A practitioner-style guide to your criminal, civil, regulatory, and money-recovery options when an “investment” site or app stops paying or blocks withdrawals. This is general guidance in the Philippine context.

I. Snapshot: What usually happened (and why it matters)

Typical red flags:

“Guaranteed” high returns, VIP groups, referral bonuses, countdowns to re-deposit.
“Tax/clearance fee” demanded before withdrawals.
Payments to personal bank/e-wallet accounts, crypto addresses with no KYC.
Anonymous operator, foreign domain, disposable social accounts.

Legal framing (often overlapping):

Estafa / fraud (Revised Penal Code), frequently through computer systems → Cybercrime Prevention Act penalty upgrades.
Unregistered securities / investment solicitation (Securities Regulation Code) and investment-taking by unlicensed entities.
Syndicated/large-scale estafa if multiple accused acting together / many victims.
Money laundering of the proceeds (AMLC tools: freeze/forfeit).
Financial consumer protection breaches (if a licensed FSP or payment intermediary is involved).
Possible data privacy violations (ID selfies, contact scraping, doxxing).

II. Your remedy “stack” (run tracks in parallel)

1) Criminal (for accountability + leverage)

Where to file: NBI-Cybercrime or PNP-ACG; then City/Provincial Prosecutor.
Crimes to assert: Estafa (with cyber aggravation), computer-related fraud/illegal access, syndicated/large-scale estafa where facts fit, securities law crimes for unregistered investment solicitation.
Why now: Lets law enforcement subpoena/subpoena-duces tecum, seek cyber warrants, and coordinate with AMLC for freeze orders.

2) Regulatory (to shut them down and aid tracing)

SEC – complaints vs. unregistered investment schemes and persons “selling securities” without registration; request advisory/cease-and-desist and referral to prosecutors.
BSP – if banks/e-money/payment gateways were used; invoke Financial Consumer Protection (RA 11765) for dispute resolution and remedial orders to FSPs that mishandled fraud signals.
NPC – for misuse of personal data (ID harvesting, debt-shaming).
DTI – deceptive advertising (complements SEC complaint).
NTC/DICT – for blocking rogue domains/apps (usually via law-enforcement request).

3) Civil (to recover your money)

Small Claims (no lawyer required) within the current monetary cap—ideal when you can identify a local mule/agent who received your funds.
Ordinary civil action (sum of money, rescission, damages) vs. local operators, recruiters, or local “handlers.”
Injunction/attachment/garnishment when you can identify assets or bank accounts.

4) Payments & chargebacks (fastest cash relief if eligible)

Cards: Dispute as services not rendered/fraud; provide screenshots and dispute letter.
Banks/e-wallets: Request recall/chargeback/pushback; give transaction IDs and a police/NBI reference number. The earlier you file, the higher the recovery odds.
Crypto: Trace to exchange; request account freeze through exchange compliance with case number (works best when funds are still on-ramp/off-ramp).

III. Evidence: build a clean, admissible package

Collect and preserve (now):

Screenshots with URL bar and system clock, videos of the app flow, PDF exports of terms and dashboards (showing “balance” and errors).
Transaction proofs (bank/e-wallet receipts, card statements, blockchain tx IDs).
Counterparty data (account names/numbers, QR codes, mobile nos., social handles, domain WHOIS, ads).
A dated chronology (who promised what, when you paid, what “fees” were demanded, when withdrawals failed).
KYC artifacts you submitted (ID, selfie, liveness video).
Any referral/agent chats (Telegram, FB, SMS), with profile links.

Preserve formally:

Send preservation letters to your bank/e-wallet and known platforms asking them to retain logs and KYC (attach your complaint reference once you have it).
Save files with hashes and keep an evidence index; don’t alter source devices.

IV. Criminal complaint—contents that stick

Complaint-Affidavit should set out:

Identity & jurisdiction (you are in the Philippines; acts/harms occurred here).
Factual narrative (timeline; promises; payments; blocked withdrawals; demands for “unlock fees”).
Elements of offenses (deceit; damage; use of computer systems; solicitation of investments).
Documents annexed (screenshots, receipts, chat logs, IDs, terms).
Prayer for cyber warrants, platform preservation, and AMLC coordination.

Venue: where any element occurred (your location at time of transactions counts), or where the computer system used is situated.

V. SEC & FCP tracks—how to frame them

SEC complaint: Identify the unregistered investment solicitation, attach marketing posts/whitepapers, list victims (if organized), and name local recruiters with bank details.
BSP/FCP complaint (vs. banks/e-wallets/payment gateways): argue failure to provide fair treatment and effective recourse, slow or inadequate fraud handling, or allowing obviously suspicious mule activity—seek refunds/reversals and compliance orders.

If a licensed local entity is behind the site (rare), also cite mis-selling, unfair contract terms, and request administrative penalties.

VI. Jurisdictional wrinkles & cross-border

Extraterritorial reach: Philippine cybercrime law applies when any element, the victim, or the computer system is in the Philippines; prosecutors may still use MLAT/Budapest Convention channels for foreign-hosted platforms.
Use NBI/PNP to send lawful requests for subscriber/payment data to platforms and exchanges.
In life/limb threats or minors’ involvement, platforms can make emergency disclosures while formal process follows.

VII. “But the ‘investment’ was illegal—can I still recover?”

Courts sometimes invoke in pari delicto (both parties at fault) to deny civil recovery in illegal gambling or patently unlawful ventures. However:

If you were defrauded by misrepresentation (fake licensing, fabricated returns), plead fraud and public policy favoring disgorgement of criminal proceeds.
If you were coerced or a minor/vulnerable, or it’s a pyramid/ponzi masquerading as legitimate investment, courts tend to favor victims.
Even where civil recovery is difficult, criminal and regulatory tracks still apply; payment disputes and AMLC freezes can work regardless of in pari delicto defenses.

VIII. Priority timeline (first 72 hours → 30 days)

0–24 hours

Stop sending money; change passwords; enable 2FA.
File disputes with card/bank/e-wallet; request recall/freeze of recipient accounts.
Blotter (local police) + NBI/PNP cyber report; get the reference number.
Send preservation letters to FSPs and platforms.
Consolidate evidence; draft chronology.

2–7 days 6) File criminal complaint with annexes. 7) Lodge SEC and BSP/FCP complaints; submit ticket numbers from banks/e-wallets. 8) Demand letter to local mule (if identifiable) and any visible recruiter/agent.

Within 30 days 9) Consider Small Claims vs. local mule/agent. 10) Work with investigators on subpoenas/cyber warrants (platform/ISP/payment). 11) If crypto used, send exchange freeze request citing the case number.

IX. Choosing defendants (who to name)

Primary operators (if identifiable).
Local agents/recruiters who solicited and received money (joint tort-feasors).
Money mules (bank/e-wallet holders who took your deposits).
Corporate shells linked to the website (if domiciled locally).
John Does tied to specific accounts (to be amended once identities are disclosed).

X. Computations & heads of recovery (civil)

Principal loss + legal interest.
Actual damages (fees, forex loss, travel, medical if stress-related and documented).
Moral/exemplary damages for fraud and bad faith.
Attorney’s fees where justified.
Restitution as accessory penalty in criminal case.

XI. Templates (short forms you can adapt)

A. Preservation/Dispute to Bank or E-Wallet

Please preserve and reverse/recall the transfers below made to [Acct Name/No.] on [dates], induced by an online investment scam [site/app]. Attached are receipts and screenshots. Police/NBI Case No.: [____]. Kindly flag linked accounts and provide KYC details upon lawful request.

B. Demand to Local Mule/Agent

You received ₱[amounts] on [dates] for [site/app], which refused withdrawal and is unlicensed. Return the total ₱[sum] within five (5) days or face criminal (estafa, securities) and civil actions.

C. Criminal Complaint—Issue List (insert under “Allegations”)

(1) False representations of licensing/returns; (2) specific deposits with references; (3) refusal to release funds; (4) demand for “unlock/tax” fees; (5) use of personal accounts/crypto; (6) multiplicity of victims (if any).

XII. Practical do’s & don’ts

Act within hours—recalls and freezes get harder by the day.
Centralize evidence with timestamped files.
Use official channels; get reference numbers for every complaint.
Coordinate victims for consolidated filings (stronger pattern proof).

Don’t

Pay any “unlock/clearance” or “tax” to withdraw.
Threaten in-person confrontations; keep it legal and documentary.
Rely solely on chats—back all claims with bank/e-wallet statements and screens showing the operator’s terms.

XIII. Special notes (edge cases)

Employer due diligence: If funds were advanced from company accounts, corporate victims should file as well; consider insurer notifications (crime/fidelity coverage).
Tax angle: If you actually received prior “profits,” keep records; the BIR may treat genuine gains as income, but in fraud collapse scenarios, net loss documentation matters.
Minors/VAWC: If grooming, sexual extortion, or domestic partner coercion is involved, add child safety/VAWC charges and seek protection orders.

XIV. Key takeaways

Run four tracks in parallel: criminal, regulatory, civil, and payment disputes—your odds of recovery rise when you act fast and document everything.
Focus on local touchpoints (mules, recruiters, payment rails) while authorities pursue the platform operators.
Expect the site to vanish; your evidence kit and timely freezes are what turn losses into recoveries.
Even if the scheme is “illegal,” courts often prioritize fraud victims; plead misrepresentation and public policy against unjust enrichment.
Above all: never pay to “unlock”. That is the trap, not the exit.