Quick answer

If you believe you were scammed through an online shop, marketplace, messaging app, or social-media account, act immediately:

Contact the bank, card issuer, or e-wallet from which the money came. Use its official 24/7 fraud channel. Ask it to secure your account, record the transaction as disputed, trace the funds, and initiate any available temporary hold or coordinated verification. Get a case-reference number.
Preserve the evidence before posts, messages, or accounts disappear.
Report the seller and transaction through the platform’s internal complaint or refund system.
Report the suspected crime to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or Cybercrime Investigation and Coordinating Center.
For a transaction with a business seller, file a consumer complaint with the Department of Trade and Industry if the platform or seller does not resolve it.

Reporting quickly improves the chance that remaining funds and digital evidence can be traced, but no agency, platform, or financial institution can guarantee recovery.

First, determine what happened

A delayed delivery or disagreement over product quality is not automatically a scam. Fraud generally involves deceit intended to make the victim part with money, property, account access, or sensitive information. Warning signs include:

The seller never intended to deliver the item.
The item, store, payment page, delivery notice, or proof of shipment was fabricated.
The seller used another person’s identity or falsely claimed affiliation with a legitimate business.
You were induced to pay repeated “release,” “insurance,” “customs,” “verification,” or “refund” fees.
A fake customer-service representative obtained your OTP, password, PIN, card details, or account credentials.
Your bank or e-wallet account was accessed or used without authority.
The seller disappeared, blocked you, or immediately moved the payment through several accounts.

A wrong, defective, counterfeit, incomplete, or undelivered order can also support consumer remedies even when criminal intent cannot yet be proved.

What to do immediately

1. Stop communicating through links supplied by the suspected scammer

Do not send another payment, OTP, PIN, password, recovery code, identification document, or selfie. Do not install a screen-sharing or remote-access application.

If you clicked a link, disclosed credentials, or installed an application:

Change the affected password using a different, trusted device.
Change any reused passwords on other accounts.
Sign out unknown devices and sessions.
Enable multi-factor authentication.
Lock or replace compromised cards.
Ask your telecommunications provider to secure your SIM if you suspect a SIM swap.
Check for unauthorized transactions and changes to your contact information.

Use contact details from the institution’s official website or application—not numbers, links, or QR codes sent by the suspected scammer.

2. Call the originating bank or e-wallet at once

Report the transaction to the institution that held the account from which the money was sent. State clearly whether:

you authorized a payment because of the scammer’s false representations;
someone accessed your account without permission;
your card details or credentials were stolen;
an OTP or approval was obtained through deception; or
the transaction was simply sent to the wrong account.

These categories can be treated differently. Do not describe an authorized transfer as “unauthorized”; give an accurate account of what happened.

Ask the institution to:

secure or restrict the compromised account;
record a fraud complaint through its Financial Consumer Protection Assistance Mechanism;
identify the transaction using its reference number;
trace the receiving account and any onward transfers;
initiate the temporary-holding and coordinated-verification process when legally applicable;
process any available card dispute, chargeback, transfer-recall, or e-wallet dispute; and
provide a written acknowledgment and case-reference number.

Under the Anti-Financial Account Scamming Act and BSP Circular No. 1215, covered financial institutions must maintain a 24/7 fraud-reporting channel. Disputed funds may initially be held for up to five calendar days and, when the requirements are met, for an additional period of up to 25 calendar days. A hold beyond the overall 30-day period requires a court order.

A hold is not automatic restitution. It depends on factors such as whether funds remain traceable, whether the transaction qualifies as disputed, and what coordinated verification establishes. Cooperate promptly with requests for identification, transaction records, or a sworn account of events.

If the institution does not satisfactorily address your complaint, escalate it to the BSP Consumer Assistance Mechanism. The BSP requires consumers to complain to the financial institution first. Escalation may be made through the BSP Online Buddy, or by submitting the prescribed form and proof of the first-level complaint to consumeraffairs@bsp.gov.ph.

3. Preserve evidence before requesting a takedown

Save the material in its original form where possible. Collect:

the full URL and username of the store, listing, advertisement, and profile;
the profile’s unique account or page identifier, if visible;
screenshots and screen recordings showing the date, time, URL, and complete conversation;
the original chat export, emails, SMS messages, and voice messages;
product descriptions, prices, photographs, reviews, and claimed business details;
order confirmations, electronic invoices, receipts, tracking numbers, and delivery records;
bank or e-wallet transaction confirmations and reference numbers;
the recipient’s account name, account number, mobile number, QR code, and financial institution;
telephone numbers, email addresses, delivery addresses, and names used by the seller;
records of calls to the bank, platform, courier, and government agencies;
photographs or video of the parcel, label, packaging, and item received;
a simple chronological statement of what was promised, what you did, and what happened; and
the names and contact details of witnesses, if any.

Keep unedited copies and backups. Do not crop away identifiers that may help establish authenticity. If investigators ask to examine a device, discuss how it will be handled and documented before altering or replacing it.

4. Use the platform’s official redress system

File the complaint from inside the marketplace, payment application, or social-media platform. Request a refund, cancellation, seller review, account restriction, and preservation of the seller’s registration and transaction records.

For covered business-to-consumer transactions, the Internet Transactions Act of 2023 generally requires an aggrieved party to use the platform, marketplace, or e-retailer’s internal redress mechanism before going to a government agency, court, or alternative dispute-resolution process. That mechanism is deemed exhausted if the complaint remains unresolved for seven calendar days.

This seven-day rule should not be treated as a reason to delay an urgent bank or law-enforcement report. Funds and digital records can disappear quickly. Preserve evidence and notify the financial institution immediately while pursuing the platform complaint.

The Act covers business-to-business and business-to-consumer internet transactions within its scope. A purely private consumer-to-consumer sale is excluded from that Act, although criminal, civil, payment, and other applicable laws may still provide remedies.

5. Report the suspected crime

You may report to any of the following:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph; PNP National Headquarters, Camp General Crame, EDSA, Quezon City
NBI Cybercrime Division: ccd@nbi.gov.ph; NBI Building, Taft Avenue, Ermita, Manila
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph; hotline 1326

The BSP’s current official complaint guide also lists additional CICC and PNP contact numbers. Verify contact details on the agency’s official site before sending personal information.

The NBI’s published procedure provides for a complaint sheet, preliminary interview, sworn statement or affidavit, supporting documents, and—when relevant—examination of the device connected with the incident. NBI regional offices may also receive cases for their regional cybercrime centers.

Bring or submit:

a valid government-issued ID;
your written chronology;
transaction and account details;
the preserved digital evidence;
the platform and financial-institution case numbers;
proof of your attempts to obtain a refund; and
any affidavit or complaint form the receiving office requires.

Ask for a receiving copy, acknowledgment, blotter or complaint number, and the investigator’s official contact details.

When to complain to the DTI

A DTI complaint is appropriate when the dispute concerns a business seller, e-retailer, marketplace, or digital platform and involves matters such as:

nondelivery;
goods materially different from their description;
defective, unsafe, counterfeit, incomplete, or misrepresented goods;
refusal to honor a lawful repair, replacement, or refund remedy;
deceptive, unfair, or unconscionable sales practices; or
failure to maintain or respond through the required redress mechanism.

Online consumers may pursue repair, replacement, refund, or other remedies available under the Internet Transactions Act, the Consumer Act, and other applicable laws. The online merchant or e-retailer is ordinarily the party primarily liable for the transaction. A platform’s liability depends on the facts and statutory conditions; it is not automatically responsible for every seller’s misconduct.

Submit the complaint through the DTI Consumer CARe portal. DTI also identifies consumercare@dti.gov.ph as a complaint channel for Metro Manila complainants and publishes its complaint instructions and address.

Attach the seller or platform’s contact information, proof of purchase and payment, your requested remedy, and proof that you used the internal redress mechanism. Under the Internet Transactions Act, a claim for damages under that Act may be filed in court or with the DTI within two years from the time the cause of action arose. Other claims or offenses may have different prescriptive periods, so do not wait for that deadline.

A DTI consumer proceeding and a criminal investigation serve different purposes. A DTI complaint may seek consumer redress and administrative enforcement; law-enforcement authorities investigate possible crimes. Depending on the facts, both may be appropriate.

Which laws may apply?

The precise offense depends on the evidence, not merely on the label “online scam.”

Estafa or other fraud: Deceit that causes another person to part with money or property may fall under Article 315 of the Revised Penal Code. If a qualifying offense under the Penal Code or a special law is committed through information and communications technology, Section 6 of the Cybercrime Prevention Act may apply.
Unauthorized account access or other computer offenses: Illegal access, computer-related fraud, identity misuse, and related conduct may fall under the Cybercrime Prevention Act, depending on the acts proved.
Financial-account scamming: The Anti-Financial Account Scamming Act addresses money-mule activity, specified social-engineering schemes, and related offenses involving financial accounts. Its social-engineering provision specifically concerns deception used to obtain sensitive identifying information that results in unauthorized access and control.
Consumer and e-commerce violations: Business sellers and covered platforms have disclosure, product-conformity, receipt, data-protection, and redress obligations under the Internet Transactions Act and other consumer laws.
Access-device offenses: Misuse of cards, account numbers, codes, or other access devices may also implicate the Access Devices Regulation Act.

Not every failed sale proves criminal fraud. Investigators and prosecutors must establish the elements of the particular offense, including fraudulent intent where the law requires it.

Evidence and expectations

A report does not automatically freeze an account

The victim cannot personally order a receiving account frozen. A covered financial institution may temporarily hold qualifying disputed funds under BSP rules, while a longer restraint or other account action may require lawful process. If the money has already been withdrawn, converted, or transferred outside the traceable system, recovery becomes more difficult.

A recipient’s account name may not identify the scammer

Scammers may use money mules, stolen identities, rented accounts, or accounts opened with falsified documents. Report the account exactly as shown, but do not assume the named owner personally conducted every part of the scheme.

Refund and criminal liability are separate issues

A refund does not necessarily erase a completed offense, and a criminal report does not itself produce a refund. Civil restitution, consumer remedies, platform refunds, card disputes, and criminal proceedings follow different rules.

Common mistakes to avoid

Waiting several days before contacting the bank or e-wallet.
Continuing to pay supposed refund, verification, tax, insurance, or account-unlocking fees.
Deleting the conversation after blocking the seller.
Sending only cropped screenshots without URLs, timestamps, or transaction references.
Reporting solely to the social-media platform and assuming it will notify Philippine authorities.
Treating the BSP as the first complaint channel instead of first contacting the regulated financial institution.
Filing only with the DTI when the facts indicate deliberate fraud requiring criminal investigation.
Publicly posting unredacted IDs, account numbers, phone numbers, addresses, or other personal data.
Threatening, impersonating, or attempting to hack the suspected scammer.
Making knowingly false or exaggerated reports. Malicious reporting that causes a wrongful temporary hold can itself carry liability under the Anti-Financial Account Scamming Act.

When help is urgent

Contact the bank or e-wallet immediately and seek prompt law-enforcement assistance if:

unauthorized transactions are still occurring;
you disclosed an OTP, password, PIN, recovery phrase, or card security code;
your device, email, social-media account, SIM, or financial account has been taken over;
the scammer is threatening violence, blackmail, or release of intimate material;
a child, senior citizen, trafficked person, or other vulnerable person is being targeted;
the loss is substantial or involves several victims;
the scammer is instructing you to receive or forward other people’s money; or
you are being pressured to destroy records, lie to the bank, or recruit additional account holders.

If you allowed another person to use your account or were recruited to receive and transfer money, stop further transfers and obtain legal advice promptly. The facts may determine whether you are treated as a victim, witness, money mule, or suspect.

Frequently asked questions

I willingly transferred the money. Can I still report it?

Yes. Authorization of the transfer does not necessarily mean the transaction was legitimate. Explain that you approved the payment because of the seller’s representations. The bank may assess whether the funds qualify for tracing or temporary holding, while investigators determine whether fraud occurred.

Can the bank reverse an InstaPay, PESONet, or e-wallet transfer?

Possibly, but not automatically. The outcome depends on the payment channel, the institution’s procedures, whether funds remain available, the evidence, and the BSP rules on disputed transactions. Report immediately and request tracing and coordinated verification.

What if I received a fake or different item through cash on delivery?

Preserve the parcel, waybill, packaging, item, listing, and an unboxing video if available. Complain through the platform and courier’s official channels. If the seller is operating as a business, pursue DTI remedies; report to law enforcement if the evidence indicates deliberate fraud or identity deception.

What if the sale was arranged with a private person on social media?

A genuine consumer-to-consumer transaction is outside the Internet Transactions Act. You may still use the platform’s reporting system, contact the payment provider, pursue appropriate civil remedies, and report suspected estafa or cybercrime. A person regularly selling as a business may not be a mere private seller simply because the sale occurred on social media.

Must I know the scammer’s real name?

No. Submit every identifier you have. A platform or financial institution may disclose protected subscriber or account information only through appropriate legal authority or process.

Can I report an overseas seller?

Yes. Philippine law may apply where the seller or platform avails itself of the Philippine market and has sufficient contacts here, but cross-border identification, service, enforcement, and recovery can be more difficult. Report to the platform, payment provider, DTI when applicable, and Philippine law enforcement.

Should I post the scammer’s identity publicly?

Prioritize formal reports. Public accusations can expose personal data, compromise an investigation, identify an innocent account holder, or create other legal issues. If warning others, stick to verifiable facts, redact sensitive information, and avoid presenting an unproven allegation as a final legal finding.

Do I need a lawyer?

Not necessarily to make the initial reports. Consider obtaining legal assistance if the loss is substantial, the identities or transactions are complex, you need to file a prosecutor’s or court case, the complaint involves several jurisdictions, or you have been identified as an account holder or participant in the fund transfers.

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, procedures, and available remedies depend on the evidence and the institutions involved. Official sources and procedures were checked as of September 16, 2026.