If you were scammed through Facebook Marketplace, GCash, Maya, bank transfer, Telegram, WhatsApp, an online shop, a fake investment offer, a romance scam, or a phishing link, the most important thing is to act quickly and preserve evidence. A police report for an online scam in the Philippines is usually not just a “blotter.” In practice, you may need a police blotter or incident report for your bank or e-wallet, a cybercrime complaint with the PNP Anti-Cybercrime Group or NBI Cybercrime Division, and later a complaint-affidavit for the prosecutor if the case is pursued criminally.

What counts as an online scam in the Philippines?

An online scam is usually a fraud committed through the internet, a mobile phone, an app, a social media account, an e-wallet, a bank account, a website, or another electronic system.

Common examples include:

A fake seller who receives payment but never delivers the item
A hacked or cloned Facebook account asking for emergency money
A fake GCash, Maya, bank, courier, or government link that steals OTPs or passwords
A fake investment, crypto, lending, job, visa, or recruitment offer
A romance scam where the scammer asks for “fees,” “customs charges,” or “emergency help”
A buyer who sends a fake proof of payment
A scammer who uses a money mule account to receive stolen funds
An impersonator pretending to be a company, lawyer, police officer, bank officer, or government employee

In many cases, the criminal offense is estafa under Article 315 of the Revised Penal Code, especially when the victim was induced to send money because of false pretenses or fraudulent representations. Article 315 punishes swindling, while Article 318 covers “other deceits” when the fraud does not fall squarely under Article 315. (Lawphil)

The Supreme Court has repeatedly described estafa by deceit as requiring: a false pretense or fraudulent representation; that the false representation was made before or at the same time as the fraud; that the victim relied on it and parted with money or property; and that the victim suffered damage. (Supreme Court E-Library)

Legal basis for reporting online scams

Several Philippine laws may apply depending on how the scam was committed.

Legal basis	When it may apply
Revised Penal Code, Article 315	Estafa, such as fake selling, fake investment, false identity, or deceit that caused the victim to part with money or property
Revised Penal Code, Article 318	Other deceits when the fraud is punishable but does not neatly fall under estafa
Republic Act No. 10175, Cybercrime Prevention Act of 2012	Cyber-related fraud, identity theft, illegal access, or traditional crimes committed through information and communications technology
Republic Act No. 12010, Anti-Financial Account Scamming Act or AFASA	Money muling, social engineering schemes, fraudulent access to financial accounts, and scams involving bank or e-wallet accounts
Republic Act No. 8792, Electronic Commerce Act of 2000	Recognition of electronic documents and electronic data messages as legally relevant evidence
Rules on Electronic Evidence, A.M. No. 01-7-01-SC	Authentication and presentation of screenshots, emails, chats, logs, digital receipts, photos, videos, and other electronic evidence

RA 10175 is important because it covers computer-related fraud and computer-related identity theft. It also provides that crimes under the Revised Penal Code and special laws committed through information and communications technology may be covered by the Cybercrime Prevention Act, with the penalty generally one degree higher. (Supreme Court E-Library)

RA 12010 is especially relevant for modern bank and e-wallet scams. It penalizes money mule activities, social engineering schemes, and related offenses, and it allows temporary holding of disputed funds for up to 30 calendar days unless extended by a court. It also requires coordinated verification of disputed transactions among institutions and account owners. (Lawphil)

File the right report in the right place

In practice, victims often confuse different kinds of reports. They are related, but they serve different purposes.

What you need	Where to go	Purpose
Police blotter or incident report	Nearest police station or local police cyber desk, if available	Records the incident; often required by banks, e-wallets, insurers, schools, employers, or platforms
Cybercrime complaint	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Starts cybercrime assessment, investigation, preservation requests, coordination with banks/platforms, or case build-up
Bank/e-wallet fraud report	Your bank, GCash, Maya, remittance provider, or payment platform	Attempts to hold, trace, reverse, or dispute the transaction
CICC / I-ARC report	Hotline 1326 or eGovPH reporting channels	Fast reporting and referral for online scams, phishing, cybercrimes, and suspicious digital activity
Prosecutor’s complaint-affidavit	City or Provincial Prosecutor’s Office, often after police/NBI case build-up	Formal criminal complaint for preliminary investigation and possible filing in court

For scam reports, the Philippine Information Agency has described Hotline 1326 as the government’s 24/7 central number for reporting online selling scams, phishing, investment fraud, romance scams, cybercrimes, and similar incidents, with enforcement handled by the PNP Anti-Cybercrime Group and NBI Cybercrime Division. (Philippine Information Agency)

For PNP Anti-Cybercrime Group reports, a PNP FOI response directed a scam victim to the PNP ACG eComplaint channel and the ACG email address. (www.foi.gov.ph)

The NBI Cybercrime Division’s Citizen’s Charter states that the general public may proceed to the Cybercrime Division to file a complaint or request investigation, undergo a preliminary interview, execute sworn statements, and submit supporting documents; the listed government fee for that service is “None.” (National Bureau of Investigation)

What to do immediately after discovering the scam

1. Contact your bank, e-wallet, or payment provider first

Do this before going to the police if money was recently transferred.

Ask for:

A fraud ticket or case reference number
Temporary hold, recall, reversal, or dispute of the transaction, if still possible
Written confirmation of your report
The recipient account name, masked account number, transaction reference number, and timestamp, if available
Instructions on whether they require a police report, blotter, or notarized affidavit

Under AFASA, institutions may temporarily hold funds subject to a disputed transaction within the period set by BSP rules, not exceeding 30 calendar days unless extended by a court. A transaction may be disputed when there are reasonable grounds to believe it is unusual, has no clear economic purpose, comes from an unknown or illegal source, or was facilitated through social engineering. (Lawphil)

If your concern remains unresolved with a BSP-supervised financial institution, BSP’s Consumer Assistance Mechanism allows escalation through BSP Online Buddy or by sending a CIR form and supporting documents to the BSP consumer assistance channels. (Bureau of the Treasury)

2. Do not delete the conversation, account, email, or app

Many victims panic and block the scammer immediately. Blocking may be understandable for safety, but before doing it, preserve evidence.

Save:

Full chat history, not only selected screenshots
Profile links, usernames, account IDs, email addresses, and phone numbers
URLs of the listing, page, website, or advertisement
Payment receipts and reference numbers
Bank or e-wallet transaction history
The scammer’s account name and number
Delivery waybill, courier tracking, or fake proof of shipping
Voice notes, call logs, SMS, emails, and OTP-related messages
Group chat links, Telegram usernames, or Discord handles
Any promise, guarantee, price, refund statement, or instruction to pay

Electronic documents matter. RA 8792 recognizes electronic documents as the functional equivalent of written documents for evidentiary purposes, subject to rules on admissibility and authentication. (Lawphil)

3. Make a simple timeline

Write the story while the details are fresh. Use dates and exact amounts.

Example:

June 18, 2026, 7:30 PM — Saw Facebook Marketplace listing for iPhone 14.
June 18, 2026, 8:15 PM — Seller sent GCash number and promised same-day Lalamove delivery.
June 18, 2026, 8:23 PM — Sent ₱18,500 via GCash, reference no. ______.
June 18, 2026, 9:05 PM — Seller sent alleged courier screenshot.
June 19, 2026 — Seller stopped replying and blocked account.
June 19, 2026 — Reported to GCash; ticket no. ______.

A clear timeline helps the investigator see deceit, reliance, payment, damage, and digital traces.

Step-by-step guide to filing a police report for an online scam

Step 1: Prepare your evidence folder

Before going to the police, organize your documents.

Document or evidence	Why it matters
Valid government ID	Proves your identity as complainant
Written incident summary or timeline	Helps the desk officer or investigator understand the case quickly
Screenshots of chats	Shows representations, promises, payment instructions, and admissions
Profile links and usernames	Helps identify accounts for preservation or platform requests
Transaction receipts	Proves payment, amount, date, time, and reference number
Bank/e-wallet ticket number	Shows you reported the fraud promptly
Scammer’s account details	Helps trace recipient account or money mule
Delivery/courier records	Useful for fake delivery or online selling scams
Printed copies	Many stations still prefer printed attachments
Soft copies in USB/cloud folder	Useful for cybercrime investigators and digital review

Print only what is useful. For long chats, print the key parts and keep the full electronic copy.

Step 2: Go to the nearest police station for a blotter or incident report

Tell the desk officer you want to report an online scam and need a police blotter, incident report, or certification for your bank/e-wallet and for further cybercrime filing.

Be ready to state:

Your full name, address, contact number, and ID details
Date and time of the scam
Platform used
Name, alias, username, phone number, account number, or profile link of the scammer
Amount lost
Mode of payment
What the scammer promised
What happened after payment
Whether the scammer is still active
Whether you already reported to the bank/e-wallet/platform

Ask politely for:

Blotter entry number
Name and station of the officer who recorded it
Copy or certification of the blotter/incident report, if available
Referral to the local cybercrime desk or PNP Anti-Cybercrime Group, if the station cannot investigate cyber aspects

A blotter is useful, but it is usually only the first record. It does not automatically mean the scammer has been charged in court.

Step 3: File with the PNP Anti-Cybercrime Group

For serious online scams, scams involving multiple victims, phishing, hacked accounts, identity theft, or digital tracing needs, file with the PNP Anti-Cybercrime Group.

You may start through the PNP ACG eComplaint channel or email, but expect that you may still be asked to appear, verify your identity, swear to statements, submit clearer evidence, or coordinate with an assigned investigator. PNP’s own FOI response has pointed scam complainants to the PNP ACG eComplaint channel and ACG email. (www.foi.gov.ph)

When filing, bring:

Valid ID
Police blotter or incident report, if already obtained
Complaint narrative
Screenshots and transaction records
Bank/e-wallet report ticket
Scammer’s account details
Printed copies and soft copies
Your phone, if messages or app logs are still on it

Step 4: Consider filing with the NBI Cybercrime Division

You may also file with the NBI Cybercrime Division, especially if:

The scam involves a sophisticated website, hacking, phishing, fake investment operation, or multiple victims
The scammer appears to operate across cities or provinces
You prefer NBI case assessment
The transaction or evidence may require cyber forensic handling

The NBI’s Citizen’s Charter for victims of computer crimes states that complainants may proceed to the Cybercrime Division, undergo preliminary interview and initial investigation, execute sworn statements, submit prepared affidavits, and submit devices relevant to the probe. (National Bureau of Investigation)

For NCR residents, an NBI FOI response directed complainants to the Complaints and Assessment Division in Pasay City; for provincial complainants, it directed them to the nearest NBI Regional or District Office with a complaint-affidavit and supporting evidence. (www.foi.gov.ph)

Step 5: Report through Hotline 1326 or eGovPH for fast referral

For fresh scams, call 1326 or use available government reporting channels such as eGovPH. This is especially useful when the scam is ongoing, the account is still active, or the money may still be in the banking/e-wallet system.

The I-ARC hotline connects reports to agencies such as CICC, PNP, NBI, and others, while enforcement is handled by PNP ACG and NBI Cybercrime Division. (Philippine Information Agency)

Step 6: Execute a complaint-affidavit if the case will be pursued

A complaint-affidavit is a sworn written statement describing what happened and attaching evidence. It is more formal than a blotter.

It should usually include:

Your identity and contact details
The identity of the respondent, if known
The scammer’s aliases, usernames, mobile numbers, account names, account numbers, links, and email addresses
A chronological narration of events
The exact amount lost
How you were deceived
Proof of payment
Screenshots and electronic evidence
Bank/e-wallet/platform reports
A statement that the facts are true based on your personal knowledge and authentic records

If the scammer’s real identity is unknown, you may still report the incident using all available identifiers. The investigator may later seek preservation, disclosure, or other lawful processes to identify the person behind the account.

Step 7: Follow up and cooperate with case build-up

After filing, the investigator may:

Ask for clearer screenshots or original files
Ask you to bring the phone used in the transaction
Ask for a sworn statement
Coordinate with your bank or e-wallet
Request preservation of computer data
Seek court warrants or disclosure orders where required
Refer the matter to the prosecutor

Under the RA 10175 IRR, service providers must preserve traffic data and subscriber information for at least six months from the transaction, and content data may be preserved for six months from receipt of a preservation order. Law enforcement may also seek court warrants for collection, disclosure, search, seizure, and examination of computer data. (Supreme Court E-Library)

This is why early reporting matters. Some digital traces become harder to obtain as time passes.

What happens after the police report?

A police report does not automatically create a criminal case in court. Usually, the process goes like this:

Incident is recorded through blotter or initial report.
Cybercrime complaint is assessed by PNP ACG, NBI, or another investigative unit.
Case build-up is done to identify the suspect, collect evidence, and determine the applicable offense.
Complaint-affidavit and supporting evidence are prepared.
Complaint is filed with the prosecutor for preliminary investigation if the offense requires it.
Respondent may be required to submit a counter-affidavit.
Prosecutor resolves whether to dismiss the complaint or file an Information in court.
If filed in court, the case proceeds as a criminal case.

For serious offenses, preliminary investigation is generally needed before the filing of an Information in court. DOJ materials on filing complaints for preliminary investigation list requirements such as an investigation data form and complaint-affidavit or sworn statement with supporting documents. (Department of Justice)

How long does it take?

Timelines vary widely because online scam cases often require bank records, platform data, telco information, digital preservation, and identification of unknown users.

Stage	Typical practical timeline
Bank/e-wallet fraud report	Same day to several business days for initial response
Police blotter or incident report	Often same day, depending on station workload
CICC / 1326 report	Immediate hotline intake or referral, depending on availability and case details
PNP ACG or NBI intake	Same day to several days or weeks, depending on queue, completeness of evidence, and location
Bank/platform coordination	Days to weeks, sometimes longer if court process is needed
Prosecutor preliminary investigation	Often several months, depending on docket, counter-affidavits, clarificatory hearings, and case complexity
Court case	Months to years, depending on evidence, witnesses, accused’s participation, and court docket

Recovery of money is different from criminal prosecution. A strong police report may help your bank or e-wallet investigate, but it does not guarantee refund. If the funds have already been withdrawn or transferred through several accounts, recovery becomes harder.

Common mistakes that weaken online scam reports

Reporting only to Facebook, GCash, or the platform

Platform reports are useful, but they are not the same as a police or cybercrime complaint. Report to the platform, but also report to your bank/e-wallet and law enforcement.

Sending only cropped screenshots

Cropped screenshots can look suspicious or incomplete. Keep full screenshots showing:

Date and time
Account name or username
Profile photo
URL or handle
Complete message thread
Payment instructions
Payment confirmation

Deleting the original chat

Screenshots help, but original chats, emails, phone logs, and app records are better. If investigators need to inspect the device, deleted data may complicate authentication.

Not reporting quickly to the bank or e-wallet

In financial scams, time matters. If funds are still in the recipient account, there may be a better chance of holding or tracing them. AFASA now gives institutions and regulators clearer mechanisms for disputed transactions, coordinated verification, and investigation of financial accounts. (Lawphil)

Thinking “small amount lang, hindi puwede i-report”

Even small amounts can be reported. The practical issue is whether enough evidence exists and whether law enforcement can identify the person responsible. Small individual losses may also matter if the same scammer has multiple victims.

Treating every failed online transaction as a crime

Not every bad transaction is automatically estafa. If there was no deceit at the start and the issue is only delay, poor service, breach of contract, or a refund dispute, the case may be civil, consumer, or platform-related instead of criminal. The key question is whether there was fraud or false representation before or at the time you parted with your money.

Special situations

The scammer used a GCash, Maya, or bank account under another person’s name

That account may belong to a money mule, a hacked account, a stolen identity, or someone who knowingly allowed the account to be used. Under AFASA, money muling includes using, borrowing, allowing the use of, buying, renting, selling, lending, or recruiting others to use financial accounts for proceeds known to come from crimes or social engineering schemes. (Lawphil)

Give law enforcement the account name, number, reference number, date, amount, and screenshot of the transfer. Do not publicly post the full account number or personal details online, because that can create privacy or defamation issues.

The scammer used a mobile number

Include the mobile number, SMS screenshots, call logs, and telco if known. The SIM Registration Act, RA 11934, requires SIM registration before activation and defines spoofing as transmitting misleading or inaccurate information about the source of a call or text with intent to defraud, cause harm, or wrongfully obtain something of value. (Supreme Court E-Library)

However, registered SIM does not mean the police can instantly give you the owner’s identity. Law enforcement may still need proper legal process.

The victim is abroad

OFWs and foreigners abroad can still preserve evidence, report to the bank/e-wallet, use online reporting channels, and authorize a trusted person in the Philippines to assist.

Practical requirements may include:

Clear scanned copy of passport or ID
Written authorization or Special Power of Attorney
Consular notarization or apostille/legalization, depending on where the document is executed and where it will be used
Sworn complaint-affidavit, if required by the investigator or prosecutor
Philippine contact person for notices and coordination

If the scam involves Philippine bank accounts, Philippine e-wallets, a Philippine mobile number, a scammer in the Philippines, or damage suffered through Philippine channels, Philippine agencies may have a practical basis to receive the report.

The scammer is unknown

You do not need the scammer’s real name to make an initial report. Many cybercrime complaints start with aliases, URLs, phone numbers, bank accounts, e-wallet accounts, IP-related traces, or platform identifiers. The investigation may later attempt to connect those identifiers to a real person.

The bank or e-wallet asks for a police report before acting

Ask what exact document they need:

Police blotter
Incident report
Complaint sheet
Certification
Complaint-affidavit
Cybercrime complaint acknowledgment

Some providers use “police report” broadly. A simple blotter may be enough for initial dispute review, but a formal complaint-affidavit may be needed for deeper investigation.

Required documents checklist

Requirement	Notes
Valid ID	Passport, driver’s license, UMID, PhilID, PRC ID, postal ID, or other accepted ID
Incident narrative	One to three pages is usually enough if well-organized
Screenshots	Include full context, not just the final message
Transaction proof	Receipt, reference number, bank statement, e-wallet history
Account identifiers	Phone number, email, username, profile link, account name, account number
Platform report	Facebook, Shopee, Lazada, TikTok, Instagram, Telegram, WhatsApp, or website report, if any
Bank/e-wallet ticket	Shows prompt reporting
Police blotter	Useful if proceeding to PNP ACG, NBI, bank, insurer, or prosecutor
Complaint-affidavit	Often needed for formal investigation or prosecutor filing
Soft copies	Save in a USB drive and cloud folder with original filenames where possible

Practical evidence tips for screenshots and digital records

For each screenshot, try to capture:

The scammer’s account name and profile photo
The full message bubble, not just a cropped line
Date and time
The URL, username, or handle
Payment instructions
Your payment confirmation
Messages after payment showing excuses, blocking, or disappearance

For emails, save the original email if possible. For websites, screenshot the page and copy the full URL. For Telegram or WhatsApp, save the phone number, username, invite link, and group name. For Facebook, copy the profile or page link before it disappears.

If the scam involved a website or phishing link, do not log in again. Save the URL and screenshots, then change your passwords and enable multi-factor authentication on affected accounts.

Frequently Asked Questions

Can I file a police report for a GCash scam?

Yes. Report immediately to GCash or the relevant e-wallet, then file a police blotter or cybercrime complaint. Bring the GCash receipt, reference number, recipient name or number, screenshots of the conversation, and your fraud ticket number.

Should I go to PNP or NBI for an online scam?

You may go to either, depending on access and urgency. The PNP Anti-Cybercrime Group handles cybercrime complaints under the police system, while the NBI Cybercrime Division also receives complaints and conducts cybercrime investigations. For urgent scam reporting and referral, Hotline 1326 is also available.

Is a police blotter enough to get my money back?

Not always. A blotter helps document the incident, but refund or recovery depends on the bank/e-wallet investigation, whether the funds are still traceable or holdable, and whether legal processes can identify the recipient or scammer.

Can I file even if I only know the scammer’s username?

Yes. Provide all identifiers: username, profile link, phone number, email, bank/e-wallet account, QR code, transaction reference number, IP-related information if available, and screenshots. Investigators may use these details for lawful requests or case build-up.

Do screenshots count as evidence in the Philippines?

Yes, electronic documents and electronic data messages may be used as evidence if properly authenticated and admitted under applicable rules. Keep original files, full conversations, transaction records, and the device used whenever possible. (Lawphil)

How much does it cost to file a police report for an online scam?

Recording a complaint or filing an investigative request with law enforcement should not require an unofficial payment. The NBI Cybercrime Division Citizen’s Charter lists no fee for its investigative assistance process. You may still spend for printing, photocopying, notarization, transportation, and document preparation. (National Bureau of Investigation)

Can I post the scammer’s name and account online?

Be careful. You may warn others using truthful, limited facts, but public accusations can create privacy, cyber libel, or harassment risks if you post unverified identities, full account numbers, private addresses, or personal data of someone who may be a mule or identity-theft victim. Reporting to authorities is safer than trial by social media.

What if the scammer is outside the Philippines?

Report anyway if a Philippine account, number, platform activity, or victim is involved. Cross-border cases are harder and slower, but RA 10175 recognizes domestic and international cooperation mechanisms for cybercrime matters. (Supreme Court E-Library)

Can the police force Facebook, GCash, Maya, or a bank to reveal the scammer?

Law enforcement may seek preservation, disclosure, collection, or search-related processes when legally justified. Under the RA 10175 IRR, disclosure of subscriber, traffic, or relevant data generally requires a court warrant and must relate to a valid complaint officially docketed and assigned for investigation. (Supreme Court E-Library)

What if I voluntarily sent the money?

Voluntary transfer does not automatically defeat a complaint. Estafa often involves a victim voluntarily parting with money because of deceit. What matters is whether the scammer made false representations before or during the transaction and whether you relied on them.

Key Takeaways

Report the scam to your bank or e-wallet immediately, especially if the transfer was recent.
Preserve full digital evidence before blocking, deleting, or resetting anything.
A police blotter records the incident, but a cybercrime complaint and complaint-affidavit may be needed for real investigation.
File with the nearest police station, PNP Anti-Cybercrime Group, NBI Cybercrime Division, and/or Hotline 1326 depending on urgency and case type.
Online scams may involve estafa under the Revised Penal Code, cybercrime under RA 10175, and financial account scamming or money muling under RA 12010.
Screenshots can help, but original chats, transaction records, profile links, and device records are stronger.
Recovery of money is not guaranteed, but fast reporting improves the chance of tracing or holding funds.
Foreigners and OFWs can report Philippine-linked online scams, but sworn documents and authorization may be required if filing through a representative.