Quick answer

If a supposed work-from-home job asks you to pay, “recharge,” deposit, buy a task package, or send more money before you can withdraw your earnings, stop paying. It is likely a task scam.

Act immediately:

Contact the bank, e-wallet, card issuer, or other payment provider used to send the money. Report a fraudulent or disputed transaction, ask it to secure your account, trace the transfer, coordinate with the receiving institution, and determine whether remaining funds can be temporarily held.
Report the scam to the Cybercrime Investigation and Coordinating Center through the official CICC reporting portal or Hotline 1326.
File a formal complaint with the PNP Anti-Cybercrime Group or its nearest regional cybercrime unit, or with the NBI Cybercrime Division or a Regional Cybercrime Center.
Preserve all messages, payment records, account details, advertisements, URLs, and other electronic evidence before blocking the scammers or deleting anything.
Report the account, advertisement, group, and messages through the platform where the approach occurred.

Reporting quickly improves the chance that institutions can trace or hold funds, but it does not guarantee recovery.

What a work-from-home task scam looks like

A task scam is presented as easy remote work. The supposed recruiter may ask you to like posts, follow accounts, rate products, watch videos, place simulated orders, or “optimize” listings. Common warning signs include:

unsolicited recruitment through text, WhatsApp, Telegram, Messenger, Viber, or social media;
unusually high earnings for simple tasks;
a small initial payment intended to gain your trust;
instructions to deposit your own money before receiving a commission;
“VIP,” “merchant,” “prepaid,” “combination,” or “welfare” tasks requiring larger payments;
a dashboard showing earnings that cannot actually be withdrawn;
demands for a tax, verification fee, penalty, account repair fee, or additional task before withdrawal;
pressure to borrow money or complete a set immediately;
payment to personal bank or e-wallet accounts unrelated to the claimed employer;
instructions to receive and forward money for other participants; or
refusal to provide a verifiable employment contract, business address, and company contact channel.

The PNP Anti-Cybercrime Group has described the typical pattern: scammers first pay commissions for simple tasks, then require increasing “investments” and demand still more money when the victim tries to withdraw. See the government’s task-scam advisory.

A small payout does not prove that the job is legitimate. It may be bait funded by later victims.

First priority: try to stop or trace the money

Contact the payment provider immediately

Use only the provider’s official app, website, hotline, or branch. Do not call a number supplied by the recruiter.

Tell the provider:

you were induced by fraud to make a transfer;
the date, time, amount, and transaction reference number;
the recipient’s name, account number, mobile number, bank, or e-wallet;
whether you disclosed a password, PIN, one-time password, card number, CVV, recovery code, or identification document;
whether the payment was authorized by you but obtained through deception, or was made without your authorization; and
whether more transactions are pending.

Ask for a complaint or case reference number. Request written confirmation if available. If several providers were involved, notify each one.

Do not describe a transfer you personally approved as “unauthorized.” Say accurately that you authorized it because of fraudulent representations. The distinction may affect the investigation, contractual rights, and provider response.

Ask about a temporary hold under AFASA

The Anti-Financial Account Scamming Act, Republic Act No. 12010, and BSP Circular No. 1215 provide a framework for temporarily holding funds involved in a disputed transaction and coordinating verification among covered financial institutions.

A transaction may be treated as disputed when there are reasonable grounds to believe it is unusual, lacks a clear economic purpose, comes from an unknown or illegal source or unlawful activity, or was facilitated through a social-engineering scheme. Account owners are expected to report disputed transactions immediately and cooperate with verification.

A hold is not automatic. It depends on the facts, the location of the funds, the applicable BSP rules, and the institutions’ verification. Under AFASA, a hold may not exceed 30 calendar days unless extended by a competent court; the implementing rules prescribe the applicable process and holding periods. A hold is also not a final ruling that the money belongs to either party.

Even if the money has already left the receiving account, report it. AFASA requires coordinated verification regardless of whether the funds remain in the financial system.

Escalate an unresolved provider complaint to the BSP

The financial institution’s consumer-assistance mechanism is generally the first level of recourse. If its response is unresolved or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism:

use the BSP Online Buddy (BOB) on the BSP website or official Facebook page; or
submit the BSP Complaint/Inquiry/Reply form and proof that you first complained to the institution to consumeraffairs@bsp.gov.ph.

The BSP channel addresses the conduct and complaint handling of BSP-supervised institutions. It does not replace a criminal complaint to the PNP or NBI and does not guarantee reimbursement.

Report the scam to the authorities

CICC: rapid reporting and coordination

Report through:

CICC online reporting portal; or
National Anti-Scam Hotline 1326.

Give the CICC a concise chronology, scammer identifiers, payment details, and the platforms used. Keep the report reference or acknowledgment.

A CICC report is useful for rapid reporting and inter-agency coordination. If you lost money, were threatened, had an account taken over, or want a criminal investigation, also make a formal complaint with the PNP Anti-Cybercrime Group or NBI.

PNP Anti-Cybercrime Group

Go to the nearest PNP anti-cybercrime office or regional cybercrime unit. If one is not readily accessible, ask the nearest police station to direct or refer you to the proper cybercrime unit.

State that you are reporting an online task or job scam and want the incident formally recorded and evaluated for investigation. Bring both printed and electronic copies of your evidence. Ask for:

the complaint, blotter, or reference number;
the investigator’s name and official contact details;
instructions for executing an affidavit; and
any request for additional records or preservation of platform data.

NBI Cybercrime Division

You may instead—or, when advised, additionally—seek investigative assistance from the NBI Cybercrime Division or a Regional Cybercrime Center. The NBI’s published process includes a preliminary interview, a sworn complaint sheet or affidavit, collection of supporting documents, witness statements where applicable, and possible examination of a relevant device. The service is listed without a filing fee in the NBI citizen’s charter for computer-crime victims.

The NBI also maintains an online complaint page. Confirm any follow-up through official NBI channels and comply with instructions if a personal appearance or sworn statement is required.

Prosecutor’s office

A criminal case ordinarily requires more than reporting an account to a platform. Depending on the investigation, a complaint-affidavit and supporting affidavits and records may be filed for preliminary investigation with the proper prosecution office.

The exact offense, venue, respondents, number of copies, and supporting documents depend on the facts. An investigator or lawyer can help identify the correct filing office, particularly when the perpetrators are unknown, funds crossed several accounts, or transactions occurred in different places.

Evidence to preserve

Preserve evidence before the scammers delete accounts, revoke group access, or change usernames.

Communications and online identities

Save:

the original job advertisement and where it appeared;
the full chat history—not only selected screenshots;
usernames, profile links, account IDs, display names, phone numbers, and email addresses;
group names, invitation links, administrator profiles, and member lists visible to you;
website URLs, domain names, app names, and login pages;
voice messages, recordings lawfully in your possession, call logs, and emails with full headers where available;
fake contracts, company IDs, permits, certificates, invoices, and instructions; and
messages promising income or explaining why withdrawal was blocked.

Screenshots should show the date, time, sender, and surrounding conversation. Also export or back up the original chat when the platform permits. Do not crop away identifying details.

Payment evidence

Keep:

transfer receipts and transaction reference numbers;
identifying details.

Payment evidence

Keep:

transfer receipts and transaction reference numbers; bank or e-wallet statements;
recipient names, account numbers, QR codes, mobile numbers, and provider names;
card charge details;
cryptocurrency wallet addresses and transaction hashes, if applicable;
cash-deposit slips and remittance records;
the scam platform’s deposit and withdrawal history; and
all complaint acknowledgments and correspondence with financial institutions.

A clear chronology

Prepare a table or written timeline showing:

when and where you saw the offer;
each person or account that contacted you;
the representation made before each payment;
every payment’s date, amount, provider, and recipient;
any amount the scammers initially paid you;
each attempt to withdraw;
subsequent demands, threats, or excuses; and
the dates you contacted the bank, CICC, PNP, NBI, or platform.

Use exact facts. Label assumptions as assumptions. Do not alter files, fabricate missing messages, or exaggerate the loss.

Protect original devices and files

Keep the phone or computer used for the communications if reasonably possible. Do not factory-reset it, wipe conversations, or install “recovery” software that may overwrite data. Make a backup, but retain the originals and their metadata.

Under the Cybercrime Prevention Act, Republic Act No. 10175, service providers must preserve certain traffic data and subscriber information for a minimum of six months from the relevant transaction. Content data is preserved for six months after a lawful preservation order, subject to the statute’s rules. This is not a reason to wait: investigators may need to issue lawful preservation or disclosure processes before records disappear.

Secure your identity and accounts

If you supplied credentials, installed an app, shared your screen, or gave remote access:

Disconnect the affected device from the internet if remote control may still be active.
From a clean device, change the password of your primary email first, then financial, social-media, and messaging accounts.
Use unique passwords and enable multi-factor authentication.
Sign out unknown devices and revoke unfamiliar sessions and connected apps.
Call the financial provider to block compromised cards, reset credentials, and review recent transactions.
Contact your mobile provider if your SIM stopped working unexpectedly or you suspect a SIM takeover.
Remove remote-access or unknown applications, but preserve their names, installation files, and screenshots before removal.
Monitor accounts and credit-related messages for attempted identity misuse.

Never give an OTP, PIN, password, CVV, seed phrase, or screen-sharing access to someone claiming they can recover the money. Legitimate investigators and banks do not need your password to receive a complaint.

If you submitted an ID, tell investigators and the relevant institution. Keep watch for accounts opened or transactions attempted in your name.

Report the advertisement and accounts to the platform

After preserving evidence, report the advertisement, recruiter profile, chat account, group, website, and payment solicitation through the platform’s fraud or scam-reporting function.

Include the police, NBI, CICC, or financial-provider reference number if the platform permits it. Ask the platform to preserve records for law-enforcement requests.

A platform report may remove an account, but it is not a substitute for reporting the financial transaction or filing a formal complaint. Do not publicly post unredacted IDs, account statements, phone numbers, affidavits, or other sensitive evidence.

Which laws may apply?

The proper charge depends on what the evidence proves. A task scam is not automatically prosecuted under only one statute.

Possible laws include:

Estafa under Article 315 of the Revised Penal Code, when deceit induced a victim to part with money and the statutory elements are established.
Republic Act No. 10175, when a crime under the Revised Penal Code or another special law was committed through information and communications technology. The Act also separately covers computer-related fraud and computer-related identity theft when their specific elements are present.
Republic Act No. 12010 or AFASA, where the conduct involves prohibited money-muling activities, qualifying social-engineering schemes, or related financial-account offenses.
Other laws where the facts involve unauthorized access, access devices, money laundering, identity misuse, falsified documents, unlawful investment solicitation, or trafficking.

Not every deceptive job offer falls within AFASA’s statutory definition of a social-engineering scheme. That provision specifically concerns obtaining sensitive identifying information through deception or fraud that results in unauthorized access and control of a financial account. A task scam involving voluntary transfers may still support other charges even if that particular AFASA element is absent.

AFASA also makes certain money-muling conduct an offense when a person knowingly uses, lends, sells, rents, or allows the use of a financial account to handle proceeds derived from crimes or social-engineering schemes. Do not let the scammers use your account to receive or forward other people’s money. If you already did so without understanding the scheme, stop, preserve the records, notify your institution, and obtain legal advice. Knowledge, intent, and the surrounding circumstances matter.

Only investigators, prosecutors, and ultimately the courts can determine criminal liability. A recruiter’s anonymity, foreign phone number, or use of cryptocurrency does not by itself establish a particular offense.

Common mistakes that can make matters worse

Paying a final “unlock,” “tax,” “withdrawal,” or “recovery” fee.
Borrowing money to complete the next task.
Continuing to communicate merely to recover losses without guidance from investigators.
Threatening the scammers before preserving evidence.
Deleting chats, leaving groups, or blocking accounts before recording identifiers.
Reporting only to the social-media platform and not to the payment provider or authorities.
Waiting for the scammer to honor another promised deadline.
Giving a recovery agent more credentials or money.
Allowing your account to receive or forward funds for others.
Filing a knowingly false or exaggerated disputed-transaction report. AFASA separately penalizes malicious or bad-faith reporting that results in a temporary hold.
Assuming that a police report automatically reverses a transfer.
Paying a person who promises a guaranteed arrest or guaranteed recovery.

When legal help is urgent

Seek a Philippine lawyer or the Public Attorney’s Office, if eligible, promptly when:

the loss is substantial or involves borrowed, business, or family funds;
several victims or multiple recipient accounts are involved;
your identity or financial account was used to receive or forward money;
police, a bank, or another victim identifies you as an account holder or possible participant;
you received a subpoena, summons, preservation notice, demand letter, or notice of account restriction;
the scammers are threatening violence, blackmail, exposure of private material, or harm to your family;
the scam involved an alleged investment, cryptocurrency pool, or solicitation from many people;
you need to prepare a complaint-affidavit or pursue restitution; or
the institution rejects your dispute and significant legal or contractual questions remain.

For an immediate threat to life or physical safety, contact emergency services or the nearest police station at once.

Frequently asked questions

I willingly sent the money. Can I still report it?

Yes. A transfer may have been authorized but induced by deception. Report that fact accurately to the provider and law enforcement. Whether funds can be held or recovered, and what offense may be charged, depends on the evidence.

Should I pay one more time to unlock my withdrawal?

No. Additional payment demands are a central feature of task scams. A balance shown on the scammer’s website or app may be fictitious.

Can the bank or e-wallet reverse the transaction?

Possibly, but not automatically. The result depends on how quickly you report, whether funds remain traceable, the recipient institutions involved, the applicable rules, and the verification findings. Ask for tracing and coordinated verification without assuming that reimbursement is guaranteed.

Is a CICC report enough?

It is an important reporting and coordination step. For a loss, account takeover, threat, or request for criminal investigation, also make a formal complaint with the PNP Anti-Cybercrime Group or NBI and report the transaction to the financial provider.

Must I know the scammer’s real name?

No. Report the identifiers you have: usernames, profile URLs, phone numbers, email addresses, recipient accounts, transaction references, wallet addresses, websites, and group links. Investigators may use lawful processes to seek subscriber and transaction records.

Should I confront or entrap the scammer myself?

No. Do not arrange a meeting, send more money, access another person’s account, or impersonate law enforcement. Preserve evidence and follow the assigned investigator’s instructions.

What if the recruiter used a real company’s name?

Contact the company through contact details independently obtained from its official website. Ask whether the recruiter and vacancy are genuine. Preserve the company’s response. The real company may be another victim of impersonation.

Is there a fixed deadline for reporting?

The cited reporting channels do not provide a general waiting period that victims should use. Report immediately. Funds can move quickly, accounts can be emptied, and electronic records may be deleted or become harder to obtain. Separate legal limitation periods may depend on the offense and facts, so obtain legal advice if time has passed.

Can I recover money through a private “hacker” or recovery service?

Be extremely cautious. Recovery scammers often target people who have already lost money. Do not pay for guaranteed recovery, disclose credentials, or install remote-access software. Give any claimed recovery lead to your bank or assigned investigator.

Official references

This article provides general legal information, not legal advice or a prediction of recovery or case outcome. The correct procedure and possible liability depend on the documents, payment route, identities, and other facts. Official sources and procedures were checked as of July 27, 2026.