Quick answer

A victim of a cryptocurrency investment scam should act immediately. Contact the bank, e-wallet, payment service, or crypto exchange used for the transfer; ask its fraud team to hold, recall, or restrict the transaction and preserve the recipient’s account records. Then report the scheme to the Securities and Exchange Commission (SEC) and file a complaint with the National Bureau of Investigation (NBI), Philippine National Police (PNP), or the appropriate prosecutor’s office.

Recovery is possible, but never guaranteed. Cryptocurrency transfers generally cannot be reversed simply because the sender was deceived. The best chance of recovery arises when funds remain in an identifiable account or licensed exchange, investigators can trace them, and a lawful freeze, seizure, restitution, or damages order can be obtained before the assets disappear.

Do not send another payment for a supposed “withdrawal fee,” “tax,” “verification deposit,” or “recovery charge.” That is often the next stage of the scam.

What counts as a cryptocurrency investment scam?

Common schemes include:

A fake trading platform that displays fabricated profits but blocks withdrawals.
A person posing as a trader, broker, adviser, celebrity, or exchange representative.
Guaranteed or unusually high returns from crypto trading, staking, mining, or arbitrage.
A Ponzi arrangement that pays early participants using money from later investors.
A romance or friendship scam that gradually introduces a fraudulent investment platform.
A “task,” “liquidity,” or “copy-trading” scheme requiring repeated deposits.
An unlicensed public offering of tokens, investment contracts, or pooled crypto investments.
A recovery agent who asks for advance payment after the first scam.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, defines investment fraud broadly as deceptive solicitation of investments from the public. It expressly includes Ponzi schemes, boiler-room operations, and public investment offerings made without the required SEC license or permit, unless the securities or transaction are legally exempt. Investment fraud is unlawful under Section 11 of the Act. Read Republic Act No. 11765.

A failed or losing crypto investment is not automatically fraud. The facts must ordinarily show deception, an unauthorized offering, misappropriation, or another legal violation. Genuine market losses, without misrepresentation or wrongdoing, do not by themselves create a right to reimbursement.

Take these steps immediately

1. Stop all contact and further payments

Do not warn the scammer that you are reporting the transaction. Do not click new links or install any program they send. Block remote-access applications and revoke suspicious wallet permissions where technically appropriate.

If you disclosed a password, one-time PIN, seed phrase, private key, recovery code, or identity document:

Change passwords using a clean device.
Enable strong multi-factor authentication.
Sign out other active sessions.
Contact the affected financial institutions.
Move unaffected crypto to a new wallet only if you can do so safely and without destroying evidence.
Tell your mobile provider if SIM swapping may be involved.

Never give anyone a seed phrase or private key. A legitimate regulator, police officer, exchange, lawyer, or blockchain analyst does not need it to investigate a complaint.

2. Contact every institution in the payment chain

Immediately notify the sending bank, e-wallet, remittance provider, card issuer, or exchange through its official fraud channel. If you know the receiving institution, notify it as well.

Provide:

The transaction date, time, amount, and currency.
Bank reference numbers or crypto transaction hashes.
The recipient’s account name, number, wallet address, username, or merchant details.
A short statement that the transfer was induced by an investment scam.
Your police, NBI, SEC, or prosecutor reference number once available.

Ask the institution to:

Attempt a recall or hold.
Restrict any recipient account when legally permitted.
Preserve account-opening, know-your-customer, login, device, and transaction records.
Escalate the report to its fraud and anti-money-laundering teams.
Give you a written acknowledgment or case number.

A recall request is not a court-ordered freeze, and the institution may be unable to return a transfer already withdrawn or moved. Speed nevertheless matters. The BSP advises consumers to report suspicious transactions to their bank or e-money issuer immediately. Use the BSP’s official verification and scam-reporting information.

3. Notify the crypto exchange or platform

If the destination wallet belongs to a centralized exchange, send the exchange’s compliance or fraud team:

The transaction hash and blockchain network.
The receiving wallet address.
The amount and exact timestamp.
The police or NBI complaint reference.
A request to preserve records and restrict the account if its rules and applicable law permit.

Do not claim that you own funds merely because they passed through an address. Give accurate facts and let the exchange and authorities establish ownership and control.

A self-hosted wallet has no central operator capable of reversing a transfer. Even then, tracing may reveal that funds later entered an exchange where account records exist.

4. Preserve evidence before it disappears

Keep original electronic files wherever possible. Save:

Complete chat histories, emails, voice messages, and call logs.
Usernames, profile links, phone numbers, email addresses, and group names.
Advertisements, livestreams, websites, domain names, and app-download links.
Contracts, brochures, white papers, account statements, and promised returns.
Deposit instructions, QR codes, bank accounts, wallet addresses, and transaction hashes.
Receipts and statements from banks, e-wallets, cards, and exchanges.
Screenshots or recordings of balances, withdrawal errors, and payment demands.
Names of recruiters, agents, witnesses, and other victims.
A chronological account of what was represented, when you relied on it, and what you paid.

Export chats instead of relying only on cropped screenshots. Preserve message dates, sender details, URLs, and surrounding context. Do not edit files or annotate the only copy. Make backups and retain the device used for the transactions.

A blockchain-explorer page can help document a transaction, but it does not by itself prove who controls a wallet. Identity may require exchange records, device data, financial records, witness testimony, or lawful investigative process.

Where to report the scam

Different complaints serve different purposes. Filing with one office does not necessarily replace filing with the others.

Securities and Exchange Commission

Report deceptive investment solicitation, an unregistered securities offering, or a person soliciting investments without the required authority through the SEC’s iMessage complaint and ticketing system. The SEC’s system includes an investment-scam complaint category.

The SEC may investigate, issue enforcement orders, impose administrative sanctions, and refer appropriate criminal matters. Under Republic Act No. 11765, it may impose sanctions for investment fraud; regulators may also order accounting and disgorgement in proceedings within their authority. These measures protect the public, but an SEC complaint does not automatically produce an individual refund.

A company’s basic SEC registration does not mean that its investment offering is approved. The authority to exist as a corporation is different from authority to solicit investments, offer securities, or act as a broker, dealer, exchange, or investment adviser. Verify the entity and its relevant licenses through Check with SEC.

National Bureau of Investigation

For an online or technology-assisted scam, approach the NBI Cybercrime Division, Fraud and Financial Crimes Division, or an NBI regional or district office. The NBI’s official procedure for computer-crime assistance requires the complainant to complete and submit a complaint form to the responsible division. See the NBI’s computer-crime assistance procedure and NBI offices and divisions.

Bring identification, a clear affidavit or narrative, proof of payment, communications, transaction hashes, and available information identifying the suspects.

Philippine National Police

A victim may also report to the PNP Anti-Cybercrime Group or the nearest police station. Use contact details published on official PNP channels, since hotlines and office arrangements can change. Obtain the complaint or blotter reference and ask which investigative unit will handle digital evidence and financial tracing.

Prosecutor’s office

A criminal complaint may ultimately require a complaint-affidavit and supporting evidence before the prosecutor with jurisdiction. Venue and jurisdiction can depend on where representations were received, money was transferred, damage occurred, the accused acted, and which offense is alleged. Online or cross-border facts can complicate this analysis, so legal assistance may be important.

Which Philippine laws may apply?

The applicable charges depend on the evidence. Authorities, not the victim, determine the final offenses to pursue.

Estafa by deceit

Article 315(2)(a) of the Revised Penal Code may apply when a victim parts with money or property because of a false pretense or fraudulent representation made before or at the time of the transaction. The Supreme Court identifies four essential matters: a false pretense or fraudulent act; its timing before or simultaneous with the fraud; the victim’s reliance; and resulting damage. See the Supreme Court’s discussion in Dulay v. People.

Failure to repay or a broken promise is not necessarily estafa. Proof that the deceptive representation induced the payment is crucial.

Investment fraud and securities violations

Republic Act No. 11765 makes investment fraud unlawful and connects it to the penalties under Section 73 of the Securities Regulation Code, in addition to administrative sanctions.

The Securities Regulation Code generally prohibits selling or offering securities in the Philippines without an effective registration statement unless an exemption applies. It also prohibits fraudulent transactions involving securities and regulates brokers, dealers, salespersons, and associated persons. Whether a particular token, pooled trading arrangement, or profit-sharing scheme is a security depends on its actual structure and representations—not merely the label “cryptocurrency

Quick answer

Recovery is possible, but speed matters and no agency can guarantee that stolen cryptocurrency will be returned. Crypto transfers are usually irreversible, and scammers often move assets through several wallets or exchanges within minutes.

Act immediately:

Contact the bank, e-wallet, card issuer, or crypto platform used for the payment. Ask it to stop, recall, or flag the transaction and preserve the recipient’s account and KYC records.
Notify every identifiable exchange or platform that received the cryptocurrency. Provide transaction hashes and request an urgent fraud hold.
Secure your accounts and preserve all evidence.
Report the scheme to the Securities and Exchange Commission (SEC) if it involved an investment solicitation.
File a complaint with the National Bureau of Investigation (NBI) or the Philippine National Police, especially when the scam occurred online.
Consult a lawyer promptly about criminal restitution, attachment or preservation of assets, and a separate civil case where appropriate.

A report to the SEC or law enforcement may stop the scheme and support asset tracing, but it does not automatically produce a refund. Actual recovery normally depends on locating assets, identifying the responsible persons, obtaining their cooperation or a lawful hold, and ultimately securing a settlement, regulatory order, forfeiture disposition, or court judgment.

First determine whether it was fraud or an investment loss

Not every losing cryptocurrency investment is a scam. Crypto prices may collapse without anyone committing a crime. Fraud is more likely when money or crypto was obtained through material falsehoods, concealment, impersonation, unauthorized investment-taking, or promises the promoter never intended or was able to perform.

Warning signs include:

guaranteed or unusually high returns with little or no risk;
fabricated trading dashboards or account balances;
supposed profits that cannot be withdrawn;
demands for an additional “tax,” “unlocking fee,” “gas fee,” or “verification deposit” before withdrawal;
claims that the promoter, token, exchange, or investment is government-approved when it is not;
fake celebrity, government, lawyer, or company endorsements;
pressure to recruit new investors;
returns paid mainly from later investors’ contributions;
instructions to transfer assets to a personal wallet or unrelated bank account;
disappearance, blocked communications, or shifting explanations after payment; or
remote-access software or stolen credentials used to control the victim’s account.

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, “investment fraud” includes deceptive public solicitation, Ponzi schemes, boiler-room operations, and public offerings of investment schemes without the required SEC authority, unless an exemption legally applies.

The precise legal remedy still depends on what was represented, who received the funds, whether an investment contract or other security was offered, how the transaction occurred, and what assets remain traceable.

What to do in the first hours

1. Stop further losses

Do not send another payment, even if the platform displays a large balance or the scammer says one final charge will release it. A demand for a “recovery fee,” “clearance tax,” “anti-money-laundering certificate,” or “wallet synchronization deposit” is commonly part of the same fraud.

If the scammer had access to your device or credentials:

disconnect remote-access applications;
change passwords using a clean device;
sign out other sessions;
enable multi-factor authentication;
revoke unknown API keys and connected applications;
contact your mobile provider if SIM-swapping is suspected; and
move unaffected assets to a new secure wallet if a seed phrase or private key was exposed.

Never give a seed phrase or private key to an investigator, exchange employee, “recovery specialist,” or lawyer. Legitimate assistance does not require it.

2. Contact the payment provider immediately

Call the fraud channel of the bank, e-money issuer, card issuer, remittance company, or crypto exchange that sent the funds. Follow up in writing and obtain a case or ticket number.

Ask the provider to:

attempt a recall or hold where technically and legally possible;
flag the beneficiary account or wallet;
preserve account-opening, KYC, login, IP-address, device, and transaction records;
identify any information it requires from law enforcement; and
give you a certified or official transaction record when available.

The BSP advises consumers to report suspicious transactions immediately to their bank or e-money issuer. Its BSP Verifier can also be used to check whether a financial institution or virtual asset service provider appears in BSP records.

A recall is more plausible while fiat funds remain in a Philippine account. Once cryptocurrency has been transferred to a self-custodied wallet and the transaction is confirmed, the sender generally cannot reverse it unilaterally.

3. Alert receiving exchanges

Use the receiving platform’s official fraud or compliance channel—not contact information supplied by the scammer. Include:

blockchain and token involved;
transaction hash or transaction ID;
sending and receiving wallet addresses;
amount and exact date and time;
police, NBI, SEC, or bank reference number, if already available; and
a short explanation of the deception.

An exchange may preserve records or temporarily restrict an account under its policies and legal obligations. It may nevertheless require a Philippine or foreign legal process before disclosing customer information or releasing assets.

Evidence to preserve

Create a chronological folder and keep original files whenever possible. Preserve:

transaction hashes and complete wallet addresses;
blockchain-explorer pages, exported as PDF or otherwise saved;
bank, card, e-wallet, remittance, and exchange receipts;
account statements and deposit or withdrawal histories;
screenshots and screen recordings of the platform, balances, and withdrawal failures;
the website address, application name, download link, domain, and social-media profile;
emails, text messages, chat exports, voice messages, and call logs;
advertisements, presentations, contracts, white papers, and promised return schedules;
names, aliases, usernames, phone numbers, email addresses, referral codes, and bank-account names;
wallet labels or deposit instructions supplied by the promoter;
identity documents or company documents the promoter sent;
evidence of recruitment or referral commissions;
later demands for taxes or release fees; and
a written timeline explaining each representation, payment, and attempted withdrawal.

Do not crop away timestamps, usernames, URLs, or transaction details. Keep the original phone or computer if it contains important evidence. Avoid editing source files; make working copies instead. Investigators may later need metadata or a forensic examination.

Blockchain records can show movement between addresses, but a wallet address alone does not necessarily identify its controller. Records from an exchange, bank, telecommunications provider, or other intermediary may be needed to connect an address to a person.

Where to report the scam

Securities and Exchange Commission

Report the matter to the SEC when the scheme involved pooled funds, managed trading, staking or lending returns, profit-sharing, token sales, passive-income promises, or another public investment solicitation.

The SEC iMessage system accepts online tickets, including investment-scam complaints. Attach a concise affidavit or narrative, payment evidence, promotional materials, identities and accounts used, and transaction hashes.

The SEC may investigate unauthorized securities offerings and investment fraud, issue enforcement measures, impose administrative sanctions, and refer appropriate criminal matters. Under Republic Act No. 11765, investment fraud is unlawful; the law also authorizes SEC administrative sanctions and applies the penalties under Section 73 of the Securities Regulation Code, Republic Act No. 8799.

A corporation’s SEC registration merely establishes its juridical existence. It does not by itself authorize the company to solicit investments. The particular securities offering and the persons selling it may require separate registration, permits, or licenses. An asserted exemption must have a real legal basis; it is not created simply by calling a payment a “membership,” “package,” “staking plan,” or “private placement.”

National Bureau of Investigation

A victim may seek investigative assistance from the NBI Cybercrime Division or an appropriate NBI regional or district office. The NBI’s official procedure directs complainants to complete and submit a complaint form to the responsible division. See the NBI service for victims of computer crimes and the NBI directory.

Bring government identification and organized copies of the evidence. Ask how to submit original electronic records and whether an affidavit of complaint, witnesses, or additional authentication is required.

Philippine National Police

A victim may also report to the PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the local police station. Use contact information published through official PNP channels, and retain the complaint or blotter reference.

The NBI and PNP are investigative bodies. Depending on the offense and the evidence, a criminal complaint may proceed to the proper prosecutor’s office for preliminary investigation.

Bangko Sentral ng Pilipinas

If the complaint concerns the conduct or complaint-handling of a BSP-supervised bank, e-money issuer, money-service business, or virtual asset service provider, first use that institution’s consumer-assistance mechanism. If the matter is not resolved, escalate it through the BSP’s official consumer channels.

BSP regulation treats covered virtual asset service providers as money-service businesses and requires authorization to operate. However, the BSP’s regulation of a transfer, exchange, or custody provider does not mean that the BSP endorses the value of a token or guarantees an investment. Offers or sales of virtual assets functioning as securities fall within the SEC’s jurisdiction rather than the BSP’s VASP framework. See BSP Circular No. 1108 and the current BSP list of VASPs.

Possible legal grounds

Estafa by deceit

A cryptocurrency investment scam may constitute estafa under Article 315(2)(a) of the Revised Penal Code when there was a false pretense or fraudulent representation made before or at the time of the fraud, the victim relied on it and parted with money or property, and damage resulted.

The Supreme Court has repeatedly applied those elements, including in Dulay v. People. Mere failure to deliver a promised return does not automatically prove estafa. Evidence must connect the victim’s payment to a deceit that existed before or when the money was obtained.

When a qualifying crime under the Revised Penal Code is committed through information and communications technology, Section 6 of the Cybercrime Prevention Act, Republic Act No. 10175 may apply. The prosecutor determines the legally supportable charge from the facts; victims should describe what happened accurately rather than select offenses based only on labels.

Securities and investment-fraud violations

Crypto-related arrangements may be securities when their actual terms fall within the Securities Regulation Code. Calling an asset a “coin,” “NFT,” “mining contract,” “AI-trading account,” or “DeFi package” does not decide its legal character.

Possible issues include:

an unregistered public offer or sale of securities;
acting as an unregistered broker, dealer, salesperson, or investment adviser;
fraudulent securities transactions; or
investment fraud under Republic Act No. 11765.

There are statutory exemptions for certain securities and transactions, but an exemption from registration is not a license to commit fraud.

Civil liability

A victim may seek return of money or damages under the rules on contracts, fraud, obligations, unjust enrichment, or civil liability arising from a crime, depending on the facts.

Under Rule 111 of the Rules of Criminal Procedure, the civil action to recover civil liability arising from the offense is generally deemed instituted with the criminal case unless the victim waives it, reserves the right to sue separately, or filed the civil action beforehand. These choices can affect strategy and procedure. Obtain legal advice before signing a waiver, reservation, settlement, quitclaim, or affidavit of desistance.

A criminal complaint and a civil claim serve different purposes. Criminal prosecution seeks to establish public liability beyond reasonable doubt. A civil action seeks a monetary or property remedy under the applicable civil standard. The failure of one route does not always resolve every possible independent civil claim, but the interaction between proceedings can be technical.

Can small claims court be used?

Possibly, but only when the claim fits the Small Claims Rules.

The current monetary ceiling is ₱1,000,000, exclusive of interest and costs. Small claims cover specified money claims, including certain obligations arising from contracts. The procedure is simplified, and lawyers generally may not appear for the parties at the hearing. See the Supreme Court’s Rules on Expedited Procedures in the First Level Courts.

Small claims may be unsuitable when:

the defendant’s true identity or address is unknown;
service must be made abroad;
the claimant needs asset tracing, injunctive relief, attachment, extensive discovery, or complex expert evidence;
the amount exceeds the ceiling;
the principal theory is not among the covered money claims; or
several victims, companies, nominees, or foreign platforms are involved.

A lawyer should assess venue, jurisdiction, parties, and available provisional remedies before filing.

Asset freezing, attachment, and recovery

Victims cannot personally freeze a wallet, bank account, or exchange account merely by showing that they sent money to it. A private request may prompt voluntary preservation, but compulsory restraint normally requires lawful authority.

Depending on the case, possible mechanisms include:

a temporary fraud hold or voluntary restriction by a bank or exchange;
preservation and disclosure orders obtained during a cybercrime investigation;
preliminary attachment in a qualifying civil or criminal-related action;
an SEC or BSP enforcement measure within the regulator’s jurisdiction;
an Anti-Money Laundering Council investigation and an appropriate court-issued freeze order; or
forfeiture and eventual disposition of assets under applicable law.

A freeze or seizure is not the same as reimbursement. Competing victims, ownership disputes, secured claims, insolvency, foreign proceedings, and forfeiture rules may affect what can ultimately be returned.

If traceable funds or crypto remain at a known platform, tell investigators and counsel immediately. Delay may allow further transfers and make cross-border legal assistance necessary.

Deadlines: do not wait

Different claims have different prescriptive periods. They may run from the transaction, accrual of the cause of action, discovery of deceit, or another event fixed by law.

For claims under Republic Act No. 11765, Section 14 generally provides five years from consummation of the financial transaction or five years from discovery of deceit or nondisclosure of material facts, subject to an absolute ten-year limit from the violation. Other civil and criminal causes of action have different periods and interruption rules.

Do not assume that a bank complaint, demand letter, SEC ticket, police blotter, negotiation, or blockchain-tracing report stops every applicable deadline. Obtain case-specific advice promptly.

Common mistakes that reduce the chance of recovery

Sending more money to “unlock” the investment.
Paying an online “hacker,” “asset recovery agent,” or supposed government contact.
Deleting conversations out of embarrassment.
Posting seed phrases, private keys, identity documents, or complete account details publicly.
Warning the scammer before the bank or exchange has had an opportunity to preserve assets.
Altering screenshots or submitting only cropped images.
Treating a blockchain address as conclusive proof of a person’s identity.
Assuming SEC corporate registration authorized the investment offering.
Filing only with one regulator when immediate bank, exchange, and law-enforcement reports are also needed.
Signing a quitclaim or accepting a small partial payment without understanding its effect.
Naming every recruiter as the mastermind without separating personal knowledge from hearsay.
Waiting for other victims to act first.

Be exact in affidavits. Separate what you personally saw or heard from what another victim told you. Overstatement can create inconsistencies and weaken a legitimate complaint.

When legal help is urgent

Seek a Philippine lawyer experienced in fraud, securities, cybercrime, or asset recovery immediately when:

a bank or exchange confirms that funds remain frozen or traceable;
a large amount is involved;
the scammer or assets are abroad;
a corporation, nominee, recruiter network, or multiple wallets were used;
you need attachment, an injunction, or other provisional relief;
investigators request access to a device or extensive digital records;
you are asked to sign a settlement, waiver, or affidavit of desistance;
you recruited relatives or friends and may face claims yourself;
the promoter threatens, blackmails, or doxxes you; or
a filing deadline may be approaching.

Victims who cannot afford private counsel may ask the Public Attorney’s Office whether they satisfy its legal and financial eligibility requirements. Law-school legal-aid clinics and the Integrated Bar of the Philippines may also provide or refer assistance, subject to capacity and qualification.

Frequently asked questions

Can the blockchain transaction be reversed?

Usually not by the sender. Recovery may still be possible if the assets reach a cooperative custodial exchange, remain under an identifiable person’s control, or are later restrained through lawful process.

Will the SEC refund my investment?

Not automatically. The SEC investigates and enforces securities and financial-consumer laws within its jurisdiction. A complaint may support enforcement, disgorgement, or other proceedings, but an individual payout depends on the assets and the remedy ultimately ordered or agreed.

Does BSP registration make a crypto investment safe?

No. Registration concerns the authorized activities of the regulated provider. It does not guarantee a token’s value, eliminate market risk, validate a separate investment scheme, or insure against every loss.

Can I report even if I voluntarily sent the money?

Yes. Voluntary transmission does not rule out fraud if deceit induced the payment. Preserve the representations that caused you to send it.

What if the scammer used a fake trading website?

Save the full URL, screenshots, account history, source of the link, domain information, and every deposit address. Report it to the payment provider, receiving platforms, SEC, and law enforcement. Do not log in again from a device that may be compromised.

What if the recruiter is a friend or relative?

Report facts accurately, including what the recruiter personally promised, received, or knew. A recruiter’s liability depends on evidence; participation does not automatically establish the same role or intent for everyone involved.

Should victims file together?

Coordinated evidence can reveal common wallets, accounts, promoters, and representations. Each victim should still retain proof of their own reliance, payments, and losses. Counsel or investigators can advise whether complaints should be consolidated.

Is a private crypto-tracing report enough?

It can help organize public blockchain data, but it does not compel disclosure, prove who controls a wallet, or freeze assets. Verify the tracer’s credentials and fee terms, and never disclose private keys or seed phrases.

Official sources

This article provides general legal information, not legal advice or a prediction of recovery. Rights and procedures depend on the evidence, transaction documents, parties, location of assets, and applicable deadlines. Official sources and procedures were checked as of July 24, 2026.