used and which statutory elements the evidence supports. See Republic Act No. 10175.

Do not assume an account name identifies the offender. Subscriber information, device records, IP logs, financial-account records, and platform data may require lawful preservation requests, subpoenas, warrants, or other official process.

How recovery may work

Civil liability in the criminal case

Rule 111 generally provides that when a criminal action is instituted, the civil action to recover civil liability arising from the offense is deemed instituted with it unless the offended party:

• Waives the civil action;
• Reserves the right to file it separately; or
• Filed it before the criminal case.

The choice matters. A reservation generally must be made before the prosecution begins presenting evidence and under circumstances giving the offended party a reasonable opportunity to reserve. A claimant also cannot recover twice for the same injury.

Actual loss must still be proved. Organize bank records, receipts, contracts, valuations, and other evidence showing the amount transferred, property lost, payments recovered, and expenses legally attributable to the offense.

A separate civil action

Depending on the facts, recovery may also rest on a contract, return of property, damages, fraud, unjust enrichment, or another civil-law source. The legal basis affects the parties, evidence, venue, filing fees, prescription, and whether the civil case may proceed independently or must be suspended while the criminal case is pending.

Consult counsel before filing parallel proceedings or making a reservation. An incorrect procedural choice can cause delay and unnecessary cost.

Attachment and preservation of assets

Rule 127 permits preliminary attachment in specified circumstances when the civil action is properly included in the criminal case—for example, in certain claims involving fraudulently misapplied or converted money or property, concealment or disposal of assets, risk of flight, or a respondent residing outside the Philippines.

Attachment is a court remedy, not an automatic freeze. It requires a proper application, factual and legal grounds, and compliance with bond and procedural requirements. Seek urgent legal help if there is evidence that identifiable assets are being transferred, concealed, or sold.

Settlement and restitution

A voluntary repayment or settlement may recover funds sooner, but private settlement does not automatically erase public criminal liability. The effect depends on the offense, stage of the case, terms of the agreement, and applicable law.

Do not sign a quitclaim, affidavit of desistance, release, novation agreement, or settlement stating facts you do not understand. Have the document specify payment dates, amounts, defaults, security, treatment of pending cases, and whether the release takes effect only after cleared funds are received.

Penalties and amount thresholds

The penalty for estafa depends on the statutory mode, the proven amount of fraud, and circumstances such as use of information and communications technology. Republic Act No. 10951 adjusted the monetary thresholds in Article 315 and other provisions of the Revised Penal Code.

Do not rely on old charts using pre-2017 amounts. The charging and penalty analysis should use the law applicable to the date of the alleged offense, together with any legally applicable favorable amendment. The controlling text is Republic Act No. 10951.

A dishonored check may also raise issues under Batas Pambansa Blg. 22, but a bounced check is not automatically estafa. The two offenses have different elements, notice requirements, defenses, and civil-action rules.

Deadlines and prescription

There is no standard waiting period before reporting fraud. Report promptly.

Criminal prescription varies according to the offense and imposable penalty. Articles 90 and 91 of the Revised Penal Code govern many offenses under the Code, including when prescription begins and how it is interrupted. Special laws may have different rules. The legally relevant date may involve commission or discovery, but “discovery” is a fact-specific legal question—not permission to delay after warning signs appear.

Civil claims have separate prescription rules that depend on whether the action is based on a written contract, oral agreement, injury to rights, fraud, or another source of obligation. A demand letter, agency report, or informal negotiation does not always have the same effect as filing the proper action.

Because classification and amount can change the applicable period, anyone facing an old transaction or an approaching anniversary should obtain legal advice immediately and bring the complete documents.

Common mistakes to avoid

• Treating every unpaid obligation as criminal fraud;
• Waiting for the suspect to make repeated promises while records and funds disappear;
• Sending more money to secure a supposed refund;
• Filing only a platform, bank, barangay, or regulatory complaint and assuming a criminal case has begun;
• Naming account holders as masterminds without evidence of their participation;
• Submitting screenshots without transaction records or a coherent chronology;
• Editing, annotating, or deleting original evidence;
• Posting accusations and personal information publicly, creating defamation or privacy risks;
• Threatening violence, detention, or public humiliation;
• Paying an unofficial “fixer” who promises an arrest, account freeze, or guaranteed recovery;
• Signing an affidavit of desistance or full release before payment clears; and
• Filing in a place with no legally sufficient connection to an essential element of the offense.

When legal help is urgent

Consult a Philippine lawyer promptly when:

• The loss is substantial or involves several victims;
• Assets are being moved or sold;
• A bank or platform says records will be retained only for a limited time;
• Cryptocurrency, foreign accounts, shell companies, or overseas suspects are involved;
• The suspect used stolen identity documents or accessed your accounts;
• You must choose whether to reserve or separately file the civil action;
• You are considering attachment, an injunction, or another urgent remedy;
• The complaint has been dismissed or you received an adverse prosecutor’s resolution;
• You have been subpoenaed, arrested, or named as an account holder or intermediary; or
• Prescription may be close.

Those unable to afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility, merit, and conflict-of-interest rules. Victims may also ask the prosecutor’s office about available witness or victim-assistance services.

Frequently asked questions

Can I file even if I know only the scammer’s username or account number?

You may report with the identifiers and evidence you have. State clearly which personal details are unknown and avoid guessing. Investigators may seek subscriber, banking, or platform records through lawful procedures, but identification and recovery are not guaranteed.

Is a demand letter required before filing estafa?

Not in every form of estafa. A demand can be important evidence in some misappropriation or conversion cases because it may help show failure to return or account for property, but demand is not a substitute for proving every element. Whether it is legally necessary or strategically advisable depends on the particular charge and documents.

Can I report a small loss?

Yes. The amount can affect the penalty and procedure, but a small loss is not automatically outside the law. Preserve the same quality of evidence and disclose any partial refund.

Does repayment erase the crime?

Not automatically. Repayment may affect civil liability, evidence, settlement decisions, or penalty-related considerations, but criminal liability is generally a matter of public law. Never promise withdrawal or dismissal without understanding what the law and the prosecutor or court permit.

Can a group of victims file together?

Victims may coordinate evidence and identify a common scheme, but each person should document their own representations, reliance, transfers, and loss. Whether incidents belong in one complaint or separate complaints depends on the acts, accused persons, dates, locations, and procedural rules.

Will the bank automatically return the money?

No. A financial institution may attempt a recall, place a lawful restriction, investigate an unauthorized transaction, or process a dispute under applicable rules, but recovery depends on the payment method, timing, authorization evidence, recipient-account status, and legal process.

Can I publicly name the suspected scammer?

Public accusations can create defamation, privacy, harassment, and evidentiary risks, especially before identity and guilt are established. Give evidence to the proper authorities and obtain advice before publishing names, photographs, addresses, or identification documents.

Official legal sources

• Revised Penal Code, particularly Articles 315, 90, and 91
• Republic Act No. 10951, adjusting monetary thresholds and fines
• Republic Act No. 10175, the Cybercrime Prevention Act
• Rules 110 to 127 of the Rules of Criminal Procedure, particularly Rules 110, 111, 112, and 127
• Supreme Court E-Library for controlling decisions and current Court issuances
• Department of Justice for prosecution-related issuances and services

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The correct offense, venue, remedies, deadlines, and recovery strategy depend on the evidence and applicable law. Sources and procedures were checked as of September 15, 2026.