Quick answer

If you paid an online seller and suspect a scam, act immediately:

Contact your bank, card issuer, or e-wallet through its official fraud channel. Ask whether the transfer can be stopped, traced, disputed, or temporarily held.
Secure your accounts if you disclosed a password, one-time PIN, card details, identification document, or other sensitive information.
Preserve the listing, seller profile, messages, payment records, delivery details, and other electronic evidence before the account or post disappears.
Report the seller and transaction through the platform’s internal complaint system.
Report suspected fraud to the Philippine National Police Anti-Cybercrime Group, the National Bureau of Investigation, or the Cybercrime Investigation and Coordinating Center.
For a business-to-consumer transaction, pursue refund or other consumer remedies through the Department of Trade and Industry if the platform or seller does not resolve the complaint.

These steps serve different purposes. A platform report may remove an account, a bank report may help protect or recover funds, a DTI complaint seeks consumer redress, and a law-enforcement complaint may lead to a criminal investigation. Filing with one does not necessarily accomplish the work of the others.

First, decide whether this may be fraud or a consumer dispute

Warning signs of a scam include:

The seller took payment and then blocked you or deleted the account.
The seller used a false identity, fake store, counterfeit receipt, or fabricated tracking information.
The advertised product did not exist, or the seller never intended to deliver it.
You were directed to pay a different person, a succession of accounts, or a supposed “verification,” “release,” or “refund” fee.
The seller obtained your banking credentials, one-time PIN, card security code, or identity documents through deception.
An account impersonated a real shop, public figure, government office, courier, bank, or payment provider.

A late shipment, defective product, wrong item, or disagreement over quality is not automatically a criminal scam. It may still support a refund, replacement, warranty, or consumer complaint. Whether conduct amounts to estafa, computer-related fraud, identity theft, financial-account scamming, or another offense depends on the evidence and the circumstances.

If money was just sent, contact the payment provider now

Use only the hotline, in-app help center, website, branch, or email address published by the bank, card issuer, or e-wallet itself. Do not call a number supplied by the suspected scammer.

Tell the provider:

The transaction was induced by suspected fraud.
The exact amount, date, time, reference number, and recipient account are known.
You want the transaction marked as disputed and urgently reviewed.
You are asking whether funds can be stopped, recalled, traced, preserved, or temporarily held.
You need a complaint or case reference number and written confirmation.

Notify both the sending provider and, if identifiable, the institution that received the money. Do not assume that deleting an app, blocking the recipient, or reporting the social-media profile will alert the financial institutions.

Under the Anti-Financial Account Scamming Act, BSP-supervised institutions may temporarily hold funds involved in a disputed transaction, subject to BSP rules. The statutory holding period cannot exceed 30 calendar days unless extended by a competent court. This does not guarantee recovery: the money may already have been withdrawn or transferred, and the institution must verify the dispute.

If the institution does not satisfactorily address your complaint, escalate it through the BSP Consumer Assistance Mechanism. BSP guidance requires consumers to complain first through the financial institution’s own Financial Consumer Protection Assistance Mechanism. An unresolved complaint may then be submitted through the BSP Online Buddy or through the BSP’s Complaints, Inquiries and Requests form.

Card disputes, fund-recall requests, and provider investigations may have separate contractual deadlines. Do not wait for a police report before notifying the provider unless the provider expressly requires one.

Secure compromised accounts and identity information

If you shared credentials or opened a suspicious link:

Change the affected password from a trusted device.
Change reused passwords on other accounts.
Sign out unknown sessions and devices.
Enable multi-factor authentication.
Lock or replace exposed cards where appropriate.
Ask your mobile provider to secure your number if you suspect a SIM takeover.
Tell the bank or e-wallet exactly what information was disclosed.
Monitor transactions and account-recovery notices.
Do not approve further prompts or disclose another one-time PIN, even to someone claiming to process a refund.

A legitimate bank or investigator will not need your password or one-time PIN to accept a complaint.

Preserve evidence before reporting the account

Keep original electronic records whenever possible. Screenshots are useful, but they should not be the only evidence.

Preserve:

The complete seller profile, username, user ID, profile link, page link, and store URL
The original listing, including price, description, photographs, promised delivery date, and representations about authenticity
The full conversation from first contact onward
Email messages with headers, where available
Order confirmations, invoices, receipts, and platform order numbers
Bank, card, or e-wallet receipts showing the transaction reference and recipient
Recipient names, account numbers, mobile numbers, QR codes, and payment links
Courier bookings, tracking numbers, package labels, and unboxing photographs or video
Calls, voice messages, and the dates and times of communications
The platform complaint, seller response, and complaint reference number
Any demand for additional payment
Identification documents or supposed permits supplied by the seller
Names and contact details of witnesses or other victims

Also make a short chronological account: what was advertised, what the seller said, when you relied on it, how you paid, what happened afterward, and how much you lost.

Do not edit original files or crop away usernames, timestamps, URLs, and transaction references. Export chats if the application permits it, save webpages as PDFs, and keep copies in more than one secure location. Do not publicly post your own account numbers, identification documents, address, or other sensitive data.

Report through the platform’s internal process

Use the platform’s “report,” “refund,” “dispute,” or buyer-protection feature. Select the most accurate reason and upload the evidence requested. Keep the ticket number and a copy of everything submitted.

For covered internet transactions, the Internet Transactions Act of 2023 requires digital platforms, e-marketplaces, and e-retailers to provide redress mechanisms. An aggrieved party must generally use that internal mechanism before filing a consumer complaint with a government agency or court. The mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing.

That seven-day rule should not be treated as a reason to delay urgent security measures, a payment-provider fraud report, or contact with law enforcement when funds, accounts, evidence, or personal safety are at immediate risk.

The Act principally covers business-to-business and business-to-consumer internet transactions connected with the Philippine market. It excludes consumer-to-consumer transactions. A person who regularly sells in the ordinary course of business may be an online merchant even if the sale took place through social media; the account’s label alone is not conclusive.

Report suspected crime to cybercrime authorities

You may bring the evidence and a valid government-issued ID to the appropriate cybercrime unit. Available official starting points include:

The CICC Cybercrime Complaint Center
The PNP Anti-Cybercrime Group
The NBI, including its Cybercrime and Fraud and Financial Crimes services
The DOJ Office of Cybercrime, particularly where central cybercrime coordination or cross-border assistance is relevant

CICC also operates the 1326 cybercrime hotline, but hotline availability may change during maintenance. Its official reporting page should be checked for current alternative numbers and instructions.

An initial report, police blotter entry, or online submission is not always the same as a formal criminal complaint. Investigators may require you to appear, establish your identity, execute a complaint-affidavit, authenticate records, or provide devices and original files for lawful examination.

Prepare a complaint packet containing:

Your full name and reliable contact details
A clear timeline
The amount and nature of the loss
The suspected person’s known identifiers
Copies of electronic evidence
Transaction records
Platform and financial-institution reference numbers
A list of possible witnesses or other victims
A statement of which facts you personally know and which information came from someone else

The Cybercrime Prevention Act of 2012 covers offenses such as computer-related fraud and computer-related identity theft. It also applies relevant cybercrime provisions when crimes under the Revised Penal Code or special laws are committed through information and communications technology. The correct charge is determined by investigators and prosecutors, not by the label selected in an online report.

File a consumer complaint with DTI

DTI is generally the appropriate consumer-redress route when an online business fails to deliver, refuses a lawful refund, misrepresents a product, or engages in an unfair or deceptive sales practice within DTI’s jurisdiction.

File through the DTI Consumer Complaints Assistance and Resolution system. Attach:

Proof of purchase and payment
The advertisement or product listing
Communications with the seller
The platform complaint and evidence that the internal process was used
The result of that process, or proof that seven calendar days passed without resolution
A clear statement of the remedy requested, such as refund, replacement, repair, or another legally available remedy

Under the Internet Transactions Act, an online consumer may pursue repair, replacement, refund, or other remedies allowed by the Consumer Act and applicable law when goods are defective, lost without the consumer’s fault, or fail to conform to a warranty or contractual obligation. The merchant or e-retailer is primarily liable in consumer civil actions and administrative complaints. Platform liability is not automatic; it depends on circumstances specified by law, including failures to exercise required diligence or respond appropriately after notice.

A claim for damages under the Internet Transactions Act must be filed in court or with DTI within two years from the time the cause of action arose. Other claims or offenses may be governed by different prescriptive periods, so do not treat two years as a universal deadline.

If personal data or identity documents were misused

Report the incident to the organization that controls the affected account or data and ask it to secure the account, preserve relevant logs, and investigate.

If the matter involves a possible violation of data-privacy rights—rather than fraud alone—consult the National Privacy Commission for its current complaint requirements. A privacy complaint and a criminal fraud report address different legal issues and may proceed separately.

If someone is using your name, photograph, identification document, or account to scam others, preserve examples of the impersonation and clearly state in reports that you are reporting identity misuse, not merely an unwanted post.

What not to do

Do not send another payment to “unlock,” “verify,” “insure,” or “refund” the first payment.
Do not give investigators, bank staff, or supposed platform agents your password or one-time PIN.
Do not delete the conversation after blocking the account.
Do not rely only on a public social-media post as your report.
Do not threaten, hack, impersonate, or publicly expose an unverified person.
Do not assume the name shown on an e-wallet or bank transfer identifies the mastermind; it may belong to a money mule or another victim.
Do not exaggerate facts or submit fabricated evidence. The Anti-Financial Account Scamming Act penalizes malicious or bad-faith reporting of completely unwarranted or false information that results in funds being held.
Do not pay a private “recovery agent” who guarantees that stolen money will be returned.

When help is urgent

Seek immediate assistance when:

A transfer has just been made and may still be stoppable.
The scammer has access to your bank, e-wallet, email, or mobile number.
You disclosed a one-time PIN, password, card security code, recovery code, or identity document.
The scammer is threatening violence, blackmail, or publication of intimate material.
A child, senior citizen, trafficking victim, or otherwise vulnerable person is involved.
Several victims or large amounts appear to be involved.
The seller is deleting accounts or messages, moving funds, or directing victims to multiple accounts.
You received a legal notice, subpoena, or demand connected with money that passed through your account.

If you allowed another person to use your account or received and forwarded suspicious funds, stop moving the money and obtain legal advice promptly. AFASA specifically addresses money-mule activity, including lending, selling, buying, renting, or recruiting the use of financial accounts in prohibited circumstances.

Frequently asked questions

Can I report a scam even if I did not lose money?

Yes. You may report a fraudulent account, listing, phishing attempt, or impersonation to the platform and an appropriate cybercrime authority. State clearly that it was an attempted or suspected scam and that no payment was made.

Can I report an anonymous or deleted seller?

Yes. Provide every available identifier: profile and listing URLs, user IDs, phone numbers, account numbers, QR codes, transaction references, email addresses, courier records, and archived communications. A platform may be required to disclose merchant information when a competent authority issues the necessary subpoena based on a sworn complaint that satisfies the statutory conditions.

Will reporting guarantee a refund?

No. Recovery depends on factors such as how the payment was made, how quickly it was reported, whether funds remain traceable, the payment provider’s rules, the platform’s buyer protection, and the available evidence. Report promptly even when recovery is uncertain.

Should I report to DTI or the police?

Often both, because they serve different purposes. DTI handles consumer redress and regulatory issues within its jurisdiction. Police or NBI investigators handle suspected crime. Your bank or e-wallet and the platform should also receive separate reports.

What if the sale was between two private individuals?

The Internet Transactions Act excludes genuine consumer-to-consumer transactions. That does not make fraud lawful or prevent a report to the payment provider, platform, PNP, NBI, or CICC. Consumer remedies under that particular Act may not apply, and the correct civil or criminal route will depend on the facts.

What if the seller is outside the Philippines?

A report may still be made. The Internet Transactions Act can apply to a person who avails of the Philippine market and has the required minimum contacts, even without a Philippine legal presence. Practical enforcement and recovery may nevertheless be harder, and cross-border cooperation may be necessary.

Do I need a lawyer to make the initial reports?

Usually not. You may personally notify the platform, payment provider, DTI, or law-enforcement agency. Legal help becomes especially useful when the loss is substantial, the facts are disputed, you are preparing a complaint-affidavit or court case, several victims are involved, or you may be accused of participating in the transactions.

This article provides general Philippine legal information, not legal advice for a particular case. Rights, filing requirements, and available remedies depend on the evidence, transaction documents, platform terms, and the agencies involved. Official sources and procedures were checked as of 15 September 2026.