Quick answer

If an online casino took your money through deception, refused a legitimate withdrawal, used a fake PAGCOR license, accessed your account without permission, or demanded more payments to “release” winnings, report it immediately to:

Your bank, e-wallet, card issuer, or cryptocurrency platform—ask its fraud team to secure your account, trace the transaction, and initiate the applicable disputed-transaction or recovery process.
The Cybercrime Investigation and Coordinating Center (CICC)—call 1326 or email 1326@dict.gov.ph.
The Philippine National Police or National Bureau of Investigation—file a formal complaint with the nearest police station, a PNP anti-cybercrime office, or the NBI Cybercrime Division.
PAGCOR—verify whether the platform is licensed and report a fake, illegal, or noncompliant gaming site.

Do not pay another “tax,” “verification fee,” “unlocking fee,” or “minimum deposit” merely because the platform promises to return your money afterward. Preserve the website address, account details, conversations, transaction records, and advertisements before the site or account disappears.

First, determine what happened

“Online casino scam” can describe several different situations:

A fake casino accepts deposits but does not provide genuine games or withdrawals.
A platform displays a forged PAGCOR license or copies the identity of a legitimate operator.
The casino changes withdrawal conditions after the player wins.
A supposed agent demands repeated deposits, taxes, insurance, or processing fees.
Someone gains unauthorized access to a casino, bank, card, or e-wallet account.
A promoter or influencer makes false representations to induce deposits.
A licensed operator has a genuine account, payout, identity-verification, or game dispute with a player.

This distinction matters. PAGCOR can address licensing and regulatory issues involving operators under its supervision. Banks and e-wallets handle financial-account security and disputed transactions. Police and the NBI investigate possible crimes. A report to only one of them may therefore be insufficient.

A losing bet, an unfavorable game result, or an ordinary delay is not automatically fraud. The strength of a complaint depends on evidence of deception, unauthorized transactions, manipulated records, fabricated licensing, breach of published rules, or another unlawful act.

Act immediately to protect your money and accounts

1. Contact the financial institution first

Use the official hotline or in-app support of the bank, e-wallet, card issuer, remittance service, or cryptocurrency platform—not contact details supplied by the casino.

Tell the institution that the transfer is connected with suspected fraud and provide:

The amount, date, and exact time of each transaction
Transaction or reference numbers
The recipient’s name, account number, mobile number, wallet address, or merchant descriptor
A short explanation of how you were deceived
Screenshots and communications supporting the report
The police, CICC, or NBI reference number, if already available

Ask for a case or ticket number. Also ask whether the transaction can be recalled, reversed, disputed, traced, or temporarily held. The available remedy depends on the payment method, whether the transfer was authorized, whether the recipient has moved the funds, and the institution’s rules.

Under the Anti-Financial Account Scamming Act, Republic Act No. 12010 and its implementing regulations, covered financial institutions may temporarily hold funds involved in a disputed transaction when the legal and regulatory conditions are met. The holding period may not exceed 30 calendar days unless extended by a competent court. This authority does not guarantee that funds remain in the recipient account or that the victim will receive an automatic refund.

Report promptly. Card networks, banks, e-wallets, and cryptocurrency services may have their own notice periods and evidentiary requirements. Do not assume that the 30-day temporary-hold limit gives you 30 days to complain.

If the scammer obtained your password, PIN, one-time password, recovery phrase, card details, or identification documents, ask the institution to secure or restrict the account. Change passwords from a trusted device, end unknown sessions, and activate stronger authentication. Never give anyone an OTP or wallet recovery phrase—including someone claiming to investigate the scam.

2. Stop communicating through unsafe channels

Do not install a screen-sharing or remote-access application at the scammer’s request. Do not allow the person to guide you through your banking app.

You may stop replying, but preserve the conversation first. Blocking an account too early can make usernames, messages, or profile details harder to retrieve. Do not provoke, threaten, or announce that you are collecting evidence.

Beware of “recovery agents” who contact victims and demand an advance fee. A second scam often follows the first.

Preserve evidence before filing reports

Create a chronological folder containing original files where possible. Preserve:

The complete website address, including subpages used for deposits and withdrawals
Screenshots or screen recordings showing the account, balance, transaction history, withdrawal request, errors, and displayed license
The casino’s name, app name, domain, social-media pages, and app-download link
Usernames, profile links, phone numbers, email addresses, and chat handles
Advertisements, referral codes, promotional claims, and influencer posts
The casino’s published terms and withdrawal rules as they appeared when you deposited
Deposit slips, bank statements, card records, e-wallet receipts, blockchain transaction hashes, and merchant descriptors
Messages, emails, call logs, voice recordings already lawfully in your possession, and customer-support tickets
Copies of identification or selfies sent to the platform
Dates and times, including the time zone if relevant
The device used, browser history, and app details
Names and contact information of witnesses or other victims

Keep unedited originals. You may create annotated copies, but do not crop away dates, account identifiers, or surrounding context. Export chat histories when the platform permits it. Back up the evidence to a secure location.

Do not delete the casino app or wipe the affected device until important data has been preserved. At the same time, do not continue using a potentially compromised device for banking. If malware is suspected, disconnect it from the internet and seek qualified technical assistance.

A list typed from memory is useful, but it is weaker than contemporaneous transaction records and complete conversations.

Verify whether the casino is actually licensed

Check the exact domain—not merely the brand name or logo—against the official PAGCOR Guarantee list of licensed internet gaming platforms. PAGCOR created this verification facility because fraudulent sites may copy its logo or display fabricated certificates.

A screenshot of a “PAGCOR license” on the casino’s own website is not independent verification. Similar spelling, an added hyphen, a different domain extension, or a link sent by an “agent” may lead to an impersonation site.

PAGCOR regulates specified local gaming operations, including authorized online platforms. Separately, offshore gaming operations were prohibited by Executive Order No. 74 and later addressed by the statutory ban in Republic Act No. 12312. That offshore-gaming ban should not be misunderstood as proof that every domestic online gaming platform is lawful or that every form of online gaming is prohibited. The operator, license, exact platform, games offered, and intended customers must be checked.

If the domain is absent from PAGCOR’s official list, uses a fake certificate, or impersonates a licensee, include that fact in your reports. Do not revisit a suspicious site merely to make another deposit.

Where and how to report

Report to CICC

The CICC coordinates responses to cybercrime and operates the national anti-scam hotline.

Call 1326
Email 1326@dict.gov.ph
Consult the official DICT–CICC information page

Provide a concise timeline, the amount lost, payment destination, exact website address, suspect identifiers, and copies of key evidence. Keep the reference number and record when and how the report was submitted.

A CICC report helps route and coordinate the incident, but it may not replace a sworn criminal complaint or the financial institution’s dispute procedure.

File with the NBI

The NBI online complaint page provides an official complaint entry point. A victim may also approach the NBI Cybercrime Division or an appropriate regional or district office.

The NBI’s published citizen-service procedure for investigative assistance to victims of computer crimes states that complainants may proceed to the Cybercrime Division to complete a complaint sheet. Its official division directory lists the Cybercrime Division at ccd@nbi.gov.ph, but confirm current contact information on the NBI website before sending sensitive documents.

Bring or prepare:

A government-issued ID
A clear written chronology
Proof of payment and account ownership
Printed and electronic copies of relevant screenshots and communications
The suspect’s available identifiers
Your bank or e-wallet complaint reference
The CICC or police reference number, if any

Investigators may request a sworn affidavit or additional records after evaluating the complaint.

Report to the PNP

You may go to the nearest police station or PNP anti-cybercrime office. If the local station receives the initial report, clearly state that the incident involved an online platform and electronic transfers, and ask for referral or coordination with cybercrime investigators when appropriate.

Bring the same evidence package you would submit to the NBI. Ask for the official record or complaint reference and the investigator’s office contact details.

For immediate threats, coercion, extortion, stalking, or danger to life or safety, call 911 or go to the nearest police station without waiting to complete the full evidence folder.

Report to PAGCOR

If the site claims PAGCOR authority, report the exact domain, copied branding, displayed certificate, account name, and transaction details to PAGCOR. Its official contact page lists:

info@pagcor.ph
Trunkline: +632 8521-1542 or +632 8522-0299
PAGCOR contact and regulatory channels

If the platform is a genuine licensee, first use its official complaint process and preserve its response. PAGCOR’s responsible-gaming rules require licensees to maintain complaint-resolution channels. Escalate the matter to PAGCOR if the operator does not resolve it, the response conflicts with published rules, or the conduct suggests a regulatory violation.

A PAGCOR complaint is not a substitute for immediately notifying the payment provider or reporting suspected crime.

Report the page, advertisement, or app

Report impersonation pages, malicious advertisements, fake profiles, and fraudulent apps through the host platform’s official reporting function. Give investigators the original link before it is removed.

Removal can protect other users, but a platform report alone normally does not initiate a Philippine criminal investigation or recover transferred funds.

What laws may apply?

The final legal classification depends on the evidence. Do not insist on a particular charge if the facts are incomplete.

Possible laws include:

Estafa under Article 315 of the Revised Penal Code, when false pretenses or fraudulent acts induce a person to part with money or property and cause damage.
Republic Act No. 10175, the Cybercrime Prevention Act of 2012, when a crime under the Revised Penal Code or a special law is committed through information and communications technology. Section 6 generally provides for a penalty one degree higher for an existing offense committed through ICT. The Supreme Court explained this treatment in Disini v. Secretary of Justice.
Computer-related fraud, identity theft, illegal access, or other offenses under the Cybercrime Prevention Act when their particular statutory elements are present.
Republic Act No. 12010, where financial accounts are used for money-mule activity, social engineering schemes, or other conduct covered by the Anti-Financial Account Scamming Act.
The Access Devices Regulation Act, Republic Act No. 8484, where credit cards or other covered access devices are fraudulently used.
Illegal-gambling laws and gaming regulations if the operation lacks the required authority.

The mere use of the internet does not prove every cybercrime offense. Likewise, failure to pay a withdrawal is not automatically estafa; investigators must examine the representations, intent, platform records, payment flow, and contractual terms.

Whether money can be recovered is separate from whether someone may be prosecuted. Recovery may depend on the payment provider’s process, the location of the funds, identification of the recipient, available assets, contractual remedies, and possible civil proceedings.

If you participated in an unlicensed gambling site

Still preserve evidence and report the suspected scam. Do not falsify the circumstances, rename transfers, delete betting records, or omit facts from a sworn statement.

Participation in illegal gambling may itself raise legal issues. That possibility does not justify allowing fraudsters to continue, but it means you should obtain independent legal advice before executing a detailed affidavit if you are concerned about personal exposure. A lawyer can help you disclose the facts truthfully while protecting your rights.

Do not accept a scammer’s claim that reporting is impossible merely because the platform may be illegal.

A practical complaint outline

Your written account can follow this structure:

Your full name and reliable contact details
The name and exact URL of the platform
How and when you found the casino
What the casino, agent, or promoter represented
Every deposit, attempted withdrawal, and additional demand in chronological order
Why you believe the conduct was fraudulent
The total amount transferred, with a transaction table
The identities and account details used by the recipient
Actions already taken with the bank, e-wallet, CICC, police, NBI, PAGCOR, or online platform
A numbered list of attachments

Separate what you personally observed from what another person told you. Use exact dates and amounts. If something is uncertain, say so.

Common mistakes that weaken a report

Paying one more fee in the hope of unlocking the withdrawal
Reporting only to the casino’s own customer-support account
Waiting for the website or chat account to disappear
Sending only cropped screenshots without dates or identifiers
Deleting the app, browser history, or full conversation
Posting every piece of evidence publicly, alerting suspects or exposing personal data
Exaggerating the amount lost or including expected winnings as though they were transferred funds
Using an unverified “hacker” or recovery service
Giving investigators only a brand name instead of the exact domain
Assuming a PAGCOR logo proves authorization
Treating a regulatory complaint as a substitute for a bank fraud report or criminal complaint
Giving an OTP, password, PIN, or recovery phrase to someone claiming to assist

When legal help is urgent

Consult a Philippine lawyer promptly if:

The loss is substantial or involves money belonging to an employer, business, or another person
You are being threatened, blackmailed, or accused of an offense
Your identity documents or financial accounts are being used by others
You unknowingly received or forwarded suspected scam proceeds
The casino asks you to recruit players or receive deposits through your account
Several victims or multiple recipient accounts are involved
A bank rejects the dispute and the reasons require legal assessment
You need to prepare a sworn complaint, seek a court order, or pursue civil recovery
You participated in a platform that may have been unlicensed

The Public Attorney’s Office may assist qualified persons under its governing eligibility and merit requirements. Private counsel may be appropriate where urgent preservation, substantial losses, cross-border transfers, corporate funds, or possible personal liability are involved.

FAQ

Can PAGCOR recover my money?

PAGCOR can verify licensing, receive regulatory complaints, and act within its authority over regulated operators. It does not guarantee reimbursement and may not control an illegal or foreign site. Notify the payment provider and law-enforcement authorities as well.

Is a casino automatically legitimate if it shows a PAGCOR certificate?

No. Fraudulent websites may copy PAGCOR branding or fabricate certificates. Verify the exact domain through the official PAGCOR Guarantee list.

Should I report even if I gave the scammer my OTP or approved the transfer?

Yes. Tell the financial institution exactly what occurred. Whether the transaction is treated as authorized, unauthorized, or induced through social engineering is fact-dependent. Concealing the OTP or approval can impair the investigation.

Can my bank freeze the recipient’s money?

A covered institution may temporarily hold disputed funds when the requirements of Republic Act No. 12010 and applicable BSP regulations are met. A hold is not automatic, may occur only if funds remain traceable, and does not itself establish ownership or guarantee reimbursement.

Is there a minimum loss before I can report?

The cited cybercrime and reporting channels do not establish a general minimum loss for making a report. Institutions may apply different investigation or documentation procedures depending on the amount and circumstances.

Should I report to both the NBI and PNP?

Either agency may receive a cybercrime complaint. Multiple uncoordinated filings can cause duplication, so disclose any earlier report and provide its reference number. CICC can also help coordinate or route scam reports.

What if the casino is licensed but refuses my withdrawal?

Preserve the rules that applied when you deposited, complete the operator’s official complaint process, and request a written reason. Escalate unresolved regulatory concerns to PAGCOR. Report to law enforcement if there is evidence of deception, identity theft, unauthorized access, or another possible crime.

Can cryptocurrency be recovered?

Sometimes transactions can be traced, but blockchain transfers usually cannot simply be canceled. Immediately notify the exchange or platform involved and provide wallet addresses and transaction hashes. Recovery depends on identification, platform cooperation, remaining assets, and lawful investigative or court processes.

Should I publish the recipient’s identity online?

Usually not. Public accusations can expose personal data, alert suspects, compromise an investigation, or create separate legal risk. Give the evidence to the relevant institution and authorities.

Official sources

This article provides general legal information, not advice for a particular case. Procedures and legal consequences may depend on the transaction, platform, evidence, and agencies involved. Official sources were checked as of July 27, 2026.