Quick answer

Yes. If an online investment promoter used false identities, fabricated credentials, fake trading records, guaranteed-return claims, or other material lies to induce you to transfer money, the facts may support estafa by false pretenses under Article 315(2)(a) of the Revised Penal Code. When information and communications technology was deliberately used to commit the fraud, prosecutors may charge estafa in relation to Section 6 of the Cybercrime Prevention Act, which raises the prescribed penalty by one degree.

A failed or loss-making investment is not automatically estafa. The evidence must connect a false representation made before or when you invested to your decision to release money and to the loss that followed. Report the transfer immediately to the bank, e-wallet, exchange, or remittance provider; preserve the digital evidence; seek investigative assistance from the NBI or PNP; and prepare a sworn complaint for the proper prosecution office. An SEC report should also be made when securities, investment contracts, public solicitation, or unlicensed sellers are involved.

Recovery is never guaranteed. Speed matters because recipient accounts can be emptied, online records can disappear, and criminal and civil claims are subject to prescriptive periods.

When an investment scam may amount to estafa

The usual charge in an online investment scam is estafa through false pretenses or fraudulent representations under Article 315(2)(a). The Supreme Court identifies four essential points:

The accused made a false pretense, fraudulent representation, or similar deceit.
The deceit was made before or at the same time as the fraud.
The victim relied on it and was thereby induced to part with money or property.
The victim suffered damage.

These elements come from Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951 and are applied in cases such as Gabionza v. Court of Appeals.

Evidence may support estafa when, for example, a promoter falsely claimed that:

a company, fund, trading platform, or investment account existed;
the promoter was licensed, accredited, or authorized to solicit investments;
investors’ money would be placed in a particular asset or legitimate business;
deposits were insured, guaranteed, or protected by a government agency;
purported profits, account balances, trades, audits, or withdrawals were genuine;
withdrawals were available when the displayed balance was fictitious;
taxes, “verification fees,” or “unlocking charges” had to be paid before funds could be released; or
the promoter possessed qualifications, credit, property, connections, or authority that the promoter did not actually have.

The complaint should identify the particular representation, who made it, when and where it was communicated, why it was false, and how it caused each transfer. Statements such as “I was scammed” or “the investment was fake,” without those details and supporting evidence, may be insufficient.

A bad investment or unpaid obligation is not automatically a crime

Criminal fraud must be distinguished from an ordinary business loss or breach of contract.

A drop in market value, business failure, delayed payment, or inability to repay does not by itself prove that the promoter was lying when the investment was made. Under Article 315(2)(a), the deceit must ordinarily precede or accompany the victim’s transfer. A false excuse invented only after a legitimate obligation became due may establish breach or nonpayment, but not necessarily estafa by prior deceit.

Indicators that may separate an intentional scheme from an honest failure include fabricated registrations, fictitious trades, impersonation, forged documents, diversion of funds from the represented purpose, use of multiple mule accounts, immediate disappearance after payment, scripted excuses shared across victims, and demands for repeated fees to release nonexistent proceeds. The entire transaction and the documents—not merely the final nonpayment—must be examined.

How the Cybercrime Prevention Act affects the charge

Section 6 of Republic Act No. 10175 covers crimes under the Revised Penal Code or special laws when committed by, through, and with the use of information and communications technology. The Supreme Court has explained that Section 6 operates as a qualifying circumstance that increases the corresponding penalty by one degree.

Its application is fact-dependent. The prosecutor must determine whether technology was deliberately used in committing the fraud—not simply whether a phone or computer appeared somewhere in the background. Relevant conduct can include solicitation through social media, a messaging application, email, a fraudulent website, an online trading dashboard, or digitally transmitted payment instructions.

Cybercrime cases fall within the jurisdiction of designated Regional Trial Courts. Under the Rule on Cybercrime Warrants, the criminal action may generally be filed in the designated cybercrime court where an element occurred, where part of the computer system used was situated, or where the damage took place. The prosecution office or investigating agency should confirm the correct venue from the actual communications, transfers, system locations, parties, and resulting loss.

Other offenses that may apply

The same conduct may implicate laws beyond simple estafa, but additional charges should not be assumed without evidence.

Securities violations

An “investment” may constitute a security or investment contract even if the promoter gives it another label. Under the Securities Regulation Code:

securities generally may not be offered or sold to the public without the required registration, unless an exemption applies;
brokers, dealers, salespersons, and associated persons must be properly registered when the law requires it; and
fraudulent conduct connected with the purchase or sale of securities is prohibited.

A company’s SEC registration as a corporation proves only its juridical existence. It does not by itself authorize the company to sell securities, solicit investments from the public, or act as a broker or dealer.

Financial Products and Services Consumer Protection Act

Republic Act No. 11765 prohibits investment fraud involving financial products or services and assigns enforcement responsibilities to financial regulators within their jurisdictions. Whether it applies depends on the product, provider, regulator, and underlying conduct.

Syndicated estafa

Presidential Decree No. 1689 may apply in narrowly defined circumstances involving a syndicate of five or more persons formed to carry out the unlawful scheme and the misappropriation of specified funds, including funds solicited by corporations or associations from the general public. The number of people in a group chat or referral network does not, by itself, establish syndicated estafa. The required organization, participation, solicitation, and handling of funds must be proved.

Identity theft, falsification, unauthorized access, misuse of access devices, money-mule activity, or money laundering may also require separate evaluation.

What to do immediately

1. Contact every financial institution involved

Notify your sending bank, e-wallet, remittance provider, payment processor, or virtual-asset service provider immediately. Ask for:

a fraud or scam report;
an attempt to recall, hold, or trace the transfer;
preservation of the transaction and account records;
the official case or reference number; and
written instructions for submitting supporting documents.

If the transfer was unauthorized, say so accurately and follow the institution’s dispute process. If you personally authorized the payment because you were deceived, do not describe it as an unauthorized transaction. Institutions apply different legal and operational procedures to those situations.

A report does not guarantee reversal or freezing. Financial institutions generally cannot disclose another customer’s protected information or permanently freeze property merely on a private request; legal process or action by competent authorities may be required.

2. Secure your accounts

If you shared passwords, one-time passwords, recovery codes, identification documents, card details, screen access, or device access:

change credentials using a clean device;
activate multi-factor authentication;
sign out unknown sessions;
contact the affected financial institutions;
check for unauthorized loans, SIM changes, or account recovery attempts; and
preserve evidence before deleting malicious applications or resetting a device, where safely possible.

Do not pay another “tax,” “clearance,” “AML fee,” “gas fee,” “withdrawal fee,” or “recovery fee” merely because the scammer promises to release the investment afterward.

3. Report for investigation

You may seek assistance from:

the NBI online complaint portal, the NBI Cybercrime Division, or the NBI Fraud and Financial Crimes Division;
the Philippine National Police Anti-Cybercrime Group or the appropriate local police unit; and
the SEC iMessage complaint system when the scheme involves investment solicitation, securities, corporate representations, or unregistered sellers.

An agency report and a prosecutor’s complaint serve different functions. Reporting to investigators can help identify account holders, preserve data through proper legal processes, locate other victims, and build the case. A criminal action is ordinarily initiated through the filing process required by the applicable rules, often beginning with a complaint-affidavit before the proper prosecution office.

Keep every acknowledgment, reference number, receiving stamp, and follow-up communication.

Evidence to preserve

Preserve originals where available and create at least two secure backups. Do not crop or edit the only copy.

Useful evidence includes:

the full conversation history, including dates, times, usernames, profile links, phone numbers, email addresses, voice messages, and attachments;
screen recordings showing the profile, page URL, account identifier, conversation context, and fraudulent dashboard;
original emails with complete headers;
advertisements, livestreams, webinars, referral presentations, contracts, term sheets, prospectuses, certificates, and promised-return schedules;
screenshots and downloadable statements from the supposed investment account;
bank, e-wallet, remittance, card, or exchange receipts showing the date, amount, reference number, and sender and recipient details;
cryptocurrency transaction hashes, wallet addresses, network used, exchange records, and peso purchase receipts;
proof connecting a promoter or recruiter to the payment instructions;
claims of SEC, BSP, insurance, exchange, or professional authorization;
records of withdrawal attempts and demands for additional fees;
names and contact details of witnesses and other victims;
your chronology of events, prepared while memories are fresh; and
proof of actual loss, refunds received, or amounts still unpaid.

Electronic documents are admissible only if the applicable evidentiary and authentication requirements are met. The Rules on Electronic Evidence make authenticity and reliability important. Retain original devices and files when practicable, export conversations through the platform’s official function, and document how each file was obtained.

Preparing the complaint-affidavit

A strong complaint-affidavit should tell a chronological, evidence-linked story. Include:

Your complete identifying and contact information.
The respondent’s known names, aliases, usernames, phone numbers, addresses, employer or company, and account details.
How and when contact began.
Each important representation made before payment.
The evidence showing that the representation was false.
Why you relied on it.
A transfer table listing each date, amount, channel, recipient, and reference number.
What happened when you requested withdrawal or repayment.
The total loss, after deducting actual refunds.
The role of each respondent, rather than treating everyone associated with the scheme as automatically liable.
A list and clear labeling of all annexes.
The facts showing why the chosen prosecution office is the proper venue.

Affidavits must be truthful, based on personal knowledge where represented as such, and properly sworn. Clearly distinguish what you personally saw from information supplied by another victim or investigator.

The DOJ’s current prosecutor-level procedures are governed by the 2024 DOJ–National Prosecution Service Rules on Preliminary Investigations and Inquest Proceedings and, for offenses within its coverage, the rules on summary investigation and expedited preliminary investigation listed on the DOJ issuances page. The correct track depends on the legally prescribed penalty and charge.

For a regular preliminary investigation, the complaint ordinarily includes the original complaint-affidavit, two duplicate official-file copies, an additional copy for each respondent, a completed NPS Investigation Data Form, witness affidavits, and supporting evidence. The prosecution-office head first checks the complaint’s form and the completeness of the evidence. Current DOJ rules require prima facie evidence with reasonable certainty of conviction, including evidence that is admissible, credible, capable of preservation and presentation, and sufficient to establish the elements and responsible persons if left uncontroverted.

Confirm the current local filing requirements, fees, office hours, acceptable electronic-filing method, and number of copies directly with the prosecution office before filing. An email is not a valid filing merely because an address appears online; electronic filing must comply with the applicable rule or an order from the prosecutor, and hard-copy submission may still be required.

What happens after filing

Depending on the applicable DOJ procedure, the complaint may be assessed for completeness, assigned to an investigating prosecutor, dismissed for lack of sufficient grounds, or served on the respondent with a subpoena.

The respondent is ordinarily allowed to submit a counter-affidavit and supporting evidence. Reply and rejoinder affidavits may be allowed under the governing procedure. The prosecutor then decides whether the required evidentiary threshold exists to file an information in court.

A prosecutor’s finding is not a conviction. If an information is filed, the court independently addresses judicial probable cause and the prosecution must ultimately prove guilt beyond reasonable doubt. A dismissal may be subject to a timely motion for reconsideration or the applicable DOJ review process. Preserve proof of the date you received every resolution because review periods are strict; under the 2024 DOJ-NPS rules, a motion for reconsideration is generally filed within 15 days from receipt, subject to the exact governing rule and procedural posture.

Claims for return of the money

When a criminal action is instituted, the civil action to recover liability arising from the offense is generally deemed included unless the victim waives it, reserves the right to file separately, or filed a civil action earlier. This rule and its exceptions appear in Rule 111 of the Rules of Criminal Procedure.

Discuss civil recovery with counsel before making a reservation or starting a separate suit. The choice can affect filing fees, timing, coordination with the criminal case, available defendants, provisional remedies, and the risk of double recovery. A criminal complaint does not assure repayment, particularly when assets have been dissipated, transferred abroad, hidden behind nominees, or converted to cryptocurrency.

A settlement, refund, or affidavit of desistance does not automatically erase a public crime after it has been committed. Record any payment accurately and obtain advice before signing a release, compromise, quitclaim, or desistance affidavit.

Common mistakes that weaken a case

Sending more money to unlock a supposed withdrawal.
Deleting chats, blocking accounts, or factory-resetting a device before preserving evidence.
Submitting isolated screenshots without dates, URLs, account identifiers, or surrounding context.
Naming company officers, endorsers, recruiters, or account holders without evidence of their knowledge and participation.
Treating an SEC certificate of incorporation as authority to solicit investments.
Calculating the loss without deducting real withdrawals or refunds.
Omitting the exact pre-payment lie and explaining only the later failure to pay.
Filing in a convenient location without facts establishing venue.
Posting accusations or personal information publicly instead of providing evidence to authorities.
Paying an alleged hacker, asset-recovery agent, or “government contact” who guarantees recovery.
Waiting for the scammer to disappear completely before reporting.

When legal help is urgent

Consult a Philippine lawyer promptly when:

the loss is substantial or involves several victims;
funds are still moving or identifiable assets may be preserved through lawful remedies;
the respondents, accounts, or servers are abroad;
cryptocurrency, layered transfers, shell companies, or money mules are involved;
you are unsure whether the transaction is criminal fraud or a civil investment dispute;
the scheme may involve syndicated estafa or securities offenses;
the prosecution office has rejected the filing or dismissed the complaint;
a reconsideration or review deadline is running;
the scammer is threatening, blackmailing, impersonating, or using your identity; or
you are being asked to sign a settlement, waiver, quitclaim, or affidavit of desistance.

If cost is a barrier, inquire with the Public Attorney’s Office about eligibility and available assistance. Private counsel may also coordinate the evidence and civil aspect, but the public prosecutor retains control of the criminal prosecution.

Frequently asked questions

Can I file even if I know only the scammer’s screen name?

You can report the incident and provide all available identifiers, including usernames, URLs, phone numbers, payment accounts, device records, wallet addresses, and transaction references. Investigators may use lawful preservation requests and court-authorized processes to seek identifying data. A prosecutor’s complaint must still contain enough evidence to establish the offense and connect an identifiable person or persons to it before a case can proceed effectively.

Is a police blotter enough?

No. A blotter documents a report but does not by itself constitute a complete prosecutor’s complaint or prove the elements of estafa. Follow through with the requested affidavit, supporting evidence, investigative steps, and prosecutor filing.

Does SEC registration mean the investment was legitimate?

No. Corporate registration is different from registration of securities and authority to solicit, sell, broker, or deal in investments. Verify the specific company, offering, and salesperson with the SEC.

Can I file against the bank or e-wallet account holder?

An account holder may be an offender, participant, nominee, or unwitting victim. Receipt of funds is important evidence but does not automatically prove deceit or conspiracy. Include the account details and let investigators determine the holder’s identity and role.

Can several victims file together?

Victims may coordinate evidence and report the common scheme, particularly where the same respondents, representations, and payment channels were used. Each victim should ordinarily provide a personal sworn account of the representations relied upon, transfers made, and loss suffered. The prosecutor determines whether complaints or charges should be handled jointly or separately.

Will reporting to the SEC replace an estafa complaint?

No. An SEC complaint may support regulatory investigation or securities-law enforcement, but it does not automatically replace a complaint for estafa before the appropriate law-enforcement and prosecution authorities.

How long do I have to file?

Do not rely on a single universal period. Prescription depends on the precise offense, prescribed penalty, date of commission or discovery, applicable statute, and acts that interrupt the period. Cybercrime, securities, and syndicated-estafa theories may involve different rules. File promptly and obtain case-specific advice if significant time has passed.

Can authorities recover cryptocurrency?

Tracing may be possible when transaction records, wallet addresses, exchange accounts, and identification data remain available. Recovery depends on speed, jurisdiction, control of the destination wallet, exchange cooperation, lawful process, and whether the assets remain reachable. No legitimate investigator or lawyer can guarantee recovery.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The proper charges, venue, procedure, deadlines, and remedies depend on the documents and complete facts. Official sources and procedures were checked as of September 5, 2026.