A Philippine Legal Article

In the Philippines, being scammed is not only a financial problem. It is often also a question of criminal law, cybercrime, fraud investigation, banking procedure, digital evidence preservation, and regulatory reporting. Victims frequently lose valuable time because they do not know where to report, which agency has jurisdiction, or what evidence must be preserved before the scammer disappears, deletes accounts, or transfers the money again.

The phrase “report a scammer” sounds simple, but in law and practice it can mean several different things:

reporting a crime to the police,
filing a complaint with the NBI,
reporting a cyber-enabled fraud to anti-cybercrime units,
informing a bank, e-wallet, remittance company, or payment platform,
reporting a securities or investment scam to the SEC,
reporting an online selling or consumer scam to the proper regulatory or law-enforcement body,
or ultimately filing a criminal complaint with the prosecutor.

The correct path depends on the nature of the scam, the evidence available, how the money moved, and whether the suspect is known or still unidentified.

This article explains the Philippine legal framework for reporting scammers, the agencies commonly involved, the difference between police reporting and formal criminal complaint, the evidence victims should gather, and the practical steps that matter most in the first hours and days after discovery.

I. The first legal reality: “scam” is not itself a single crime label

In everyday speech, many kinds of fraud are called a “scam.” But in Philippine law, the act must still be classified into an actual legal offense. Depending on the facts, the conduct may involve:

estafa under the Revised Penal Code,
swindling through deceit,
online fraud or computer-related conduct under cybercrime-related laws,
identity misuse,
investment solicitation violations,
securities fraud,
consumer deception,
forgery or falsification,
unauthorized access or account takeover,
or other special-law offenses.

This matters because authorities do not prosecute “scam” in the abstract. They investigate facts and match them to offenses.

Still, a victim does not need to perfectly classify the crime before reporting. The victim’s real task is to:

preserve evidence,
report to the proper agencies quickly, and
describe the facts clearly.

The legal characterization can then be refined by investigators and prosecutors.

II. The most important first step: preserve evidence immediately

The first thing a victim should do is preserve everything.

Scam cases are often lost not because the victim had no case, but because the victim deleted messages, failed to screenshot the account, lost the transaction reference, or allowed crucial digital evidence to disappear.

The victim should preserve:

chat messages,
text messages,
emails,
call logs,
usernames,
social media accounts,
profile URLs,
screenshots of posts and advertisements,
proof of bank transfer,
e-wallet transaction records,
remittance receipts,
account numbers,
QR codes,
delivery receipts,
invoices,
fake IDs or documents sent by the scammer,
photos,
audio recordings if lawfully available,
website links,
app names,
and all timestamps.

It is often useful to create:

a folder of screenshots,
a timeline of what happened,
and a written summary of the conversation and payments.

A scammer can vanish in minutes. Evidence must be secured before reporting delays make recovery harder.

III. The second urgent step: notify the bank, e-wallet, or payment platform

If money was sent through:

a bank transfer,
GCash,
Maya,
online banking,
remittance center,
credit card,
payment gateway,
or other financial channel,

the victim should immediately notify the relevant institution.

This is critical because the bank or platform may:

place alerts,
attempt internal review,
preserve transaction records,
flag the receiving account,
assist law enforcement later,
or in some cases act quickly while funds are still within the system.

The victim should provide:

the transaction reference number,
date and time,
amount,
sender account details,
recipient account details,
screenshots,
and a short explanation that the transaction was scam-related.

A bank report is not the same as a criminal complaint. But it is often the fastest financial-response step available, and delay can matter.

IV. The third step: decide which authority to approach first

In the Philippines, several authorities may be relevant, depending on the scam type.

The most common first-report agencies are:

the Philippine National Police (PNP),
the PNP Anti-Cybercrime Group (ACG),
the National Bureau of Investigation (NBI),
the NBI Cybercrime Division or relevant unit,
the Securities and Exchange Commission (SEC) for investment and securities-related scams,
and, in some situations, other regulatory or consumer bodies.

The correct first stop depends on what kind of scam occurred.

V. Report to the local police or PNP when the scam is a criminal fraud case

If the victim has been defrauded through deceit, false pretenses, fake sales, bogus loans, fake jobs, fake property offers, romance fraud, delivery fraud, or similar conduct, reporting to the local police can be an appropriate first step.

The police can:

receive the complaint,
prepare a blotter or incident report,
interview the victim,
identify the proper unit,
and refer the matter for investigation or cybercrime handling if needed.

For online scams, ordinary police reporting is often only the beginning. The case may later be handled by specialized cyber units or elevated to the prosecutor. Still, a police report can be valuable because it:

creates an official incident record,
helps document the timeline,
and starts the formal complaint trail.

VI. Report to the PNP Anti-Cybercrime Group for online scams

Many scams today are committed through:

Facebook,
Instagram,
TikTok,
messaging apps,
fake websites,
online selling platforms,
phishing pages,
email,
or digital wallets.

Where the scheme is internet-based, the PNP Anti-Cybercrime Group is often one of the most appropriate authorities.

The ACG is especially relevant when the scam involves:

fake online sellers,
account takeovers,
phishing,
hacking-related fraud,
identity impersonation online,
fake digital promotions,
or other internet-enabled criminal activity.

The value of cybercrime reporting is that cyber investigators are better positioned to understand:

IP-related traces,
platform records,
digital evidence preservation,
online account tracking,
and cyber-enabled fraud structures.

A victim of an online scam should generally consider cybercrime reporting early, not only ordinary police reporting.

VII. Report to the NBI for serious fraud or cyber-enabled deception

The National Bureau of Investigation is another major authority for scam complaints, especially where:

the amount is large,
the scam is organized,
the suspect used multiple identities,
cross-border or digital elements are present,
there are multiple victims,
or the victim wants a more specialized investigative route.

The NBI is often used in cases involving:

online fraud,
organized swindling,
identity-based scams,
fake recruitment,
fake investment offers,
digital extortion,
and broader fraud schemes.

Like the police, the NBI can receive complaints, evaluate evidence, conduct investigation, and support later prosecutorial action.

VIII. Report to the SEC for investment scams and unauthorized solicitation

A large number of scams in the Philippines involve:

fake investments,
Ponzi-like structures,
guaranteed return schemes,
crypto-related solicitations,
fake trading platforms,
unregistered securities offers,
or “double your money” arrangements.

When the scam involves solicitation of investment from the public, the Securities and Exchange Commission may be highly relevant.

The SEC’s role is especially important where the scheme appears to involve:

sale of securities without proper authority,
investment taking without registration or license,
fraudulent investment representation,
or unauthorized crowdfunding or pooled investment.

This does not replace criminal reporting. Rather, it adds a regulatory layer. In many investment scam cases, victims should consider:

law enforcement report, and
SEC report.

The criminal and regulatory sides often move in parallel.

IX. Report to consumer or trade-related bodies in fake selling cases, but do not stop there

Some scams look like ordinary consumer disputes at first:

seller took payment but delivered nothing,
goods delivered were fake,
online store disappeared,
or fake reservation fee was collected.

Victims sometimes think this is merely a customer service issue. Often it is more serious. If deceit was present from the start, it may already be a fraud case.

In such situations, a victim may report through the platform or marketplace, but should not stop there if:

the seller used fake identity,
many victims exist,
delivery was never intended,
or the account was clearly fraudulent.

A platform complaint may help suspend the account, but criminal reporting may still be necessary.

X. Police report, blotter, affidavit, and criminal complaint are not the same thing

This distinction is extremely important.

1. Police blotter or incident report

This is often the first documentation step. It records the incident, but it is not yet the full prosecution stage.

2. Complaint-affidavit

This is a sworn written statement of the victim setting out the facts, evidence, and accusation more formally.

3. Criminal complaint before the prosecutor

This is the formal complaint process that may lead to preliminary investigation and eventually filing of charges in court.

Many victims believe that making a police report automatically means a criminal case is already filed. That is not always true. Often, the process moves in stages:

report,
investigation,
affidavit preparation,
filing before prosecutor,
then preliminary investigation.

A victim should understand where the case currently stands.

XI. The complaint-affidavit: why it matters

In real scam cases, the complaint-affidavit often becomes the backbone of the prosecution.

A strong complaint-affidavit should clearly state:

who the complainant is,
how contact with the scammer began,
what false representations were made,
what the victim relied on,
how much money was sent,
where the money was sent,
what happened after payment,
and why the complainant believes the act was fraudulent.

It should attach supporting evidence such as:

screenshots,
receipts,
IDs used by the scammer,
account details,
and platform records.

A vague affidavit is much weaker than a carefully organized one with annexes and chronology.

XII. What if the scammer’s real name is unknown?

This is common and does not prevent reporting.

Many scammers use:

aliases,
fake business names,
dummy social media accounts,
fake IDs,
mule bank accounts,
or borrowed SIM registration identities.

A victim should still report using all available identifiers, including:

account name used,
social media handle,
URL,
phone number,
email,
bank account number,
e-wallet account,
delivery address if any,
and the device or platform trail.

Authorities may later identify the real person through:

bank subpoenas or lawful requests,
account registration information,
platform records,
witness statements,
surveillance,
or linked complaints from other victims.

The absence of a real full name is not a reason to do nothing.

XIII. The importance of transaction records

In many scam cases, the most important hard evidence is the money trail.

Victims should preserve:

deposit slips,
transfer screenshots,
bank SMS alerts,
e-wallet confirmation,
remittance acknowledgment,
account numbers,
and proof that the transfer was connected to the scam transaction.

These records matter because scams often turn on proving:

that money was actually transferred, and
where it went.

Without the money trail, the case becomes harder to prove.

XIV. If the scam happened through Facebook, Instagram, or another platform

Victims should preserve more than just chat screenshots. They should also preserve:

profile URL,
page name,
page link,
username,
profile photos,
public posts,
comments,
fake reviews,
and any advertisements used.

If possible, the victim should also:

report the account to the platform,
preserve the platform complaint number,
and save screenshots of the report confirmation.

Platform reporting is not a substitute for reporting to Philippine authorities, but it can help:

suspend the scam account,
preserve evidence trail,
and reduce harm to others.

XV. If the scam involved phishing, hacking, or account takeover

Where the case involves:

hacked email,
compromised online banking,
fake OTP collection,
fake bank sites,
account cloning,
or identity theft,

the victim should urgently do more than ordinary reporting. The victim should immediately:

change passwords,
secure email recovery settings,
notify the bank,
lock accounts if possible,
preserve phishing links and messages,
and report to cybercrime authorities.

This is because the problem is not just past loss. It may be an ongoing breach.

A victim who waits too long in a phishing case may suffer repeated losses.

XVI. If the scam involved fake job offers or illegal recruitment

Some scams pretend to offer:

overseas jobs,
local jobs,
work-from-home positions,
government jobs,
or agency placements.

These may involve fraud, and in some cases illegal recruitment issues as well, depending on how the scheme operated.

Victims should preserve:

job advertisements,
recruiter names,
agency names,
payment instructions,
receipts,
and interview messages.

These cases may involve not only police or NBI reporting, but also labor-related authorities where the facts fit illegal recruitment patterns. But the criminal fraud side remains central.

XVII. If the scam involved romance, emotional manipulation, or “love scam” structures

Romance scams often involve:

long online conversations,
fake emergencies,
fake packages,
fake customs fees,
fake hospital crises,
or requests for repeated transfer.

Victims are often embarrassed and delay reporting. That is a mistake.

From a legal perspective, these are still fraud cases if money was obtained through deceit. The emotional context does not make the case less real.

Victims should preserve:

profile screenshots,
full chat history if possible,
money transfers,
photos sent by the scammer,
phone numbers,
and any claims made about identity, occupation, or location.

Romance fraud may be harder to investigate, especially if cross-border, but it should still be reported.

XVIII. What if the scammer is abroad?

A scammer being abroad does not make reporting useless. But it does make the case more complex.

The victim should still report to Philippine authorities if:

the victim is in the Philippines,
the money moved through Philippine systems,
the harm occurred here,
or there is a Philippine nexus.

Authorities may still:

document the case,
trace local accounts,
identify local accomplices,
or connect the report to a larger transnational fraud pattern.

A cross-border element makes enforcement harder, but it does not erase the usefulness of reporting.

XIX. If the receiving account belongs to a “money mule”

Many scam funds are sent not directly to the mastermind, but to an intermediary account. That account holder may be:

an accomplice,
a mule,
or someone whose account was used.

Victims should not assume the account holder is automatically innocent or automatically the mastermind. This is why reporting should focus on facts:

the account number,
account name,
transaction reference,
and all surrounding circumstances.

Investigators can then determine the level of participation.

The fact that the receiving person says “I was only asked to receive the money” does not automatically end the inquiry.

XX. Reporting to the prosecutor: the formal charging stage

Eventually, a scam case that is being seriously pursued must reach the prosecutor’s office through a formal criminal complaint if the evidence supports it.

This is where:

the complaint-affidavit,
witness affidavits,
annexes,
and supporting records

are formally evaluated in a preliminary investigation or related prosecutorial process.

The prosecutor determines whether there is sufficient basis to proceed with charges in court.

The victim should understand that:

reporting to police is important,
but prosecutor-level filing is where formal criminal action becomes more concrete.

XXI. Civil recovery versus criminal complaint

Victims often ask whether they can recover the money through criminal complaint alone.

The answer is: sometimes partially, but the legal system distinguishes between:

criminal liability for fraud, and
civil recovery of the amount lost.

A criminal case may carry civil consequences, but in practice, actual recovery still depends on:

whether the scammer can be identified,
whether assets exist,
whether money can be traced,
and whether enforcement succeeds.

Some victims may also consider a civil action, depending on the facts. But in many scam cases, the immediate priority is criminal reporting and evidence preservation.

The harsh truth is that legal reporting may punish or expose the scammer even where full monetary recovery remains difficult.

XXII. Why speed matters

Speed matters for at least five reasons:

1. Money may still be traceable

The faster the report to the bank or platform, the better.

2. Accounts may still be active

A quick report may preserve data before disappearance.

3. CCTV or transaction footage may still exist

In some bank or remittance cases, video retention periods matter.

4. Scam posts and profiles may vanish

Screenshots should be taken immediately.

5. Other victims may still be getting targeted

A timely report may help authorities connect patterns.

Delay is one of the scammer’s greatest advantages.

XXIII. What victims should never do

Victims should avoid these common mistakes:

deleting chats after getting angry,
confronting the scammer in a way that reveals strategy,
publicly posting accusations without preserving evidence first,
relying only on social media exposure instead of formal reporting,
sending more money in hope of recovery,
accepting dubious “refund processing fees,”
or using threats of violence or illegal retaliation.

A victim trying to recover money should not become entangled in a second illegal act. The strongest position is a documented, lawful, evidence-based complaint.

XXIV. A practical evidence checklist

A scam victim in the Philippines should ideally prepare:

valid ID of the victim,
written narrative of events,
screenshots of all chats,
bank or e-wallet transaction proof,
account numbers and names used,
URLs and usernames,
photos and IDs sent by the scammer,
ad screenshots,
call logs,
proof of delivery failure or fake shipment if applicable,
platform complaint records,
and a list of witnesses if any.

The better organized the evidence, the easier it is for police, NBI, cybercrime units, or prosecutors to act.

XXV. A practical reporting sequence

A strong real-world response often follows this order:

Preserve all evidence immediately.
Notify the bank, e-wallet, or platform at once.
Prepare a clear written timeline.
Report to the police, PNP-ACG, or NBI depending on the scam type.
If investment-related, also report to the SEC.
Prepare a complaint-affidavit with complete annexes.
Coordinate toward formal prosecutor filing if warranted.

This sequence is often more effective than reacting emotionally or posting online without documentation.

XXVI. Bottom line

In the Philippines, reporting a scammer is not a one-step process. It usually involves both:

immediate protective action, and
formal legal reporting.

The most important legal principles are these:

a “scam” must eventually be matched to an actual legal offense, often involving estafa, fraud, cyber-enabled deception, or special-law violations;
the victim should preserve all evidence immediately;
if money was transferred, the victim should notify the bank, e-wallet, or payment platform at once;
online scams should often be reported to the PNP Anti-Cybercrime Group or the NBI;
investment scams should also be brought to the SEC;
a police blotter is useful, but it is not the same as a full criminal complaint;
and a carefully prepared complaint-affidavit is often essential for serious prosecution.

The clearest practical rule is this: the faster, more organized, and more evidence-based the report, the stronger the victim’s chance of meaningful action by Philippine authorities. In scam cases, silence, delay, and lost screenshots help the scammer. Prompt reporting helps the case.