Quick answer

If money, account access, or personal information may still be at risk, act immediately:

Contact the sending bank, e-wallet, card issuer, or payment provider through its official fraud channel. Ask it to secure the account, mark the transaction as disputed, trace the transfer, coordinate with the receiving institution, and preserve relevant records.
Contact the receiving institution, if identifiable, and report the recipient account as suspected of receiving scam proceeds.
Report the incident to the PNP Anti-Cybercrime Group, the NBI, or another proper law-enforcement office. Online incidents may also be reported through the DOJ Office of Cybercrime or CICC’s hotline 1326.
Preserve messages, receipts, account numbers, usernames, URLs, call logs, emails, delivery records, and the device on which the incident occurred.
Change compromised passwords, revoke unknown sessions, and secure the affected mobile number and email account.

Reporting promptly improves the chance that funds or electronic evidence can still be located. It does not guarantee reimbursement. Recovery depends on such matters as where the money went, whether it remains in the financial system, whether the transaction was authorized, the institution’s security and fraud controls, the available evidence, and the legal identity and assets of the persons responsible.

First, determine what happened

“Scam” is a practical description, not a single offense under Philippine law. The facts may support one or more different remedies.

Possible legal classifications include:

Estafa or swindling, when deceit or another mode specified in Article 315 of the Revised Penal Code caused the victim to part with money or property and suffer damage.
Computer-related fraud, identity theft, or illegal access under the Cybercrime Prevention Act of 2012, when computers, mobile devices, accounts, or electronic data were unlawfully used or manipulated.
Social-engineering or money-mule offenses under the Anti-Financial Account Scamming Act, or AFASA.
Violations involving unauthorized access devices, securities, lending, consumer transactions, personal data, impersonation, falsified documents, or other special laws.
A civil breach of contract or nonpayment, if the evidence shows a genuine transaction that later failed rather than deceit existing when the money was obtained.

A broken promise, delayed delivery, unsuccessful investment, or unpaid debt is not automatically criminal fraud. Investigators and prosecutors will examine the representations made, the offender’s intent, what induced the payment, and what happened to the money.

Act while the transaction is still traceable

Contact the financial institutions first

Use only contact details shown in the institution’s official app, website, card, or account statement. Do not call a number supplied by the suspected scammer or contained in an unverified message.

Tell the institution:

that you are reporting a suspected scam or unauthorized transaction;
the exact amount, date, time, transaction or reference number, and recipient details;
whether you personally initiated the transaction;
whether you disclosed an OTP, PIN, password, card details, authentication code, or remote access;
whether your phone, SIM, email, or device may have been compromised; and
that you request immediate account protection, transaction tracing, coordinated verification, and preservation of records.

Ask for a case or ticket number and written confirmation. Record the date, time, channel, and name or identifier of every representative.

If several banks or e-wallets were used, report to each one. A complaint to law enforcement does not replace a fraud report to the payment provider, and a bank report does not replace a criminal complaint.

What AFASA may allow

Republic Act No. 12010 authorizes BSP-supervised institutions to temporarily hold funds involved in a disputed transaction under circumstances and procedures prescribed by the Bangko Sentral ng Pilipinas. The statutory ceiling is 30 calendar days, unless a competent court extends the hold.

Institutions and affected account owners must also undertake coordinated verification when a disputed transaction is reported or detected. The law permits restitution in certain cases involving inadequate risk-management controls or failure to exercise the required degree of diligence; a criminal conviction is not always a prerequisite.

These provisions do not mean that every report automatically freezes an account or produces a refund. A hold is temporary, subject to the governing rules and verification process, and cannot recover money that has already left reachable accounts. AFASA also penalizes malicious or bad-faith reporting of completely unwarranted or false information that causes funds to be held.

If the transaction was by card

Ask the card issuer whether a dispute or chargeback process is available and request the applicable deadline and required documents in writing. Chargebacks ordinarily arise from card-network and issuer rules; they are not an automatic statutory refund for every scam.

Clearly distinguish:

a charge you did not authorize;
a duplicated or incorrectly processed charge;
goods or services not received or materially different from what was promised; and
a payment you authorized after being deceived.

Those situations may be handled differently.

If the institution does not resolve the complaint

For a bank, e-money issuer, or other BSP-supervised institution, first use the institution’s own Financial Consumer Protection Assistance Mechanism. If the concern remains unresolved, escalate it through the BSP Consumer Assistance Mechanism. The BSP currently accepts complaints through BSP Online Buddy and, as an alternative, the prescribed complaint form sent to consumeraffairs@bsp.gov.ph.

The BSP channel addresses the conduct and complaint handling of supervised institutions. It is not a substitute for a police investigation or a court action against the scammer.

Secure compromised accounts and identities

If credentials or personal information were exposed:

Change the affected account password using a trusted device.
Change the password of the linked email account and any other account using the same or a similar password.
Sign out of other sessions and remove unfamiliar devices.
Enable multifactor authentication.
Block or replace affected cards and review transfer limits and beneficiaries.
Notify the mobile provider immediately if a SIM swap, lost SIM, or unauthorized porting may have occurred.
Remove unfamiliar remote-access or screen-sharing applications.
Review bank, e-wallet, email, social-media, and shopping-account activity.
Warn trusted contacts if your identity or messaging account is being used to solicit money.

If the device may contain evidence or malware, avoid factory-resetting it before asking an investigator or qualified forensic professional whether an image or examination is needed. You may still isolate it from networks and use a different trusted device to secure your accounts.

Preserve evidence properly

Keep both human-readable copies and the original electronic records where possible. Useful evidence commonly includes:

transaction receipts and complete account statements;
recipient account or wallet numbers and displayed account names;
chat histories, SMS messages, emails, voice messages, and call logs;
the sender’s email address, telephone number, profile URL, username, and user ID;
advertisements, listings, livestreams, websites, shortened links, and QR codes;
order confirmations, invoices, contracts, identification documents, and delivery records;
photographs or recordings sent by the other party;
notices from banks, e-wallets, telecom providers, platforms, or couriers;
proof of what was represented before payment;
a chronological account of events; and
the names and contact details of witnesses or other victims.

Take screenshots that show the date, time, account identity, URL, and surrounding conversation—not only an isolated statement. Export or download the full conversation and original email where the service allows it. An email’s original file and headers can contain information that a screenshot omits.

Keep an unedited master copy. Work from duplicates if you need to crop, annotate, or highlight evidence. Do not fabricate a conversation, alter timestamps, impersonate the suspect, or access another person’s account without authority.

Electronic documents may be admitted under the Rules on Electronic Evidence, but authenticity and integrity must still be shown. A screenshot is useful; it becomes stronger when supported by the original device, account records, transaction confirmations, testimony, and provider data.

Report to the proper authorities

PNP or NBI

For an online scam, you may approach the PNP Anti-Cybercrime Group, a regional or local cybercrime unit, or the NBI Cybercrime Division. The NBI’s published process for computer-crime assistance states that a complainant may be interviewed and assisted in completing a sworn complaint.

Bring:

a government-issued ID;
a clear incident chronology;
printed and electronic copies of the evidence;
proof of payment and account ownership;
the institutions’ ticket numbers and responses; and
the suspect’s identifying and account information, even if incomplete.

An online report or hotline call may begin triage, referral, or evidence preservation. Authorities may still require personal appearance, identity verification, original records, and a sworn affidavit before a formal investigation or prosecution proceeds.

Prosecutor’s office

A criminal complaint may be filed with the appropriate Office of the City or Provincial Prosecutor, usually through a complaint-affidavit and supporting affidavits and documents. Cases subject to preliminary investigation proceed under Rule 112 of the Rules of Criminal Procedure.

Venue depends on where the offense or an essential element occurred and on special jurisdictional rules. Cybercrime and cross-border facts can complicate the analysis. Ask the investigating agency or a lawyer which prosecutor’s office has proper territorial authority before filing.

A prosecutor determines whether the evidence supports filing a criminal case. A report, incident record, or affidavit does not itself establish guilt or ensure that charges will be filed.

Other regulators

Use the regulator that matches the transaction:

Online retail or consumer transaction: complain to the merchant or platform first and, where appropriate, use the DTI consumer complaint channels. The Internet Transactions Act governs covered internet transactions and imposes obligations on online merchants and e-marketplaces.
Investment, securities, or solicitation of public funds: report the offering to the Securities and Exchange Commission, especially if returns were promised or the promoter’s registration or authority is doubtful.
Personal-data misuse or a covered organization’s data-security failure: consider the National Privacy Commission’s complaint process.
Insurance product or unauthorized insurance activity: approach the Insurance Commission.

A regulator may investigate, mediate, or impose administrative sanctions within its jurisdiction. It does not necessarily recover money or prosecute every related crime.

How recovery may happen

Recovery can follow more than one path, and several may proceed together.

Recall, reversal, or return of reachable funds

The fastest possibility is institutional intervention before the funds are withdrawn, transferred onward, converted to virtual assets, or sent abroad. The sending and receiving institutions may trace and verify the transfer, but release or return of funds must follow applicable law, regulatory rules, and account procedures.

Do not assume that a displayed recipient name identifies the actual scammer. The account may belong to a money mule, a person whose identity was misused, or another victim.

Restitution connected with a criminal case

Civil liability arising from the charged offense is generally deemed instituted with the criminal action unless it was waived, reserved for a separate action, or previously filed, subject to Rule 111 of the Rules of Criminal Procedure.

A court may order restitution or damages when legally and factually supported. Under AFASA, conviction carries civil liability that may include restitution, while the Act separately recognizes potential institutional restitution in specified circumstances.

Even a favorable judgment may not result in immediate payment if the responsible person or recoverable assets cannot be found.

A separate civil action

A victim may have a civil claim for return of money, damages, breach of contract, fraud, or another recognized cause of action. The correct claim, defendant, venue, court, and prescriptive period depend on the documents and facts.

Small-claims procedure may be available for qualifying money claims within the current monetary limit under the Supreme Court’s rules. It is most useful when the defendant is identifiable, can be served, and the claim belongs to a category covered by the rule. It is not a substitute for criminal prosecution or a practical solution against an unknown online identity.

Under the current Rules on Expedited Procedures in the First Level Courts, qualifying small claims may involve amounts not exceeding ₱2,000,000, exclusive of interest and costs. Confirm the current forms and filing requirements with the Office of the Court Administrator or the proper first-level court before filing.

Barangay conciliation may be a precondition to some civil or criminal filings when the parties are covered by the Katarungang Pambarangay rules. Exceptions exist, including circumstances based on residence, urgency, the nature of the action, and the penalty involved. Do not assume that a barangay complaint is always required—or that it replaces an urgent bank or cybercrime report.

Claims against a financial institution

The fact that a scam passed through a bank or e-wallet does not automatically make the institution liable. Relevant questions include:

whether the payment was genuinely authorized;
whether credentials were stolen or voluntarily disclosed;
whether the institution employed adequate authentication, monitoring, and verification controls;
whether warning signs should reasonably have been detected;
whether the institution acted properly after receiving notice; and
whether its acts caused or increased the loss.

Preserve the institution’s terms, transaction alerts, fraud warnings, complaint correspondence, and final decision. A lawyer may need to assess AFASA, Republic Act No. 11765, BSP regulations, contract terms, and the specific transaction records.

Common mistakes that reduce the chance of recovery

Waiting for the scammer’s promised refund before notifying the bank.
Sending an additional “release fee,” “tax,” “verification deposit,” or “recovery charge.”
Trusting a person who claims to be a hacker, government agent, lawyer, or bank employee who can recover funds for an advance payment.
Deleting conversations, resetting the device, or closing the account before preserving evidence.
Reporting only to the social-media platform and assuming that a criminal case has been opened.
Posting unverified names, photographs, addresses, or accusations publicly. This can expose innocent account holders and create privacy, harassment, or defamation issues.
Paying for private subscriber or bank information that can lawfully be obtained only through institutional cooperation, legal process, or a court order.
Signing a quitclaim, settlement, affidavit of desistance, or acknowledgment without understanding its effect.
Assuming that a demand letter, barangay complaint, hotline report, or bank ticket suspends every legal deadline.
Filing identical narratives with inconsistent dates, amounts, or recipient details.

Correct mistakes openly. An accurate supplemental affidavit or clarification is safer than trying to conceal an error.

When legal help is urgent

Consult a Philippine lawyer promptly when:

the loss is substantial or involves several victims;
funds are still in a known account and urgent court relief may be possible;
the institution denies the claim despite apparent account takeover or security failure;
the suspect, money, or platform is outside the Philippines;
the scheme involves investments, virtual assets, forged documents, real property, or a business account;
you are being threatened, blackmailed, or pressured to destroy evidence;
your identity or account was used as a money mule;
police, prosecutors, or institutions give conflicting venue or filing instructions;
a prescriptive period may be approaching; or
you are offered a settlement that requires waiver of criminal or civil claims.

If you cannot afford private counsel, ask whether you qualify for assistance from the Public Attorney’s Office or an accredited legal-aid office.

For immediate threats to life or safety, contact emergency services or the nearest police station. Do not arrange a confrontation or attempt to seize property yourself.

A practical reporting checklist

Before ending each report, ask for:

the complaint or reference number;
the name of the unit handling the matter;
confirmation that transaction and account records will be preserved;
a list of missing documents;
the next procedural step;
the deadline for submitting additional evidence or appealing a decision; and
written notice of the outcome.

Maintain one case folder containing a master chronology, evidence index, copies of all submissions, delivery or acknowledgment receipts, and a log of every follow-up. Give agencies copies unless an authorized officer formally receives an original and provides a receipt.

Frequently asked questions

Can I recover money that I voluntarily transferred?

Possibly. A transfer induced by deception can still be part of a criminal or civil fraud claim. However, authorization of the payment may affect the institution’s dispute process and liability. Immediate reporting and proof of the deception are important.

Will reporting automatically freeze the recipient’s account?

No. Institutions may temporarily hold disputed funds under AFASA and applicable BSP rules, while courts and competent authorities have other powers under specific laws. A report alone does not guarantee a freeze, and the money may already have been moved.

Should I negotiate with the suspected scammer?

Do not send more money or disclose more information. Preserve all communications. Before making threats, accepting partial payment, signing a waiver, or arranging a meeting, seek guidance from the investigator or a lawyer.

Can I report even if I do not know the scammer’s real name?

Yes. Provide the account numbers, telephone numbers, usernames, profile links, URLs, payment references, and other identifiers you have. Identifying the responsible person may still require provider records and lawful investigative process.

Is a police blotter enough?

Usually not. A blotter entry records a report but may not complete the sworn complaint, supporting evidence, or prosecutor’s requirements. Ask what additional steps are required for investigation and prosecution.

How long do I have to file?

There is no single deadline for every scam. Criminal prescription depends on the offense and applicable penalty; civil claims have different periods depending on their legal basis and when the cause of action accrued. Institutional dispute and card processes may have much shorter contractual deadlines. Report immediately and obtain case-specific advice instead of relying on the longest possible period.

Should I report an attempted scam when no money was lost?

Yes, particularly if credentials were requested, an account was accessed, identity documents were used, or other people remain at risk. Attempts and related conduct may be punishable, and the information may help connect multiple incidents.

Will filing a criminal complaint guarantee repayment?

No. Investigation, prosecution, conviction, civil liability, tracing of assets, and actual collection are separate issues. Pursuing institutional remedies and preserving possible civil claims may therefore be necessary.

Official legal and reporting references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the evidence, institutions, parties, venue, and governing documents. Official sources and current procedures were checked as of 15 September 2026.