If you have just sent money to a scammer, act immediately. The best chance of recovering the funds usually comes from reporting the transaction to the bank or e-wallet before the money is withdrawn, converted to cryptocurrency, or transferred through several “mule” accounts. At the same time, secure your accounts, preserve the evidence, and file reports with the proper Philippine authorities. Recovery is never guaranteed, but a fast, organized response can substantially improve the chances of tracing, holding, and eventually returning the money.

What to Do Immediately After Being Scammed

1. Contact the sending bank or e-wallet at once

Use the institution’s official fraud hotline, in-app help center, branch, or customer-service channel. Do not rely on a phone number or link sent by the scammer.

Tell the institution that:

You are reporting a fraudulent or socially engineered transaction.
You want the transaction formally recorded as disputed.
You are requesting immediate tracing and preservation of the funds.
You want an initial holding request sent to the receiving institution and any succeeding institutions in the transaction chain.
You need a complaint or case-reference number.

Provide:

Transaction reference number
Date and exact time
Amount
Sending account
Receiving account, mobile number, QR code, or wallet
Recipient name displayed during the transfer
Brief explanation of how the deception occurred

Under the Anti-Financial Account Scamming Act, or Republic Act No. 12010 of 2024, banks and other covered financial institutions may temporarily hold funds involved in disputed transactions while coordinated verification is conducted. The implementing rules generally contemplate an initial hold of up to five calendar days, subject to the applicable procedures and a maximum temporary-hold period of 30 calendar days unless a court authorizes a further extension. (Lawphil)

A hold does not mean that the money has already been recovered. It prevents or delays further movement while the institutions determine where the funds went and whether they remain available.

2. Secure your accounts and devices

A scammer who obtained an OTP, password, card number, identity document, or remote access may still be able to cause further losses.

Immediately:

Change your online banking, e-wallet, email, and social-media passwords.
Log out all unknown devices and sessions.
Ask the bank to block compromised cards or online-banking access.
Remove any remote-access application the scammer told you to install.
Change your mobile banking PIN and transaction limits.
Contact your telecommunications provider if your SIM stopped working unexpectedly.
Check for unauthorized loans, credit-card transactions, or newly enrolled beneficiaries.

If malware or remote-access software may be involved, preserve basic evidence before resetting the device. Take photographs or screenshots of installed applications, permissions, call logs, and suspicious messages. An investigator may later ask to examine the device.

3. Notify the receiving institution

The sending institution should communicate with the receiving institution, but a separate report may help create an earlier fraud alert.

Give the receiving bank or e-wallet:

The recipient account or mobile number
Transaction reference
Amount and time
Your sending institution
Your police, NBI, or complaint-reference number, if already available

Ask for written acknowledgment. The institution may not disclose the account holder’s personal information directly to you because of privacy and bank-confidentiality rules. Investigators, courts, and authorized regulators have legal processes for obtaining that information.

4. Preserve evidence before accounts disappear

Scammers often delete profiles, change usernames, remove listings, and block victims. Save the evidence in its original form as early as possible.

Preserve:

Full chat conversations, not only selected screenshots
Profile links, usernames, account IDs, and page URLs
Advertisements, marketplace listings, and product photographs
Bank or e-wallet receipts
Statements showing the debit
Emails, text messages, call logs, and voice notes
QR codes and payment instructions
Delivery receipts and tracking records
Contracts, invoices, investment presentations, or loan documents
Copies of identification documents sent by the scammer
Names and statements of witnesses
A written timeline of events

Keep the original files and devices. Avoid editing screenshots, adding annotations to the only copy, or repeatedly forwarding files through applications that reduce their quality or remove metadata.

Electronic messages and chat logs can be admitted in Philippine proceedings when properly identified and authenticated. The Supreme Court has recognized that chat logs and videos may be used to determine whether a crime occurred, but the party offering electronic evidence must still establish its authenticity and connect the account or number to the alleged offender. (Supreme Court of the Philippines)

5. Stop communicating when further contact creates risk

Do not send an additional “release fee,” “tax,” “verification payment,” or “refundable deposit.” A scammer may promise to return the original amount after one final payment.

Avoid threatening the scammer or announcing that investigators are tracing the account. This can encourage the offender to transfer the funds, destroy evidence, or disappear.

Where to Report a Scammer in the Philippines

Reporting to one office does not automatically notify every other institution. In serious cases, several reports should be filed in parallel.

Where to report	When it is most useful	What it can do
Your bank or e-wallet	Any bank transfer, card payment, QR payment, or e-wallet transaction	Trace the transaction, send holding requests, secure the account, and review possible reimbursement
NBI Cybercrime Division or Regional Cybercrime Center	Online selling scams, phishing, investment scams, account takeovers, identity fraud, and organized cybercrime	Receive a sworn complaint, evaluate digital evidence, identify suspects, and conduct an investigation
PNP Anti-Cybercrime Group or local cybercrime unit	Urgent criminal reporting, especially when a police unit is more accessible	Record the complaint, investigate, coordinate preservation requests, and refer the case for prosecution
CICC Hotline 1326	Cybercrime reporting and assistance in identifying the proper channel	Route or coordinate cybercrime concerns with relevant government agencies
Bangko Sentral ng Pilipinas	A BSP-supervised bank or e-wallet has not properly handled or resolved your complaint	Facilitate second-level consumer assistance and require the institution to respond
Department of Trade and Industry	Dispute involving an identifiable online seller or merchant	Handle consumer complaints and facilitate administrative resolution
Securities and Exchange Commission	Investment solicitation, Ponzi scheme, unauthorized securities, or suspicious investment company	Investigate regulatory violations and receive complaints about entities or investment schemes
Online platform or marketplace	Fraudulent seller, impersonation account, fake advertisement, or compromised profile	Preserve platform records, restrict accounts, and process buyer-protection claims where available

The NBI Cybercrime Division’s published procedure covers victims who need investigative assistance for computer-related crimes. It includes a complaint sheet, preliminary interview, sworn complaint or statement, submission of supporting documents, and possible examination of the affected device. The Citizen’s Charter lists no fee for the intake service. (National Bureau of Investigation)

The Cybercrime Investigation and Coordinating Center, an attached agency of the Department of Information and Communications Technology, may also be reached through Hotline 1326 for cybercrime reporting and coordination. (DICT)

How to Escalate a Complaint Against a Bank or E-Wallet

Banks and e-money issuers supervised by the BSP must maintain a consumer-assistance process. Your first report should therefore be made directly to the institution through its Financial Consumer Protection Assistance Mechanism, often called its complaints or customer-assistance channel.

Keep proof of:

The date you first complained
Your ticket or reference number
Emails and chat transcripts with the institution
The institution’s final response
Any failure to respond within its stated timeframe

When the institution does not resolve the complaint or its response is unsatisfactory, the matter may be escalated through the BSP Consumer Assistance Mechanism. The BSP’s current procedure directs consumers to use the BSP Online Buddy, or BOB, or submit the prescribed Consumer Inquiry and Request form with proof that the complaint was first raised with the financial institution. (Bangko Sentral ng Pilipinas)

The BSP process is not the same as filing a criminal case. It is primarily a financial-consumer redress channel that facilitates communication, evaluates regulatory compliance, and may support further supervisory action.

Philippine Laws Commonly Applied to Scams

Estafa under Article 315 of the Revised Penal Code

Many scams are prosecuted as estafa, which is fraud that causes another person to surrender money or property and suffer damage.

For estafa through false pretenses, prosecutors generally look for proof that:

The accused made a false statement or used a fraudulent representation.
The deception occurred before or at the time the victim transferred the money.
The victim relied on that representation.
The victim suffered financial damage.

Examples include:

Selling an item that the seller never possessed or intended to deliver
Pretending to be a bank employee, government officer, relative, or legitimate business
Offering a fictitious investment
Using a fake emergency to obtain money
Misrepresenting ownership of land, vehicles, or other property

A failed transaction is not automatically estafa. If the seller genuinely intended to perform but later failed because of financial difficulty, delay, or a contractual disagreement, the matter may be civil rather than criminal. The Supreme Court has repeatedly emphasized that the deceit must generally precede or accompany the victim’s payment; a broken promise arising only afterward does not by itself establish estafa. (Lawphil)

Cybercrime Prevention Act of 2012

When estafa or another crime is committed through an information and communications technology system, Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may apply.

Section 6 generally allows crimes under the Revised Penal Code or special laws to be prosecuted under the Cybercrime Prevention Act when committed through ICT, with the penalty imposed one degree higher. The law also provides investigative tools for preserving, disclosing, searching, and examining computer data under lawful authority. (Lawphil)

Anti-Financial Account Scamming Act

RA 12010 specifically addresses modern financial-account scams. It penalizes forms of money muling, including knowingly allowing an account to receive, transfer, or withdraw proceeds of crime, as well as buying, selling, renting, lending, or recruiting financial accounts for unlawful use.

It also penalizes social engineering schemes—deceptive methods used to obtain passwords, OTPs, identifying information, or unauthorized control over another person’s account. Prosecution under RA 12010 does not prevent prosecution under estafa, RA 10175, or other applicable laws. (Lawphil)

Financial consumer protection laws

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, requires financial service providers to observe standards involving fair treatment, transparency, protection of client assets and data, and effective complaint handling. (Lawphil)

Under RA 12010, a financial institution may be required to make restitution when its failure to employ adequate risk-management systems, fraud controls, or the legally required degree of diligence contributed to the loss. However, reimbursement is not automatic simply because money passed through a bank or e-wallet. Liability depends on the evidence, the type of transaction, the institution’s controls, and whether the victim authorized the transfer after being deceived. (Lawphil)

How to File a Criminal Complaint

1. Prepare a clear chronology

Write the events in date-and-time order. Explain:

How the scammer contacted you
What identity or business the scammer claimed to have
What promises or representations were made
Why you believed them
When and how you sent money
What happened after payment
How much you lost
What attempts you made to recover it

Avoid conclusions you cannot support. State what you personally saw, heard, received, and did.

2. Prepare a complaint-affidavit

A complaint-affidavit is a sworn written statement describing the offense and identifying the available evidence.

It commonly contains:

Your full name, citizenship, address, and contact information
The respondent’s known name, aliases, accounts, telephone numbers, and addresses
A detailed statement of facts
The legal or factual basis for believing fraud occurred
The exact amount of loss
A list of attachments
A statement that the allegations are true based on personal knowledge and authentic records

The affidavit must be sworn before an authorized officer, prosecutor, investigator, or notary, depending on where it is filed. The NBI’s own procedure contemplates assistance in preparing and executing the sworn complaint.

3. Organize the attachments

Use labels such as:

Annex A: Screenshot of advertisement
Annex B: Full conversation
Annex C: Transfer receipt
Annex D: Bank statement
Annex E: Recipient account details
Annex F: Complaint acknowledgment from the bank

Keep a duplicate set and a digital backup. Investigators may retain copies or temporarily examine a device.

4. Submit the complaint to the NBI or PNP

The investigator may:

Interview you
Examine the evidence
Request additional documents
Coordinate preservation of platform or financial records
Trace receiving and succeeding accounts
Identify account holders and possible money mules
Refer the evidence to a prosecutor

The account holder shown on a transfer receipt may not be the main scammer. Organized groups often use accounts belonging to recruits, borrowers, identity-theft victims, or persons paid to receive and forward funds.

5. Participate in preliminary investigation

When a suspect is identified, a complaint may be filed with the Office of the City or Provincial Prosecutor. In a preliminary investigation, the prosecutor determines whether probable cause exists to file a criminal case in court.

The respondent is normally allowed to submit a counter-affidavit. The prosecutor may request clarificatory evidence before issuing a resolution.

If charges are filed, the court will determine guilt beyond reasonable doubt. Investigation, prosecutor review, service of notices, account tracing, and digital-forensic work can take months, especially when several institutions, foreign platforms, or unidentified suspects are involved.

Documents and Evidence Checklist

Document or evidence	Why it matters
Government-issued ID	Confirms the complainant’s identity
Transaction receipt and reference number	Allows financial institutions to trace the transfer
Bank or e-wallet statement	Proves the debit and financial loss
Complete chat export	Shows the representations, instructions, and intent
Screenshots with dates and account names	Preserves visible content that may later disappear
Profile links and user IDs	Helps platforms and investigators identify the account
Phone numbers and email addresses	Provides tracing leads
Advertisement or listing	Shows what was offered or promised
Contracts, invoices, or investment materials	Establishes the transaction’s terms
Call logs and voice messages	Supports the timeline and identity evidence
Bank complaint acknowledgment	Proves prompt reporting
Written chronology	Helps investigators understand the case efficiently
Computation of total loss	Supports restitution or damages

Do not send an investigator your OTP, PIN, password, or full card credentials. Genuine investigators and regulators do not need those secrets to receive a complaint.

Ways to Recover Lost Money

Recovery through a financial-account hold

This is usually the fastest route when the money remains in the receiving account or a traceable succeeding account.

The chance of recovery decreases when the funds have already been:

Withdrawn in cash
Split among several accounts
Used to purchase cryptocurrency
Remitted abroad
Spent through merchant transactions
Transferred to accounts opened under false or stolen identities

Even when the first recipient account is empty, coordinated verification may help trace the transaction chain and identify other participating accounts. (Lawphil)

Card chargeback or platform buyer protection

For card purchases, contact the card issuer and ask whether the transaction qualifies for a chargeback. Deadlines and grounds vary depending on the card network, transaction type, and whether the cardholder authenticated the payment.

For marketplace purchases, immediately open a dispute before the platform releases payment to the seller. Preserve the product listing, order page, delivery records, and messages.

Restitution in the criminal case

Article 100 of the Revised Penal Code provides that a person criminally liable is also civilly liable. Restitution, reparation, and damages may therefore be pursued as part of the criminal case. (Lawphil)

Under Rule 111 of the Rules of Criminal Procedure, the civil action arising from the offense is generally deemed instituted with the criminal case unless the victim waives it, reserves the right to file it separately, or previously filed it. A separate contract-based claim may require different treatment because not every civil obligation arises directly from the crime. (Lawphil)

A favorable judgment does not always mean immediate payment. Actual collection may require identifying assets, garnishing accounts, levying property, or enforcing a settlement.

Civil action or small claims

A civil case may be appropriate when:

The evidence supports a contractual obligation but not criminal deceit
The defendant’s true identity and address are known
The defendant has assets or income that can satisfy a judgment
The claim is based on a loan, sale, service, lease, or similar agreement

The Supreme Court’s Rules on Expedited Procedures allow small-claims cases of up to ₱1,000,000, excluding interest and costs, for specified money claims arising from contracts such as loans, services, leases, and sales of personal property. Small claims cannot identify an anonymous scammer; valid service of summons still requires a usable name and address. (Supreme Court of the Philippines)

Settlement

A suspect, account holder, or intermediary may offer repayment. Any settlement should clearly state:

Total amount acknowledged
Payment schedule
Due dates and payment method
Consequences of default
Whether the settlement affects the criminal or civil complaint
Addresses and identification details of the parties

Do not withdraw a complaint merely because the other party promises to pay later. Payment terms should be written, signed, and properly documented before procedural decisions are made.

Specialized Reports for Common Types of Scams

Online shopping scams

Report the seller to the marketplace and, when the seller or merchant is identifiable, file through the DTI Consumer CARe portal. DTI consumer handling is useful for merchant disputes, refund failures, misleading representations, and violations of consumer-protection rules, but it does not replace a criminal complaint when there was deliberate fraud. (DTI Consumer Care System)

Investment scams

Preserve investment contracts, presentations, group-chat messages, payment records, promised returns, referral structures, and names of recruiters.

Complaints involving unauthorized investment solicitation, Ponzi schemes, or securities violations may be submitted through the SEC iMessage system, which issues a ticket for inquiries and complaints. Report the transaction separately to the bank and law-enforcement authorities. (Securities and Exchange Commission)

Cryptocurrency scams

Provide:

Wallet addresses
Transaction hashes
Exchange receipts
Blockchain-network name
Date, time, and amount of each transfer
Name of the exchange or wallet service
Any know-your-customer information available

Blockchain transfers are usually irreversible at the protocol level, but a regulated exchange may be able to preserve an account or respond to lawful requests if the assets reach its platform.

Romance, job, loan, and impersonation scams

Preserve proof of the false identity and the specific reason given for each payment. These cases often involve repeated transfers for emergencies, customs fees, employment processing, loan release, medical expenses, or alleged government charges.

No legitimate lender should require an unexplained advance payment to release a loan through an unrelated personal account. Government payments should be verified through the agency’s official website or payment channel.

Reporting From Abroad or as a Foreigner

A victim does not have to be a Filipino citizen to report a Philippine-connected scam. RA 12010 may apply where a relevant act, victim, financial account, device, infrastructure, or transaction nexus is located in the Philippines. (Lawphil)

A person abroad should:

Report immediately to the sending bank or remittance provider.
Ask the institution to contact the Philippine receiving institution.
File an online or written report with the appropriate Philippine agency.
Preserve original digital records and international transfer documents.
Identify a Philippine address or authorized representative when required.
Confirm whether the receiving investigator or prosecutor requires an original sworn affidavit.

An affidavit executed abroad may be notarized before a Philippine Embassy or Consulate. In a country that is a party to the Apostille Convention, a locally notarized document may instead be apostilled by that country’s competent authority for recognition in the Philippines. Requirements vary by country and by the office receiving the document, so the format should be confirmed before sending originals. Documents in another language may need a certified English translation. (Apostille Philippines)

Common Mistakes That Reduce the Chance of Recovery

Waiting for the scammer to return the money. The first hours may be crucial for holding funds.
Reporting only to Facebook, Telegram, or the marketplace. Platform reports do not replace bank and criminal reports.
Deleting embarrassing conversations. Messages that seem personal or irrelevant may establish deceit and identity.
Keeping only cropped screenshots. Full conversations, URLs, timestamps, and original files are more useful.
Assuming the receiving account owner is the mastermind. The account may belong to a money mule or identity-theft victim.
Giving inconsistent versions to different offices. Use one accurate chronology and explain any later correction.
Paying a “recovery agent.” Secondary scammers often target people who have already lost money.
Posting accusations without sufficient proof. Public accusations can create separate privacy, harassment, or defamation issues.
Treating every unpaid debt as estafa. Criminal fraud requires evidence of deceit, not merely nonpayment.
Sharing OTPs or passwords with someone claiming to investigate. Legitimate institutions do not need them.

Expected Timelines and Costs

Process	Practical expectation
Bank or e-wallet fraud report	File immediately; acknowledgment or reference number should be requested during the first contact
Initial AFASA holding action	Generally up to five calendar days under the implementing procedure
Total temporary hold	May extend up to 30 calendar days under the applicable rules, with further extension requiring court authority
NBI cybercrime intake	The published Citizen’s Charter lists approximately one hour and ten minutes for intake steps, not for completion of the investigation
Criminal investigation	Commonly takes weeks or months, depending on tracing, evidence, and suspect identification
Prosecutor preliminary investigation	Often takes several months, particularly where notices, counter-affidavits, or additional evidence are required
Court proceedings	May take considerably longer, especially if several accused persons, witnesses, or financial institutions are involved
NBI cybercrime intake fee	None listed in the Citizen’s Charter
DTI or SEC online complaint	Filing channels are available online; resolution time depends on the nature and complexity of the complaint
Small claims	Designed as an expedited process, but progress still depends on proper filing and service upon the defendant

Frequently Asked Questions

Can GCash, Maya, or a bank reverse money sent to a scammer?

Possibly, but not automatically. Recovery is most likely when the money remains in a traceable account and the report is made quickly. Authorized transfers made after deception can be more difficult to reverse than transactions made through an account takeover, although AFASA procedures may still permit holding and coordinated verification.

How long do I have to report an online scam?

Report it immediately. Criminal prescriptive periods vary depending on the offense and penalty, but waiting even one day may allow the money to be withdrawn or moved. The operational deadline for saving funds is usually much shorter than the legal deadline for filing a case.

Can the police trace a scammer using a bank account or phone number?

They may be able to identify the registered account holder or subscriber through lawful requests. That person may not be the actual organizer, so investigators usually examine transaction chains, device data, communications, withdrawals, IP records, and links among multiple accounts.

Do I need a lawyer to report a scam?

A lawyer is not required simply to make an initial bank, NBI, PNP, CICC, DTI, or SEC report. Legal assistance becomes more useful when preparing a complex complaint-affidavit, responding to a prosecutor’s requirements, pursuing a substantial civil claim, negotiating a settlement, or dealing with several suspects and jurisdictions.

Is a small amount worth reporting?

Yes. Multiple small complaints can reveal a larger organized operation. A report may also help freeze an account, protect other victims, and establish a pattern of transactions.

Can I file against the owner of the receiving account?

A complaint may include the account holder when evidence shows knowing participation, benefit, or money-mule activity. Ownership of the account alone does not automatically prove that the person planned the scam. Investigators must determine whether the owner knowingly allowed, transferred, withdrew, or benefited from criminal proceeds.

Should I go to the barangay first?

Barangay conciliation may apply to certain disputes between individuals residing in the same city or municipality. It is often impractical or legally inapplicable when the scammer is unknown, lives elsewhere, is a corporation, or the matter falls within an exception. A barangay complaint should not delay an urgent bank hold or cybercrime report.

What if the scammer used a fake name?

Report every identifier available: account number, phone number, email, username, wallet address, transaction reference, QR code, voice recording, device information, and profile URL. Investigators often begin with technical and financial records rather than the displayed name.

Can I recover money sent through cryptocurrency?

Recovery is difficult because blockchain transfers generally cannot be reversed. It may still be possible to trace the wallet movement and identify a regulated exchange where the assets were deposited. Prompt reporting, transaction hashes, and lawful preservation requests are essential.

What if the bank says the transfer was authorized?

Ask for the decision in writing and request the factual and contractual basis. Explain whether the scam involved account takeover, phishing, remote access, impersonation, an unauthorized device, or social engineering. Complete the institution’s complaint process, then escalate an unresolved complaint to the BSP while continuing the criminal report.

Key Takeaways

Report the transaction to the sending bank or e-wallet immediately and request tracing, preservation, and an initial holding request.
Secure compromised accounts, cards, email addresses, devices, and mobile numbers.
Preserve full conversations, original files, transaction references, profiles, advertisements, and a clear timeline.
File with the NBI Cybercrime Division, PNP cybercrime authorities, or CICC Hotline 1326; report specialized issues to the BSP, DTI, or SEC as appropriate.
Estafa requires proof of deceit that caused the victim to surrender money; a simple broken promise or unpaid debt is not automatically a crime.
RA 12010 penalizes social engineering and money-mule activity and creates procedures for temporarily holding disputed funds.
Bank reimbursement is not automatic, but liability or restitution may arise when institutional failures contributed to the loss.
Criminal restitution, civil proceedings, small claims, chargebacks, platform refunds, and properly documented settlements are separate possible recovery routes.
Speed matters: the chance of recovering money usually declines once funds are withdrawn, divided among accounts, converted to cryptocurrency, or transferred abroad.