Falling for a crypto investment scam can feel overwhelming because the money often moves fast, the “company” may disappear overnight, and the people behind it may hide behind Telegram names, fake Facebook profiles, wallet addresses, or overseas entities. In the Philippines, however, a crypto scam can still be pursued as estafa, especially when someone used false promises, fake authority, guaranteed returns, manipulated dashboards, or other deceit to make you send money or cryptocurrency. The key is to act quickly, preserve digital evidence properly, identify the correct offices, and present the facts in a way that proves the legal elements of the crime.

What Estafa Means in a Crypto Investment Scam

Estafa is the Philippine crime commonly known as swindling. It is punished under Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951. In a crypto investment scam, the usual theory is estafa by false pretenses or fraudulent acts under Article 315(2)(a). This covers situations where the scammer made false representations about a business, investment, authority, qualifications, property, credit, agency, or imaginary transaction to induce the victim to part with money or property. (Lawphil)

For crypto scams, estafa may apply when the suspect:

Promised fixed or guaranteed crypto returns that were never real.
Pretended to operate a licensed exchange, fund, trading desk, mining operation, staking pool, or AI trading platform.
Showed fake screenshots, dashboards, wallet balances, SEC certificates, BSP approvals, or “proof of profit.”
Claimed the victim had to pay “tax,” “gas fee,” “unlocking fee,” “anti-money laundering fee,” or “withdrawal clearance” before funds could be released.
Used a fake company, fake broker identity, fake group chat, fake celebrity endorsement, or cloned website.
Induced the victim to transfer pesos, dollars, USDT, Bitcoin, Ethereum, or other crypto assets.

The important point is this: a failed investment is not automatically estafa. Criminal estafa focuses on deceit. You must show that the false representation existed before or at the same time you transferred the money or crypto, and that you relied on it when you invested.

Legal Basis for Filing an Estafa Case

Article 315 of the Revised Penal Code

For estafa by deceit under Article 315(2)(a), prosecutors usually look for these elements:

The accused made a false pretense, fraudulent representation, or similar deceit.
The deceit was made before or at the same time as the fraud.
The victim relied on the deceit and was induced to part with money, crypto, or property.
The victim suffered damage.

The Supreme Court has repeatedly emphasized that the false pretense must be proven and must be the reason the victim parted with money. In one estafa case involving alleged investment solicitation, the Court restated the elements of Article 315(2)(a) and stressed that deceit must be proven, not merely assumed from a failed transaction. (Supreme Court E-Library)

Republic Act No. 10175, Cybercrime Prevention Act of 2012

If the estafa was committed through a computer system, social media, messaging app, fake website, online wallet, email, or other information and communications technology, Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may also be involved. Section 6 of RA 10175 treats crimes under the Revised Penal Code committed by, through, or with the use of information and communications technologies as cybercrimes, with a higher penalty. The Supreme Court upheld the constitutionality of this ICT-related qualifying circumstance in Disini v. Secretary of Justice. (Lawphil)

This is why many online scam complaints are written as:

Estafa under Article 315(2)(a) of the Revised Penal Code, in relation to Section 6 of Republic Act No. 10175.

Depending on the facts, investigators may also look at computer-related fraud, illegal access, identity misuse, phishing, or other cybercrime issues.

Securities Regulation Code and Investment Fraud

A crypto investment scam may also involve securities law violations if the scheme is an investment contract or an unauthorized public offering of securities. Under Republic Act No. 8799, the Securities Regulation Code, securities generally must be registered before being sold to the public, and persons selling or offering securities must have the proper authority. The Supreme Court has recognized that investment contracts are securities that must be registered with the Securities and Exchange Commission. (Lawphil)

This matters because many crypto scams are marketed as:

“Passive income”
“Trading package”
“Staking contract”
“Mining contract”
“Copy-trading fund”
“AI bot investment”
“Guaranteed daily profit”
“Referral income plan”

Even if the word “crypto” is used, the scheme may still be treated as an investment contract if people invest money in a common enterprise and expect profits mainly from the efforts of others.

Financial Products and Services Consumer Protection Act

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, is also relevant where financial products, financial services, or investment fraud are involved. The law expressly addresses investment fraud and works alongside the powers of financial regulators such as the SEC and BSP. (Lawphil)

Anti-Financial Account Scamming Act

For scams involving bank accounts, e-wallets, mule accounts, phishing, or social engineering, Republic Act No. 12010, the Anti-Financial Account Scamming Act or AFASA, may also be relevant. AFASA penalizes money muling activities and social engineering schemes involving financial accounts, including e-wallets, and gives the BSP authority to investigate financial accounts involved in prohibited acts. (Lawphil)

This is useful when the scammer used:

A GCash, Maya, bank, remittance, or payment account under another person’s name.
A “mule” account that received victim payments.
Deceptive electronic communications to obtain credentials or account access.
Multiple accounts to move proceeds quickly.

Civil Liability and Recovery of Money

A criminal case may include civil liability. Under the Revised Penal Code, civil liability may include restitution, reparation of damage, and indemnification for consequential damages. The Civil Code also recognizes liability for fraud, bad faith, unjust enrichment, and acts contrary to law, morals, good customs, or public policy, including Articles 19, 20, 21, 22, and 1170. (Lawphil)

In practical terms, this means a criminal estafa case is not only about imprisonment. It may also support a claim for the return of the amount lost, although actual recovery depends on whether the accused and assets can be located.

Is Cryptocurrency Legal in the Philippines?

Cryptocurrency itself is not automatically illegal in the Philippines. The legal issue is how it is offered, sold, managed, promoted, or used.

The Bangko Sentral ng Pilipinas regulates Virtual Asset Service Providers, or VASPs, under BSP Circular No. 1108. VASPs generally include entities that exchange virtual assets for fiat currency, exchange one virtual asset for another, transfer virtual assets, or safeguard/administer virtual assets. (Bangko Sentral ng Pilipinas)

The BSP also maintains a list of VASPs. The BSP list available as of 31 May 2026 identifies active non-bank VASPs and active bank VASPs, which is important when checking whether a platform is actually regulated.

But BSP registration as a VASP does not automatically mean an entity may offer investment contracts, guaranteed returns, or pooled crypto investments to the public. Investment solicitation may fall under SEC rules, especially if the scheme is effectively asking the public to invest money and expect profits from the efforts of the promoter.

Where to File a Crypto Estafa Complaint in the Philippines

You may need to deal with more than one office. Each has a different role.

Office	Main Role	When to Go There
NBI Cybercrime Division	Investigation, cybercrime complaint intake, digital evidence handling	When the scam involved websites, social media, wallet addresses, fake platforms, hacked accounts, or online identities
PNP Anti-Cybercrime Group	Law enforcement investigation of cyber-related crimes	When you need police cybercrime assistance, tracing, blotter/report, or coordination with local police
Office of the City or Provincial Prosecutor	Preliminary investigation and filing of criminal information in court	When you are ready to file the formal criminal complaint-affidavit for estafa
SEC	Investment scam reports, unauthorized solicitation, securities violations	When the scam involved public investment solicitation, trading packages, passive income, or a fake company
BSP / regulated financial institution	Financial account, e-wallet, payment provider, or VASP issues	When bank, e-wallet, payment, or VASP accounts were used
CICC / Inter-Agency Response Center	Scam reporting and coordination	For fast reporting of online scams, especially where immediate coordination may help

The NBI Citizen’s Charter for cybercrime complaints states that complainants may proceed to the Cybercrime Division to file a complaint or request investigation, undergo interview, execute sworn statements, and submit supporting documents, with no fee for that initial investigative assistance process. (National Bureau of Investigation)

Step-by-Step Guide to Filing an Estafa Case for a Crypto Scam

1. Preserve the evidence immediately

Before confronting the scammer, posting online, or deleting conversations, preserve your evidence. Online scammers often delete accounts, change usernames, revoke group chat access, or block victims.

Save the following:

Chat records
- Messenger, Telegram, WhatsApp, Viber, Discord, Instagram, TikTok, email, SMS.
- Export full conversations if possible.
- Include profile names, usernames, phone numbers, handles, and group chat details.
Payment proof
- Bank transfer receipts.
- GCash, Maya, Coins.ph, PDAX, Binance, OKX, Bybit, Coinbase, Kraken, or other exchange records.
- Remittance slips.
- QR code screenshots.
- Deposit instructions sent by the scammer.
Crypto transaction details
- Wallet address where you sent crypto.
- Transaction hash or transaction ID.
- Date and time of transfer.
- Blockchain explorer link.
- Token type and network used, such as USDT TRC20, USDT ERC20, BTC, ETH, SOL, BNB, or Polygon.
Investment representations
- Promised returns.
- “Guaranteed profit” messages.
- White paper, pitch deck, contract, certificate, or “trading plan.”
- Fake SEC/BSP certificates.
- Screenshots of website dashboards showing fake profits.
- Withdrawal denial messages.
Identity clues
- Names used by recruiters.
- Facebook profile URLs.
- Telegram handles.
- Phone numbers.
- Bank or e-wallet account names.
- Referral codes.
- Company registration claims.
- Meeting invites, Zoom recordings, webinars, and attendance screenshots.

Do not rely only on screenshots if you can export or download original records. Screenshots help, but prosecutors and investigators prefer evidence that is organized, dated, complete, and connected to the person you are accusing.

2. Create a clear timeline

A crypto estafa complaint becomes stronger when the facts are easy to follow. Prepare a timeline like this:

Date	What Happened	Evidence
5 January 2026	Recruiter introduced the crypto trading package and promised 10% monthly return	Messenger screenshots, webinar recording
7 January 2026	Victim sent ₱100,000 to named bank account	Bank receipt
8 January 2026	Platform dashboard showed fake profit	Website screenshots
20 January 2026	Victim requested withdrawal	Chat screenshots
21 January 2026	Scammer demanded “tax clearance fee”	Telegram screenshots
25 January 2026	Scammer blocked victim	Profile screenshots

This helps prove that the deceit came before the transfer, not only after the investment failed.

3. Verify whether the company or platform is registered

Check whether the entity is registered with the SEC, whether it has authority to solicit investments, and whether the platform is on the BSP VASP list if it claims to be a Philippine-regulated crypto exchange or wallet.

Be careful with this common scam tactic: scammers show a SEC Certificate of Incorporation and say, “Registered kami sa SEC.” A corporation’s registration is not the same as authority to sell investments to the public. A company may be registered as a corporation but still lack authority to solicit investments, sell securities, operate an exchange, or offer pooled investment products.

For investment scam reports, the SEC now uses its public-facing SEC iMessage portal for complaints and inquiries, with ticket creation and tracking. (Securities and Exchange Commission)

4. Report quickly to the platform, bank, e-wallet, or exchange

If you sent money through a bank, e-wallet, remittance center, or crypto exchange, report the transaction immediately.

Ask for:

Freezing or holding of suspicious funds if still possible.
Preservation of account records.
Internal investigation report or reference number.
KYC details preservation, subject to proper legal process.
Confirmation of transaction details.

Banks and exchanges will usually not disclose another person’s private account information directly to you without legal process. However, your report can help preserve records and support later requests from law enforcement, prosecutors, courts, or regulators.

5. File a report with NBI Cybercrime or PNP ACG

For crypto scams, it is often practical to first report to a cybercrime law enforcement unit because they understand digital evidence and may help with technical aspects such as wallet addresses, websites, IP logs, platform accounts, and online identities.

Bring:

Valid government ID.
Printed and digital copies of your evidence.
A USB drive or organized folder.
Your timeline.
Bank/e-wallet/crypto receipts.
Device used, if relevant.
Names, numbers, usernames, links, and wallet addresses.

You may be interviewed and asked to execute a sworn statement. The investigator may also advise what additional evidence is needed before endorsement to the prosecutor.

6. Prepare the complaint-affidavit

The complaint-affidavit is the heart of the case. It is your sworn statement explaining what happened and why the respondent should be charged.

A good complaint-affidavit should include:

Your full name, address, citizenship, contact details, and identification.
The respondent’s known names, aliases, addresses, phone numbers, usernames, wallet addresses, and account details.
How you first encountered the investment offer.
The exact false promises or representations made.
Why you believed those representations.
The amounts and dates you transferred money or crypto.
What happened when you tried to withdraw or recover funds.
The total amount lost.
A list of attached evidence.
A clear request that the respondent be investigated and charged for estafa and other applicable offenses.

Avoid emotional but vague statements such as “They are scammers” without supporting facts. Replace them with specific facts:

“Respondent represented that the company was SEC-authorized to solicit investments, but no such authority was shown.”
“Respondent promised a guaranteed 8% weekly return and said my principal was risk-free.”
“Respondent instructed me to send USDT to wallet address ___ on ___.”
“After I requested withdrawal, respondent demanded an additional ₱50,000 as tax before release, then blocked me.”

7. Notarize the complaint-affidavit and supporting affidavits

A complaint-affidavit must be sworn. In the Philippines, this usually means signing before a notary public or authorized officer.

If you are abroad, you may need to execute documents through a Philippine Embassy or Consulate, or use apostilled foreign notarized documents depending on the country and document type. Philippine embassies can notarize private documents such as affidavits and special powers of attorney, while apostille rules apply to public documents between Apostille Convention countries. (Philippine Embassy)

For OFWs, foreigners, and Filipinos abroad, practical issues include:

The prosecutor may still require clarificatory participation later.
Remote hearings may be possible in some proceedings, depending on available systems and the prosecutor or court.
A representative in the Philippines may help submit papers, but the victim’s own sworn affidavit is usually still important.
If original evidence is abroad, keep the devices, accounts, and files preserved.

8. File with the prosecutor’s office

The criminal complaint is usually filed with the Office of the City Prosecutor or Office of the Provincial Prosecutor that has territorial jurisdiction.

Venue can be fact-sensitive in online scams. Possible connections include:

Where the victim was deceived.
Where the victim sent the money or crypto.
Where the bank or e-wallet account was maintained or received funds.
Where the respondent acted.
Where an essential element of the offense occurred.

Because online scams often involve multiple places, organize your complaint to clearly state where you were located when you received the false representations and where you made the transfer.

Under the 2024 DOJ-NPS rules framework, preliminary investigation is a prosecutorial function. The Supreme Court recognized the DOJ’s authority over preliminary investigations and inquests, and in 2026 it upheld the DOJ rules raising the standard in preliminary investigations and inquests to prima facie evidence with reasonable certainty of conviction. (Supreme Court E-Library)

In practical terms, this means your evidence should not merely create suspicion. It should be organized enough to show:

The crime charged.
All legal elements.
The identity of the person responsible.
Evidence that can be preserved and presented in court.

9. Participate in preliminary investigation

After filing, the prosecutor may require the respondent to submit a counter-affidavit. You may be asked to submit a reply-affidavit if the respondent denies the allegations or claims the transaction was a legitimate investment loss.

Common defenses in crypto scam cases include:

“It was a business loss, not fraud.”
“The victim knew crypto was risky.”
“I was only a recruiter, not the owner.”
“The company abroad controlled the platform.”
“The victim voluntarily sent the funds.”
“The wallet address is not mine.”
“The dashboard reflected market losses.”
“I also got scammed.”

Your evidence must answer these points. For example, if the recruiter personally guaranteed returns, used fake documents, controlled deposit instructions, received referral commissions, or continued soliciting after withdrawals were blocked, include those facts.

10. If the prosecutor finds sufficient basis, the case goes to court

If the prosecutor finds sufficient basis, an Information is filed in court in the name of the People of the Philippines. The court process may include:

Judicial determination of probable cause.
Issuance of warrant or summons, depending on the case.
Arraignment.
Pre-trial.
Trial.
Decision.
Civil liability determination, if applicable.

Timelines vary widely. A simple complaint may move faster, but crypto scams often face delays because of identity tracing, multiple victims, foreign platforms, wallet analysis, exchange records, and coordination with banks or regulators.

Evidence That Usually Makes or Breaks a Crypto Estafa Case

The strongest cases usually have evidence of pre-investment deceit. The weakest cases only show that the victim lost money.

Strong evidence

Chat where the respondent guaranteed profit.
Proof that the respondent claimed SEC, BSP, or exchange authority without basis.
Bank/e-wallet account in the respondent’s name.
Wallet address repeatedly provided by the respondent.
Screenshots of fake dashboards plus proof of deposits.
Other victims with the same script and same receiving accounts.
SEC advisory or regulator confirmation that the entity was unauthorized.
Withdrawal demands for fake taxes or clearance fees.
Respondent’s admissions that funds were used for something else.

Weak or incomplete evidence

Screenshot without date, username, or context.
Only a deposit receipt, with no proof of inducement.
Only a group chat where the respondent was not clearly identified.
A complaint based only on “I was promised returns” without showing who made the promise.
Edited screenshots without originals.
No transaction hash for crypto transfers.
No link between the wallet/account and the respondent.

Common Crypto Scam Scenarios in the Philippines

The “guaranteed trading profit” scam

The victim is told that a trader or AI bot can generate fixed weekly or monthly returns. The scammer shows fake profit screenshots and asks for more capital. When the victim withdraws, the platform demands tax, KYC, AML, or gas fees.

Possible case theory: estafa by false pretenses, cybercrime, securities violations, and possible financial account scamming if mule accounts were used.

The “pig butchering” romance-investment scam

The scammer builds trust through dating apps, Facebook, WhatsApp, or Telegram, then introduces a fake crypto platform. The victim sees fake profits and keeps adding funds.

Possible case theory: estafa through deceit, cybercrime, identity-related offenses, and cross-border investigation issues.

The “community investment group” scam

A friend, churchmate, coworker, OFW group member, or social media influencer recruits people into a crypto staking or trading pool. The group pays early members using later investors’ money, then collapses.

Possible case theory: estafa, syndicated estafa if legal requirements are met, securities violations, and civil liability.

The “fake exchange withdrawal fee” scam

The victim is told funds are already profitable but cannot be withdrawn unless additional fees are paid. Each payment leads to another demand.

Possible case theory: continuing estafa acts, cybercrime, and social engineering-related offenses.

What If the Scammer Is Abroad?

A Philippine case may still be possible if essential elements happened in the Philippines, the victim was in the Philippines, Philippine financial accounts were used, or Philippine residents were targeted.

However, foreign suspects create practical bottlenecks:

Identification may require platform or exchange records.
Foreign exchanges may respond only to law enforcement requests.
Extradition is complex and depends on treaties and the offense.
Recovery may require tracing assets across jurisdictions.
Witnesses abroad may need consular notarization, apostille, or remote participation.

For foreigners scammed by people in the Philippines, the same basic rule applies: organize the evidence, execute a sworn complaint, and file with the proper Philippine office. If documents are executed abroad, authentication requirements should be checked early to avoid rejection or delays.

Fees, Timelines, and Practical Bottlenecks

Item	Practical Notes
NBI cybercrime complaint intake	NBI’s citizen-facing process for cybercrime investigative assistance indicates no fee for the listed initial steps. (National Bureau of Investigation)
Notarization	Private notarization fees vary. Bring valid ID and do not sign until before the notary or authorized officer.
Printing and evidence preparation	Expect costs for printing screenshots, receipts, affidavits, annexes, folders, and certified copies where needed.
Prosecutor evaluation	Timing varies by office, completeness of evidence, number of respondents, and whether additional case build-up is needed.
Cybercrime tracing	Can take longer if records must be requested from platforms, banks, exchanges, telcos, or foreign service providers.
Court case	Once filed in court, timelines depend on docket congestion, arrest/summons issues, witness availability, plea, motions, and trial settings.

Common bottlenecks include incomplete respondent identity, missing transaction hashes, deleted chats, unverified screenshots, foreign platforms, mule accounts, and victims filing separate uncoordinated complaints instead of organizing common evidence.

Mistakes to Avoid When Filing

Waiting too long before reporting. Crypto and e-wallet proceeds can move within minutes.
Deleting the scammer from your contacts. You may lose usernames, profile URLs, photos, group details, and message history.
Sending more money to “unlock” withdrawals. Repeated fees are often part of the scam.
Posting all evidence publicly. This can alert suspects and compromise investigation strategy.
Filing a vague complaint. Prosecutors need facts, dates, amounts, identities, and attachments.
Assuming SEC registration equals investment authority. These are different.
Ignoring the recruiter. A local recruiter may be important even if the “main company” is abroad.
Failing to connect each respondent to specific acts. Do not lump everyone together without explaining what each person did.
Submitting screenshots without context. Include dates, account names, URLs, phone numbers, and related receipts.
Treating wallet addresses as self-explanatory. Explain who gave the wallet address, when, through what account, and what transfer corresponds to it.

Frequently Asked Questions

Can I file estafa if I voluntarily sent money or crypto?

Yes, if you sent it because of deceit. Estafa often involves voluntary delivery of money or property, but the consent is obtained through fraud. The issue is not simply whether you clicked “send.” The issue is whether false representations induced you to send the funds.

Is losing money in crypto automatically estafa?

No. Crypto trading is risky, and market losses alone are not estafa. You need evidence of fraud, such as fake guaranteed returns, fake authority, fake platform balances, false identities, or other deceit made before or during the transfer.

What if the scammer used a fake name?

You can still file, but you should include all identifiers: usernames, phone numbers, account names, wallet addresses, email addresses, profile links, photos, bank accounts, e-wallet numbers, referral codes, and group chat records. Law enforcement may use these to trace the person behind the account.

Can I file against the recruiter even if the main company is abroad?

Yes, if the recruiter personally made false representations, induced you to invest, received money, provided deposit instructions, vouched for the scheme, or participated in the fraud. The complaint should clearly describe the recruiter’s specific acts.

Do I need an SEC advisory before filing estafa?

No. An SEC advisory can help, especially in investment scams, but estafa depends on the evidence of deceit, reliance, and damage. If there is no advisory yet, you may still file with law enforcement or the prosecutor and separately report the entity to the SEC.

Can I recover my crypto through the criminal case?

Possible, but not guaranteed. A criminal case may include civil liability, but actual recovery depends on tracing assets, identifying the accused, freezing or preserving accounts, and proving the amount lost. Crypto transfers are often difficult to reverse once completed.

Should I file with NBI, PNP, SEC, or the prosecutor first?

For a cyber-heavy crypto scam, many victims first report to NBI Cybercrime or PNP ACG for investigation and evidence handling. If the evidence is already organized, you may file a complaint-affidavit with the city or provincial prosecutor. If the scheme involved public investment solicitation, also report to the SEC.

What if I am an OFW or foreigner outside the Philippines?

You can prepare a sworn complaint-affidavit abroad, but notarization, consular acknowledgment, or apostille issues may arise depending on where the document is executed. You should preserve original digital evidence and be ready for possible clarificatory participation later.

Can multiple victims file together?

Yes. Multiple victims can coordinate evidence, execute separate affidavits, and show a common fraudulent scheme. This may help prove pattern, intent, and public solicitation. Each victim should still state their own facts, amount lost, dates, and evidence.

What if the scammer already returned part of the money?

Partial payment does not automatically erase criminal liability if estafa was already committed. It may affect the amount of civil liability or be raised by the respondent, but the core issue remains whether fraud induced the transfer.

Key Takeaways

A crypto investment scam may be filed as estafa under Article 315(2)(a) of the Revised Penal Code, often in relation to RA 10175 if committed online.
The strongest evidence shows deceit before or at the time you sent money or crypto.
Preserve chats, receipts, wallet addresses, transaction hashes, dashboards, profile links, and withdrawal-denial messages immediately.
Report cyber-heavy scams to NBI Cybercrime or PNP ACG, file the formal complaint-affidavit with the proper prosecutor’s office, and report investment solicitation issues to the SEC.
BSP VASP registration, SEC corporate registration, and authority to solicit investments are different things.
For e-wallets, mule accounts, phishing, and social engineering, RA 12010 may also be relevant.
A clear timeline, notarized complaint-affidavit, organized annexes, and specific facts against each respondent greatly improve the chance that prosecutors can act on the complaint.