Quick answer

Stop paying immediately. A demand for another “tax,” “clearance fee,” “insurance,” “verification deposit,” “VIP upgrade,” or “recovery charge” to unlock supposed investments or recovered funds is a strong scam warning.

Report the transaction at once to the bank, e-wallet, card issuer, or crypto exchange that sent the money. Ask for its 24/7 fraud channel, a case number, tracing of the transfer, and—when applicable—temporary holding of disputed funds under the Anti-Financial Account Scamming Act. Then report the scheme to the SEC and to a cybercrime authority. Do these in parallel; do not wait for one agency to respond before contacting the others.

Reporting does not guarantee a refund. Speed matters because scammers often move funds through several accounts or convert them to cash or cryptocurrency.

Recognize the scheme

“Investment recovery scam” and “paywall scam” are practical descriptions, not names of specific offenses in Philippine statutes. The applicable law depends on what the perpetrators actually did.

A recovery scam commonly begins after an earlier investment loss. Someone claiming to be a lawyer, investigator, regulator, bank officer, hacker, blockchain expert, or recovery company says that the money has been located or recovered. The victim must supposedly pay first for legal fees, taxes, anti-money-laundering clearance, a court certificate, or a release code. After each payment, another obstacle appears.

A paywall-style scam usually shows fictitious profits or a fake withdrawable balance but blocks withdrawal until the victim pays for items such as:

“Tax” or “BIR clearance”
Withdrawal, processing, or activation fees
Insurance or security deposits
A negative-balance top-up
Account verification or unlocking
VIP membership or a higher trading tier
Crypto “gas,” liquidity, or validation charges
Penalties for an alleged trading mistake
A payment needed to prove that the victim is not involved in money laundering

A disclosed fee on a legitimate regulated service is not automatically fraudulent. The warning signs are invented or changing charges, pressure to pay immediately, payment to a personal account or private crypto wallet, refusal to deduct the fee from the displayed balance, guaranteed recovery, and a demand for an OTP, PIN, password, seed phrase, private key, or remote access to the victim’s device.

What to do in the first hour

1. Make no further payment

Do not pay merely to “complete” a withdrawal or preserve eligibility for recovery. Do not borrow money to satisfy the latest demand. Scammers may threaten forfeiture, prosecution, account closure, or permanent loss to force a quick decision.

Do not send a small “test” payment. It confirms that the victim remains responsive and may lead to more demands.

2. Contact the sending financial institution immediately

Use contact details from the institution’s official app, card, statement, or website—not a number or link supplied by the person who contacted you.

Tell the institution:

The transfer was induced by an online investment, withdrawal, or recovery scam.
Whether you personally authorized the transfer but did so because of deception.
Whether anyone obtained your password, OTP, card details, PIN, biometrics, or device access.
The transaction reference number, date, time, amount, source account, and beneficiary details.
Whether other payments were made and whether another payment is pending.

Ask it to:

Open a formal fraud or disputed-transaction complaint.
Trace the funds and notify the receiving institution.
Initiate coordinated verification and temporary holding when legally applicable.
Secure or restrict the source account if credentials may be compromised.
Give you the case or reference number and written confirmation of the report.

Do not inaccurately label a payment “unauthorized” if you initiated it yourself. State that it was authorized under deception or social engineering and explain the false representation. Accurate facts allow the institution to apply the correct procedure.

3. Secure compromised accounts and devices

From a clean device, change the passwords of affected email, banking, e-wallet, social-media, and exchange accounts. Use unique passwords and activate multi-factor authentication.

If the scammer installed a remote-access or screen-sharing application, disconnect the affected device from the internet after documenting what was installed. Inform the financial institution that the device may have been controlled remotely. If a SIM swap or unauthorized number transfer is suspected, contact the mobile provider immediately.

Never give a supposed recovery agent an OTP, seed phrase, private key, recovery code, or control of a device. A legitimate authority does not need those credentials to investigate a complaint.

The bank and e-wallet fund-hold process

Under Republic Act No. 12010, the Anti-Financial Account Scamming Act, BSP-supervised institutions may temporarily hold funds involved in a disputed transaction and must conduct coordinated verification. A transaction may be disputed when there is reasonable ground to believe it is unusual, lacks a clear economic purpose, comes from an illegal or unknown source or unlawful activity, or was facilitated through social engineering.

BSP Circular No. 1215 provides the operational rules:

A victim-initiated report goes first to the sending institution’s 24/7 fraud-reporting channel under its Financial Consumer Protection Assistance Mechanism.
When the regulatory criteria are met, available disputed funds may initially be held for up to five calendar days.
The hold may be extended by up to 25 additional calendar days when justified.
The total administrative holding period cannot exceed 30 calendar days, unless extended by a competent court.
The institutions and affected account owners must cooperate in verifying the transaction.

This is a temporary hold, not an automatic reversal or judgment that the victim owns the money. The outcome depends on what funds remain, the transaction trail, the evidence, and the verification findings.

The Circular’s temporary-hold procedure principally covers electronic transfers from one financial account to another. It does not cover erroneous transfers, and ordinary credit-card transactions follow separate rules unless the card was used to make an electronic fund transfer. Cash payments, gift cards, direct transfers to an unhosted crypto wallet, and funds already withdrawn or moved outside participating institutions may require different recovery measures. Report them anyway.

For card payments, ask the issuer immediately whether a chargeback or merchant dispute is available. Card-network and issuer deadlines can differ; do not assume the 30-day AFASA holding period is a chargeback deadline.

Where to report

The Securities and Exchange Commission

Report to the SEC when the scheme involved an investment, trading opportunity, pooled fund, passive-income arrangement, securities offering, broker, investment adviser, or solicitation of money on the promise of returns.

Use the SEC’s iMessage ticketing portal and select the service for an investment-scam complaint. Include:

All names and aliases used
Company, group, platform, app, and website names
Social-media pages and profile links
Promoters, recruiters, account managers, and supposed recovery agents
The investment promise and representations made
Payment dates, amounts, recipient accounts, and crypto wallet addresses
Withdrawal attempts and every fee demanded
Advertisements, presentations, contracts, receipts, and chat records
Any claimed SEC registration, secondary license, or permit number

A certificate of incorporation or company registration does not by itself authorize a company to solicit investments, sell securities, act as a broker, or provide another regulated service. Check the entity and its claimed authority through Check with SEC, but remember that absence from an online result is evidence to investigate—not a final legal finding by itself.

Under the Securities Regulation Code, securities generally cannot be offered or sold without the required registration or exemption, and fraudulent practices in securities transactions are prohibited. Whether a particular arrangement is a security depends on its actual terms, not merely the name used by the promoter.

CICC Hotline 1326

Call the government’s 24/7 anti-scam hotline 1326. Reports may also be sent through the eGovPH app. The hotline centralizes scam reports and can coordinate referrals, but a hotline report does not replace immediate notice to the sending bank or a formal criminal complaint.

Current government information identifies investment fraud, phishing, impersonation, and other cybercrimes as reportable through 1326. DICT also lists 1326@dict.gov.ph as a complaint channel on its official contact page.

NBI or PNP cybercrime investigators

For a formal criminal investigation, report to either:

The NBI online complaint page or NBI Cybercrime Division; or
The PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the nearest police station for referral.

The NBI’s official computer-crime assistance procedure states that a complainant may be interviewed, execute a sworn complaint sheet or affidavit, submit supporting records and witness statements, and allow examination of a relevant device. An online submission may therefore be followed by a request for personal appearance, an affidavit, originals, or access to a device.

A police blotter can help document when the incident was reported, but it does not necessarily replace a complaint to the proper cybercrime investigators or prosecutor.

BSP escalation

The BSP is the second-level consumer channel for complaints about how a BSP-supervised institution—such as a covered bank, e-wallet issuer, payment provider, money-service business, or BSP-supervised virtual-asset service provider—handled the matter.

First complain directly to the institution. If its action is unresolved or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism, using BSP Online Buddy or the official Complaint, Inquiry and Request form. Attach the institution’s case number, your first-level complaint, its response, and supporting documents.

BSP consumer assistance is not a substitute for reporting the scammers to the SEC, NBI, PNP, or CICC. It addresses the conduct and complaint handling of the supervised institution.

The platform or crypto exchange

Report the account, page, advertisement, app, domain, or wallet to the platform where the contact occurred. For cryptocurrency, notify every exchange involved and provide the transaction hash, wallet addresses, network, amount, date, and law-enforcement complaint number when available.

Platform takedown can protect other users, but preserve the evidence before blocking or reporting the account. A takedown does not itself recover money.

Evidence to preserve

Keep the original electronic records whenever possible. Screenshots are useful, but they should not be the only evidence.

Preserve:

Complete chats, including earlier messages that built trust
Exported chat histories and original emails with headers
Profile URLs, usernames, user IDs, phone numbers, and email addresses
Website URLs, domain names, app names, and download links
Advertisements, videos, webinars, presentations, and referral materials
Contracts, account-opening forms, terms, invoices, and certificates
Screenshots or recordings of the dashboard, displayed balance, and failed withdrawals
Every demand for a fee and the reason given
Bank statements, transfer receipts, reference numbers, QR codes, and beneficiary details
Crypto wallet addresses, transaction hashes, network names, and exchange records
Call logs and recordings already lawfully in your possession
Copies of IDs, licenses, court orders, tax forms, or letters sent by the suspects
Your reports to institutions and agencies, including acknowledgment emails and case numbers

Prepare a simple chronology showing the date, person or account involved, representation made, action taken, amount paid, and supporting file. Keep an untouched backup. Do not crop out dates, usernames, URLs, transaction references, or surrounding context.

Under the Cybercrime Prevention Act, service providers must preserve specified traffic data and subscriber information for minimum periods, and law enforcement can issue preservation and disclosure measures subject to statutory and warrant requirements. Victims cannot compel disclosure themselves, which is another reason to report promptly.

What laws may apply

Depending on the evidence, the conduct may involve:

Estafa or other fraud under the Revised Penal Code
Fraudulent or unregistered securities activity under the Securities Regulation Code
Computer-related fraud, identity theft, illegal access, or an offense committed through information and communications technology under the Cybercrime Prevention Act
Money-mule activity or social-engineering offenses under the Anti-Financial Account Scamming Act
Other offenses involving access devices, falsified documents, money laundering, threats, or unauthorized use of personal information

The exact charge cannot be determined from the scam’s label alone. A genuine investment that performs badly is not automatically criminal. Investigators will look for matters such as false statements, concealment, lack of authority, deception at the time money was obtained, fictitious profits, diversion of funds, unauthorized account access, or deliberate prevention of withdrawal.

Do not allow your bank account or e-wallet to receive or forward “recovered” money for someone else. Under AFASA, knowingly lending, selling, renting, or allowing an account to be used to handle criminal or social-engineering proceeds can expose an account owner or recruiter to serious liability.

Common mistakes

Paying one final fee because the displayed balance is much larger
Trusting a recovery agent who knows details of the original loss
Calling a number found in the scammer’s message or fake website
Reporting only to a social-media platform and not to the financial institution
Waiting for SEC or police action before notifying the bank
Deleting chats, resetting the phone, or closing the fake account before preserving evidence
Describing a self-initiated payment as unauthorized instead of explaining the deception
Posting unverified names, IDs, or account numbers publicly
Paying a “hacker” to break into an account or retrieve crypto
Assuming that an SEC company registration proves authority to take investments
Treating a temporary bank hold as a guaranteed refund
Omitting earlier payments out of embarrassment

Report facts in good faith and distinguish what you personally know from what you suspect. AFASA penalizes malicious or bad-faith reporting of completely unwarranted or false information that causes funds to be held; this does not prevent an honest victim from reporting a genuinely disputed transaction.

When legal or emergency help is urgent

Seek immediate assistance if:

A transfer has just occurred or another transfer is scheduled.
The scammer still has remote access to a device or access to email, banking, or a SIM.
IDs, selfies, signatures, card details, passwords, OTPs, biometrics, seed phrases, or private keys were disclosed.
The victim’s account was used to receive or forward other people’s money.
There are threats, blackmail, stalking, or demands to meet in person.
The loss involves retirement funds, business funds, borrowed money, or an amount requiring urgent asset-preservation measures.
The financial institution refuses to accept or document a fraud report.
A subpoena, prosecutor’s notice, account-freeze notice, or court document has been received.

For immediate physical danger, call 911. A Philippine lawyer can assess possible civil recovery, provisional remedies, criminal complaints, and responses to account restrictions. Verify anyone claiming to be a lawyer through the Supreme Court’s official Lawyers List and contact the lawyer or firm using independently obtained details. Lawyers may legitimately charge professional fees, but no lawyer can honestly guarantee recovery or a particular government action.

Frequently asked questions

I personally approved the transfer. Can I still report it?

Yes. Explain that you initiated the transfer because of specific false representations. AFASA’s disputed-transaction framework can cover transactions facilitated through social engineering, but the institution must assess whether the facts and type of payment fall within the rules.

Will the bank automatically return my money?

No. A temporary hold prevents available funds from being withdrawn while verification proceeds; it is not an automatic refund. Recovery is harder when the money has already been withdrawn, transferred again, converted to cryptocurrency, or sent outside the covered financial system.

Is every withdrawal fee a scam?

No. A legitimate regulated service may impose properly disclosed fees. Treat the demand as highly suspicious when it was not disclosed in advance, keeps changing, must be paid to a personal account or wallet, cannot be deducted from the balance, or is accompanied by threats and guaranteed-release promises.

Should I pay a recovery company if it says it has already traced the funds?

Do not pay until its identity, authority, address, personnel, and claimed recovery are independently verified. Do not rely on documents or contact details it supplied. Never provide online-banking access, an OTP, seed phrase, or private key.

Can I report a foreign or anonymous scammer?

Yes. Philippine cybercrime and AFASA jurisdiction can apply in defined circumstances involving damage to a person in the Philippines, Philippine-based systems, or accounts maintained by institutions operating here. Cross-border location may make investigation and recovery slower, but it is not a reason to withhold the report.

Is there a 24-hour or 30-day deadline to report?

There is no universal 24-hour deadline for filing every investment-scam complaint. The 30-day period in AFASA is the maximum administrative holding period for disputed funds, not a deadline that victims should wait for. Bank, card, platform, civil, and criminal deadlines differ. Report immediately; delay can reduce recovery options and allow electronic evidence to disappear.

Do I need a lawyer before reporting?

Not for the initial reports to the financial institution, SEC, CICC, NBI, or PNP. Legal advice becomes particularly important for a substantial loss, a disputed ownership claim, possible civil action, threats, account freezing, or concern that the victim’s account was used as a money mule.

This article provides general Philippine legal information, not legal advice for a particular case. The applicable remedies depend on the payment method, documents, representations, institutions, and transaction trail. Laws, regulations, procedures, and official channels were checked as of 4 August 2026.