I. Introduction

Online scams in the Philippines may involve fake sellers, fake buyers, investment schemes, online lending scams, job scams, romance scams, phishing, e-wallet fraud, bank transfer fraud, crypto scams, identity theft, fake delivery schemes, marketplace fraud, fake travel bookings, fake rentals, fake tickets, fake government documents, and impersonation of legitimate companies or public officers.

The usual problem is urgent and practical: the victim lost money and wants to recover it. Filing a complaint is important, but recovery depends on speed, evidence, traceability of funds, identification of the scammer, and cooperation from banks, e-wallets, platforms, and law enforcement.

This article explains how to file a complaint for online scam in the Philippine context, what evidence to preserve, where to report, what criminal and civil remedies may apply, how to try to recover money, and what victims should realistically expect.

II. What Is an Online Scam?

An online scam is a fraudulent scheme carried out through the internet, mobile phones, digital platforms, social media, messaging apps, online marketplaces, e-wallets, bank transfers, crypto wallets, fake websites, or other electronic means.

The common feature is deceit: the scammer makes false representations to induce the victim to send money, goods, personal data, login credentials, OTPs, crypto, or other value.

Examples:

fake online seller accepts payment but never ships the item;
fake buyer sends a fake proof of payment;
scammer offers investment returns and disappears;
fake recruiter collects placement or processing fees;
fake lender collects advance fees;
phishing site steals bank or e-wallet credentials;
scammer impersonates a friend and asks for money;
fake customer support asks for OTP;
romance scammer asks for emergency funds;
crypto scammer promises guaranteed profit;
fake landlord collects reservation deposit;
scammer uses a mule bank account to receive proceeds.

III. Main Legal Theories

An online scam may involve one or more legal violations.

A. Estafa

The most common criminal charge is estafa or swindling. Estafa generally involves fraud or deceit causing damage.

In online scams, estafa may occur when the scammer:

falsely represents that goods will be delivered;
falsely claims to be a legitimate seller, lender, recruiter, investor, or agent;
uses fake receipts or fake identity;
promises returns with no intent or ability to perform;
induces payment through lies;
obtains money and disappears;
obtains money through false pretenses.

Important elements usually include:

deceit or fraudulent representation;
reliance by the victim;
delivery of money, property, or value;
damage to the victim.

B. Cybercrime

Because the scam is committed through digital means, the Cybercrime Prevention Act may apply.

Possible cybercrime-related offenses include:

computer-related fraud;
computer-related identity theft;
illegal access;
misuse of accounts or credentials;
cyber libel, if defamatory posts are involved;
phishing-related conduct;
online impersonation;
unauthorized access to financial accounts.

If ordinary estafa is committed through information and communications technology, cybercrime rules may affect penalties and procedure.

C. Falsification

Falsification may apply if the scammer used:

fake IDs;
fake receipts;
fake proof of payment;
fake bank documents;
fake SEC certificates;
fake business permits;
fake contracts;
fake court or police documents;
fake delivery receipts;
fake screenshots;
falsified authorization letters.

D. Identity Theft

Identity theft may apply when the scammer uses another person’s name, photo, ID, account, business name, company registration, social media profile, mobile number, or personal data.

This is common when scammers impersonate legitimate sellers, companies, lawyers, government employees, delivery riders, bank staff, or relatives.

E. Data Privacy Violations

If the scam involved collection, misuse, sale, disclosure, or posting of personal information, the Data Privacy Act may be relevant.

Examples:

fake lender collects IDs and selfies;
scammer posts victim’s ID online;
app harvests contacts;
personal data is used to open accounts;
identity is used for unauthorized loans;
private information is used for harassment.

F. Financial Account Scamming and Mule Accounts

Many scams use bank accounts, e-wallets, remittance accounts, payment links, or QR codes under names different from the scammer. These may be mule accounts.

A person who knowingly allows an account to receive scam proceeds may face liability. The receiving account is often one of the most important leads for investigation and recovery.

G. Civil Liability

A scam victim may seek civil recovery for:

money paid;
damages;
interest;
attorney’s fees, where proper;
costs;
moral damages in appropriate cases;
exemplary damages in serious bad-faith cases.

Civil recovery may be pursued as part of the criminal case or through a separate civil action, depending on strategy.

IV. Immediate Steps After Discovering an Online Scam

Speed is critical. Money can be withdrawn, transferred, converted to crypto, or moved through multiple mule accounts quickly.

Step 1: Stop sending money

Scammers often demand additional payments to recover the first payment.

Examples of follow-up scam demands:

unlocking fee;
tax clearance;
AML clearance;
refund processing fee;
legal fee;
delivery insurance;
bank verification fee;
chargeback fee;
account activation fee;
withdrawal fee;
customs fee;
identity verification fee.

Do not send more money.

Step 2: Preserve evidence before blocking

Before blocking or reporting the scammer’s profile, preserve:

full chat history;
screenshots;
profile links;
phone numbers;
account names;
payment instructions;
receipts;
advertisements;
transaction references;
URLs;
emails;
fake documents;
voice messages;
call logs.

If the scammer deletes the account, evidence may disappear.

Step 3: Contact the bank, e-wallet, or payment provider immediately

Report the transaction as fraud. Provide:

transaction reference number;
date and time;
amount;
recipient account name and number;
screenshots of scam instruction;
proof of payment;
police report, if already available.

Ask whether the funds can be held, recalled, traced, or investigated. Act immediately because funds may be withdrawn within minutes.

Step 4: Secure your accounts

If you gave credentials, OTPs, IDs, selfies, or personal information:

change passwords;
enable two-factor authentication;
log out all devices;
call bank or e-wallet hotline;
freeze compromised cards;
secure email account first;
check recovery numbers and emails;
monitor unauthorized transactions;
report identity theft if personal documents were used.

Step 5: Prepare a timeline

Write down the sequence of events while memory is fresh.

Include:

when you first saw the offer;
who contacted whom;
what was promised;
what money was sent;
where money was sent;
when scammer stopped responding;
what profiles, numbers, and accounts were used;
what reports were made.

Step 6: File the appropriate complaint

Depending on the scam, report to the police, cybercrime authorities, prosecutor, bank, e-wallet, regulator, platform, or other agency.

V. Evidence to Preserve

Evidence is the foundation of both complaint and recovery.

A. Communication evidence

Preserve:

Messenger chats;
SMS messages;
Viber messages;
Telegram chats;
WhatsApp chats;
emails;
marketplace messages;
Instagram or TikTok messages;
voice messages;
call logs;
video call screenshots;
group chats;
seller or scammer profile URLs;
usernames and handles;
phone numbers;
email addresses.

Screenshots should show date, time, profile name, and message context.

B. Payment evidence

Preserve:

bank transfer receipts;
GCash or Maya receipts;
remittance receipts;
QR code screenshots;
account name and account number;
reference numbers;
transaction IDs;
bank statements;
e-wallet statements;
crypto transaction hashes;
wallet addresses;
payment links;
proof of chargeback request;
platform payment confirmation.

For each payment, record:

amount;
date and time;
sender account;
recipient account;
platform;
reference number;
related scam instruction.

C. Advertisement or offer evidence

Preserve:

product listing;
Facebook page;
marketplace post;
sponsored ad;
investment presentation;
website;
job offer;
loan offer;
rental post;
ticket listing;
crypto platform page;
app listing;
fake business page;
screenshots of prices, promises, returns, or guarantees.

D. Identity evidence of the scammer

Preserve whatever the scammer used:

name;
alias;
profile photo;
mobile number;
bank account name;
e-wallet name;
email;
address;
courier details;
business name;
SEC or DTI registration claimed;
ID sent;
social media links;
vehicle plate;
voice notes;
IP-related information, if available.

Do not assume the name is real. But even fake names can help investigators connect accounts.

E. Platform evidence

Preserve:

order number;
complaint ticket;
platform report;
seller ID;
buyer ID;
listing number;
transaction ID;
support chat;
platform decision;
refund denial;
delivery tracking;
courier record;
account suspension notice.

F. Identity theft evidence

If you submitted personal data, preserve:

ID sent;
selfie with ID;
proof of billing;
payslip;
bank details;
job application form;
loan form;
KYC screenshots;
messages requesting the data;
date and platform used;
evidence of later misuse.

VI. How to Preserve Digital Evidence Properly

A. Take complete screenshots

Do not crop out usernames, dates, URLs, or context.

Capture:

profile;
conversation from beginning;
payment instructions;
proof of payment;
scammer’s responses after payment;
refusal, excuses, or blocking;
public posts;
comments from other victims.

B. Export chats where possible

Exported chat logs can be stronger than isolated screenshots. They show continuity and timestamps.

C. Save URLs

For social media profiles, posts, and websites, copy the actual URL. Screenshots alone may not be enough if multiple profiles have similar names.

D. Preserve original files

Do not edit screenshots. Keep originals and make separate annotated copies if needed.

E. Use screen recording

For long conversations, disappearing stories, app flows, or websites, a screen recording may help.

F. Back up evidence

Save evidence in secure folders, cloud storage, or external drives. Organize by date and type.

VII. Where to File a Complaint

A. Bank or e-wallet provider

Report immediately to the institution used for payment.

This is essential for possible recovery. The bank or e-wallet may investigate, freeze accounts, request documents, or coordinate through lawful channels.

Ask for:

complaint ticket number;
fraud report acknowledgment;
required documents;
status of funds;
whether a hold or recall is possible;
written response.

B. Police station

A victim may file a police report or blotter at the local police station. This may be useful for documentation and for submitting to banks or platforms.

However, a blotter is not the same as full prosecution. It records the incident but does not automatically recover money.

C. PNP Anti-Cybercrime Group

For online scams, phishing, identity theft, fake profiles, cyber-enabled estafa, unauthorized access, or digital evidence, the PNP cybercrime authorities may be appropriate.

Bring:

evidence files;
screenshots;
transaction receipts;
phone numbers;
account details;
URLs;
affidavit or narrative;
valid ID.

D. NBI Cybercrime Division

The NBI may investigate cybercrime, online fraud, identity theft, and organized scam schemes. This may be appropriate for larger, repeated, cross-border, or technically complex scams.

E. Office of the City or Provincial Prosecutor

A criminal complaint may be filed with the prosecutor’s office. The complaint should include:

complaint-affidavit;
witness affidavits;
evidence;
transaction records;
screenshots;
proof of payment;
identity details of respondent, if known;
barangay certificate if required and applicable.

The prosecutor determines whether probable cause exists and whether to file the case in court.

F. Barangay

Barangay conciliation may apply if the parties are known individuals and reside in the same city or municipality, subject to exceptions.

However, many online scam cases involve unknown scammers, different cities, cybercrime, or offenses not suitable for barangay resolution. In such cases, police, cybercrime authorities, or prosecutor may be more appropriate.

G. Platform complaint

Report to the platform where the scam occurred:

Facebook;
Marketplace;
Instagram;
TikTok;
Shopee or Lazada;
Carousell;
Telegram;
Viber;
WhatsApp;
crypto exchange;
job platform;
dating app;
payment platform.

Platform reports may lead to takedown, account restriction, internal records preservation, or refund review if the platform has buyer protection.

H. SEC

If the scam involves investment solicitation, fake lending company, fake corporation, fake SEC registration, online lending app, or securities-like scheme, report to the Securities and Exchange Commission.

I. BSP or financial consumer channels

If the issue involves a bank, e-wallet, payment service provider, remittance company, or other supervised financial institution, the victim should first complain to the institution and may escalate through appropriate consumer assistance channels if unresolved.

J. National Privacy Commission

If personal data was misused, exposed, sold, posted, or used for harassment, the victim may complain to the National Privacy Commission.

VIII. Complaint-Affidavit for Online Scam

A complaint-affidavit is a sworn statement describing what happened.

A. Contents

It should include:

complainant’s name, address, and contact details;
respondent’s name or online identity, if known;
platform used;
date and time of communication;
false representations made;
amount paid;
payment method and recipient account;
what happened after payment;
damages suffered;
evidence attached;
request for investigation and prosecution.

B. Sample structure

Affidavit-Complaint

I, [name], Filipino, of legal age, residing at [address], after being sworn, state:

I am filing this complaint for online scam/estafa/cybercrime against the person using the name/profile/account [name/account].
On [date], I saw/contacted/was contacted through [platform] regarding [item/investment/job/loan/service].
The respondent represented that [state exact promise or false statement].
Relying on this representation, I sent the amount of ₱[amount] on [date/time] through [bank/e-wallet/remittance] to [recipient name/account/number], with reference number [reference].
After receiving my payment, respondent [failed to deliver/blocked me/gave excuses/demanded more money/deleted account].
I later discovered that the representation was false because [explain].
I suffered damage in the amount of ₱[amount], plus other expenses and distress.
Attached are screenshots of our conversation, proof of payment, profile details, and other evidence.
I respectfully request investigation and prosecution for the proper offenses under Philippine law.

IX. Attachments to the Complaint

Attach:

valid ID;
screenshots of the offer;
full chat history;
proof of payment;
recipient account details;
scammer profile screenshots;
URLs;
transaction reference numbers;
police or barangay blotter, if any;
bank or e-wallet complaint acknowledgment;
platform report;
witness affidavits, if any;
computation of loss;
identity theft evidence, if any;
fake documents used by scammer.

Make several copies. Keep originals safe.

X. Filing With the Bank or E-Wallet: Recovery-Oriented Steps

If the goal is to recover money, the financial institution report is urgent.

A. What to tell the bank or e-wallet

State clearly:

“I was induced by fraud to transfer money.”
“Please treat this as a scam/fraud transaction.”
“Please preserve records and investigate the receiving account.”
“Please advise if the funds can be held, recalled, or frozen.”
“Please provide a ticket number and required documents.”

B. Documents usually requested

valid ID;
transaction receipt;
affidavit or complaint narrative;
police report or blotter;
screenshots of scam;
recipient account details;
proof of payment;
contact details.

C. What the institution may do

Depending on timing and rules, it may:

investigate;
temporarily restrict the receiving account;
request more documents;
coordinate internally;
advise filing with law enforcement;
deny reversal if funds were already withdrawn;
preserve records for subpoena or official request.

D. Realistic recovery issue

If the funds are still in the account, recovery is more possible. If withdrawn or transferred, recovery becomes harder. This is why immediate reporting matters.

XI. Can the Bank or E-Wallet Reverse the Transaction?

Not always.

If the transfer was authorized by the victim, the bank or e-wallet may not automatically reverse it without consent of the recipient, legal process, or internal fraud basis.

However, the institution may still investigate and preserve records. In some cases, if funds remain and fraud is reported quickly, a hold may be possible.

Important factors:

how fast the victim reported;
whether the funds are still available;
whether the recipient account is suspicious;
whether many victims reported the same account;
institution policies;
law enforcement involvement;
whether transaction was unauthorized or authorized but induced by fraud.

XII. Authorized Transfer Versus Unauthorized Transfer

Recovery analysis differs depending on whether the victim authorized the transfer.

A. Authorized but scam-induced transfer

The victim personally sent money because of deceit. This is common in fake seller, investment, and job scams.

Recovery may require fraud investigation, account hold, complaint, or court/legal process.

B. Unauthorized transfer

The scammer accessed the victim’s account and transferred money without permission.

This may involve phishing, OTP theft, SIM swap, account takeover, malware, or unauthorized access. The bank or e-wallet investigation may focus on account security, authentication, and liability.

Evidence includes:

login alerts;
OTP messages;
device logs;
unauthorized transaction notices;
phishing link;
suspicious calls;
account access history.

XIII. Civil Recovery Options

A. Civil action implied in criminal case

When a criminal case is filed, the civil action for recovery of damages is generally deemed included unless the victim waives, reserves, or files it separately.

This means the criminal court may also order restitution or damages if the accused is convicted.

B. Separate civil action

A victim may file a separate civil action for collection of sum of money or damages, especially if the scammer is identifiable.

This may be useful where:

the recipient account holder is known;
the scammer is locally located;
the issue is primarily recovery of money;
evidence is strong;
criminal prosecution may take time.

C. Small claims

If the amount is within small claims jurisdiction and the defendant is identifiable and reachable, small claims may be an option.

Small claims may be useful for:

fake seller who is known;
local person who received payment;
failed online transaction where respondent is identifiable;
simple money recovery.

But small claims may be less useful if:

scammer used fake identity;
defendant address is unknown;
cybercrime investigation is needed;
case involves multiple victims or complex fraud;
claim requires subpoenas or digital forensic evidence.

D. Restitution through settlement

Sometimes the account holder or scammer returns money after receiving a demand, barangay complaint, police report, or prosecutor notice.

Any settlement should be in writing and should state amount, payment date, and effect on complaint. For serious scams, consult counsel before signing desistance.

XIV. Who Should Be Sued or Complained Against?

Possible respondents include:

the person who communicated with the victim;
the owner of the receiving bank or e-wallet account;
the page or business owner;
the fake seller or recruiter;
the investment promoter;
the mule account holder;
the person who withdrew or transferred funds;
co-conspirators;
company officers, if a company was used;
agents who induced payment.

A receiving account holder may be investigated even if they claim they were only asked to receive money. The key question is whether they knowingly participated, benefited, or allowed account misuse.

XV. Demand Letter Before Complaint or Civil Action

A demand letter may be useful when the recipient is known.

Sample demand

Subject: Demand for Return of Money Obtained Through Online Scam

Dear [Name],

On [date], I sent ₱[amount] to your [bank/e-wallet] account [details] in connection with [transaction]. The payment was induced by false representations made through [platform/account]. Despite receipt of the amount, [goods/services/refund] were not delivered, and communication was discontinued.

I demand the return of ₱[amount] within [number] days from receipt of this letter. If you fail to return the amount, I will pursue all available remedies, including complaints for estafa, cybercrime, financial account scamming, civil recovery, damages, and reports to the relevant banks, e-wallets, platforms, and authorities.

This demand is made without prejudice to all rights and remedies under law.

XVI. Common Types of Online Scams and Filing Strategy

A. Fake seller scam

Evidence:

listing;
chat;
payment receipt;
delivery promise;
non-delivery;
blocked account.

Possible remedies:

platform report;
bank/e-wallet report;
police/cybercrime complaint;
estafa complaint;
small claims if seller is identifiable.

B. Fake buyer scam

Common scheme:

buyer sends fake proof of payment;
seller ships item or releases crypto;
payment never arrives.

Evidence:

fake receipt;
bank statement showing non-receipt;
chat;
courier record;
buyer profile.

Possible remedies:

estafa complaint;
platform report;
courier evidence;
civil claim if buyer known.

C. Investment scam

Common promises:

guaranteed returns;
doubling money;
daily profit;
crypto trading bot;
forex pool;
casino investment;
task earning scheme;
Ponzi referral bonuses.

Evidence:

investment pitch;
promised returns;
payment receipts;
group chats;
referral structure;
fake certificates;
withdrawal refusal.

Possible remedies:

SEC report;
police/NBI complaint;
estafa or syndicated estafa analysis;
AML and financial account tracing;
civil recovery.

D. Online lending advance-fee scam

Common scheme:

loan approved;
borrower must pay processing fee;
additional fees demanded;
loan never released.

Evidence:

loan approval message;
fake SEC certificate;
payment receipts;
fee demands;
non-release of loan.

Possible remedies:

SEC report;
estafa/cybercrime complaint;
bank/e-wallet report;
identity theft report if IDs were sent.

E. Job or employment scam

Common scheme:

fake employer offers work;
collects training fee, equipment fee, placement fee, visa fee, or processing fee;
asks for IDs and bank details.

Evidence:

job post;
recruiter messages;
payment proof;
fake company documents;
personal data submitted.

Possible remedies:

cybercrime complaint;
labor/recruitment-related complaint if overseas or recruitment;
estafa complaint;
identity theft monitoring.

F. Romance scam

Common scheme:

emotional relationship built online;
emergency money requested;
fake packages, customs fees, medical emergencies, travel fees.

Evidence:

chats;
photos;
payment receipts;
fake shipping/customs documents;
identity used.

Possible remedies:

cybercrime complaint;
bank/e-wallet report;
platform report;
identity theft precautions.

G. Phishing and account takeover

Common scheme:

fake bank/e-wallet link;
victim enters credentials;
account drained.

Evidence:

phishing link;
SMS/email;
unauthorized transaction alerts;
bank statement;
device logs;
calls from fake support.

Possible remedies:

immediate bank/e-wallet report;
cybercrime complaint;
account security measures;
request investigation.

H. Crypto scam

Common scheme:

fake investment;
fake exchange;
fake support;
wallet recovery scam;
romance crypto scheme;
P2P fraud.

Evidence:

wallet address;
transaction hash;
exchange UID;
chat;
website;
blockchain records;
payment receipts.

Possible remedies:

exchange report;
cybercrime complaint;
blockchain tracing;
law enforcement request;
civil/criminal action if persons identified.

XVII. Recovery of Money: Practical Realities

A. Recovery is easiest when reported immediately

If the funds remain in the receiving account, a hold may be possible. If withdrawn, recovery becomes more difficult.

B. The account name may not be the mastermind

Many scammers use mule accounts. The account owner may be:

the scammer;
a paid mule;
a deceived job seeker;
a person who sold account access;
an identity theft victim;
a relative or associate;
a hacked account holder.

Still, the account is a major lead.

C. Criminal conviction can order restitution

If the accused is convicted, the court may order return of money or damages. But collection still depends on the accused’s assets.

D. Civil judgment still needs enforcement

Winning a civil case does not instantly recover money. The victim may need execution against bank accounts, salary, or property.

E. Settlement may be fastest

If the respondent is known and reachable, a settlement may recover money faster than full litigation. But avoid signing broad waivers without payment.

XVIII. How to Increase Chances of Recovery

Report to bank/e-wallet immediately.
File a police or cybercrime complaint quickly.
Preserve complete evidence.
Identify the receiving account holder.
Ask the institution to preserve records.
File a proper affidavit.
Avoid public posts that may alert the scammer before funds are traced.
Coordinate with other victims if the same account was used.
Report to the platform.
Consider civil action if respondent is identifiable.
Do not pay recovery scammers.
Follow up in writing.

XIX. Recovery Scams

After being scammed, victims are often targeted again by “recovery agents.”

Red flags:

promises guaranteed refund;
asks for upfront recovery fee;
claims to be from bank, NBI, police, Interpol, SEC, crypto exchange, or court;
asks for OTP;
asks for wallet seed phrase;
asks to install remote access app;
asks for “clearance fee”;
demands payment before releasing recovered funds.

Do not pay anyone who promises guaranteed recovery for a fee. Legitimate authorities do not recover funds by asking victims to send more money to personal accounts.

XX. What If the Scammer Is Unknown?

You may still file a complaint against the person using the account/profile/number.

Use available identifiers:

online profile;
phone number;
bank account;
e-wallet account;
email;
wallet address;
username;
IP-related details, if known;
platform ID;
courier information.

Law enforcement may use subpoenas or official requests to identify the person behind accounts, subject to procedure.

XXI. What If the Receiving Account Holder Says They Are Innocent?

The account holder may claim:

account was hacked;
account was borrowed;
they were only a payment processor;
they were deceived by a fake job;
they already forwarded the money;
they do not know the scammer;
their identity was stolen.

These claims must be investigated. The victim should still file a complaint and include the receiving account details.

A person who allowed an account to be used knowingly may be liable. A truly innocent identity theft victim may need to prove compromise.

XXII. What If the Scammer Is Abroad?

Online scams may be cross-border. Recovery becomes harder but not impossible.

Steps:

file local cybercrime complaint;
report to platform;
report to payment institution;
report to embassy or foreign platform if relevant;
preserve international numbers, emails, and wallet addresses;
coordinate through law enforcement channels.

Private victims usually cannot compel foreign platforms or foreign banks directly without legal process.

XXIII. What If the Amount Is Small?

Even small scams may be reported, especially if the same scammer targets many victims.

For small amounts, practical options include:

platform report;
bank/e-wallet report;
police blotter;
barangay if person is known and local;
small claims if respondent is identifiable;
joining other victims for coordinated complaints.

The cost-benefit of full litigation should be considered.

XXIV. What If the Scam Involves Many Victims?

For group scams:

collect victim statements;
organize payment records;
identify common recipient accounts;
preserve group chats;
avoid mob harassment;
designate coordinators;
file coordinated complaints;
report to SEC if investment-related;
report to banks/e-wallets using a list of transactions;
prepare a consolidated timeline.

Group complaints may show pattern, intent, and scale.

XXV. What If the Victim Posted About the Scammer Online?

Victims often post warnings online. This may help others but must be done carefully.

Avoid:

unsupported accusations against the wrong person;
posting private IDs of possibly innocent account holders;
threats;
defamatory language beyond facts;
revealing personal data of others;
interfering with investigation.

Safer wording:

“I am reporting this account/number/payment account for a transaction I believe to be fraudulent. If you also transacted with this account, please preserve evidence and report to authorities.”

Truth is important, but public accusations can create counterclaims if careless.

XXVI. If Personal Data Was Submitted

If the victim sent IDs, selfies, proof of billing, bank details, or signatures:

preserve proof of submission;
file identity theft report;
notify banks and e-wallets;
monitor unauthorized loans;
change passwords;
beware of SIM or account takeover;
report misuse of data;
keep police/cybercrime report for future disputes.

If someone later claims the victim borrowed money or opened an account, the earlier identity theft report may help.

XXVII. If OTP or Password Was Shared

Immediately:

change passwords;
call bank/e-wallet;
lock account;
revoke linked devices;
check transactions;
report unauthorized transfers;
secure email;
change recovery information;
file cybercrime complaint;
preserve the scam call/message.

Do not share OTPs again. No legitimate bank, e-wallet, or government office should ask for OTPs or passwords.

XXVIII. If a Device Was Compromised

If the scam involved malware, remote access, or suspicious app installation:

disconnect from internet if necessary;
uninstall suspicious apps only after documenting them;
change passwords from a clean device;
scan device;
reset only after preserving evidence;
check banking and e-wallet apps;
revoke sessions;
report unauthorized transactions.

Remote access scams are serious because the scammer may control the device while the victim is logged in.

XXIX. Cryptocurrency-Specific Recovery Issues

Crypto transfers are often irreversible. Recovery depends on identifying the recipient, freezing exchange accounts, or tracing funds.

Evidence:

transaction hash;
sending wallet;
receiving wallet;
network used;
exchange used;
UID;
chat;
payment instruction;
KYC information, if available.

Report immediately to the exchange if the wallet belongs to a custodial platform. If funds go to a self-custody wallet, recovery is harder without identifying the person.

Beware of crypto recovery scams.

XXX. Marketplace and Delivery Scams

For marketplace scams:

preserve listing;
seller profile;
chat;
payment proof;
delivery tracking;
courier receipt;
photos of item received, if wrong item;
unboxing video, if available;
platform complaint.

If the platform has buyer protection, follow its deadlines strictly.

For cash-on-delivery scams, preserve parcel label, waybill, seller name, and courier records.

XXXI. Online Bank and E-Wallet Fraud

For unauthorized transactions:

call official hotline immediately;
freeze account;
change credentials;
file dispute;
request investigation;
preserve OTP messages and login alerts;
file cybercrime complaint;
follow up in writing.

Do not rely solely on phone calls. Obtain ticket numbers and written acknowledgments.

XXXII. Fake Business or Company Scam

If the scammer used a business name:

check if the business actually exists;
preserve fake documents;
identify corporate name used;
preserve receipts and invoices;
report to SEC or DTI if applicable;
complain against actual persons involved, not merely a name.

Scammers often copy legitimate company documents. The real company may also be a victim of impersonation.

XXXIII. Complaint Against Platforms

Sometimes victims blame platforms for scams by users.

Whether a platform is liable depends on:

platform terms;
payment protection program;
whether platform held the funds;
whether platform ignored reports;
whether platform verified seller;
whether transaction occurred on or off platform;
whether the platform made guarantees;
whether the user bypassed safety rules.

Even if platform liability is uncertain, reporting helps preserve data and may stop further victimization.

XXXIV. Role of Lawyers

A lawyer may help:

classify the offense;
draft complaint-affidavit;
prepare evidence index;
send demand letter;
identify respondents;
file civil action;
assist with prosecutor proceedings;
coordinate with banks and platforms;
challenge dismissals;
negotiate settlement;
protect victim from counterclaims.

For small claims, a lawyer may not appear in hearings under simplified procedure, but legal consultation beforehand may still help.

XXXV. Practical Complaint Package

A strong complaint package contains:

complaint-affidavit;
timeline;
evidence index;
screenshots of offer and profile;
full conversation;
proof of payment;
recipient account details;
bank/e-wallet complaint ticket;
platform report;
witness affidavits, if any;
computation of loss;
identity theft documents, if any.

Organize files clearly.

Example folder structure:

01 Timeline
02 Chats
03 Payment Receipts
04 Profiles and URLs
05 Bank or E-Wallet Reports
06 Platform Reports
07 Affidavits
08 Loss Computation

XXXVI. Common Mistakes Victims Make

Avoid these mistakes:

sending more money for “refund processing”;
deleting chats after reporting;
blocking before preserving evidence;
failing to save profile URLs;
relying only on one screenshot;
waiting too long to report to bank/e-wallet;
posting accusations without complete facts;
confronting the scammer and warning them to move funds;
paying recovery agents;
sharing OTPs with fake support;
failing to secure email;
not filing because the amount is “small”;
signing settlement without receiving money;
ignoring identity theft risks.

XXXVII. What Happens After Filing a Criminal Complaint?

The process may include:

submission of complaint-affidavit and evidence;
evaluation by police/cybercrime unit or prosecutor;
identification of respondent;
subpoena or request for counter-affidavit, if respondent is known;
preliminary investigation;
prosecutor resolution;
filing of information in court if probable cause exists;
arraignment;
trial;
judgment;
possible restitution or damages if convicted.

If the respondent is unknown, investigation may focus on identifying the person behind accounts.

XXXVIII. Preliminary Investigation

In preliminary investigation, the prosecutor determines whether there is probable cause to charge the respondent in court.

The complainant should present evidence showing:

deceit;
payment;
damage;
identity or link to respondent;
use of online means;
supporting documents.

The respondent may deny involvement or claim civil dispute. The complainant must show fraudulent intent, not merely failed transaction.

XXXIX. Difference Between Scam and Ordinary Breach of Contract

Not every failed online transaction is estafa.

A case may be civil if:

seller intended to deliver but failed due to legitimate reasons;
there is a genuine dispute over quality or timing;
refund delay is documented;
no deceit existed at the beginning;
business failure occurred after a real transaction;
the parties disagree over contract terms.

A case is more likely a scam if:

identity is fake;
seller disappears after payment;
same account scams multiple victims;
documents are fake;
promises were impossible;
no goods existed;
payment was routed to mule accounts;
excuses are repeated to get more money;
account is deleted after payment.

XL. Demand for Refund Versus Criminal Complaint

A demand for refund may help show that the victim gave the other party a chance to return the money. But if the scammer is unknown or dangerous, immediate reporting may be better.

A demand letter is useful when:

identity and address are known;
there is a chance of settlement;
transaction may be argued as civil;
victim plans small claims or civil case.

A demand letter may be unnecessary or risky when:

scammer is anonymous;
funds may be moved if alerted;
urgent account freeze is needed;
organized scam is involved;
identity theft or cybercrime is ongoing.

XLI. Settlement and Affidavit of Desistance

If the scammer offers to return money, the victim should be careful.

A settlement should state:

exact amount;
payment date;
payment method;
whether payment is partial or full;
whether complaint will continue;
no withdrawal until cleared funds are received;
consequences of nonpayment.

Do not sign an affidavit of desistance before receiving full payment unless advised by counsel.

Even after desistance, the State may proceed in some cases if evidence supports prosecution.

XLII. Sample Settlement Receipt With Reservation

Receipt of Payment

I acknowledge receipt of ₱______ from ______ on ______ as partial/full return of the amount involved in the online transaction dated ______.

If partial:

This payment is partial and does not waive my right to claim the remaining balance and pursue remedies.

If full but preserving non-money issues:

This acknowledgment covers the return of the amount received only and does not waive claims arising from identity theft, harassment, threats, or other unlawful acts, unless expressly stated in a separate settlement agreement.

XLIII. How to Deal With Police or Prosecutor Requests

When authorities ask for documents:

submit clear copies;
label attachments;
bring originals for comparison;
keep receiving copies;
ask for case reference number;
follow up politely;
update them if scammer contacts you again;
submit additional evidence through proper channels.

Do not fabricate evidence. False evidence can create criminal liability.

XLIV. If the Complaint Is Dismissed

A dismissal does not always mean the victim has no remedy.

Possible next steps:

file motion for reconsideration, if allowed;
submit additional evidence;
pursue civil action;
file complaint against a different identified respondent;
report to regulator;
coordinate with bank/e-wallet;
join other victims;
seek legal review.

Dismissals often happen because of insufficient identification, weak proof of deceit, or classification as civil dispute. Better evidence may change strategy.

XLV. If You Receive Money From a Scam by Mistake

If someone reports that your account received scam proceeds and you are innocent:

do not withdraw or transfer suspicious funds;
notify your bank/e-wallet;
preserve messages showing why you received the funds;
avoid acting as a pass-through account;
file a report if your account was misused;
seek legal advice if contacted by police or victim;
do not ignore subpoenas.

Allowing your account to be used can create serious legal risk.

XLVI. Special Considerations for Minors

If the victim is a minor, parents or guardians should file on the child’s behalf. If the scam involves sexual exploitation, sextortion, child images, or coercion, report urgently to appropriate child protection and cybercrime authorities.

Do not repost sensitive images. Preserve privately and report.

XLVII. Special Considerations for OFWs

OFWs may file complaints through representatives in the Philippines if properly authorized. They should preserve overseas messages, remittance records, and digital evidence.

If the scam involves recruitment, deployment, visa processing, or overseas employment, report to appropriate migrant worker and recruitment authorities.

XLVIII. Special Considerations for Businesses

A business victim should preserve:

invoices;
purchase orders;
emails;
payment approvals;
bank transfers;
vendor profiles;
employee communications;
fake supplier documents;
internal approval trail;
system logs;
authority limits;
board or management reports.

If an employee was tricked into paying a fake supplier, the business should investigate internal controls and preserve evidence for insurance, audit, and legal purposes.

XLIX. Practical Timeline for Victims

Within the first hour

stop communication except evidence preservation;
call bank/e-wallet;
secure accounts;
screenshot everything;
copy URLs;
warn bank/e-wallet not to process further if possible.

Within the first day

file fraud report with institution;
file police or cybercrime report if amount is significant;
report platform account;
prepare timeline;
ask witnesses to preserve messages.

Within the first week

file complaint-affidavit;
follow up with bank/e-wallet;
submit required documents;
send demand letter if respondent known;
report to regulator if investment/lending/privacy issue.

Ongoing

monitor identity theft;
track platform responses;
coordinate with other victims;
preserve new messages;
avoid recovery scams.

L. Frequently Asked Questions

1. Can I recover money sent to a scammer?

Possibly, but recovery depends on how fast you report, whether funds remain, whether the recipient is identified, and whether legal action succeeds.

2. Should I report first to the bank or police?

Report to the bank or e-wallet immediately because funds move fast. Also file with police or cybercrime authorities as soon as possible.

3. Is a police blotter enough?

No. A blotter records the incident. For prosecution, you usually need a complaint-affidavit and evidence.

4. Can the bank reverse my transfer?

Not automatically. If you authorized the transfer, reversal may require investigation, available funds, recipient cooperation, or legal process.

5. What if I sent money through GCash or Maya?

Report immediately through official channels, preserve the reference number, and file a fraud complaint. Also file with law enforcement if necessary.

6. What if the scammer used a bank account under a real name?

Include that account holder in the complaint or investigation. The account holder may be the scammer, a mule, or another victim.

7. Can I file estafa if the seller did not deliver?

Yes, if there was deceit or fraudulent intent. If it was merely a failed transaction without fraud, it may be civil.

8. What if the scammer blocked me?

Screenshot proof of blocking if possible and preserve all prior evidence. Blocking after payment supports suspicious conduct.

9. What if the scammer deleted the account?

Use saved screenshots, URLs, payment records, phone numbers, and platform reports. Authorities may seek platform records through proper process.

10. What if I only know the phone number?

File using the phone number and other available details. Law enforcement may investigate through lawful channels.

11. Can I file small claims?

Yes, if the respondent is identifiable and the claim is monetary. It may not work well if the scammer’s identity or address is unknown.

12. Can I post the scammer online?

Be careful. Stick to truthful, documented facts and avoid exposing private data unnecessarily. Public accusations against the wrong person can create legal risk.

13. What if I gave my ID and selfie?

Treat it as identity theft risk. File a report, notify financial institutions, and monitor for unauthorized loans or accounts.

14. Can I recover crypto?

Crypto recovery is difficult but possible if funds are traced to an exchange or identifiable person. Report immediately with transaction hashes.

15. Should I pay someone who promises recovery?

No. Upfront-fee recovery offers are often another scam.

LI. Summary of Key Legal Points

Online scams may involve estafa, cybercrime, identity theft, falsification, privacy violations, financial account scamming, and civil liability.
Recovery depends heavily on speed and evidence.
Report to the bank or e-wallet immediately.
Preserve chats, receipts, URLs, profiles, and transaction details before blocking.
A police blotter is useful but not the same as a criminal complaint.
A complaint-affidavit should clearly show deceit, payment, damage, and respondent details.
Bank or e-wallet reversal is not automatic, especially for authorized transfers.
Mule accounts are important investigative leads.
Civil recovery may be possible through the criminal case, small claims, or ordinary civil action.
Avoid recovery scams that ask for upfront fees.
If personal data was submitted, treat the matter as identity theft risk.
Settlement should be documented and should not be signed before payment is actually received.

LII. Conclusion

Filing a complaint for an online scam in the Philippines requires fast action, complete evidence, and the correct choice of remedies. The victim should immediately preserve digital evidence, report the transaction to the bank or e-wallet, secure personal accounts, file with cybercrime authorities or the prosecutor where appropriate, and consider civil recovery if the scammer or receiving account holder is identifiable.

Recovering money is possible in some cases, but it is not guaranteed. The best chance exists when the victim reports quickly, the funds are still traceable, the receiving account is identified, and the complaint is supported by clear proof of deceit and payment. A careful, organized, evidence-based approach gives the victim the strongest chance of stopping further loss, identifying the offender, and recovering the money.