Quick answer

Stop paying immediately. A demand for a “withdrawal tax,” “unlocking fee,” “AML clearance,” “gas fee,” “insurance bond,” or “recovery charge” is a strong scam warning—especially when the payment must go to a personal account, e-wallet, or crypto wallet.

Report the transaction at once through your bank or e-wallet’s official 24/7 fraud channel and ask it to trace the funds and assess a temporary hold under the Anti-Financial Account Scamming Act. Then report the incident through the government’s 1326 anti-scam hotline and file complaints with the NBI or PNP. If an investment was offered, also report it to the Securities and Exchange Commission (SEC).

Do not assume that the “balance” shown on an investment website is real. Do not pay anyone who promises guaranteed recovery or claims that one final payment will release your money.

What counts as an investment recovery or paywall scam?

An investment recovery scam usually targets someone who has already lost money. The fraudster may pose as a lawyer, regulator, investigator, bank officer, cryptocurrency expert, or “asset recovery” company. The person claims that your money has been found but demands an advance payment before it can be returned.

A paywall scam, as the term is used here, displays supposed investment profits or recovered funds but prevents withdrawal until you pay another amount. Common labels include:

Withdrawal, processing, or account-unfreezing fee
Tax or Bureau of Internal Revenue clearance
Anti-money-laundering certificate
Exchange verification or wallet activation fee
Security deposit, insurance bond, or refundable guarantee
Blockchain gas or liquidity fee
Lawyer’s fee, court fee, or regulator’s fee
Payment needed to “upgrade” the account or complete a trading volume requirement

Real taxes, professional fees, and network charges can exist. The warning sign is an unexpected payment demanded through the same platform or contact that controls the supposed funds, without documents that can be independently verified through the named institution or government office.

What to do immediately

1. Stop all further payments and contact

Do not send a “small final amount” to test whether withdrawal will work. Do not borrow money to complete the payment. Recovery scammers commonly invent a new fee after every payment.

Save the evidence before blocking the accounts. After preservation, stop responding unless law enforcement specifically advises otherwise.

2. Call your bank, card issuer, e-wallet, or exchange

Use only the contact information in the provider’s official app, website, card, or account statement—not a number or link supplied by the scammer.

Tell the provider:

The transfer was induced by an investment, recovery, or withdrawal-fee scam.
The exact date, time, amount, transaction reference, and recipient account are known.
You want the transaction investigated, traced, and assessed as a disputed transaction.
You are requesting any available recall, card dispute, temporary hold, or coordinated verification.
Your credentials, OTP, device, or account may also have been compromised, if applicable.

Ask for a written acknowledgment and case reference number. Ask whether any beneficiary funds remain and whether the provider has sent a holding request to the receiving institution.

Under Republic Act No. 12010 and the BSP’s implementing rules, a transaction may be treated as disputed when the institution has reasonable grounds to believe it is unusual, lacks a clear economic purpose, relates to an unlawful activity, or was facilitated through a covered social-engineering scheme. A complaint through the originating institution’s 24/7 fraud-reporting channel can trigger tracing and coordinated verification. This is not an automatic refund: the legal criteria must be met, and funds may already have been withdrawn or moved outside the covered financial system. See the Anti-Financial Account Scamming Act and the BSP AFASA rules and handbook.

The BSP rules provide for an initial hold of up to five calendar days. If the requirements for an extended hold are met, the total hold generally cannot exceed 30 calendar days unless a court extends it. If no funds were successfully held, coordinated verification ordinarily must be completed within 30 calendar days, although an institution may extend it for meritorious reasons up to a total of 60 calendar days. These periods are investigation and holding limits, not promises of reimbursement.

Card chargebacks, transfer recalls, and complaints involving particular payment services may have separate contractual deadlines. Ask the provider for the exact applicable cutoff immediately.

3. Secure compromised accounts and devices

If the scammer had remote access or obtained credentials:

Disconnect the affected device from the internet.
From a clean device, change the passwords for your email, banking, e-wallet, exchange, and social-media accounts.
Sign out other sessions and enable multi-factor authentication.
Call the financial provider to freeze affected cards or account access.
Contact your mobile provider if your SIM stopped working or may have been taken over.
Preserve screenshots or photographs of remote-access applications before removing them.
Review recent transactions, password-reset messages, forwarding rules, and newly added beneficiaries.

Never disclose an OTP, PIN, recovery phrase, private key, password, or screen-sharing code to a supposed investigator or recovery agent. Government agencies and legitimate financial institutions do not need your crypto recovery phrase.

4. Report through the national anti-scam channel

Call 1326, the government’s anti-scam hotline, as soon as possible. Reports may also be submitted through the eGovPH app’s eReport feature. The hotline can assist with intake and referral, but it should not be treated as a substitute for notifying the financial provider or executing a formal sworn complaint when investigators require one. See the DICT’s CICC information page and the government’s 1326 reporting guidance.

5. File a criminal complaint

Online investment and recovery fraud may involve estafa, computer-related offenses, financial-account scamming, identity theft, or other crimes. The correct charge depends on the representations made, how the payment occurred, whether account access was authorized, and what the evidence proves.

You may report to:

The NBI Cybercrime Division or an NBI Regional Cybercrime Center
The PNP Anti-Cybercrime Group, a Regional Anti-Cybercrime Unit, or the nearest police station for referral

The Cybercrime Prevention Act designates the NBI and PNP as cybercrime law-enforcement authorities. An incident may still be investigated when the offender appears to be abroad if the statutory jurisdictional requirements are met—for example, damage was caused to a person in the Philippines. See Republic Act No. 10175.

The NBI provides an online complaint page and an office locator. For formal investigative assistance, the NBI’s published procedure includes an interview, a sworn complaint sheet or affidavit, supporting documents, and possible examination of a relevant device. See the NBI Cybercrime Division citizen’s charter.

Bring the original device if requested, but keep a backup of important records. Tell investigators about every other report you have filed and provide the corresponding reference numbers.

6. Report the investment offer to the SEC

Report to the SEC if the scheme involved investments, profit-sharing, managed trading, pooled funds, securities, investment contracts, or people soliciting money as brokers, dealers, or salespersons.

Use the SEC’s official iMessage complaint and ticketing system and direct the report to the Enforcement and Investor Protection Department where applicable.

Under the Securities Regulation Code:

Securities generally cannot be publicly offered or sold in the Philippines without SEC registration, subject to statutory exemptions.
Fraudulent schemes, material misrepresentations, and deceptive practices connected with securities transactions are prohibited.
Brokers, dealers, salespersons, and associated persons generally must be registered, subject to applicable exemptions.

A corporation’s SEC certificate establishes its corporate registration; it does not, by itself, authorize investment solicitation. Verify both the entity and any necessary secondary licence through Check with SEC. See Republic Act No. 8799, particularly Sections 8, 26, and 28.

An SEC report can support regulatory investigation, enforcement, or referral for prosecution. Filing one does not guarantee that the SEC can locate or return the money, and it does not replace reports to the payment provider and law enforcement.

Which report should you make?

Situation	Report to	Purpose
Money was sent through a bank, e-wallet, card, or BSP-supervised payment provider	Provider’s official 24/7 fraud channel	Trace funds, secure the account, assess a hold, recall, or dispute
Provider has not resolved your complaint	BSP Consumer Assistance	Escalate a complaint against a BSP-supervised institution
Online scam needs immediate government intake or referral	Hotline 1326 or eGovPH eReport	Central reporting and referral
You want

Quick answer

Stop paying immediately. A demand for a “withdrawal fee,” “tax,” “AML clearance,” “account upgrade,” “gas fee,” “insurance bond,” or “recovery charge” before supposedly releasing an investment is a serious scam warning—especially when payment must go to a personal account, e-wallet, or crypto wallet.

Report the transaction at once through your bank or e-wallet’s official 24/7 fraud channel. Ask it to trace the transfer, assess it as a disputed transaction, and temporarily hold any remaining funds under the Anti-Financial Account Scamming Act (AFASA). Obtain a case reference number. Then call the government’s 24/7 anti-scam hotline at 1326, file a cybercrime complaint with the NBI or PNP, and report an investment-related scheme to the Securities and Exchange Commission (SEC).

A report does not guarantee reimbursement. Speed matters because funds may be withdrawn, transferred through several accounts, converted to cryptocurrency, or sent abroad.

What is an investment recovery or paywall scam?

“Paywall scam” is not a statutory legal term. Here, it refers to a scheme in which a fake investment platform displays profits or an available balance but prevents withdrawal unless the victim sends more money.

Typical demands include:

Tax, commission, or “capital gains” payments to the platform or an individual;
Anti-money laundering or know-your-customer clearance fees;
Account verification, upgrade, or unlocking fees;
A refundable deposit, security bond, or minimum balance;
Cryptocurrency “gas,” validation, or wallet synchronization fees;
A fee to correct an alleged withdrawal mistake;
A recovery payment to a supposed lawyer, government agent, hacker, forensic investigator, or fund-recovery company.

A recovery scam commonly follows an earlier investment scam. The new contact may already know the victim’s name, loss, platform, or transaction history because the original scammers retained or sold that information. A polished dashboard, certificate, case number, video call, government logo, or visible “balance” does not prove that recoverable funds exist.

Legitimate taxes and transaction charges can exist, but verify them independently with the regulated institution, relevant government agency, or your own lawyer or accountant. Do not rely on contact details, documents, or links supplied by the person demanding payment.

What to do immediately

1. Stop all further payments

Do not pay to “complete” the withdrawal or recovery. Do not borrow money, recruit another investor, or allow the use of your bank account or e-wallet.

Avoid confronting the scammers before preserving the evidence. They may delete messages, close accounts, or move funds after realizing that a report is being prepared.

2. Contact the originating bank, e-wallet, card issuer, or exchange

Use only the provider’s official app, website, card hotline, or published customer-service number—not a number supplied by the scammer.

Tell the provider:

The payment was induced by a suspected investment or recovery scam;
Whether you personally authorized it or whether your account was accessed without permission;
The amount, date, time, reference number, and destination account or wallet;
Whether the scammer obtained an OTP, password, PIN, card details, identification document, selfie, or remote access to your device;
Whether other transfers are pending or scheduled.

Ask the provider to:

Secure or restrict the source account if it may be compromised;
Trace the transaction chain;
Send a holding request to the receiving institution;
Assess whether the payment qualifies as a disputed transaction under AFASA and BSP Circular No. 1215;
Attempt a recall, card dispute, or other available recovery procedure;
Preserve transaction and access records;
Give you a written acknowledgment and case reference number.

Under the AFASA rules compiled by the Bangko Sentral ng Pilipinas, a complaint may trigger an initial hold of disputed funds for up to five calendar days. If warranted, the total temporary holding period may reach 30 calendar days, unless extended by a court. When no funds were successfully held, coordinated verification should generally be completed within 30 calendar days and may, for meritorious reasons, extend to a total of 60 calendar days.

These periods are investigation and holding limits—not promises that funds will be returned. A hold may be unavailable if the money has already been withdrawn, moved outside covered institutions, or otherwise cannot be traced.

Card chargeback, crypto-exchange, remittance, and payment-service deadlines may be shorter and provider-specific. Ask for the exact applicable cutoff immediately.

3. Secure compromised accounts and devices

From a clean device:

Change the password of your primary email first, then your banking, e-wallet, exchange, social-media, and messaging accounts;
Enable multi-factor authentication using a method the scammer cannot access;
Sign out unknown sessions and remove unfamiliar devices;
Block or replace compromised cards and credentials;
Notify your mobile provider if your SIM may have been taken over;
Disconnect a device if the scammer is controlling it remotely.

Preserve screenshots or photographs showing suspicious remote-access applications, permissions, logins, and transactions before removing them. If law enforcement is already assisting, ask how the device should be preserved or examined.

Where to report

Report to	Purpose	How
Bank, e-wallet, card issuer, remittance provider, or crypto exchange	Immediate account security, tracing, possible hold, recall, or dispute	Use the provider’s official 24/7 fraud channel
CICC Inter-Agency Response Center	Rapid anti-scam intake, assistance, and agency referral	Call 1326 or use the eGovPH app’s reporting feature; the DICT identifies 1326 as the National Anti-Scam Hotline
NBI Cybercrime Division	Criminal investigation and electronic-evidence handling	Use the NBI Online Complaint page and follow instructions for formal filing, or approach the nearest NBI regional or district office
PNP Anti-Cybercrime Group	Criminal investigation and urgent police assistance	Approach the PNP Anti-Cybercrime Group or the nearest police station and request referral to the appropriate cybercrime unit
Securities and Exchange Commission	Unregistered investment solicitation, fraudulent securities activity, or unlicensed sellers	Open a complaint through SEC iMessage and select the Enforcement and Investor Protection Department
Bangko Sentral ng Pilipinas	Escalation when a BSP-supervised institution has not satisfactorily handled your complaint	First complain to the institution, then use the BSP Consumer Assistance Mechanism or email the completed CIR form and supporting records to `consumeraffairs@bsp.gov.ph`
National Privacy Commission	Misuse or unauthorized disclosure of identification documents or personal data	Follow the NPC formal complaint procedure
Insurance Commission	If the transaction genuinely concerns an insurance, pre-need, HMO, or regulated intermediary	Submit the Insurance Commission Assistance Form and required documents

CICC intake or an online report may lead to a referral, but it should not be assumed to replace a formal criminal complaint. The NBI’s official procedure may require a sworn complaint sheet or affidavit, an interview, supporting documents, witness statements, and examination of a relevant device.

If reporting to several agencies, disclose the other reports and reference numbers. Keep the facts, dates, and amounts consistent.

How to report the investment aspect to the SEC

Report to the SEC when the scheme involved promised returns, pooled funds, managed trading, profit-sharing, cryptocurrency investment packages, shares, notes, or another arrangement that may constitute a security or investment contract.

Include:

The platform, company, group, and trading names used;
Names and aliases of recruiters, agents, account managers, and recovery contacts;
Websites, apps, social-media pages, referral links, and group chats;
The investment amount, promised return, and withdrawal conditions;
Copies of advertisements, presentations, contracts, certificates, dashboards, and payment instructions;
The destination accounts or wallets and all transaction references;
Any claim that the entity is SEC-registered or government-approved;
The names of other known victims, with their permission.

Under the Securities Regulation Code, securities generally may not be offered or sold in the Philippines without an SEC-approved registration statement, subject to statutory exemptions. Fraudulent schemes and material misrepresentations connected with securities transactions are prohibited, and brokers, dealers, and salespersons generally must be registered.

A certificate of incorporation alone does not authorize a company to solicit investments. Verify both the entity and its relevant secondary license through Check with SEC. Even a real company name or registration number may have been copied or impersonated.

An SEC report can support regulatory investigation, warnings, cease-and-desist action, or referral for prosecution. It does not by itself guarantee repayment or replace a bank dispute or criminal complaint.

Information every report should contain

Prepare one clear chronology covering both the original investment and the later recovery or paywall demands:

How and when you first encountered the offer;
What was represented about the investment, returns, risks, licensing, and withdrawals;
Every payment, including date, time, amount, method, reference number, and recipient;
What appeared on the platform after each payment;
Your withdrawal requests and the responses;
Each additional fee demanded and the stated reason;
Any personal data or account credentials disclosed;
The latest communication and whether funds or accounts remain active;
The action already taken by banks, platforms, CICC, SEC, NBI, or PNP;
The assistance requested, such as account security, tracing, investigation, or preservation of records.

State only facts you can support or honestly identify as your recollection. AFASA penalizes malicious or bad-faith reporting of completely unwarranted or false information that results in a temporary hold.

Evidence to preserve

Keep original, unedited copies whenever possible:

Full chat exports, SMS messages, emails, and email headers;
Voice messages, call logs, meeting links, and recordings lawfully in your possession;
Screenshots showing the full URL, account name, date, time, and device status;
Advertisements, livestreams, influencer posts, referral codes, and group invitations;
Contracts, receipts, invoices, certificates, prospectuses, and payment instructions;
Bank and e-wallet statements, deposit slips, transaction references, recipient details, and support tickets;
Crypto wallet addresses, network names, transaction hashes, exchange deposit addresses, and block-explorer records;
App names, download links, installation files, permissions, and remote-access settings;
Names, aliases, phone numbers, email addresses, profile links, account numbers, and claimed office addresses;
Copies of identification documents or selfies sent to the scammers;
Your written chronology and the reference number for every report.

Create at least two secure backups. Do not crop or annotate the only copy. Redact account numbers and identification documents from anything posted publicly, while keeping unredacted copies for the institution and authorities through official channels.

Under BSP Circular No. 1215, a source account owner may request transaction identifiers, information about receiving institutions involved in the transfer chain, and transaction dates and times. Ask your provider for these records in writing.

What Philippine law may cover

The legal classification depends on the representations made, how payment was obtained, whether account credentials were stolen, and what the evidence shows.

Potentially relevant laws include:

The Anti-Financial Account Scamming Act, Republic Act No. 12010, covering specified money-muling and social-engineering conduct and establishing financial-account investigation and fund-holding mechanisms;
The Securities Regulation Code, Republic Act No. 8799, where an investment or securities offer is unregistered, fraudulently marketed, or sold by an unregistered person;
The Cybercrime Prevention Act, Republic Act No. 10175, including computer-related fraud or identity theft and crimes committed through information and communications technology;
Estafa or other offenses under the Revised Penal Code, depending on the deceit, reliance, transfer of property, damage, and surrounding facts;
Other financial, access-device, data-privacy, anti-money-laundering, or special laws where their particular elements are present.

Do not assume that every failed or losing investment is automatically criminal fraud. Market loss, breach of contract, unauthorized investment solicitation, and deliberate deception are legally different. Regulators, investigators, prosecutors, and courts determine the applicable violations from the documents and evidence.

Common mistakes to avoid

Paying one final fee because the dashboard shows a larger balance;
Trusting a recovery agent who contacted you without being asked;
Using contact details found in the scammer’s document instead of an official government or company website;
Assuming that an SEC-registered corporation is licensed to accept investments;
Waiting for the scammer’s promised release date before contacting the financial institution;
Reporting only to the social-media platform and not to the bank and authorities;
Deleting chats, resetting the device, or uninstalling applications before preserving evidence;
Posting unredacted IDs, account numbers, or wallet recovery phrases online;
Omitting a payment because you personally authorized it—authorization does not prevent you from reporting that it was induced by alleged fraud, although reimbursement is not automatic;
Hiring someone who guarantees recovery, claims inside access to government, or requests advance payment through a personal account or cryptocurrency;
Assuming that filing an agency or hotline report stops every civil or criminal prescriptive period or satisfies a court-filing deadline.

When help is urgent

Act immediately if:

The scammer still has remote access, an OTP, password, PIN, card number, recovery phrase, or email access;
A transfer is pending or was made only recently;
Further withdrawals or logins are appearing;
The scammer is threatening you, blackmailing you, or pressuring you to recruit others;
Your identity documents are being used to open accounts or contact relatives;
The loss is substantial, involves several victims, crosses borders, or was converted to cryptocurrency;
A bank or e-wallet refuses to record the complaint or assess an AFASA hold;
You need a court order, asset-preservation measure, civil recovery action, or advice about prescription.

Contact the financial institution and 1326 first when funds may still be moving. For threats or immediate physical danger, contact the police or emergency services.

Consult a Philippine lawyer promptly for document-specific advice. If financially qualified, ask the Public Attorney’s Office about legal assistance. A lawyer can assess possible criminal, civil, regulatory, and provisional remedies; a private “recovery specialist” cannot guarantee an outcome.

FAQ

Can I report the scam even if I authorized the transfer?

Yes. Tell the institution truthfully that you authorized the payment but did so because of the alleged fraudulent representations. The provider must assess the facts and applicable dispute rules. Authorization may affect reimbursement, but it is not a reason to conceal or delay the report.

Will AFASA automatically return my money?

No. AFASA permits tracing, temporary holding, coordinated verification, and, in qualifying circumstances, return of disputed funds. Recovery depends on whether funds remain traceable, whether the statutory and BSP criteria are met, and what verification establishes.

What if I paid in cryptocurrency?

Report immediately to the exchange or wallet provider used to send the assets. Provide the network, wallet addresses, transaction hash, amount, and exact time. Also report to CICC, NBI or PNP, and the SEC if the transaction involved an investment offer. Blockchain transfers may be technically irreversible, but exchanges and investigators may still be able to identify or restrict assets that reach a participating service.

Should I pay a tax or AML fee to release the investment?

Do not pay based solely on a platform message or chat. Independently verify the obligation with the regulated institution, the relevant government agency, or your own licensed adviser. A demand to send “tax” or “clearance” money to an individual, unrelated company, e-wallet, or private crypto address is a major warning sign.

What if the scammer is abroad?

Still report it. Philippine cybercrime and AFASA jurisdiction may apply when legally specified connections to the Philippines exist, including damage to a person in the Philippines or involvement of a financial account maintained with an institution operating here. Cross-border investigation and recovery may take longer and remain fact-dependent.

Is it too late if the transaction happened weeks or months ago?

Report it anyway. The chance of an immediate hold may be lower, but records, linked accounts, other victims, and enforcement leads may remain useful. Legal prescription and filing periods depend on the possible offense, remedy, discovery facts, and procedural act involved. Obtain legal advice rather than assuming that a hotline or administrative report preserves every claim.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of recovery. Rights and procedures depend on the evidence, transaction method, institutions involved, and applicable law. Official sources and reporting procedures were checked as of 4 August 2026.