Quick answer

If someone asks you to pay a “recovery fee,” “tax,” “verification deposit,” “insurance,” “gas fee,” or other charge before you can recover an investment or withdraw supposed profits, stop paying. A balance shown on a website or app is not proof that money exists.

Act immediately:

Contact the bank, e-wallet, card issuer, remittance company, or regulated virtual-asset service you used through its official 24/7 fraud channel. Report a disputed or fraudulent transaction, request tracing and any available hold or recall, and obtain a case reference number.
Report the online scam to the Cybercrime Investigation and Coordinating Center through Hotline 1326, 1326@dict.gov.ph, or the eGov PH app.
File a complaint with the NBI Cybercrime Division, an NBI regional or district office, or the PNP. A criminal complaint is separate from a bank dispute.
If the scheme solicited investments or promised returns, report it through the SEC’s iMessage system under Enforcement and Investor Protection Department — eComplaints on Investment Scams.
Preserve every message, transaction record, account number, wallet address, website and identity used. Do not delete the app or conversation until evidence has been secured.

Reporting quickly improves the chance of tracing or holding funds, but no agency, bank, lawyer, or private recovery company can guarantee repayment.

What is an investment-recovery or paywall scam?

These are practical descriptions, not specific offenses named in Philippine law.

A recovery scam usually begins after a person has already lost money. Someone claiming to be a lawyer, regulator, investigator, hacker, bank employee, blockchain expert, or “fund recovery agent” says the lost investment has been found. The victim is then asked to pay an advance fee or disclose account credentials.

A paywall scam in this context involves a fake investment or trading platform that displays profits but prevents withdrawal unless the victim makes another payment. The demanded payment may be called a tax, commission, anti-money-laundering clearance, account upgrade, liquidity deposit, conversion charge, or security bond. After each payment, another condition normally appears.

A fee is not automatically fraudulent. Legitimate investments may have disclosed redemption periods, taxes, charges, identity checks, or contractual restrictions. Warning signs become serious when:

the charge was not disclosed in the contract or prospectus;
payment must go to a personal account, unrelated e-wallet, or changing crypto address;
the person refuses independent verification;
the amount keeps increasing;
a supposed government office communicates through an unofficial account;
withdrawal depends on recruiting others or depositing more money;
the platform shows profits that cannot be independently verified; or
the person guarantees recovery or threatens immediate forfeiture unless you pay.

Verify any claimed institution by finding its official website yourself. Do not use the telephone number or link supplied by the person demanding payment.

How Philippine law may apply

The correct offense depends on the evidence. A failed investment, delayed withdrawal, or contractual disagreement is not automatically a crime.

Fraudulent representations made before or at the time the victim parts with money may constitute estafa by deceit under Article 315(2)(a) of the Revised Penal Code. The Supreme Court describes the essential issues as a false pretense or fraudulent representation, reliance by the victim, and resulting damage. When the conduct occurs through online communications or information and communications technology, the Cybercrime Prevention Act, Republic Act No. 10175, may also apply.

An investment scheme may violate the Securities Regulation Code, Republic Act No. 8799. Subject to statutory exemptions, securities offered to the public must be registered, and persons acting as brokers, dealers, salespersons or associated persons must have the required registration. Ordinary SEC company registration does not, by itself, authorize a company to solicit investments or sell securities to the public.

The Anti-Financial Account Scamming Act, Republic Act No. 12010, separately addresses money-mule activities, certain social-engineering schemes, financial-account investigations, and temporary holding of disputed funds. Its statutory definition of social engineering is narrower than the everyday meaning: it involves obtaining sensitive identifying information through deception or electronic communications, resulting in unauthorized access and control of a financial account. A victim who personally authorized a transfer after being deceived may still have a possible estafa complaint and may ask the financial institution to assess the transfer as a disputed transaction, but restitution is not automatic.

Report what happened accurately instead of trying to select the offense yourself. Investigators and prosecutors determine the appropriate charges.

Contact the financial institution first

Use only the telephone number in the institution’s official app, website, card, or account statement. Do not call a number contained in the scam message.

Tell the institution:

you are reporting a suspected scam and disputed transaction;
whether you authorized the transfer because of a false representation or whether it was entirely unauthorized;
the exact amount, date, time and transaction reference;
the source and beneficiary account details;
whether credentials, an OTP, PIN, card information or remote access were exposed; and
whether more transfers may be attempted.

Request:

immediate protection of your account;
an initial hold, trace, recall or other available action;
coordinated verification with receiving institutions;
written acknowledgment and a case reference number; and
the documents and deadline required to support an extended hold.

Change compromised passwords from a clean device, sign out other sessions, reduce transfer limits where available, and block affected cards or accounts. Never give anyone your OTP, PIN, password or authenticator code.

The five-day window under the current BSP rules

BSP Circular No. 1215 provides a coordinated process for disputed electronic fund transfers between financial accounts:

An initial hold may last not more than five calendar days.
To support an extension, the source-account owner should submit a sworn complaint, affidavit, police report or other supporting document within the initial holding period, except as otherwise allowed by the applicable industry protocol.
If justified, the hold may be extended by up to 25 additional calendar days.
The total administrative holding period is therefore no more than 30 calendar days, unless a competent court extends it.
The originating institution should acknowledge a complaint and issue a case reference number.

A hold is not automatic and can apply only to funds that can still be located and held. It does not by itself establish guilt or guarantee a refund. The rules cover electronic transfers from one financial account to another; they do not cover erroneous transactions or ordinary credit-card purchases, except when a credit card is used for an electronic fund transfer through an automated clearing house.

For a card purchase, ask the issuer immediately about its dispute or chargeback procedure. Contractual and card-network deadlines vary, so use the deadline given by the issuer.

Where to report

Report to	Purpose	Current official channel
Bank, e-wallet, remittance provider or other originating financial institution	Protect the account; trace, hold or recall funds; begin coordinated verification	Institution’s official fraud channel or Financial Consumer Protection Assistance Mechanism
SEC	Investigate suspected unauthorized investment solicitation, securities violations or unlicensed intermediaries	SEC iMessage; select the Enforcement and Investor Protection Department’s investment-scam complaint service
CICC	Central reporting and coordination for online scams and cybercrime	Call 1326, email `1326@dict.gov.ph`, or use the eGov PH app
NBI or PNP	Criminal investigation, sworn complaint, evidence gathering and possible referral for prosecution	NBI Cybercrime Division procedure, an NBI regional or district office, or the nearest PNP station/anti-cybercrime unit
BSP	Second-level complaint when a BSP-supervised institution has not handled the financial complaint satisfactorily	BSP Online Buddy and Consumer Assistance Channels
DTI	An ordinary consumer subscription, digital-service or billing dispute that is not primarily an investment solicitation	DTI Consumer CARe

These reports serve different functions. An SEC report does not replace a criminal complaint, and a criminal complaint does not replace the urgent report needed for a possible financial-account hold.

Filing with the SEC

Create or sign in to an eSECURE account at SEC iMessage, open a new ticket, and select eComplaints on Investment Scams under the Enforcement and Investor Protection Department. The SEC’s current iMessage User Guide identifies iMessage as its official central platform for public complaints and says it generates a unique ticket.

Provide the scheme’s exact name, former names, promoters, website, social-media accounts, promised returns, method of solicitation and payment details. Include any claimed SEC registration number, certificate, permit or secondary licence. State whether the complaint concerns the original investment, a later recovery demand, or both.

Filing with the NBI or PNP

The NBI Citizen’s Charter lists no filing fee for investigative assistance by its Cybercrime Division. Its process includes a complaint sheet, preliminary interview, sworn statement or prepared affidavit, submission of supporting documents and, when relevant, examination of a device.

Bring organized copies of your evidence. Keep your original files and devices unless an investigator formally receives them. If a device is taken for examination, ask for documentation identifying the device and the receiving officer.

You may also report to the nearest PNP station and request referral to the appropriate anti-cybercrime unit. Republic Act No. 10175 assigns cybercrime enforcement responsibilities to both the NBI and PNP.

Prepare one complete complaint packet

A clear complaint is easier to act on than hundreds of unsorted screenshots. Prepare:

A short factual summary

State:

how and when the person first contacted you;
what investment, recovery service or withdrawal was promised;
the exact representation that caused each payment;
each amount paid and its destination;
what happened when you requested withdrawal or recovery;
every additional fee demanded; and
the total amount lost or still at risk.

Separate facts you personally know from statements made by the suspect. If an identity, address or licence is unverified, label it as “claimed” or “represented.”

A transaction schedule

For every payment, list:

date and exact time;
amount and currency;
payment method;
originating institution and account;
beneficiary name and account number;
transaction reference number;
crypto wallet address and transaction hash, if applicable; and
the message or representation that led to that payment.

Ask the originating institution for transaction identifiers and information on receiving institutions where the BSP rules permit disclosure to the source-account owner.

Identity and platform information

Preserve:

names, aliases and job titles;
phone numbers, email addresses and messaging-app usernames;
social-media profile URLs and numerical account IDs where visible;
complete website URLs and domain names;
app name, download link and package information;
QR codes and receiving-account names;
supposed company addresses and registration numbers;
advertisements, endorsements and referral codes; and
names of recruiters, agents and other victims or witnesses.

Preserve digital evidence properly

Before blocking or reporting an account to a platform:

capture the complete conversation with dates, times and usernames;
export chats where the app permits it;
save emails in their original format, including headers;
take uncropped screenshots showing the full URL or account name;
record the fake dashboard, withdrawal error and fee demand;
download contracts, receipts, statements and promotional materials;
retain voice messages, call logs and meeting links;
keep the original device and avoid factory-resetting it; and
maintain at least two secure backups.

Do not alter documents or create reconstructed conversations. Keep a simple record of when and where each file was obtained. Avoid publicly posting unredacted account numbers, IDs, signatures or other victims’ personal information.

After preserving the evidence, use the platform’s reporting function to report the fraudulent advertisement, profile, group, website or app.

Common mistakes that make recovery harder

Paying one last fee. A final payment commonly leads to another invented requirement.
Waiting for the scammer’s deadline. The urgent deadline is the financial institution’s ability to find the money, not the countdown displayed by the scammer.
Reporting only to social media. Platform removal may stop an account but does not initiate a bank hold or criminal investigation.
Reporting only to the SEC. The SEC handles investment and securities issues; the bank and law-enforcement reports remain necessary.
Deleting the app or chat too early. Secure the evidence first.
Giving a “recovery agent” remote access. Remove remote-access software and check the device for unauthorized applications.
Using the scammer’s contact details to verify the scammer. Start a separate search for the agency or institution’s official contact information.
Exaggerating or naming people without a factual basis. Report verified facts and identify assumptions. Under the AFASA, malicious or bad-faith filing of completely unwarranted or false information that causes a fund hold is itself punishable.
Assuming company registration proves legitimacy. Check both the entity’s registration and its authority to offer the specific investment or act as an intermediary.
Hiring another recovery company without verification. A legitimate professional should identify the legal entity, responsible individuals, scope of work, fees and realistic limitations in writing. A guarantee of recovery is a major warning sign.

When help is urgent

Contact the financial institution immediately if money was transferred recently, credentials were disclosed, remote access was installed, or another debit may occur.

File with law enforcement promptly if:

the scammer is threatening violence, blackmail or publication of private material;
your identity documents or financial account are being used by someone else;
you were instructed to receive or forward other victims’ funds;
the scheme is still recruiting people;
several accounts or jurisdictions are involved; or
the loss is large enough that civil asset-preservation remedies may be necessary.

For an immediate threat to life or safety, call the Philippines’ Unified 911 Emergency Hotline.

Consult a Philippine lawyer promptly when substantial funds are involved, the receiving account or suspect has been identified, court relief may be needed before the 30-day holding period ends, or authorities ask you to execute documents you do not understand. Initial reporting does not require waiting for a lawyer.

Frequently asked questions

I approved the transfer myself. Can I still report it?

Yes. State clearly that you authorized the payment because of particular false representations. Do not describe it as an account takeover if that did not happen. A voluntary transfer can still support an estafa complaint, and the institution may assess whether it qualifies as a disputed transaction under the BSP rules. Recovery remains fact-dependent.

The website shows my money is still there. Is that evidence of funds?

It is evidence of what the website displayed, not proof that actual assets exist. Preserve the dashboard and transaction history, but rely on records from legitimate banks, exchanges or blockchain explorers when tracing real transfers.

The platform says the payment is a Philippine tax. Should I pay?

Do not pay through a personal account, unfamiliar e-wallet or crypto address merely because the demand uses the word “tax.” Ask for the exact legal basis and official documentation, then verify independently with the relevant government agency using contact details you found yourself.

Does SEC registration mean the investment was authorised?

No. Incorporation gives an entity juridical personality; it does not automatically authorise a public securities offering, investment solicitation, brokerage or dealing activity. Verify the specific authority, security and intermediary—not merely the company name.

What if I paid in cryptocurrency?

Preserve the wallet addresses, transaction hashes, exchange records and communications. Report immediately to any exchange or regulated service involved and ask it to flag or preserve the destination account. Also report to the NBI or PNP. Transfers from a self-custody wallet ordinarily lack a bank-style reversal mechanism, so recovery depends on tracing, institutional control over later accounts, and available legal process.

What if the bank or e-wallet does not resolve the complaint?

First use the institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory or the complaint is not acted on within a reasonable period, escalate it through BSP Online Buddy or submit the BSP complaint form to consumeraffairs@bsp.gov.ph. Include the institution’s case reference, your original complaint and its response.

Is there a minimum amount required before I can report?

The official reporting channels above do not publish a minimum-loss requirement for reporting suspected scams. Report attempted scams and small losses as well; related reports may help identify a wider operation.

Will filing a report guarantee that I get my money back?

No. A financial institution may be able to hold and return identifiable disputed funds, but the money may already have been withdrawn, moved overseas, converted to crypto or divided among accounts. Criminal, regulatory and civil proceedings also have different purposes and evidentiary requirements.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. The applicable offense, forum and recovery options depend on the representations, contracts, transactions and available evidence. Laws, procedures and official channels were checked as of 30 July 2026.