If you sent money to an online “investment” platform, crypto trading group, forex bot, AI trading scheme, Telegram recruiter, Facebook page, or person who now refuses to let you withdraw, act quickly. Online investment scams in the Philippines are usually not just one legal problem. They may involve illegal investment solicitation, securities fraud, estafa or swindling, cybercrime, money mule bank or e-wallet accounts, and sometimes organized syndicated fraud. This guide explains where to report, what evidence to preserve, what laws may apply, and what realistically happens after you file a complaint.

First: Stop Sending Money and Preserve Everything

Many victims lose more money after the first deposit because the scammer says they must pay a “tax,” “unlocking fee,” “anti-money laundering clearance,” “verification charge,” “upgrade fee,” or “withdrawal processing fee.” In real investment platforms, legitimate fees are usually disclosed before you invest and are not demanded through personal bank accounts, e-wallet numbers, crypto wallets, or random agents in chat.

Do these immediately:

Stop sending money. Do not pay any more “withdrawal” or “release” fees.
Do not delete chats, emails, receipts, screenshots, or call logs.
Report the transaction to your bank, e-wallet, remittance company, or crypto exchange immediately.
Take screenshots and screen recordings before the website, Facebook page, Telegram group, or account disappears.
Write a simple timeline while details are still fresh.
Report to the proper government offices, especially the SEC, PNP Anti-Cybercrime Group, NBI Cybercrime Division, CICC/I-ARC, and BSP when a bank or e-wallet is involved.

Speed matters because scam accounts are often emptied quickly. Banks, e-wallets, investigators, and regulators need transaction reference numbers, account names, timestamps, wallet addresses, usernames, URLs, and chat records before they disappear or become harder to trace.

What Makes an Online Investment Scam Illegal in the Philippines?

An online investment scam usually has some combination of these red flags:

The public is invited to invest money with a promise of high returns.
The person or platform claims the investment is “guaranteed” or “risk-free.”
Returns are supposedly generated by crypto, forex, AI trading, casino arbitrage, real estate, mining, stocks, lending, or import/export, but there is little verifiable business activity.
Investors earn more by recruiting others.
Withdrawals are delayed, blocked, or made conditional on paying more money.
The company says it is “SEC registered,” but cannot show authority to sell securities or solicit investments.
Payments are sent to personal GCash, Maya, bank, remittance, or crypto wallet accounts.
The supposed broker, trader, or account manager is not properly registered or licensed.

A very important point: SEC company registration is not the same as authority to solicit investments from the public. A corporation may be registered as a juridical entity, but that does not automatically allow it to sell securities, issue investment contracts, operate as a broker, or take public investments. Under the Securities Regulation Code, securities cannot generally be sold or offered for sale or distribution in the Philippines without registration approved by the SEC, and brokers, dealers, salesmen, and associated persons must also be registered with the SEC. (Supreme Court E-Library)

Legal Basis: Laws That May Apply to Online Investment Scams

Several Philippine laws may apply at the same time. The exact charges depend on the evidence, the amount involved, the number of victims, the method used, and whether the scheme involved securities, financial accounts, electronic communications, or organized groups.

Law	Why it matters in an online investment scam
Securities Regulation Code — Republic Act No. 8799 (2000)	Covers illegal sale or offer of securities, fraudulent securities transactions, and unregistered brokers, dealers, or salesmen. The SEC may investigate, impose sanctions, and issue cease and desist orders to prevent fraud or injury to the investing public. (Supreme Court E-Library)
Financial Products and Services Consumer Protection Act — Republic Act No. 11765 (2022)	Defines and penalizes investment fraud, including Ponzi schemes and the offering or selling of investment schemes to the public without SEC license or permit. It also gives financial consumers rights to fair treatment, disclosure, protection of assets against fraud, data privacy, and timely complaint handling. (Supreme Court E-Library)
Revised Penal Code, Article 315 — Estafa	Applies when a person defrauds another through deceit, false pretenses, or abuse of confidence, causing damage. Philippine jurisprudence describes the core of estafa as fraud or deceit that causes prejudice to another. (Lawphil)
Presidential Decree No. 1689 — Syndicated Estafa	May apply when estafa is committed by a syndicate of five or more persons formed to carry out an unlawful scheme to defraud the public. The Supreme Court has emphasized the requirement of at least five persons and the use of an association or entity to defraud the public or its members. (Supreme Court E-Library)
Cybercrime Prevention Act — Republic Act No. 10175 (2012)	Applies when fraud, estafa, identity theft, computer-related fraud, or other crimes are committed through information and communications technology. The NBI and PNP are responsible for cybercrime enforcement, with cybercrime units handling these investigations. (Supreme Court E-Library)
Anti-Financial Account Scamming Act — Republic Act No. 12010 (2024)	Covers financial account fraud, money muling, and social engineering schemes involving bank accounts, e-wallets, transaction accounts, credit cards, and other financial accounts. It also recognizes jurisdiction when elements of the offense, damage, devices, or financial accounts are connected to the Philippines. (Lawphil)

Where to Report an Online Investment Scam in the Philippines

There is no single “perfect” office for every online investment scam. In practice, victims often need to report to more than one office because each agency handles a different part of the problem.

Office or agency	Report here when…	What they can usually do
Securities and Exchange Commission (SEC), Enforcement and Investor Protection Department	The scam involved public investment solicitation, investment contracts, crypto or forex investment offers, Ponzi-type returns, fake trading platforms, or claims of SEC registration.	Receive investment scam complaints, investigate illegal solicitation, issue advisories or enforcement actions, and refer proper cases for prosecution. The SEC iMessage system includes an “eComplaints on Investment Scams” service under the Enforcement and Investor Protection Department. (Securities and Exchange Commission)
PNP Anti-Cybercrime Group (PNP ACG)	The scam happened through Facebook, Messenger, Telegram, WhatsApp, Viber, SMS, email, websites, fake apps, online ads, or e-wallet/bank transfers.	Receive cybercrime complaints, investigate digital fraud, coordinate evidence preservation, and endorse cases for prosecution. The PNP has identified its ACG eComplaint channel and email for cybercrime-related complaints. (www.foi.gov.ph)
NBI Cybercrime Division	The case involves organized groups, fake trading platforms, multiple victims, large amounts, identity theft, crypto wallets, overseas elements, or complex digital evidence.	Investigate cybercrime, receive complaints, gather digital evidence, and recommend criminal charges when supported by evidence. The NBI identifies its Cybercrime Division and official cybercrime contact channel. (National Bureau of Investigation)
CICC / Inter-Agency Response Center Hotline 1326	You need a quick reporting channel for cyber fraud, suspicious messages, scam numbers, or online scam incidents.	Receive cyber fraud reports and coordinate with relevant agencies. The government has encouraged victims of cyber fraud to call 1326 and report suspicious messages through the eGov app. (Philippine News Agency)
Your bank, e-wallet, remittance company, or crypto exchange	You sent money, your account was accessed, or the scam used a bank account, GCash, Maya, remittance account, or exchange account.	Create an incident ticket, attempt tracing or holding of funds when possible, secure your account, and issue documents you may need for your complaint.
Bangko Sentral ng Pilipinas (BSP)	Your complaint involves a BSP-supervised institution such as a bank, e-money issuer, money service business, pawnshop, or other covered financial institution, and the institution has not properly acted on your complaint.	Consumer assistance and regulatory action for unresolved complaints against supervised institutions. BSP guidance generally requires consumers to first raise the issue with the financial institution’s consumer assistance mechanism before escalating to BSP. (Bangko Sentral ng Pilipinas)
City or Provincial Prosecutor / DOJ	You are ready to pursue a formal criminal complaint, usually after evidence gathering by PNP, NBI, or SEC.	Conduct preliminary investigation and determine whether criminal charges should be filed in court. Under the Securities Regulation Code, SEC criminal complaints are referred to the DOJ for preliminary investigation and prosecution. (Supreme Court E-Library)

Step-by-Step: How to Report to the SEC

Report to the SEC if the scam involved public investment solicitation, fake investment contracts, crypto or forex investment schemes, Ponzi-type returns, or claims that the company is SEC registered.

The SEC’s iMessage platform is its official web-based system for public inquiries, complaints, incidents, and requests. It generates an electronic ticket and allows users to track the status of their submission. (Securities and Exchange Commission)

1. Prepare your evidence before opening the ticket

Before filing, organize your evidence into PDF or image files if possible. Include:

Full name of the company, group, platform, or person who solicited the investment
Website links, social media links, Telegram or Messenger usernames, email addresses, phone numbers, referral codes, and group names
Proof of payment, including bank or e-wallet reference numbers
Screenshots of promises of profit, investment plans, payout charts, referral bonuses, and withdrawal restrictions
Screenshots showing that withdrawals were denied, delayed, or made conditional on paying more money
Any contract, receipt, certificate, dashboard, account statement, or onboarding form
Copies of your valid ID and contact details
A short timeline of what happened

2. File through SEC iMessage

The practical process is:

Go to the SEC iMessage portal.
Choose Open a New Ticket.
Read and accept the privacy notice.
Sign in or create access through the SEC’s required account system.
Choose the relevant service.
For investment scam complaints, select the Enforcement and Investor Protection Department service for eComplaints on Investment Scams.
Fill out the complaint form clearly.
Upload your supporting documents.
Submit the ticket and save the ticket number.
Check the ticket status and reply promptly if the SEC asks for clarification or additional documents.

The SEC iMessage user guide explains that after a ticket is created, it is assigned to the responsible department. Users may also check ticket status, reply, and upload files when the handling department needs additional information. (Securities and Exchange Commission)

3. Write a clear complaint narrative

A good SEC complaint is factual and chronological. Avoid emotional accusations without supporting details. A useful format is:

“On [date], I saw an investment offer through [Facebook/Telegram/website/person].”
“The offer promised [specific return], payable every [day/week/month].”
“I was instructed to send money to [account name, account number, bank/e-wallet, crypto wallet].”
“I sent [amount] on [date/time], with reference number [number].”
“After payment, I was given access to [dashboard/group/account].”
“When I tried to withdraw, I was told to pay [tax/fee/upgrade/clearance].”
“I later discovered that other investors had the same experience.”
“Attached are screenshots, receipts, account details, chat records, and the investment offer.”

Step-by-Step: How to Report to PNP ACG or NBI Cybercrime Division

Report to PNP ACG or NBI when the scam happened online, involved electronic communications, used fake websites or social media accounts, involved identity theft, or used bank/e-wallet/crypto accounts.

1. Start with an online or email report when available

For urgent documentation, you may begin with the agency’s online complaint channel or email. Save all automated replies, ticket numbers, or acknowledgment emails. These are useful when you later report to your bank, SEC, or prosecutor.

2. Expect to execute a sworn statement or complaint-affidavit

A formal criminal complaint usually needs a complaint-affidavit. This is a sworn written statement describing what happened, the persons involved, the evidence, and the loss suffered. It may be subscribed before a prosecutor, investigating officer, notary public, or authorized officer depending on the stage and agency practice.

Bring or prepare:

Your valid government ID or passport
Proof of your address and contact information
Printed screenshots and digital copies
Bank, e-wallet, remittance, or crypto transaction records
The receiving account name, number, wallet address, or exchange details
Chat logs, emails, SMS, call logs, URLs, and social media profile links
The SEC iMessage ticket number, if already filed
Bank or e-wallet incident ticket numbers
A written timeline
Names and contact details of other victims, if any

3. Preserve digital evidence properly

Do not rely only on cropped screenshots. Investigators may need context.

Better evidence includes:

Full-screen screenshots showing the date, URL, account name, and conversation thread
Screen recordings scrolling through the entire chat or investment dashboard
Exported chat files where possible
Original receipts downloaded from the bank or e-wallet app
Email headers, not just email screenshots
Crypto transaction hashes and wallet addresses
The device used to communicate with the scammer, if investigators ask to inspect it

Under the Cybercrime Prevention Act, the NBI and PNP have cybercrime enforcement authority. The law and its rules also recognize procedures for preservation and disclosure of computer data, including subscriber and traffic data, subject to legal requirements such as court warrants where applicable. (Supreme Court E-Library)

4. Understand what happens after filing

A cybercrime complaint does not automatically result in an instant refund or arrest. Usually, the process involves:

Complaint intake and evaluation
Interview and sworn statement
Initial digital evidence review
Requests to banks, e-wallets, platforms, telcos, or service providers
Preservation or disclosure requests when legally available
Identification of account holders, devices, IP logs, or connected persons
Referral to the prosecutor for preliminary investigation, if evidence supports a criminal complaint

Timelines vary widely. Simple cases with clear account details may move faster. Cases involving fake identities, foreign platforms, cryptocurrency, deleted accounts, or multiple layers of money mules can take much longer.

Report to Your Bank, E-Wallet, or Crypto Exchange Immediately

Even if you already reported to the SEC, PNP, or NBI, you should still report directly to the financial institution used in the transaction.

For bank or e-wallet transfers

Give the bank or e-wallet provider:

Your account name and number
Date and exact time of transfer
Amount sent
Reference number
Receiving account name and number, if visible
Screenshots of the scam conversation
Police, NBI, PNP, SEC, or CICC report numbers, if already available
A request to trace, hold, freeze, reverse, or investigate the transaction if still possible

Use the provider’s official in-app support, hotline, branch, or email. Ask for a case number or ticket number.

Under the Anti-Financial Account Scamming Act, financial accounts include deposit, trust, investment, credit card, transaction, and e-wallet accounts. The law also penalizes money muling and social engineering schemes involving financial accounts, and gives the BSP authority to inquire into financial accounts in investigations covered by the law. (Lawphil)

For crypto transactions

Crypto cases are harder because blockchain transfers may be irreversible, and scammers often move funds quickly. Still, report immediately and include:

Transaction hash
Sending wallet address
Receiving wallet address
Exchange account details, if known
Screenshots of the platform dashboard
Chat instructions from the scammer
Proof of fiat-to-crypto purchase
KYC information you submitted to the platform, if any

If the scam began as a public investment offer, also report it to the SEC. If it involved deception through websites, apps, messages, or social media, also report it to PNP ACG or NBI Cybercrime Division.

Evidence Checklist for an Online Investment Scam Complaint

Evidence	Why it matters
Valid ID or passport	Establishes your identity as complainant.
Proof of payment	Shows the amount, date, recipient, and transaction reference.
Bank or e-wallet account details	Helps investigators trace the money trail.
Chat records	Shows solicitation, promises, instructions, admissions, and refusal to release funds.
Screenshots of investment offers	Shows how the scheme was marketed to the public.
Website, app, or dashboard screenshots	Shows account balances, blocked withdrawals, fake profits, or platform representations.
Social media profiles and group links	Helps identify recruiters, admins, and other victims.
Emails and SMS messages	Shows electronic communications and possible phishing or social engineering.
Crypto wallet addresses and transaction hashes	Helps trace blockchain movement, even if recovery is not guaranteed.
SEC registration claims or certificates shown by the scammer	Helps the SEC verify whether the entity misused registration or lacked authority to solicit investments.
Timeline of events	Makes your complaint easier to evaluate and reduces inconsistencies.
Names of other victims	May support a pattern of fraud or possible syndicated activity.

Keep both digital copies and printed copies. Do not edit screenshots except to make separate duplicate copies for highlighting. Keep the originals untouched.

Common Mistakes That Can Hurt Your Complaint

Relying only on “SEC registered” claims

Scammers often show a certificate of incorporation to look legitimate. That certificate may only prove that a company name was registered. It does not necessarily prove authority to sell investments, issue securities, manage pooled funds, operate as a broker, or promise returns.

Paying more money to “unlock” withdrawals

This is one of the most common ways victims lose more. Once the platform refuses withdrawal unless you pay a new fee, assume the demand may be part of the scam and preserve the conversation as evidence.

Waiting too long to report

The longer you wait, the more likely the receiving account will be emptied, deleted, renamed, or replaced. Report to your financial institution immediately, then proceed with SEC and cybercrime reporting.

Sending only cropped screenshots

Cropped screenshots may hide context. Investigators need dates, account names, URLs, phone numbers, and full conversation flow. Use full-screen screenshots and screen recordings when possible.

Threatening the scammer before preserving evidence

If you confront the scammer too early, they may delete chats, remove you from groups, block you, take down websites, or warn other participants. Preserve evidence first.

Assuming a barangay blotter is enough

A barangay or police blotter may help document that you reported an incident, but it is usually not enough for an online investment scam. Cybercrime and investment fraud complaints typically need supporting documents and should be brought to the agencies with proper authority and technical capability, such as SEC, PNP ACG, NBI Cybercrime Division, or the prosecutor.

Special Situations

If you are an OFW or Filipino abroad

You can still report a Philippine online investment scam even if you are outside the Philippines. Start by preserving evidence and filing through available online channels such as SEC iMessage, CICC/I-ARC, your bank or e-wallet provider, and the cybercrime complaint channels of PNP or NBI.

If a sworn affidavit is needed while you are abroad, you may be asked to execute it before a Philippine Embassy or Consulate, or to prepare a notarized and properly authenticated document depending on where it will be used. If you have a trusted representative in the Philippines, a properly prepared authorization or special power of attorney may help with follow-ups, but the representative cannot replace your personal knowledge as the victim.

If you are a foreigner scammed by someone in the Philippines

Foreigners may report if there is a Philippine connection, such as:

Money sent to a Philippine bank or e-wallet account
A scammer located in the Philippines
A company registered or pretending to operate in the Philippines
A victim residing in the Philippines
A platform or account using Philippine financial infrastructure

The Anti-Financial Account Scamming Act recognizes jurisdiction in situations where elements of the offense, devices, damage, or financial accounts are connected to the Philippines. (Lawphil)

Prepare your passport, proof of remittance, bank records, chat records, and any documents showing the Philippine connection. If documents are in another language, certified translations may be requested by banks, investigators, or prosecutors.

If many people were victimized

If several victims invested through the same platform or recruiter, coordinate evidence carefully. Each victim should prepare their own proof of payment, chats, and affidavit. A group chat of victims can help identify patterns, recruiters, receiving accounts, and total losses, but individual documents remain important.

If the evidence shows that five or more persons formed or managed an association to defraud the public, authorities may evaluate whether syndicated estafa under PD 1689 applies. (Supreme Court E-Library)

If the scam used a money mule account

A “money mule” is someone who allows a financial account to be used to receive, transfer, or withdraw scam proceeds. Under the Anti-Financial Account Scamming Act, money muling and social engineering schemes involving financial accounts are prohibited. This matters because the name on the receiving account may not be the mastermind, but it is still a critical lead for investigators. (Lawphil)

Practical Timeline: What to Expect

Stage	Practical timing	Notes
Report to bank or e-wallet	Same day, ideally immediately	Fast reporting gives the best chance of tracing or holding funds, but recovery is never automatic.
CICC/I-ARC report	Same day	Useful for quick cyber fraud reporting and scam number or suspicious message reporting.
SEC iMessage complaint	Same day to a few days	Save the ticket number and monitor requests for more documents.
PNP ACG or NBI intake	Same day to several days	You may need to appear, submit documents, and execute a sworn statement.
Digital evidence preservation or requests	Days to weeks	Depends on legal requirements, agency action, provider response, and whether data still exists.
Prosecutor preliminary investigation	Weeks to months or longer	The prosecutor evaluates whether there is probable cause to file charges in court.
Court case	Months to years	Criminal cases take time, especially when there are many victims, multiple accused, or digital evidence issues.

These timelines are practical estimates, not fixed guarantees. Delays commonly happen because of incomplete evidence, wrong account details, unresponsive platforms, fake identities, foreign service providers, crypto transfers, or the need to coordinate with several institutions.

Frequently Asked Questions

Can I get my money back if I report an online investment scam?

Reporting improves your chances, especially if the money is still in a traceable bank or e-wallet account. However, a report does not guarantee a refund. Recovery depends on how quickly you reported, whether the funds remain available, whether the receiving account can be identified, and whether a bank, court, regulator, or law enforcement agency can legally act on the funds.

Should I report to the SEC, NBI, or PNP first?

If it is an investment solicitation scam, report to the SEC. If it happened online, also report to PNP ACG or NBI Cybercrime Division. If money passed through a bank or e-wallet, report immediately to the financial institution. These reports serve different purposes and can support each other.

Is a company legitimate just because it is SEC registered?

No. SEC registration may only mean the entity exists as a corporation or partnership. It does not automatically mean it can solicit investments, sell securities, operate as a broker, manage funds, or guarantee returns. Always verify whether the investment activity itself is authorized.

What if the scammer is using GCash, Maya, or a Philippine bank account?

Report immediately to the e-wallet or bank and ask for an incident ticket. Then report to PNP ACG or NBI Cybercrime Division. If the transaction was part of a public investment scheme, report to the SEC as well. The account holder may be a money mule, but the account is still an important investigative lead.

Can I report if I only have a phone number, Facebook profile, or Telegram username?

Yes. Report what you have, but try to strengthen your evidence with transaction receipts, screenshots, URLs, group links, account names, and timestamps. A phone number or username alone may not be enough to prove the full case, but it can help investigators connect the scam to other reports.

Do I need a lawyer to report an online investment scam?

You can file initial reports with the SEC, PNP, NBI, CICC, your bank, or your e-wallet without a lawyer. A lawyer may become helpful when preparing a detailed complaint-affidavit, organizing many victims, pursuing a prosecutor complaint, responding to subpoenas, or evaluating civil recovery options.

What if I am abroad?

You can begin reporting online and through official email channels. Keep your Philippine bank or e-wallet records, remittance receipts, screenshots, and identification documents. If a sworn affidavit is required, you may need consular notarization, apostille, or other authentication depending on where the document is executed and where it will be submitted.

Is a crypto investment scam reportable in the Philippines?

Yes. If the crypto scheme was offered to the public as an investment, report it to the SEC. If it involved deception through websites, apps, chats, or fake accounts, report to PNP ACG or NBI Cybercrime Division. Include wallet addresses, transaction hashes, exchange details, screenshots, and chat instructions.

Should I pay a “tax” or “clearance fee” to withdraw my investment?

No. A demand for additional payment before withdrawal is a major scam warning sign, especially if the payment must be sent to a personal account, e-wallet, or crypto wallet. Preserve the demand as evidence and report it.

Can I post the scammer’s name online?

Be careful. Public posting may warn others, but it can also create defamation, privacy, or evidence problems if the information is incomplete or wrong. It is usually safer to preserve evidence and report to the proper agencies first, especially if you want a formal investigation.

Key Takeaways

Act fast. Report immediately to your bank, e-wallet, remittance company, or crypto exchange.
Report investment solicitation scams to the SEC, especially if the scheme promised returns, used recruiters, or claimed SEC registration.
Report online fraud to PNP ACG or NBI Cybercrime Division, especially when social media, messaging apps, fake websites, or digital payments were used.
Use CICC/I-ARC Hotline 1326 for cyber fraud reporting and suspicious scam messages.
Do not rely on SEC company registration alone. Authority to solicit investments is different from ordinary corporate registration.
Preserve complete digital evidence, including chats, receipts, URLs, screenshots, screen recordings, account names, transaction references, and wallet addresses.
Do not pay withdrawal fees, tax fees, or verification fees demanded by the scammer.
Recovery is possible in some cases but not guaranteed. The sooner you report, the better the chance that funds, accounts, or perpetrators can be traced.