How to Recover Money From an Online Scam in the Philippines

(NBI, PNP ACG, SEC—A Practical, Philippine-Law Guide)

This article explains what to do immediately, how to work with your bank/e-wallet, and how to escalate with the NBI, PNP Anti-Cybercrime Group, and the SEC. It also covers the relevant laws, evidence you need, civil/criminal options, small claims, and realistic timelines—Philippine context throughout.

1) First 24–72 Hours: Contain the Damage

1. Freeze/recall funds (same day if possible).

Bank transfer / e-wallet: Call the sending institution’s fraud hotline and file a dispute/Recovery of Funds request. Provide: reference number, date/time, recipient details, amount, screenshots, and a narration that it’s a fraud-induced transfer (not a mistake or buyer’s remorse).
Ask the sending institution to alert the receiving bank/e-money issuer to flag the destination account and hold remaining funds (subject to their policies and law-enforcement coordination).
Cards (Visa/Mastercard): File a chargeback for fraud/unauthorized transaction; follow your issuer’s checklist and timelines.

2. Secure your accounts and devices.

Change passwords and enable MFA/2FA on banking, email, and e-wallets.
If there’s SIM-swap risk, contact your telco to suspend or reissue your SIM and turn on SIM-lock features (where available).

3. Preserve evidence (do not edit/rename originals).

Full screenshots (with status bar/time), chat/email threads, transaction receipts, reference/trace numbers, profile links/handles, phone numbers, website/app names, and device used.
Export chat logs and email headers. Keep files in a dated folder; make a read-only duplicate (PDF + original files).
Write a timeline: who said what, when; amounts; accounts used; promises made.

2) Decide Your Track: Criminal, Regulatory, Civil—or All Three

Most victims pursue (A) criminal, (B) regulatory (SEC) for investment schemes, and (C) civil for recovery. These can run in parallel.

A. Criminal (NBI Cybercrime Division or PNP Anti-Cybercrime Group)

Common charges (depending on facts):

Estafa under Art. 315, Revised Penal Code (RPC).
Cybercrime under RA 10175 (Cybercrime Prevention Act) when fraud is done “through computer systems” (online posts, chats, phishing, fake platforms). This may qualify or aggravate the offense.
Access Devices Regulation Act (RA 8484) for unauthorized card/device use.
Anti-Photo and Video Voyeurism / identity theft and related cyber offenses if applicable.

Why criminal? It triggers law-enforcement coordination (subpoenas to platforms/ISPs/banks), helps trace funds, and may support asset preservation when coordinated with regulators and the AMLC via covered institutions.

B. Regulatory (SEC) — for investment/“trading”/crypto/ROI scams

Violations may include:

Illegal solicitation without SEC registration/secondary license (SRC).
Securities fraud (misrepresentation, Ponzi-type schemes).
Unregistered investment contracts.

Why SEC? The SEC (through its enforcement arm) can investigate, issue advisories, recommend criminal prosecution, and coordinate with banks/AMLC for fund tracing when supported by covered-institution reports.

C. Civil (money recovery)

Sum of money/damages via ordinary civil action.
Small Claims (no lawyers required): up to ₱1,000,000 (as last amended—check current limit when filing). Ideal for clear, document-backed claims (e.g., you paid; no delivery; identifiable payee).
Injunction/asset preservation: possible, but you’ll need identifiable defendants and assets located within jurisdiction; expect bonds and hearings.

3) Where to Report and What to File

3.1 NBI Cybercrime Division (National Bureau of Investigation)

Purpose: Investigation, digital forensics, bank/platform coordination.

What to bring/submit:

Affidavit-Complaint narrating facts chronologically.
Government ID, contact details.
Evidence bundle: screenshots, receipts, chat/email logs (with headers), transaction references, bank certifications (if any), and your timeline.
If payments were made, attach bank/e-wallet dispute ticket numbers and any responses from the receiving institution.

What happens next: The NBI may take your sworn statement, log a complaint, and can issue subpoenas duces tecum/ad testificandum to banks/e-wallets and platforms to identify account owners and trace funds. They can coordinate with PNP-ACG if needed and refer to the Prosecutor’s Office for inquest or preliminary investigation.

3.2 PNP Anti-Cybercrime Group (ACG)

Purpose: Police investigation; on-the-ground coordination, especially for real-time scams, swindling syndicates, mule accounts.

What to bring: Same dossier as NBI. Note: You can report to either NBI or PNP-ACG (or even both). If both are engaged, tell each office to avoid duplication and to coordinate.

3.3 SEC (for Investment-Type Scams)

File with the SEC Enforcement/Investor Protection arm if the scam involves “investments,” “trading bots,” “forex/crypto ROI,” or “double your money” schemes.

What to submit:

Complaint letter/affidavit, IDs, proof of payments, contracts/“investment” agreements, screenshots of pitches and promised returns, social-media pages, and list of other victims (if available).
Request cease-and-desist actions (if ongoing solicitation), investigation, and referral for criminal prosecution under the Securities Regulation Code and other laws.

Parallel step: Tell your bank/e-wallet it’s an investment fraud matter so their Compliance/AML team can file or enhance Suspicious Transaction Reports (STRs) to the AMLC.

4) Banking & E-Money Playbook (Philippine Context)

1) Open a formal dispute right away. Use the bank app/phone channel and get a ticket/reference number. Follow up in writing (secure email/app message). State “fraud-induced transaction” and request fund recall/freeze.

2) Provide complete identifiers. Reference IDs, time stamps, amount, destination account name/number, screenshots, and links.

3) Ask for AML/Compliance escalation.

Covered institutions file STRs to AMLC when warranted. This can prompt inter-bank flags and help preserve residual balances.
You, as a customer, don’t file an STR; your bank does. But your detailed complaint helps them justify it.

4) Wrong-send vs. social-engineering fraud vs. account takeover.

Wrong-send: Banks/e-wallets may attempt “credit-push recalls” (voluntary return by recipient) and can temporarily hold funds if still available—often needs recipient consent unless there’s a law-enforcement order.
Fraud/social engineering: Stress that consent was vitiated by deceit; request fraud workflows (stronger holds/flags).
Account takeover (ATO): If your device/email/SIM was compromised, push for full ATO investigation and chargeback where applicable.

5) Card transactions (chargebacks).

Quickly choose the right reason code (fraud/“no cardholder authorization” or “goods not received”). Supply documentary proof and police/NBI complaint if available.

6) Keep escalation trails.

If front-line support is slow, escalate to the Dispute Resolution/Complaints Management and Compliance/AML teams.

5) Prosecutor’s Office & Courts

Preliminary Investigation

NBI or PNP-ACG can file a complaint with the City/Provincial Prosecutor, or you can file directly with your Affidavit-Complaint and annexes.
The prosecutor may issue a subpoena to respondents; you’ll exchange counter-affidavits/rejoinders. Resolution may recommend filing Informations in court.

Venue (Cybercrime): RA 10175 allows filing where any element happened or where the offended party resides—useful if the scammer is elsewhere.

Restitution:

Criminal courts can award civil liability together with conviction.
Separately, you can sue for sum of money/damages (or Small Claims up to the prevailing limit) if the payee is identifiable.

Small Claims (practical notes):

No lawyers required; use verified Statement of Claim with receipts/chat screenshots.
Good for disputes against identified recipients (e.g., mule account holders who received your money).
Consider Barangay conciliation requirements (Katarungang Pambarangay) if both parties live in the same city/municipality and the case is civil (not criminal). Many online scams involve different locales or criminal elements, which exempt you from barangay conciliation.

6) Working With Platforms & Telcos

Social media/marketplaces/messaging apps: Report the account/page/listing for fraud, request preservation of data (so it’s not auto-deleted), and note any ticket number.
Telcos: For SIM-related abuse or SIM-swap, request immediate block; ask for a case report you can attach to NBI/PNP filings.
Domain/hosting/app operators: Include URLs, app names, and developer/publisher details in your complaints to help law enforcement issue subpoenas.

7) Evidence Checklist (Print this)

IDs, contact info.
Affidavit-Complaint (signed, notarized when required).
Screenshots of ads/chats/emails (complete with timestamps and handles).
Payment proofs: bank/e-wallet receipts, reference numbers, account names/numbers, card statements.
Device info and email headers (exported).
Bank/e-wallet dispute ticket and escalation emails.
Platform/telco abuse report tickets.
Timeline of events and list of other victims/witnesses (if any).

8) Common Scam Types & Legal Hooks

Investment/ROI/crypto/forex bots: SEC (unregistered securities/illegal solicitation) + estafa + cybercrime.
Marketplace purchase non-delivery: Estafa; civil sum of money; platform complaint; chargeback if carded.
Phishing/ATO: RA 10175 (illegal access, computer-related fraud), RA 8484 (access devices), estafa.
Catfishing/romance scams: Estafa; sometimes identity theft/other cybercrimes.
“Business loan unlocking”/advance-fee scams: Estafa; cyber elements if online.

9) Timelines & Expectations (Real Talk)

Same-day: best chance to hold residual funds at the receiving institution—act immediately.
Bank/e-wallet disputes: days to weeks (varies by product and network).
Law-enforcement ID requests to platforms/banks: weeks to months.
Criminal cases: months to years; restitution depends on assets and conviction/settlement.
Civil/small claims: faster than ordinary civil cases, but still expect multiple settings.

10) Sample Templates (you can copy-paste and fill in)

A) Bank/E-Wallet Fraud Dispute (Email/App Message)

Subject: URGENT Fraud-Induced Transfer – Recovery Request – [Ref No.] I am reporting a fraud-induced transaction on [date/time], amount ₱[amount], sent from my account [last 4 digits / e-wallet handle] to [recipient name/number/account] with reference [ref no.]. I was deceived via [brief facts]. Please escalate to Fraud/Compliance for fund recall/hold at the receiving institution and initiate AML review. Attached are screenshots, receipts, and my ID. Kindly confirm case/ticket number, actions taken, and any additional requirements. Customer name / contact no. / email / ID attached

B) Affidavit-Complaint (Outline)

Personal details of complainant.
Narration of facts (chronological; attach Annex “A” timeline).
Payment details (Annex “B” receipts; Annex “C” chat logs; Annex “D” screenshots of pages/profiles).
Offenses committed (e.g., Estafa under Art. 315 RPC; violation of RA 10175; RA 8484, etc.).
Prayer: investigation, filing of appropriate charges, and assistance in recovery.
Verification/Jurat (notarization as required).

C) SEC Complaint (Investment Scam)

Re: Unregistered Investment Solicitation by [Entity/Page/Persons]
Facts (promises of returns, recruitment, screenshots).
Payments (dates, amounts, channels, recipients).
Reliefs sought: investigation, public advisory, cease-and-desist where applicable, and referral for prosecution.

11) Practical Tips That Make a Difference

Name the mule. If you have the recipient account holder (from receipts), you can pursue Small Claims/civil action directly against that person while criminal/regulatory cases run their course.
Don’t label it “mistaken transfer” if it wasn’t—use fraud-induced to trigger the right bank workflow.
Don’t delete chats; export them. Avoid “editing” images—courts prefer original metadata.
Coordinate victims. A consolidated list helps SEC/NBI/PNP prioritize.
Be precise with amounts/dates. Consistency across your bank dispute, NBI/PNP affidavit, and SEC complaint strengthens your case.

12) Key Laws to Know (Quick Guide)

Revised Penal Code (Estafa, Art. 315): Deceit/damage through false pretenses or fraudulent acts.
RA 10175 (Cybercrime Prevention Act): Computer-related fraud, illegal access, data interference; special venue and procedural rules.
RA 8484 (Access Devices Regulation): Fraudulent use/possession of access devices (cards, account credentials).
Securities Regulation Code & related rules: Unregistered securities/illegal solicitation, securities fraud (for investment schemes).
AMLA (RA 9160, as amended): Covered institutions’ STR/CTR reporting to AMLC; AMLC may seek freeze orders via courts.
Consumer Financial Protection framework: Banks/e-money issuers must have dispute resolution and fraud handling processes.
Katarungang Pambarangay Law: Barangay conciliation rules for civil disputes (numerous exceptions for crimes/different localities/SEC violations).

13) When Recovery Is Unlikely—and What Still Helps

If funds were instantly cashed out or moved through multiple mules, direct recovery may be difficult.
Still file NBI/PNP and SEC complaints: these feed bigger cases, platform takedowns, and potential future restitution if assets are later seized.

14) One-Page Action Plan (TL;DR)

Immediately: File bank/e-wallet dispute (get ticket no.); request fund recall/hold; change passwords; secure SIM.
Assemble evidence: screenshots, receipts, chat/email exports, timeline.
File with NBI or PNP-ACG: submit Affidavit-Complaint + annexes.
If investment-type: file SEC complaint in parallel.
Consider Small Claims/civil vs. identified mule/recipient.
Keep escalating with banks (Fraud/Compliance) and maintain a clean paper trail.

Final Note

Procedures and thresholds can change. Use this as a working playbook, and when you prepare to file, review the latest forms and requirements of the NBI, PNP-ACG, SEC, your bank/e-wallet, and local courts. If you’d like, I can tailor the templates to your specific facts and generate a filled-out affidavit and dispute letters based on your details.