An online casino may be operating illegally, falsely claiming a PAGCOR license, refusing to release withdrawals, using mule bank accounts, stealing personal data, or running from a physical office in the Philippines. The correct reporting route depends on what happened. In most cases, you should preserve the digital evidence first, verify the exact website or app against PAGCOR’s official records, report the operator to PAGCOR, and file a separate cybercrime report if fraud, identity theft, threats, or financial loss is involved.

Is Online Casino Gambling Legal in the Philippines?

Online gambling is not automatically illegal in the Philippines. The central question is whether the game and operator have authority from the proper government regulator and whether they are operating within the conditions of that authority.

Under Presidential Decree No. 1869, as amended by Republic Act No. 9487, the Philippine Amusement and Gaming Corporation, or PAGCOR, has broad authority to operate and license gambling activities within Philippine territory, subject to exceptions created by other laws.

Executive Order No. 13, series of 2017, treats a gambling activity as illegal when it:

Has no license or authority from a duly empowered regulator;
Operates outside the scope of its license;
Violates the conditions imposed by the regulator; or
Uses permits issued by an agency that has no legal authority over the activity.

The Supreme Court applied the same basic distinction in Republic of the Philippines and the City of Baguio v. Association of Barangay Councils, G.R. No. 207118, April 22, 2025: gambling is not illegal merely because money is wagered, but it may become illegal when the required authority is absent or regulatory conditions are violated. (Lawphil)

Domestic online gaming is different from a POGO

A common source of confusion is the difference between:

A locally authorized electronic gaming operator serving qualified players in the Philippines; and
A Philippine Offshore Gaming Operator, Internet Gaming Licensee, or similar operation serving an offshore market.

Executive Order No. 74, issued on November 5, 2024, imposed an immediate ban on Philippine offshore gaming, Internet gaming licensees, and other offshore gaming operations. Existing offshore operations were ordered to wind down by December 31, 2024. A website claiming in 2026 that it has an active “PAGCOR offshore,” “POGO,” or “IGL” license should therefore be treated as highly suspicious. (Presidential Communications Office)

The offshore ban did not automatically abolish every form of domestically regulated electronic gaming. PAGCOR continues to publish lists of accredited gaming system administrators, registered brands, and approved domains for the Philippine market.

How to Check Whether an Online Casino Is PAGCOR-Licensed

Before reporting the site as illegal, compare its exact domain name with PAGCOR’s current list.

PAGCOR’s list of accredited gaming system administrators, registered brands, and domain names dated June 30, 2026 identifies approved operators, brands, main domains, subdomains, and additional URLs. (Pagcor)

Check all of the following:

Exact spelling of the domain. example.ph and example-bet.ph are different websites. Scammers frequently add a word, number, hyphen, or different domain extension.
The specific app download source. An approved brand name does not automatically make every APK, app-store listing, Telegram bot, or download link legitimate.
The legal operator behind the brand. Compare the company name shown in the terms, privacy notice, payment page, and PAGCOR list.
Registered mirror domains and subdomains. A copied PAGCOR logo or certificate is not proof. The actual URL should appear in the official list or be confirmed directly by PAGCOR.
Whether the site claims to serve offshore players under an old POGO or IGL license. Those operations are covered by the offshore gaming ban.

Absence from the published list is a strong warning sign, but it is better to ask PAGCOR for confirmation rather than publicly declaring that a site is criminal. Lists may be updated, and some app interfaces redirect users through several domains.

Where to Report an Online Casino in the Philippines

Situation	Primary office	Additional report
Unlisted website, fake PAGCOR certificate, or suspected unlicensed online casino	PAGCOR Electronic Gaming Licensing Department	CICC, PNP Anti-Cybercrime Group, or NBI Cybercrime Division
Money taken through deception or withdrawals blocked after repeated additional-payment demands	Bank or e-wallet provider and law enforcement	PAGCOR if the operator claims to be licensed
Unauthorized bank, card, or e-wallet transaction	Financial institution immediately	CICC, PNP-ACG, NBI, then BSP if the institution does not resolve the complaint
Physical online gambling or scam hub operating from a building	PNP or NBI	PAGCOR and the city or municipal government
Threats, detention, trafficking, or immediate danger	911 or the nearest police station	NBI, PNP specialized units, or IACAT as appropriate
Misuse of IDs, selfies, contact lists, or other personal information	National Privacy Commission	CICC, PNP-ACG, or NBI if criminal conduct is involved
Complaint involving a licensed operator’s payout, account closure, or responsible-gaming rules	Operator’s complaint channel, then PAGCOR	Law enforcement only when there is evidence of fraud or another offense

PAGCOR

For a suspected illegal online casino, fake license, unregistered domain, or regulatory violation, send the information to PAGCOR’s Electronic Gaming Licensing Department.

Current PAGCOR regulatory contacts include:

Email: eGaming_Policy@pagcor.ph
General inquiries: info@pagcor.ph
Trunklines: (02) 8521-1542 and (02) 8522-0299
PAGCOR regulatory contact page

PAGCOR’s published contact directory identifies the Electronic Gaming Licensing Department as the appropriate regulatory unit for electronic gaming concerns. (support.pagcor.ph)

Cybercrime Investigation and Coordinating Center

The CICC receives reports of online scams and other cybercrime incidents and may coordinate or refer cases to the appropriate investigative agency.

Hotline: 1326
Email: report@cicc.gov.ph
Mobile numbers: 0991 481 4225, 0947 714 7105, and 0966 976 5971

These channels are listed in the Bangko Sentral ng Pilipinas’ September 2025 consumer complaint guide.

Philippine National Police Anti-Cybercrime Group

Report to the PNP Anti-Cybercrime Group, particularly when the case involves fraud, phishing, threats, hacked accounts, identity theft, or operators who can be traced to a Philippine location.

Email: acg@pnp.gov.ph
You may also go to the nearest police station or cybercrime unit.

A police blotter documents that you reported an incident, but it is not always the same as a complete criminal complaint. For an investigation, you may still be asked to submit a complaint-affidavit, transaction records, and your original devices.

National Bureau of Investigation Cybercrime Division

The NBI may handle online casino cases involving organized fraud, multiple victims, foreign operators, complex digital evidence, or operations spanning several cities or countries.

Email: ccd@nbi.gov.ph
NBI hotline: (02) 8523-8231
NBI online complaint page
NBI office and division directory

The NBI Citizen’s Charter states that computer-crime complainants may proceed to the Cybercrime Division, undergo a preliminary interview, execute sworn statements, and submit devices and supporting documents relevant to the investigation. The intake process itself has no stated filing fee. (National Bureau of Investigation)

Step-by-Step Guide to Reporting an Online Casino

1. Stop sending money

Do not pay another “verification fee,” “tax,” “unlocking fee,” “VIP upgrade,” “anti-money laundering deposit,” or “withdrawal bond.”

A typical casino scam works by showing a large balance or alleged jackpot, then demanding repeated payments before a withdrawal can be processed. Each new payment is usually presented as the final requirement.

Do not continue gambling merely to collect more evidence. You may increase your loss and potentially expose yourself to liability for participating in unauthorized gambling.

2. Contact your bank or e-wallet immediately

When money has just been transferred, contact the sending bank, card issuer, or e-wallet through its official fraud channel. Ask it to:

Record the transaction as disputed or fraud-related;
Preserve the transaction and account records;
Check whether the recipient funds can be temporarily held;
Coordinate with the receiving institution; and
Give you a complaint or case reference number.

Republic Act No. 12010, the Anti-Financial Account Scamming Act, penalizes money-mule activities and social-engineering schemes involving bank accounts, e-wallets, and other financial accounts. It also provides mechanisms for temporary holding and coordinated verification of disputed transactions under BSP rules. Recovery is not guaranteed, particularly when the money has already been withdrawn or transferred through several accounts, but rapid reporting can materially improve the chances of tracing or preserving funds. (Lawphil)

Never send your PIN, password, one-time password, card security code, or full login credentials to PAGCOR, BSP, the police, or anyone claiming to assist with recovery.

3. Preserve the original digital evidence

Collect the evidence before the website disappears, changes its domain, deletes your account, or removes its messages.

Preserve:

The full website address, including the page path;
Screenshots showing the browser address bar;
Screen recordings of the app, wallet, account balance, and withdrawal history;
The app name, APK file, app-store page, or download link;
Your casino username and account number;
Chats with agents, customer support, promoters, or “account managers”;
Telegram, Viber, Messenger, WhatsApp, or SMS numbers;
Advertisements, referral codes, social-media posts, and influencer promotions;
Deposit and withdrawal instructions;
Bank and e-wallet account names, numbers, QR codes, and transaction references;
Dates, times, amounts, and currency used;
Emails and their complete headers, where available;
The purported PAGCOR license or certificate;
Names, addresses, company registrations, and physical locations shown by the operator.

Keep the original files. Avoid relying only on cropped screenshots because cropping may remove the URL, date, sender identity, or surrounding context.

Create at least two backups. One can be stored in secure cloud storage and another on a separate device or drive.

4. Prepare a short chronology

Investigators can understand a case faster when the facts are arranged by date.

A useful chronology looks like this:

Date and time	Event	Amount or account involved	Evidence
June 2, 2026, 8:15 p.m.	Saw Facebook advertisement and registered	None	Screenshot A
June 2, 2026, 8:40 p.m.	Deposited through e-wallet	₱5,000	Receipt B
June 4, 2026, 10:10 a.m.	Requested withdrawal	₱18,500	Screen recording C
June 4, 2026, 11:30 a.m.	Agent demanded “tax deposit”	₱3,700 requested	Chat export D
June 5, 2026	Site stopped responding	—	Screenshots E–F

State what you personally saw or experienced. Clearly label information received from another person rather than presenting it as your own direct knowledge.

5. Verify the domain and license claim

Search the official PAGCOR list for:

The operator;
Brand;
Exact domain;
Subdomain; and
Additional URLs.

Take a screenshot or save a copy of the official list showing the relevant result or absence. Because lists change, include the document date.

You may also email PAGCOR and ask a direct question:

Is the website [exact domain], using the brand [brand], currently authorized by PAGCOR to accept players or wagers in the Philippines?

6. Send a focused report to PAGCOR

Use a clear subject line such as:

Suspected Unlicensed Online Casino — [brand and exact domain]

Include:

Your name and reliable contact information;
The exact website, app, or social-media account;
The dates you accessed it;
The reason you suspect it is illegal or noncompliant;
The license number or PAGCOR certificate it displays;
The payment accounts it uses;
Your loss, if any;
Known promoters, agents, or physical addresses;
A numbered list of attachments; and
A request for a reference number or confirmation of receipt.

Do not attach passwords, PINs, OTPs, or unredacted copies of sensitive IDs unless an authorized investigator specifically requires them through a secure channel.

7. File a cybercrime report when there is fraud or another offense

A regulatory report to PAGCOR and a criminal complaint serve different purposes.

PAGCOR determines licensing and regulatory compliance.
PNP and NBI investigate possible crimes.
CICC coordinates cybercrime reports and referrals.
Your bank or e-wallet handles the first financial dispute.
BSP handles unresolved consumer complaints against BSP-supervised institutions.

For a formal criminal case, expect to identify yourself, answer questions, and execute a sworn statement. The investigator may examine your phone or computer, ask for original records, identify other victims, obtain account-preservation requests, and seek cybercrime warrants where legally justified.

8. Keep all reference numbers and follow up in writing

Maintain a report log containing:

Agency;
Date filed;
Email address or office;
Name of receiving officer, if provided;
Reference number;
Documents submitted; and
Follow-up date.

When following up, reply to the original email chain. Do not repeatedly send separate complaints without mentioning the first reference number, because this may cause duplicate records.

Evidence Checklist

Evidence	Why it matters
Exact URL and screenshots with address bar	Distinguishes the real site from copies and mirror domains
PAGCOR certificate displayed by the site	Helps determine whether the certificate is fabricated, expired, or misused
Bank or e-wallet receipt	Identifies the financial trail and recipient account
Chat export	Shows representations, payment demands, threats, and admissions
Withdrawal history	Shows whether funds were blocked or conditions were changed
Original advertisement	Identifies promoters and how victims were recruited
Phone numbers and social-media profiles	Helps link operators, agents, and accounts
Chronology	Allows investigators to understand the sequence quickly
Valid government ID	May be required when executing a formal complaint or affidavit
Original phone or computer	May be needed for examination or authentication of digital evidence

What Laws May Apply?

The proper charge depends on what the evidence shows. Reporting an online casino does not mean every law below automatically applies.

Illegal gambling under Presidential Decree No. 1602

Presidential Decree No. 1602 penalizes participation in and operation of unauthorized gambling activities. Liability may differ depending on whether a person is merely a bettor, an employee, an agent, a collector, a maintainer, a manager, or a financier. (Lawphil)

Republic Act No. 9287 is often cited in discussions about illegal gambling, but it specifically increases penalties for illegal numbers games, such as jueteng, masiao, and last two. It should not be treated as the universal statute for every online casino offense. (Lawphil)

Estafa under Article 315 of the Revised Penal Code

If operators obtained money through false representations—for example, by inventing a license, displaying a fake balance, promising a withdrawal they never intended to release, or demanding fabricated taxes—Article 315 on estafa may apply.

A delayed withdrawal alone does not automatically prove estafa. Investigators must distinguish deliberate deceit from a genuine account review, technical problem, contractual dispute, or regulatory hold. (Lawphil)

Cybercrime Prevention Act of 2012

Section 6 of Republic Act No. 10175 provides that crimes under the Revised Penal Code and special laws committed through information and communications technology may be covered by the Cybercrime Prevention Act, with the statutory consequence specified in that section.

The law also gives authorities procedures for preserving, examining, and obtaining computer data through judicially authorized cybercrime warrants. (Lawphil)

Anti-Financial Account Scamming Act

Republic Act No. 12010 may apply when casino-related scammers:

Buy, rent, sell, or lend financial accounts;
Recruit people to receive or transfer proceeds;
Use fictitious identities;
Obtain bank or e-wallet credentials through deception; or
Operate coordinated social-engineering schemes.

The Act covers bank accounts, e-wallets, and other BSP-supervised financial accounts. (Lawphil)

Data Privacy Act of 2012

An online casino may also violate Republic Act No. 10173 when it unlawfully collects, uses, discloses, or fails to protect passports, IDs, facial images, contact lists, financial details, or other personal data.

A person directly affected by misuse of personal data may use the National Privacy Commission’s formal complaint procedure. The NPC generally requires a verified or notarized complaint form and supporting evidence for a formal case. (National Privacy Commission)

Special Situations

The casino appears licensed but will not release my withdrawal

Start with the operator’s formal complaint channel and request a written explanation stating:

The exact term allegedly violated;
The transaction or game under review;
The documents required;
The expected completion date; and
The operator’s final decision.

Then report the issue to PAGCOR with the complaint record.

Do not pay an alleged “PAGCOR tax” or “BIR clearance fee” to a personal bank or e-wallet account. Legitimate tax obligations are not normally settled by transferring money to an agent’s personal account so that a casino withdrawal can be unlocked.

The casino uses a legitimate brand name but a different URL

This may be a clone or phishing site. Record both:

The genuine domain found in PAGCOR’s list; and
The suspicious domain you used.

Send the comparison to PAGCOR and law enforcement. Also report the impersonating account to the relevant social-media platform, hosting provider, app store, or search engine.

I know the physical location of an online casino or scam hub

Do not enter, confront employees, photograph through restricted areas, or conduct your own entrapment operation.

Provide the police or NBI with:

Complete address;
Floor or unit number;
Building name;
Work schedules;
Vehicle descriptions;
Photographs taken lawfully from public areas;
Names used by recruiters;
Job advertisements; and
Any indications of coercion, detention, trafficking, weapons, or threats.

Call emergency services when someone is in immediate danger.

My identity documents were submitted to the casino

Change passwords, enable multifactor authentication, notify your financial institutions, and monitor for unauthorized accounts or transactions.

A formal NPC complaint may be appropriate if your documents were misused, disclosed, or retained without a lawful basis. A separate PNP, NBI, or CICC report may be needed for identity theft or financial fraud.

A minor is using the online casino

Report the account to the operator and PAGCOR. Preserve proof of the age information given to the operator, advertisements directed at minors, payment method, and account activity.

Do not publicly post the child’s name, photograph, ID, or transaction records.

The main concern is gambling addiction

PAGCOR provides self-exclusion and family-exclusion procedures for persons who need to be barred from regulated gaming venues or sites. A spouse, adult child, or parent may qualify to apply for family exclusion, subject to documentary requirements.

PAGCOR’s player-exclusion page lists the forms and required proof of relationship. Foreign-issued relationship documents may require authentication acceptable to Philippine authorities. (Pagcor)

Reporting From Outside the Philippines

A Filipino or foreign national abroad may make an initial report by email to PAGCOR, CICC, PNP-ACG, or NBI. Include:

Your country and time zone;
Passport nationality;
Philippine contact details, if any;
Whether the money passed through a Philippine bank or e-wallet;
Whether the operator, agents, servers, or office are believed to be in the Philippines; and
Whether you can attend an online interview or execute a sworn statement.

An investigator may later require a sworn affidavit. Depending on the country and the agency’s instructions, the document may be:

Executed before a Philippine embassy or consulate;
Notarized locally and apostilled in a country that is party to the Apostille Convention; or
Authenticated or legalized under the procedure applicable to a non-Apostille country.

Do not obtain an apostille before the investigator confirms that it is necessary. Ordinary screenshots, emails, and transaction records do not automatically need apostilles merely because the reporter is abroad.

Fees, Notarization, and Expected Timelines

Item	Typical practical position
Initial report to PAGCOR, CICC, PNP, or NBI	Generally no filing fee
Bank or e-wallet fraud report	No government filing fee; provider procedures apply
NBI cybercrime intake	Citizen’s Charter states no fee for the listed intake steps
Complaint-affidavit	May be sworn before an authorized officer; private notarization may involve a notarial fee
Formal NPC complaint	Verified or notarized form and evidence are generally required
Apostille or consular notarization abroad	Only when required for a formal document; government fees depend on the country and service
Initial acknowledgment	May be immediate or within several working days, depending on the channel
Full investigation	Often takes weeks or months and may take longer for foreign platforms, multiple accounts, warrants, or cross-border requests
Recovery of money	No guaranteed timeline; may be impossible if funds were withdrawn, converted, or transferred abroad

The NBI’s published intake estimate covers the front-end complaint and preliminary interview—not the completion of an investigation, arrest, prosecution, or recovery of funds. (National Bureau of Investigation)

For an unresolved bank or e-wallet complaint, first use the institution’s Financial Consumer Protection Assistance Mechanism. You may then escalate the matter through the BSP Online Buddy or email the prescribed form to consumeraffairs@bsp.gov.ph. BSP requires proof that the complaint was first raised with the financial institution.

Common Mistakes That Weaken a Report

Reporting only the casino’s brand name without the exact URL;
Deleting chats after becoming angry or embarrassed;
Sending only cropped screenshots;
Paying another fee while waiting for authorities to respond;
Posting accusations on social media before preserving the evidence;
Warning the operator that a police report is about to be filed;
Giving an alleged “recovery agent” access to the victim’s bank account;
Filing with only one agency when both regulatory and criminal issues are involved;
Sending passwords, OTPs, or card security codes in a complaint email;
Exaggerating facts or including rumors that cannot be supported;
Assuming a copied PAGCOR logo proves the site is licensed;
Assuming every withdrawal dispute is automatically estafa; and
Assuming a police blotter alone is a complete criminal complaint.

Sample Online Casino Report

Subject: Suspected Unlicensed Online Casino — [Brand and Exact Domain]

I am reporting the website/app [full URL or app name], which appears to offer online casino games to persons in the Philippines.

I accessed the platform on [date and time]. It claimed to be licensed by PAGCOR under [license number or certificate details]. I could not locate the exact domain in PAGCOR’s published list dated [date of list].

I deposited a total of [amount] through [bank/e-wallet] to the following account:

Account name: [name]

Account or mobile number: [number]

Transaction reference: [reference]

Date and time: [date and time]

The operator later [briefly explain what happened—for example, demanded an additional fee, refused withdrawal, changed the terms, or stopped responding].

Known contact details of the operator or agent are:

Phone number:

Email:

Social-media account:

Telegram/Viber/WhatsApp username:

Physical address, if known:

Attached are:

Screenshots showing the complete URL;

Copy of the alleged PAGCOR certificate;

Deposit receipts and transaction records;

Chat history;

Withdrawal records; and

Chronology of events.

Please confirm whether this operator and domain are authorized and refer the matter for investigation if appropriate. Kindly provide a reference number for follow-up.

Frequently Asked Questions

Can I report an online casino anonymously?

You may provide an initial tip without publishing your identity to the operator or the public. However, an agency may need your identity, interview, affidavit, and evidence if you want a criminal investigation, account tracing, or possible recovery of funds. Ask the receiving agency whether your identity can be treated as confidential.

Can I report an online casino even if I did not lose money?

Yes. You may report a suspected unlicensed site, fake PAGCOR certificate, illegal advertisement, physical operation, or recruitment scheme even if you did not place a bet. Clearly state that you are providing information rather than filing as a financial victim.

What should I do if the casino is not on PAGCOR’s list?

Save proof of the exact domain and the version of PAGCOR’s list you checked. Email PAGCOR for confirmation and report the site. If the site took money, stole data, made threats, or used deceptive representations, file a separate cybercrime report.

Is a PAGCOR logo enough to prove that a casino is legitimate?

No. Logos, seals, QR codes, and certificates can be copied or fabricated. Verify the operator, brand, and exact domain against PAGCOR’s official records.

Can PAGCOR recover my money?

PAGCOR can investigate regulatory issues involving operators under its jurisdiction, but a report does not guarantee reimbursement. Fraud-related tracing or freezing may require immediate action by financial institutions and law enforcement.

Should I report the receiving bank account?

Yes. Provide it to your bank or e-wallet and to the investigating agency, together with the account name, number, transaction reference, amount, date, and time. Do not contact or threaten the account holder yourself.

Is refusing a withdrawal automatically estafa?

No. A refusal may result from account verification, suspicious-transaction review, disputed game results, bonus conditions, or a regulatory issue. It may indicate estafa when the evidence shows deliberate deception intended to obtain money or induce additional payments.

Can a foreigner file a complaint in the Philippines?

Yes. Foreign nationality does not prevent a person from reporting conduct connected with the Philippines. The agency may ask for passport identification, remote interview arrangements, transaction records, and a properly executed affidavit.

Should I go to the barangay first?

A barangay may record local information or assist with safety concerns, but it cannot determine whether a website holds a PAGCOR license, block a domain, investigate digital financial trails, or replace the PNP, NBI, CICC, or PAGCOR. Report directly to the appropriate national agency.

Can I get in trouble for admitting that I played on the site?

Participation in unauthorized gambling can create legal exposure under Philippine gambling laws. Give investigators truthful information and do not destroy or alter evidence. The operator, agents, collectors, and financiers generally face different legal issues from those of an ordinary bettor, and the applicable charge depends on the facts.

Key Takeaways

Verify the exact website or app domain, not merely the casino’s brand or PAGCOR logo.
Active POGO and IGL offshore operations were banned under Executive Order No. 74 and were required to wind down by December 31, 2024.
Report licensing and regulatory concerns to PAGCOR.
Report scams, identity theft, threats, and organized online operations to CICC, PNP-ACG, or NBI.
Notify your bank or e-wallet immediately when money has been transferred.
Preserve original screenshots, chats, URLs, app files, advertisements, and transaction records.
Do not pay additional “withdrawal,” “tax,” “verification,” or “unlocking” fees.
An initial report is generally free, but a formal investigation may require a sworn statement and original evidence.
A report may lead to investigation or account tracing, but it does not guarantee that lost money will be recovered.