Quick answer

If you suspect fraud or estafa, act immediately: stop further payments, contact the bank or e-wallet through its official fraud channel, preserve every record, secure compromised accounts, and report the incident to law enforcement. To start a criminal case, the victim ordinarily submits a sworn complaint and supporting evidence to the proper prosecutor’s office or, depending on the offense and applicable procedure, to the appropriate first-level court.

A police, NBI, or cybercrime report documents the incident and may begin an investigation, but it does not by itself guarantee prosecution or repayment. Recovery may be pursued through the civil action deemed included in the criminal case, a separately reserved civil case, or—when the claim qualifies—a small-claims action. The correct route depends on how the money or property was obtained, the evidence of deceit or misappropriation, the amount involved, the parties’ locations, and whether the transaction was online.

When suspected fraud may be estafa

“Fraud” is a broad description. Estafa is a specific crime under Article 315 of the Revised Penal Code. Common forms include:

receiving money, goods, or property in trust, on commission, for administration, or under an obligation to deliver or return them, then misappropriating or converting them;
obtaining money or property through a false name, false qualifications, fictitious business, fraudulent transaction, or another false pretense made before or at the same time as the victim parted with the property; and
using fraudulent means to cause another person financial or property damage.

The prosecution must prove the elements of the particular form charged. In a false-pretense case, for example, the representation must generally have been made before or simultaneously with the transfer, the victim must have relied on it, and the reliance must have caused damage. In misappropriation cases, the legal character of the original receipt—such as whether ownership was transferred or there was a duty to return or deliver the same property—can be decisive.

A failed investment, unpaid debt, broken promise, delayed delivery, or breach of contract is not automatically estafa. Criminal liability ordinarily requires the deceit, abuse of confidence, or fraudulent conversion specified by law. The Supreme Court has also cautioned that mere possession or handling of property does not, without the other required facts, establish misappropriation. See Article 315 of the Revised Penal Code and the Supreme Court’s discussion in Medina v. People.

Other laws may apply instead of, or alongside, Article 315. Examples include bouncing-check offenses, falsification, identity theft, unauthorized account access, investment or securities violations, and offenses involving financial accounts. The final charge is determined from the evidence, not from the label used by the complainant.

If the fraud happened online

When estafa is committed through an information and communications technology system, the Cybercrime Prevention Act may apply. Section 6 of Republic Act No. 10175 provides for a penalty one degree higher than that imposed by the underlying law when a crime under the Revised Penal Code or a special law is committed by, through, or with the use of information and communications technology.

Online incidents may also involve computer-related fraud, computer-related identity theft, illegal access, or misuse of financial accounts. Relevant primary laws include the Cybercrime Prevention Act and the Anti-Financial Account Scamming Act.

Do not assume that every online non-delivery case automatically carries a cybercrime enhancement. The prosecution must still establish the elements of the underlying offense and the legally significant use of technology.

What to do immediately

1. Stop the loss

Do not send “verification,” “release,” “tax,” “insurance,” or “recovery” payments demanded after the first transfer. Fraudsters often claim that one more payment will unlock a refund.

If a card, bank, e-wallet, or online account may be compromised:

change the password using a clean device;
sign out other sessions;
enable multi-factor authentication;
freeze or block affected cards and accounts where available; and
change reused passwords on other services.

Do not continue communicating merely to gather evidence if doing so could expose you to further loss, threats, malware, or identity theft.

2. Contact the financial institution at once

Use only the phone number, in-app support function, website, or branch information published by the bank, e-wallet, remittance company, card issuer, or payment platform. Ask it to:

flag the transaction as suspected fraud;
attempt a hold, recall, reversal, or dispute, if available;
secure the sending account;
preserve transaction and access records;
identify the reference or case number; and
state the documents and deadlines for its internal dispute process.

A recall or reversal is not guaranteed. Speed matters because transferred funds can be withdrawn or moved through several accounts. Do not rely only on a social-media message to the provider.

3. Preserve evidence before content disappears

Keep original files and make backed-up copies of:

receipts, deposit slips, transaction confirmations, reference numbers, and account statements;
the recipient’s account name, account number, mobile number, QR code, wallet ID, and payment link;
complete chat and email threads showing dates, times, usernames, and profile details;
advertisements, listings, livestreams, websites, URLs, and social-media profiles;
contracts, invoices, order forms, delivery promises, investment presentations, and acknowledgment receipts;
audio or video recordings lawfully obtained;
identification documents or business permits supplied by the other party;
demand letters, delivery records, returned mail, and responses;
names and contact details of witnesses; and
reports or case numbers issued by banks, platforms, police, or government agencies.

Export chats where the platform allows it. Retain the original device and unedited files. Screenshots are useful, but they should show enough context to identify the account, date, time, and full conversation. Record the URL separately because screenshots alone may not establish where content appeared.

Create a chronological summary listing each representation, payment, promised performance, follow-up, and discovery of the suspected fraud. Separate what you personally know from what another person told you.

4. Avoid contaminating the evidence

Do not edit screenshots, impersonate another person, access the suspect’s account without authority, secretly alter transaction records, or publicly accuse someone as a criminal. Preserve evidence privately and give it to the proper institution or investigator. Public posts may expose personal data, alert suspects, invite defamation disputes, or interfere with tracing efforts.

Where to report

Depending on the facts, you may report to:

the nearest Philippine National Police station;
the PNP Anti-Cybercrime Group for internet-enabled incidents;
the National Bureau of Investigation, including its cybercrime investigators;
the city or provincial prosecutor’s office with proper territorial jurisdiction;
the affected bank, e-wallet, remittance service, marketplace, or payment platform; and
the appropriate regulator, such as the Bangko Sentral ng Pilipinas, Securities and Exchange Commission, Insurance Commission, or Department of Trade and Industry, when the transaction falls within that agency’s authority.

A regulator’s consumer-assistance or administrative process serves a different purpose from a criminal complaint. Reporting to a bank, platform, or regulator does not necessarily stop the limitation period for a criminal or civil action.

If the suspect, victim, accounts, and transactions are spread across several places, ask a lawyer or prosecutor to assess venue. Under the Rules of Criminal Procedure, a criminal action is generally instituted and tried where the offense, or any essential ingredient of it, occurred. Online communications and transfers can make that analysis fact-sensitive. See Rule 110, Section 15.

Preparing the criminal complaint

A complaint should be factual, chronological, and supported by documents. It should ordinarily identify:

the complainant and respondent;
when and where the material events occurred;
the exact statements or conduct alleged to be false or fraudulent;
why those representations were false;
how and why the complainant relied on them;
each transfer of money or property;
any trust, commission, agency, or return obligation;
the demand made and the response, if demand is legally or evidentially relevant;
the loss or damage; and
the participation of each respondent.

The complaint-affidavit should be sworn before an officer authorized to administer oaths. Supporting witnesses may execute their own affidavits. Attach readable, organized copies of the evidence and retain the originals.

Avoid broad conclusions such as “they scammed me” without explaining the acts that satisfy the legal elements. Also avoid naming a person merely because an account was registered in that person’s name. Account ownership may be important evidence, but participation and criminal intent must still be established.

What happens after filing

The route depends partly on the penalty prescribed for the offense and therefore, in estafa cases, often on the amount of damage and the mode allegedly used.

Under Rule 112, a preliminary investigation is generally required when the prescribed penalty is at least four years, two months, and one day, without regard to the fine. The respondent is ordinarily given an opportunity to submit a counter-affidavit and evidence. The prosecutor determines whether the evidence justifies holding the respondent for trial; guilt beyond reasonable doubt is decided by the court, not at preliminary investigation.

For offenses not requiring a preliminary investigation, different filing procedures may apply before the prosecutor or proper first-level court, subject to local rules and special provisions. Arrest is not automatic merely because a complaint was filed.

The schedules governing estafa penalties and jurisdiction are technical. Republic Act No. 10951 adjusted the value thresholds in Article 315, and the amount involved can affect the penalty, preliminary investigation, court jurisdiction, bail, and prescription. Consult the full text of Republic Act No. 10951 rather than relying on older charts.

Barangay conciliation may be required in some cases

Before certain court actions may be filed, the Katarungang Pambarangay process can be a condition precedent when the parties actually reside in the same city or municipality. The requirement has statutory exceptions, including disputes involving the government, public officers acting officially, parties residing in different cities or municipalities except in specified adjoining-barangay situations, offenses punishable by imprisonment exceeding one year or a fine exceeding ₱5,000, and cases requiring urgent legal action.

Whether barangay conciliation applies must be checked against the actual parties, residence, offense, penalty, and relief sought. Do not assume that obtaining a barangay blotter or certificate is always necessary—or always sufficient. The controlling provisions are Sections 408 to 412 of the Local Government Code.

Seeking repayment or return of property

Civil liability in the criminal case

When a criminal action is instituted, the civil action to recover civil liability arising from the offense is generally deemed instituted with it unless the offended party:

waives the civil action;
reserves the right to bring it separately; or
files the civil action before the criminal action.

The reservation must be made at the time allowed by Rule 111. Filing a separate case without considering this rule can create procedural problems. The court may order restitution, reparation, or indemnification if liability is established, but a judgment does not guarantee collection if the liable person has no reachable assets.

Read Rules 110 to 127 of the Rules of Criminal Procedure, particularly Rule 111.

An independent civil case

A civil action may be appropriate when the evidence supports breach of contract, rescission, collection, restitution, damages, or another civil remedy, even if criminal intent cannot be proved. The proper cause of action depends on the documents and how the transaction was structured.

Civil and criminal remedies should be coordinated. The rules on reservation, suspension, consolidation, prejudicial questions, double recovery, and prescription can affect strategy. Payment or settlement may resolve civil liability but does not automatically extinguish a public criminal action.

Small claims

A qualifying claim for payment or reimbursement of money not exceeding ₱1,000,000, exclusive of interest and costs, may generally be brought under the Rules on Expedited Procedures in the First Level Courts. Common examples include money owed under a contract, loan, service, sale, or damage to property.

Small claims are designed for simpler money demands; attorneys may not appear as advocates at the hearing, although a party may consult one beforehand. The procedure is not a substitute for criminal prosecution, and not every fraud-related dispute fits its covered causes of action. Confirm the current forms, filing venue, fees, and required attachments through the Supreme Court’s Office of the Court Administrator or the clerk of the proper first-level court.

Deadlines and prescription

Do not wait for a promised repayment, a platform investigation, or informal negotiations to finish before checking legal deadlines.

For crimes under the Revised Penal Code, prescription depends on the legally prescribed penalty. Article 90 sets different periods, while Article 91 governs when prescription begins and how it is interrupted. Because the amount of damage can change the estafa penalty, it can also affect the prescriptive period. Determining when the offense was discovered, what valid proceeding interrupted prescription, and which version of the law applies requires examination of the dates and records.

Civil deadlines depend on the cause of action. Under the Civil Code, examples include:

ten years for actions upon a written contract, an obligation created by law, or a judgment;
six years for actions upon an oral contract or quasi-contract; and
four years for actions based on injury to rights or fraud, counted as the applicable law provides.

Those categories are not interchangeable, and another specific law may supply a different period. Under Article 1155, civil prescription may be interrupted by filing an action, a written extrajudicial demand, or a written acknowledgment of the debt by the debtor. Whether a communication qualifies must be assessed from the document itself. See Articles 1144 to 1155 of the Civil Code.

Seek advice promptly if a transaction or discovery occurred years ago. Do not calculate a deadline solely from an online summary.

Demand letters and settlement

A clear written demand can help establish default, confirm the amount claimed, invite repayment, and preserve a record. In some forms of estafa involving property received with a duty to deliver or return, demand can be important evidence of misappropriation, although it is not an inflexible element in every case.

A demand letter should identify the transaction, amount or property due, factual basis, payment instructions, and reasonable deadline. It should not contain threats of violence, public humiliation, disclosure of private information, or unsupported accusations.

Before accepting a settlement:

verify that funds have cleared;
put the terms, dates, and consequences of default in writing;
identify whether payment is full or partial;
avoid signing a general waiver without understanding its scope;
preserve security or collateral arrangements properly; and
clarify what, if anything, will be filed with the prosecutor or court.

Private settlement does not automatically compel the State to dismiss a criminal prosecution. An offended party’s affidavit of desistance is not conclusive, although it may affect the evidence and civil claim. Conversely, accepting partial payment does not necessarily waive the balance unless the agreement says so or the law treats the payment as full satisfaction.

Common mistakes that weaken a case

Continuing to send money after obvious warning signs.
Deleting chats, losing the original phone, or keeping only cropped screenshots.
Reporting only a conclusion instead of identifying each false statement and transfer.
Treating every unpaid obligation as criminal estafa.
Filing in a convenient but legally improper venue.
Naming account holders, employees, officers, or relatives without evidence of participation.
Exaggerating the amount or mixing personal knowledge with hearsay.
Submitting altered, incomplete, or unreadable documents.
Assuming a police blotter is already a prosecutor’s complaint.
Waiting for a platform’s response while legal periods continue to run.
Starting separate civil and criminal proceedings without considering Rule 111.
Paying an unofficial “investigator,” “hacker,” or recovery agent who promises guaranteed retrieval.
Posting accusations and unredacted IDs, bank details, or private conversations online.

When legal help is urgent

Consult a Philippine lawyer promptly when:

a substantial amount, land, securities, cryptocurrency, or business assets are involved;
funds are still moving and preservation, attachment, or other urgent relief may be possible;
the suspect threatens violence, blackmail, or destruction of evidence;
several victims or several jurisdictions are involved;
the suspect is abroad or used foreign accounts;
the transaction occurred years ago;
the complainant has received a subpoena, countercharge, settlement proposal, or waiver;
the prosecutor dismissed the complaint and a review deadline may apply;
the case involves a corporation, investment solicitation, forged public documents, or regulated financial activity; or
you are unsure whether the matter is estafa, a civil debt, or another offense.

Victims who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility and merit requirements. A lawyer can also assess whether provisional remedies are realistic; these remedies require legal grounds, procedure, and often a bond.

Frequently asked questions

Can I file estafa if I do not know the suspect’s real name?

You may report the incident using the identifiers available, such as account numbers, phone numbers, usernames, URLs, and transaction references. Identification may require lawful requests to financial institutions or platforms. A prosecutor or court case against a particular person will ultimately require evidence connecting that person to the offense.

Is a police blotter enough?

No. It records the report and may support an investigation, but it is not ordinarily a substitute for the sworn complaint and evidence required for prosecution.

Must I send a demand letter first?

Not in every estafa case. Its importance depends on the form of estafa and the disputed facts. Demand may be especially useful evidence where property was received under an obligation to return or deliver it, but pre-existing fraudulent conduct may be proved in other ways.

Can the bank simply return the money?

Sometimes a transaction can be held, recalled, reversed, or disputed, but this depends on speed, the payment method, applicable rules, account status, and the evidence. Neither a report nor a court case guarantees that funds remain available.

Does repayment erase estafa?

Not automatically. Repayment may affect civil liability and may be relevant to the evidence or settlement, but criminal liability is generally based on the offense as completed. The offended party cannot privately extinguish a public criminal action merely by accepting payment.

Can I pursue both a criminal complaint and repayment?

Yes, subject to Rule 111 and the prohibition against double recovery. The civil claim arising from the offense is ordinarily included in the criminal case unless waived, reserved, or previously filed.

Is every fake online sale cybercrime?

No. The facts must establish an underlying offense or a cybercrime specifically defined by law. Non-delivery alone may be a civil breach; evidence of a fraudulent representation existing when payment was induced can materially change the analysis.

How long will the case take?

There is no reliable universal timetable. Investigation, prosecutor review, service on respondents, court congestion, motions, trial, and appeals vary considerably. Anyone promising a guaranteed filing result, arrest date, conviction, or recovery should be treated with caution.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case. The applicable offense, venue, procedure, deadline, and remedy depend on the evidence and governing law. Official sources were checked as of 17 September 2026.