How to Obtain a Court Order to Trace and Freeze Funds After an Online Scam (Philippines)

This is general information for Philippine matters and not a substitute for advice from your own counsel.

Big picture

When money is whisked away in a scam, you usually need two tracks running at the same time:

Fast, practical containment with banks/e-wallets and law enforcement to stop further dissipation and start tracing; and
Court relief to legally freeze or preserve assets and compel third parties (banks, e-wallets, platforms) to disclose data.

In the Philippines, effective “freezing” orders come from three legal avenues:

Pre-judgment attachment/garnishment or injunction from a trial court in a civil case;
Freeze orders and bank-inquiry orders under the Anti-Money Laundering Act (AMLA) via the AMLC and the Court of Appeals (public enforcement route); and
Cybercrime warrants (to disclose, search, seize, examine, intercept, or preserve computer data) in a criminal investigation.

You rarely rely on just one. The best outcomes coordinate all three.

Immediate actions (hours to days)

Call your sending bank/e-wallet immediately.
- File a fraud report/recall request and ask that they alert the receiving institution.
- Get a written ticket/reference and certified transaction records (proof of transfer, receiving account details, time stamps).
Report to law enforcement.
- PNP–Anti-Cybercrime Group or NBI–Cybercrime Division.
- Bring IDs, device screenshots, chat logs, transaction slips, phone numbers, email/handles, URLs, and any delivery addresses.
- Ask the investigator to consider applying for cybercrime warrants (see below) and to coordinate with AMLC.
Lock down evidence.
- Preserve original files, export chats, email headers, and device logs.
- Avoid “editing” or forwarding original media; keep a clean copy.
Engage counsel ASAP if you intend to seek court relief.
- You will likely need a verified complaint and an ex parte application for a writ of preliminary attachment (and possibly a TRO/preliminary injunction) within 24–72 hours.

Civil route: pre-judgment attachment and injunction

Why it matters

A writ of preliminary attachment lets the court levy/garnish a defendant’s “debts and credits” in the hands of a third person—including bank and e-wallet balances—up to the claim amount. Properly served, garnishment effectively freezes the funds in the garnishee’s hands.

Where and what to file

Court & venue. File an ordinary civil action (e.g., estafa/fraud-based damages) in the RTC if your principal claim exceeds ₱2,000,000; otherwise, the MTC has jurisdiction. For pure speed plus asset preservation, do not use small claims, because provisional remedies (like attachment) aren’t available there.
Parties. Sue the scammer (use “John/Jane Doe” if identity is unknown, then amend later). You do not typically sue the bank/e-wallet as a defendant; they are reached as garnishees through the sheriff once a writ issues.
Pleadings. File:
- Verified Complaint (with detailed fraud narrative and prayer for damages and provisional relief),
- Application for Writ of Preliminary Attachment (may be ex parte),
- Applicant’s Affidavit stating (a) a cause of action, (b) a Rule-based ground (fraud in contracting/incurring obligation; embezzlement; fraudulent conversion/misapplication), (c) amount due, and (d) that it’s not secured by any lien, and
- Attachment Bond (through a surety) in an amount the court fixes to answer for wrongful attachment.

Tip: Attach your transfer proof and the receiving account details (bank/EMI name, account number or identifier, transaction IDs). The sheriff needs something concrete to serve on the garnishee.

How the attachment “freeze” works, step-by-step

Court issues the writ (often ex parte).
Sheriff serves:
- Summons and complaint on the defendant (unless exempted because writ is ex parte and promptly followed by service), and
- Notice of garnishment on the receiving bank/e-wallet (and any subsequent hops you have identified).
Once served, the garnishee must hold the funds up to the amount of the writ and report to the court.
The defendant may post a counter-bond to discharge the attachment.
The case proceeds to judgment; attached funds later satisfy the judgment.

Preliminary injunction / TRO (optional and case-specific)

You may pair attachment with a TRO/preliminary injunction to restrain dissipation (e.g., ordering a defendant not to transfer assets). TROs are short-lived (a few days ex parte, then up to 20 days at the RTC), while a preliminary injunction lasts until judgment. Courts are cautious when injunctions resemble a “freeze” of assets; attachment is usually the cleaner tool to immobilize money in bank/EMI hands.

Bank secrecy considerations

Bank secrecy laws restrict disclosure of deposit details, but they do not generally prevent garnishment/levy under a lawful writ.
Expect limited information from banks absent a specific court order for production or an AMLC/CA bank-inquiry order. Plan to prove your case using your own records and third-party data obtained via subpoena or discovery later.

Public-enforcement route: AMLA freeze & civil forfeiture

If the facts suggest money laundering (proceeds of an unlawful activity like estafa or cyberfraud), law enforcement can coordinate with the Anti-Money Laundering Council (AMLC). The AMLC may apply ex parte to the Court of Appeals for:

a Freeze Order over specified accounts/assets (initially time-bound, extendable);
a Bank Inquiry Order to look into deposits/investments; and
later, an Asset Preservation Order and civil forfeiture case.

Key points for victims

You don’t file the AMLA petition yourself. You file a complaint and submit evidence to AMLC/LEAs.
AMLA freezes can reach banks, e-wallets, remittance, securities, VASPs, and other covered persons.
Even if you pursue civil attachment, parallel AMLA action can lock down assets that moved beyond the initial receiving account or offshore.

Criminal route: cybercrime warrants to trace the money

Under the Rules on Cybercrime Warrants, investigators (NBI/PNP) and prosecutors may seek, from designated cybercrime courts:

Warrant to Disclose Computer Data (WDCD) – compels platforms, telcos, and financial service providers to turn over subscriber/transaction data, logs, IPs, device identifiers, etc.;
Warrant to Search, Seize, and Examine Computer Data (WSSECD) – for imaging/seizure and forensic analysis;
Warrant to Intercept Computer Data (WICD) – real-time interception for qualified cases;
Preservation orders – to ensure data isn’t deleted.

These tools map the funds’ path (e.g., receiving e-wallet → cash-out agent → another bank → crypto exchange) so you can target additional garnishees, and help AMLC justify wider freeze coverage.

Putting it together: a 72-hour freeze strategy

Day 0 (immediate)

File bank/e-wallet recall and internal fraud tickets; ask for temporary hold pending legal orders.
Report to PNP-ACG/NBI-CCD; hand over your dossier and request WDCD against the receiving institution and relevant platforms.

Day 1

Counsel files civil case + ex parte application for attachment (RTC/MTC as proper).
Prepare surety bond.
Draft garnishee list: every identified receiving account/EMI, and probable onward accounts if known.

Day 2

Writ issued and served on garnishees; funds (if still present) become legally immobilized.
Investigators move for additional warrants; AMLC evaluation begins.

Day 3+

If AMLC proceeds, CA freeze order may expand the perimeter (other accounts, related persons, crypto wallets with custodians).
In civil court, pursue discovery/subpoenas to fill identity gaps and, if needed, amend the complaint to name real parties.

Evidence & annex checklist (practical)

Government-issued ID (complainant).
Transaction proofs: bank/e-wallet receipts, reference numbers, timestamps, screenshots of successful transfer status, chargeback letters.
Receiving account details (account number, name as displayed, e-wallet handle, mobile number, QR, merchant ID, device ID if shown).
Communications: chat/email threads, marketplace listings, social media posts, call logs, phone numbers.
Device information: make/model, OS version; if feasible, export of logs.
Police/NBI report numbers.
Affidavit narrating the fraud (chronology, who said what, when money moved, how you discovered the scam).
Draft writs and sheriff’s instructions (with complete service addresses for garnishees’ legal/central offices).
Bond documents (or surety pre-approval).

Special contexts

E-wallets and cash-out agents

Serve the garnishment on the EMI’s legal office (not just a retail store).
If funds already converted to cash via agents, rely on warrants to identify agent terminals, CCTV/time logs, and then pursue identity and recovery from the human cash-out recipient.

Card transactions

Parallel chargeback with your issuing bank under card-network rules. This is separate from court remedies and may recover funds even if the scammer is offshore.

Crypto/VASPs

If transfers hit a custodial exchange licensed as a VASP, include it as a garnishee once you have destination identifiers (account/email/customer ID/transaction hash correlated to the exchange). Pair with AMLA freeze for better reach.

Offshore or unknown recipients

Civil attachment is difficult without a bank/EMI you can serve in the Philippines. Prioritize AMLC and MLA/EGMONT channels via law enforcement to reach foreign FIUs, then proceed on selective targets as they surface.

Barangay conciliation

Often not required for online scams because parties do not reside in the same city/municipality and/or the claim involves offenses outside Katarungang Pambarangay’s scope.

Common pitfalls (and how to avoid them)

Waiting too long. Funds move fast across multiple hops; serve the writ quickly.
Using small claims when you need a freeze. You lose provisional remedies; file an ordinary civil action.
Too little detail for garnishment. Provide exact identifiers the garnishee recognizes.
Over-relying on bank secrecy as a roadblock. You can still garnish without prying into deposit contents; use discovery and warrants for data.
Skipping the bond. No bond, no attachment.
Not coordinating with AMLC. Civil attachment can snag the first account; AMLA tools help widen the net.
Underserving parties. Garnishment binds only served garnishees; serve every plausible holder.

Sample structure: ex parte attachment package (outline)

Verified Complaint for Damages (Estafa/Fraud), with Prayer for Provisional Relief
- Parties, jurisdiction & venue
- Detailed chronology of scam and transfers
- Causes of action (e.g., deceit, unjust enrichment, damages)
- Prayer (damages, interest, costs; writ of attachment; TRO/PI if warranted)
Application for Writ of Preliminary Attachment (Ex Parte)
- Applicant’s Affidavit (grounds under Rule 57, facts showing urgency)
- Attachment Bond (surety)
- Proposed Order and Writ
- Sheriff’s Instructions (with garnishee details and addresses)
- Annexes (transaction proofs, screenshots, police report, etc.)
After issuance
- Coordinate immediate service on garnishees; get returns on service; move for compliance reports from garnishees.

What judges look for (practical standards)

Clear, specific fraud narrative with documentary exhibits.
Identifiable garnishees and traced transfers (at least the first receiving account).
Proper bond and risk of dissipation explained.
Good faith (no harassment; realistic claim amount).
Procedural regularity (verified pleadings, correct venue, service readiness).

Costs, timing, and expectations

Court fees scale with the claim; bond premiums vary by surety and amount.
TRO/attachment can be issued quickly on a strong ex parte showing, but service and compliance determine real-world freezing.
If the money has already moved several times or been cashed out, a civil writ on the first account may net zero—which is why law enforcement + AMLC coordination is crucial to trace and widen the freeze.

Quick reference: who does what

You / Counsel: Civil suit, writ of attachment/garnishment, subpoenas/discovery, injunctions.
PNP–ACG / NBI–CCD: Criminal complaints, cybercrime warrants, platform/bank data, arrests.
AMLC: CA freeze orders, bank inquiry, asset preservation, civil forfeiture, international FIU cooperation.
Banks / EMIs / VASPs: Implement holds on lawful orders, report to court/AMLC, provide records on proper legal process.

Final takeaways

Move immediately and in parallel: bank recall, police/NBI report, civil attachment, AMLC coordination.
Provide precise identifiers so sheriffs can garnish effectively.
Expect to combine civil and public-enforcement tools to both trace and freeze.
Plan for a marathon, not a sprint: early freezes are possible, but recovery often depends on sustained tracing across multiple institutions.

If you want, I can draft a fill-in-the-blanks template for the verified complaint, the ex parte attachment affidavit, and a model sheriff’s instruction page tailored to your facts.