Quick answer

Act immediately on three tracks: recover and secure the account, stop or trace any money transfers, and preserve evidence for a formal report. Warn your contacts through another verified channel that the account was compromised and that they should not send money, disclose one-time passwords, or follow payment instructions from it.

A hacked account does not automatically make the real account owner criminally or civilly liable for the fraud. Criminal liability generally requires proof that the person knowingly participated in the offense. Civil liability also depends on the facts—such as a wrongful or negligent act, actual damage, and a causal connection—not merely whose name or photo appeared on the account. However, the owner should respond promptly because delay, misleading statements, receipt or movement of stolen funds, or destruction of evidence may complicate the case.

If money has already been sent, the sender should contact the originating bank or e-wallet immediately, report a disputed or fraudulent transaction, request tracing and temporary holding of any remaining funds, and obtain a reference number. Recovery is not guaranteed, especially if the funds have already been withdrawn or transferred onward.

What to do in the first hour

1. Secure the email account first

Your email is often the recovery key for social media, banking, shopping, and cloud accounts.

Using a trusted device:

Change the email password to a new, unique password.
Sign out unknown devices and active sessions.
Remove unfamiliar recovery email addresses, phone numbers, forwarding rules, app passwords, and connected applications.
Turn on multi-factor authentication, preferably through an authenticator app or security key where available.
Check the trash, sent folder, filters, and security history for password-reset or account-change messages.
If your mobile number suddenly stopped working, contact your telecommunications provider in case of a SIM-swap or unauthorized SIM replacement.

Do not change passwords on a device that may contain malware. Update the operating system and applications, run a reputable security scan, and remove unknown browser extensions or remote-access software first.

2. Start the platform’s official recovery process

Use only the platform’s own application or help center. For Facebook, use the official hacked-account recovery page, preferably from a device previously used to log in. Instagram provides an official hacked-account recovery guide.

During recovery:

Reverse unauthorized changes to the email address, phone number, username, and password.
Remove unknown linked accounts, administrators, business managers, advertising accounts, and payment methods.
End all other sessions.
Review recent posts, stories, messages, advertisements, and marketplace activity.
Save the platform’s confirmation emails and report or case numbers.
Do not pay anyone claiming to be an “insider” who can recover the account.

If you still have access, capture the evidence described below before removing fraudulent content—unless leaving it online creates an immediate risk of further loss. Where possible, preserve first, then remove or report.

3. Warn people through a different, trusted channel

Post from another verified account, send a group message, or ask trusted relatives or colleagues to circulate a short warning. State:

the exact account name and profile link;
the approximate period when it was compromised;
that messages, sales offers, loan requests, investment pitches, or payment instructions during that period were unauthorized;
that recipients should not send money or share passwords, PINs, or one-time passwords; and
how they can contact you through a verified channel.

Avoid publicly posting victims’ full names, account numbers, identification documents, private conversations, or unredacted transaction receipts.

If someone already sent money

The person whose money was transferred should make the financial report because the sending institution will normally need to verify its own customer. The hacked account owner should cooperate and provide proof of the compromise.

The sender should:

Contact the bank or e-wallet through its official fraud hotline or in-app support immediately.
Report the transaction as fraudulent or disputed.
Provide the amount, date and time, transaction reference, destination institution, recipient account details, and relevant conversation.
Request tracing and the temporary holding of any funds that remain in the transaction chain.
Ask for a written acknowledgment and complaint reference number.
Follow all requests for an affidavit, identification, police report, or additional documents without delay.

Under the Anti-Financial Account Scamming Act and current Bangko Sentral regulations, BSP-supervised institutions must have procedures for tracing disputed transactions, temporarily holding qualifying disputed funds, and conducting coordinated verification. The regulations provide for an initial hold of up to five calendar days, which may be extended so that the total temporary holding period does not exceed 30 calendar days, unless a competent court extends it. These periods are not promises that money will be recovered; only funds still located and successfully held can be protected. See Republic Act No. 12010 and BSP Circular No. 1215.

The bank or e-wallet’s Financial Consumer Protection Assistance Mechanism is the first-level complaint channel. If its action is unsatisfactory, the consumer may escalate to the BSP Consumer Assistance Mechanism through the BSP Online Buddy or, if necessary, submit the prescribed form to the channel identified in the BSP’s current complaint guide.

Do not knowingly submit an exaggerated or false fraud report. Malicious reporting that causes funds to be held is itself punishable under Republic Act No. 12010.

If money entered your own account

If the fraudster caused money to be sent to an account you control:

Do not withdraw, spend, return, or transfer it on instructions received through social media.
Notify your financial institution immediately.
Ask the institution to document and handle any reversal through official channels.
Preserve the complete transaction history and all communications.
Obtain legal advice promptly, particularly if the account has been frozen or you are being treated as a suspect.

Moving the money after learning that it may be fraud proceeds can create serious factual and legal problems. A person who knowingly sells, lends, or permits the use of a financial account for a social-engineering scheme may also face liability under Republic Act No. 12010. The treatment of an innocent account holder depends on what the person knew, authorized, received, and did after discovering the transaction.

Evidence to preserve

Keep original electronic records whenever possible. Screenshots are useful, but they should not be the only evidence.

Preserve:

the compromised profile’s full URL, username, user ID if visible, and profile name;
screenshots or screen recordings showing fraudulent posts and conversations;
the full conversation from the first contact through the payment request;
visible dates, times, sender names, account details, and URLs;
downloaded account data or message exports offered by the platform;
login alerts, password-reset emails, security notices, and notices of changed contact details;
the date and time you first noticed the compromise and each recovery step taken;
lists of unfamiliar devices, locations, sessions, linked accounts, and applications;
payment receipts, transaction reference numbers, bank or e-wallet statements, and destination-account details;
platform, bank, telecommunications-provider, police, and NBI report numbers;
warnings you sent to contacts; and
names and contact information of witnesses or recipients of fraudulent messages.

Keep untouched copies. Do not crop the only screenshot, overwrite original files, edit conversations, impersonate the hacker, or attempt to break into the suspect’s account. Record times in Philippine Standard Time and note if a platform displays a different time zone.

For a business account, ask the administrator or IT team to preserve access logs, audit trails, advertising records, administrator changes, customer messages, and relevant device logs. Limit access to the evidence and avoid unnecessary disclosure of customers’ personal information.

Where to report

Social-media platform

Report both the account takeover and each fraudulent post, advertisement, marketplace listing, or message where the platform allows it. Ask recipients to report the content as a scam, but tell them to preserve their evidence first.

Bank or e-wallet

This is the most urgent report when money moved. Reporting to the police does not replace reporting to the financial institution, and vice versa.

NBI Cybercrime Division

The National Bureau of Investigation provides investigative assistance to victims of computer crimes. Its process may require a complaint form, supporting documents, a sworn statement or prepared affidavit, and examination of a relevant device. Consult the NBI’s official Cybercrime Division service guide and office directory before going to an office.

Bring:

a valid government-issued ID;
a concise chronological statement;
printed and electronic copies of the evidence;
transaction records and complaint reference numbers;
the device involved, if investigators ask to examine it; and
witnesses who personally received messages or made payments, where practicable.

Philippine National Police

A complaint may also be brought to the PNP’s cybercrime unit or an appropriate police station for referral. Ask for the desk officer’s record or complaint reference and confirm where follow-up documents should be submitted. Do not rely on social-media pages or unofficial telephone numbers purporting to belong to law enforcement; verify contact details through an official government site or at a police station.

National Privacy Commission

The NPC is not the general replacement for a cybercrime or fraud complaint. It is relevant when personal data was unlawfully processed, disclosed, or inadequately protected by a person or organization covered by the Data Privacy Act.

An individual who is personally affected by a privacy violation may file an NPC complaint. Ordinarily, the complainant must first notify the respondent in writing and allow it to address the violation. The NPC states that this requirement is met when the respondent takes no timely or appropriate action or gives no response within 15 calendar days after receipt. A complaint generally must be verified or use the prescribed notarized complaint-assisted form and include evidence and witness affidavits. See the NPC’s complaint mechanics.

A company or other personal information controller facing a personal-data breach has separate assessment and notification duties. Where mandatory-notification conditions are met, notification to the NPC and affected data subjects is generally required within 72 hours from knowledge or reasonable belief that a qualifying breach occurred. The rule does not mean every hacked personal profile must be reported by its individual owner. Purely personal, family, or household affairs and business processing require different analysis. Organizations should consult the NPC’s breach-reporting guidance and obtain advice from their data protection officer or counsel immediately.

What Philippine laws may apply

The precise charges depend on how access was obtained, what the offender did, where the money went, and what the evidence can prove.

The Cybercrime Prevention Act of 2012 criminalizes, among other acts:

access to a computer system without right;
computer-related fraud involving unauthorized manipulation or interference that causes damage with fraudulent intent; and
intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right.

“Computer system” is defined broadly enough to cover modern digital devices and services. Depending on the evidence, the fraudulent solicitation may also constitute estafa under Article 315 of the Revised Penal Code, particularly where deceit caused another person to part with money or property. Use of information and communications technology may affect the applicable charge and penalty under Section 6 of Republic Act No. 10175.

Republic Act No. 12010 separately addresses prohibited conduct involving financial accounts, money-mule activity, and social-engineering schemes. The Data Privacy Act of 2012 may apply where personal information was unlawfully processed or where a covered organization failed to meet its data-protection duties.

Which offense should be charged is a matter for investigators and prosecutors. A complaint should describe the facts accurately instead of insisting on a particular criminal label.

Is the hacked account owner liable to the victims?

Not merely because the fraud appeared under the owner’s name.

For criminal liability, investigators must establish the owner’s participation and the required criminal intent beyond reasonable doubt. Evidence that the owner lost access, promptly sought recovery, warned contacts, received no benefit, and cooperated with investigators may be important.

A victim could still pursue a civil claim if there is evidence of an actionable wrongful or negligent act that caused the loss. Articles 19, 20, 21, and 2176 of the Civil Code recognize liability in appropriate cases involving unlawful, willful, or negligent conduct. But negligence and causation are fact-specific. There is no sound basis for assuming that poor password security, delayed discovery, or ownership of the profile automatically makes the owner responsible for every payment a scammer induced.

Do not admit legal liability simply to calm an angry victim. Give a truthful account, provide evidence of the takeover, encourage an immediate bank report, and seek counsel if a demand letter, subpoena, summons, or formal complaint arrives.

Common mistakes that make the situation worse

Waiting for the platform to restore the account before contacting the bank or e-wallet.
Deleting the fraudulent conversation before preserving it.
Posting unredacted IDs, receipts, phone numbers, or account numbers publicly.
Reusing the compromised password on the recovered account.
Communicating with the hacker from the compromised channel.
Paying a “recovery agent,” “law-enforcement fixer,” or supposed platform employee.
Sending money directly to a person claiming to be a victim without independently verifying the claim and coordinating with the financial institution.
Assuming that a police report automatically freezes or reverses a transfer.
Filing a false or inflated disputed-transaction report.
Threatening, doxxing, or publicly accusing a suspected person without reliable evidence.
Factory-resetting or disposing of a relevant device before investigators or counsel assess whether it contains evidence.

When legal or emergency help is urgent

Consult a Philippine lawyer promptly if:

several victims or a large amount of money is involved;
police, prosecutors, a bank, or the NBI identifies you as a respondent or suspect;
fraudulent funds entered an account you own or control;
your account was used to sell regulated goods, solicit investments, impersonate a government official, or exploit a child;
intimate images, threats, extortion, stalking, or physical danger are involved;
a business account exposed customer, employee, financial, health, government-ID, or other sensitive information;
you receive a demand letter, subpoena, warrant, summons, or account-freeze notice; or
important logs or content may soon be deleted.

For immediate danger, threats of violence, or ongoing extortion, contact local law enforcement without waiting for account recovery.

Frequently asked questions

Should I reimburse people who sent money to the scammer?

Do not make an immediate payment based only on a message or screenshot. Verify the person’s identity, obtain the complete transaction record, and involve the relevant financial institutions. Whether you legally owe compensation depends on participation, fault, causation, and other facts. A voluntary settlement can also affect later disputes, so seek advice before signing an acknowledgment or release.

Can the bank reverse the transfer?

Possibly, but not automatically. Speed matters. A bank or e-wallet may trace and temporarily hold funds that remain within the participating financial system, subject to Republic Act No. 12010 and BSP rules. Recovery becomes harder once funds are withdrawn, spent, converted, or transferred beyond reach.

Is a screenshot enough to file a complaint?

It can support a complaint, but stronger evidence includes the original conversation, profile URL, account exports, email security notices, transaction records, device information, and sworn statements from people who received the messages or sent money.

Should I negotiate with the hacker?

Generally, no. Do not pay, threaten, or attempt counter-hacking. Preserve the messages, use official recovery tools, and report extortion or payment demands to law enforcement.

What if I recovered the account and no one lost money?

Secure all linked accounts, preserve the access evidence, warn anyone who received suspicious messages, and consider reporting the unauthorized access. Illegal access and identity misuse may still be relevant even if no financial loss was completed.

Is there a fixed deadline for reporting a hacked account to the police or NBI?

There is no single short reporting deadline that applies to every account-takeover case. Different offenses and claims have different prescriptive rules, and digital evidence may disappear quickly. Report as soon as practicable rather than waiting to determine the final charge.

Can I name the suspected hacker online?

That is risky unless the identification is reliable and disclosure is legally justified. Public accusations may expose private information, prejudice an investigation, or create separate legal disputes. Give the evidence to the platform, financial institution, investigators, and counsel.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Liability and available remedies depend on the evidence, account arrangements, transaction path, and procedural history. Laws, procedures, and official guidance were checked through July 24, 2026.