Quick answer

Stop paying immediately. Do not send another “withdrawal fee,” “tax,” “verification deposit,” “gas fee,” “VIP upgrade,” or recovery charge. Contact the bank, e-wallet, remittance provider, card issuer, or crypto exchange from which the money was sent through its official fraud channel—not through contact details supplied by the scammer. Ask it to treat the transfer as a disputed transaction, trace the funds, and determine whether a temporary hold or recall is possible.

Then report the scheme to:

The Cybercrime Investigation and Coordinating Center through Hotline 1326;
The NBI online complaint portal or NBI Cybercrime Division;
The PNP Anti-Cybercrime Group or the nearest police cybercrime unit; and
The SEC iMessage portal under Enforcement and Investor Protection Department → eComplaints on Investment Scams if the scheme involved investments, trading, securities, or public solicitation.

Reporting quickly matters. Funds can move through several accounts within minutes, online content may disappear, and service-provider data is not necessarily kept forever.

What counts as an investment recovery or paywall scam?

An investment recovery scam targets someone who has already lost money. A supposed lawyer, government officer, investigator, hacker, blockchain expert, regulator, or “asset recovery company” claims it has located the money and can return it after payment of an advance fee.

A paywall scam commonly appears on a fake investment or trading platform. The dashboard may show substantial profits, but every withdrawal attempt produces a new payment demand, such as:

A withdrawal or processing fee;
A tax or anti-money-laundering clearance;
A security deposit or account-verification payment;
A VIP or premium-account upgrade;
A “liquidity,” “gas,” or blockchain fee paid to a separate wallet;
An insurance bond or compliance certificate; or
A payment to release funds supposedly frozen by a regulator.

The displayed balance may be only a number controlled by the scammer. Paying one demand usually leads to another.

A real provider may charge disclosed contractual fees, and legitimate taxes or regulatory requirements can exist. The warning sign is an unexpected payment to a personal account, e-wallet, unrelated company, or crypto wallet as a condition for releasing your own money—especially when the recipient cannot provide independently verifiable legal authority, an official assessment, and an authorized payment channel.

What to do immediately

1. Contact the institution that sent the money

Use the number printed on your card, the institution’s official app, or its independently verified website. Do not use a number or link in the scammer’s message.

Tell the fraud team:

You were induced by deception to transfer money;
The exact amount, date, time, and transaction reference;
The source and recipient account numbers, names, e-wallets, or wallet addresses;
Whether you disclosed a password, PIN, one-time password, recovery phrase, ID, or card information;
Whether the scammer obtained remote access to your device; and
Whether further transactions are pending or scheduled.

Ask for:

A fraud or disputed-transaction case number;
Immediate tracing of the transaction chain;
A recall, charge dispute, or temporary hold, if available;
Protection or restriction of the source account;
Written instructions for the sworn complaint, affidavit, police report, or supporting documents needed; and
Written confirmation of the action taken.

Do not inaccurately call a transfer “unauthorized” if you personally approved it. Explain truthfully that you authorized it because of fraudulent representations. False or bad-faith reporting that causes funds to be held can itself create liability under the Anti-Financial Account Scamming Act.

2. Use the AFASA temporary-hold process promptly

For covered transfers occurring after the Anti-Financial Account Scamming Act took effect, a complaint through the originating institution’s 24/7 fraud-reporting channel can trigger tracing, coordinated verification, and temporary holding of disputed funds.

Under BSP Circular No. 1215:

The initial holding period is no more than five calendar days.
It may be extended by up to 25 additional calendar days when the rules’ conditions are met.
A hold beyond the total 30-day period requires an extension from a competent court.
The source-account owner must submit supporting material—such as a sworn complaint, affidavit, police report, or other supporting document—within the initial holding period, subject to the applicable industry protocol.
If funds were successfully held, coordinated verification should ordinarily be completed within the 30-day holding period unless a court extends it.
If no funds were held, verification ordinarily runs for 30 calendar days and may, for meritorious reasons, extend to a total of 60 calendar days.

This mechanism does not guarantee recovery. The money may already have been withdrawn, converted to cryptocurrency, sent abroad, or transferred outside participating institutions. The rules also do not treat an ordinary credit-card transaction in the same way; report card charges directly through the issuer’s charge-dispute process.

3. Secure every affected account

From a clean, trusted device:

Change the passwords for your email, banking, e-wallet, exchange, social-media, and messaging accounts.
Use different passwords for each account and enable multi-factor authentication.
Sign out other sessions and remove unfamiliar devices.
Change compromised PINs and freeze or replace affected cards.
Contact your mobile provider if the SIM may have been taken over.
Revoke remote-access software, browser extensions, API keys, exchange permissions, and connected apps.
Move unaffected cryptocurrency only after securing the wallet and obtaining competent technical advice. Never disclose a seed or recovery phrase to a supposed investigator.

If the scammer had remote access, do not continue banking on that device until it has been properly checked. Do not factory-reset it before preserving evidence or consulting investigators if the device may contain important records.

4. Preserve evidence before blocking the scammer

Save complete, unedited copies of:

Chats, emails, SMS messages, voice messages, and call logs;
The full social-media profile, username, user ID, group, channel, and page URL;
Advertisements and the account that published them;
Website URLs, domain names, app names, download links, and login pages;
Contracts, prospectuses, certificates, invoices, tax demands, and recovery agreements;
Bank, e-wallet, remittance, and card records;
Recipient names, account numbers, QR codes, and payment references;
Crypto wallet addresses, transaction hashes, networks used, and exchange deposit details;
Screenshots or recordings of the dashboard, balance, withdrawal rejection, and fee demands;
Names, titles, phone numbers, email addresses, and claimed office addresses; and
Every complaint reference number and response from a bank, platform, regulator, or law-enforcement agency.

Keep the original files and device where possible. Do not crop screenshots so tightly that dates, usernames, URLs, and surrounding context disappear. Export full conversations when the app permits it.

Prepare a simple chronology showing:

How the person contacted you;
What was represented before each payment;
Why you believed the representation;
Each amount and payment destination;
What happened when you tried to withdraw; and
Every later recovery or release-fee demand.

This chronology can be important because estafa by deceit generally requires a false representation made before or at the time the victim was induced to part with money, reliance on that representation, and resulting damage. The Supreme Court restated these elements in Dulay v. People.

Electronic evidence must eventually be authenticated. Preserving complete originals helps establish integrity and reliability under the Supreme Court’s Rules on Electronic Evidence.

5. Make the criminal report

You may use one or more of these official channels:

CICC: Report through cicc.gov.ph/report, call 1326, or email report@cicc.gov.ph.
NBI: Use the NBI online complaint portal or approach the Cybercrime Division or an NBI regional office. The NBI’s published procedure includes an interview, a sworn complaint sheet or affidavit, collection of supporting documents, and, where relevant, examination of the device. The service is listed as having no fee in the NBI Citizens’ Charter.
PNP Anti-Cybercrime Group: Contact acg@pnp.gov.ph or approach the nearest PNP cybercrime unit. Current government-listed PNP, NBI, and CICC channels appear in the BSP’s fraud-reporting guidance.

Bring a government ID, chronology, transaction records, device, and preserved communications. Investigators may ask you to execute a sworn statement or provide additional copies.

Prompt reporting can also help investigators seek preservation or disclosure orders. Under the Cybercrime Prevention Act, service providers must preserve relevant traffic data and subscriber information for a minimum of six months from the transaction; access by investigators remains subject to the law’s warrant and disclosure requirements.

6. Report the investment aspect to the SEC

File through the SEC iMessage system. Select:

Enforcement and Investor Protection Department → eComplaints on Investment Scams

Include the scheme’s name, operators, promoters, website, social-media pages, investment terms, promised returns, payment accounts, withdrawal demands, and evidence of public solicitation. The SEC’s current iMessage user guide confirms that the system creates trackable tickets and has replaced informal complaint channels.

A certificate of incorporation does not by itself authorize a company to solicit investments. As a general rule, securities offered in the Philippines must have an SEC-approved registration statement, and persons acting as brokers, dealers, or salesmen may need separate registration. Exempt securities and exempt transactions exist, so the legal conclusion depends on the actual product and documents. See Sections 8 to 10 and 28 of the Securities Regulation Code.

An SEC report serves regulatory investigation and investor protection. It is not a substitute for reporting the payment immediately to the financial institution or making a criminal complaint.

7. Escalate poor handling by a BSP-supervised institution

For a dispute involving a bank, e-wallet issuer, remittance company, BSP-supervised exchange, or other BSP-supervised institution:

Complain first through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel.
If the response is unsatisfactory, escalate through the BSP Online Buddy (BOB) on the BSP website.
If BOB is inaccessible, submit the BSP Complaint/Inquiry/Reply Form to consumeraffairs@bsp.gov.ph, together with proof that you first complained to the institution.

The BSP complaint guide describes BSP-CAM as a second-level remedy. It does not replace a CICC, NBI, or PNP criminal report.

If the disputed product is insurance, a pre-need plan, or an HMO product, use the Insurance Commission assistance form. For a cooperative’s financial product, complain first through the cooperative’s assistance mechanism and then contact the Cooperative Development Authority if unresolved.

Laws that may apply

The exact charge depends on what was represented, who received the money, how the accounts were used, and what the electronic evidence proves.

The Financial Products and Services Consumer Protection Act prohibits investment fraud, including deceptive public solicitation, Ponzi-type schemes, and public investment offerings made without the required SEC authority, subject to lawful exemptions.
Section 26 of the Securities Regulation Code prohibits schemes, material misstatements, omissions, and practices that operate as fraud in connection with securities transactions.
Article 315(2)(a) of the Revised Penal Code may apply to estafa where prior or simultaneous false pretenses induced the victim to part with money and caused damage.
The Cybercrime Prevention Act covers specific computer-related offenses and crimes committed through information and communications technology. An online scam is not automatically “computer-related fraud” under Section 4; investigators and prosecutors must match the evidence to the statutory elements.
The Anti-Financial Account Scamming Act addresses money-mule activity, specified social-engineering schemes, account protection, temporary holding, and coordinated verification.

A failed investment or ordinary market loss is not automatically criminal fraud. Deception, unlawful solicitation, misuse of accounts, or another legally defined offense must be supported by evidence.

Important deadlines

Do not wait for a promised refund date before reporting.

Report a disputed transfer to the originating institution immediately through its 24/7 fraud channel.
For an AFASA hold to be extended beyond the initial period, provide the requested sworn complaint, affidavit, police report, or other supporting documents within the initial five-calendar-day holding period.
Different civil and criminal limitation periods apply. Claims under the Financial Products and Services Consumer Protection Act generally prescribe five years from consummation or discovery of deceit or nondisclosure, subject to a ten-year outer limit. Certain civil liabilities under the Securities Regulation Code have shorter two-year discovery and five-year outer limits.
The correct limitation period depends on the particular claim, transaction date, discovery date, and applicable law. Seek legal advice promptly instead of relying on the longest possible period.

Common mistakes to avoid

Paying one final fee because the dashboard shows a large balance;
Trusting a recovery service that contacted you without being asked;
Using contact information supplied by the scammer to “verify” the recovery agent;
Reporting only to Facebook, Telegram, WhatsApp, or another platform;
Waiting until every document is complete before notifying the bank;
Deleting embarrassing conversations or uninstalling the app before preserving evidence;
Editing transaction receipts or omitting payments made voluntarily;
Sending investigators or regulators your PIN, password, OTP, card security code, or wallet seed phrase;
Assuming SEC incorporation is the same as authority to sell investments;
Publicly confronting or threatening the suspected scammer and causing accounts or evidence to disappear; and
Hiring a supposed hacker or paying someone who guarantees recovery.

When legal help is urgent

Consult a Philippine lawyer promptly when:

A substantial amount or several victims are involved;
The bank refuses to accept or document a fraud complaint;
Funds have been temporarily held and a court order may be needed;
The recipient, platform, or exchange is overseas;
Cryptocurrency tracing, subpoenas, or cross-border evidence may be required;
Your identity or account was used as a money mule;
You have received a subpoena, demand, account-freeze notice, or accusation;
The scammer is threatening violence, exposure, or retaliation; or
A civil or regulatory filing deadline may be approaching.

A lawyer is not required merely to notify a bank, call 1326, or make an initial police, NBI, or SEC report. Legal assistance becomes more important when preparing a formal complaint-affidavit, seeking recovery through court, or responding to allegations against your own account.

FAQ

Can money sent to a scammer still be recovered?

Sometimes, particularly when the report reaches the originating institution before the funds are withdrawn or moved outside the covered financial system. A temporary hold, coordinated verification, charge dispute, exchange freeze, or voluntary return may help. No agency, lawyer, or recovery company can honestly guarantee recovery.

I personally approved the transfer. Can I still report it?

Yes. State exactly how false representations induced you to approve it. Authorization does not erase possible estafa or investment fraud, although it may affect the bank’s classification, available remedies, and responsibility. Never falsely claim that your account was hacked.

Should I pay a tax or fee to release the investment balance?

Not based only on a message from the platform or recovery agent. Verify the legal basis directly with the named regulator, government agency, or licensed provider using independently obtained contact details. Do not send supposed taxes or compliance fees to a personal account, e-wallet, or unrelated crypto wallet.

What if the scammer says the SEC, BSP, AMLC, court, or foreign regulator ordered the payment?

Ask for the complete official order and docket or reference number, then verify it directly with the named authority. Do not use the phone number, email address, or website supplied in the demand.

Can I report if I did not lose money?

Yes. Preserve the message, profile, URL, phone number, wallet address, and payment instructions. Report the attempted scheme to CICC, the relevant platform, and the SEC if it involved investment solicitation.

Can I report a foreign website or overseas scammer?

Yes. Report the matter in the Philippines, especially if you are here, used a Philippine financial account, or were solicited here. Give investigators the foreign phone numbers, domains, exchange details, wallet addresses, and transaction hashes.

Is an anonymous report enough?

An anonymous tip may alert an authority, but tracing funds or pursuing a complaint usually requires identity verification, transaction records, and eventually a sworn statement from the affected account owner. Ask the receiving agency how it will handle your information if safety or retaliation is a concern.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of recovery or case outcome. The applicable remedy depends on the transaction, evidence, institutions involved, and current procedural rules. Sources and official reporting channels were checked as of August 4, 2026.