Here’s a practical, law-grounded guide to reporting an online scam and trying to recover your money in the Philippines. It’s written for victims, helpers, and in-house officers. (This is general information—if you can, consult a lawyer for your specific case.)

1) First 24 hours: what to do immediately

Speed matters. The longer funds sit in the system, the lower the recovery odds.

If money left your account/card/e-wallet without your authorization

Call your bank/e-wallet/card issuer right now. Ask to: • block your account/card/app session; • initiate a recall/chargeback/dispute for the transaction(s); • lodge a formal complaint and get a case/reference number in writing (email/SMS).
Report to the receiving institution. If you know the recipient bank/e-wallet, email their fraud/abuse address with the transfer details and request a freeze/hold on the beneficiary account under their fraud protocols.
Change credentials & secure devices. New passwords, revoke app sessions, enable 2FA, scan for malware. If there’s a SIM-swap risk, contact your telco.
Preserve evidence (see §3). Do not delete chats or emails.
File a police blotter (nearest station) or go straight to PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division (see §4). Keep a copy.

If you paid voluntarily to a seller/investment that turned out to be a scam

Send a same-day demand/cancellation email/message to the seller (see template in §10) asking for a refund and giving a short deadline.
Notify your bank/e-wallet/card issuer that you suspect fraud and request a transaction recall (instaPay/PESONet) or chargeback (for cards).
Proceed with criminal and/or civil remedies in §5–§7.

2) What laws can apply (Philippine context)

Estafa (Swindling) under Article 315, Revised Penal Code – classic fraud, false pretenses, non-delivery after payment, etc.
Cybercrime Prevention Act of 2012 (RA 10175) – computer-related fraud, identity theft, phishing, and offenses done through information systems. It also sets jurisdiction/venue rules and empowers cybercrime courts to issue warrants to get subscriber info, logs, and to search/examine digital evidence.
Access Devices Regulation Act (RA 8484) – credit/debit/ATM and similar device fraud.
E-Commerce Act (RA 8792) + Rules on Electronic Evidence (A.M. No. 01-7-01-SC) – electronic documents (screenshots, emails, logs) can be admissible if properly authenticated.
Financial Consumer Protection Act of 2022 (RA 11765) – banks, e-money issuers, and other FSPs must have redress mechanisms and fair handling of unauthorized electronic transactions. Sector regulators: BSP (banks/e-money/payment), SEC (investment offerings/lending platforms), IC (insurance).
Data Privacy Act (RA 10173) – for doxxing/harassment/illegal processing of your personal data (e.g., loan apps abusing contacts).
Anti-Money Laundering Act (RA 9160, as amended) – banks/e-wallets must report suspicious transactions; authorities can seek freezes and forfeiture when proceeds of unlawful activities are identified.

3) Evidence pack: build it like a case file

Create a single folder and add:

Identity & ownership

Your government ID(s) (masked copy), proof you own the affected account/number/device.

Transaction proof

Bank/e-wallet statements and in-app receipts (PDF/screenshots).
Transfer details: amount, date/time, reference numbers, account names/numbers, receiving institution.

Communication trail

Full chat/email threads with scammer (export if possible).
Marketplace listing links, profile URLs/usernames, phone numbers, group names.

Technical breadcrumbs

Screenshots of phishing pages, domain/URL, sender email headers, SMS headers, caller IDs.
Device details (make/model), app versions.
If available: IP addresses, timestamps, and logs.

Your actions

Copies of all reports (bank ticket number, blotter, NBI/PNP complaint number, regulator complaint number).
Demand letter and proof of sending.

Preserve originals; when you print or export, note the date of capture.

4) Where and how to report (criminal & regulatory)

You can file in parallel—criminal + regulator + financial institution. Parallel tracks increase pressure and options for recovery.

A. Law enforcement (criminal track)

PNP Anti-Cybercrime Group (ACG) – accepts complaints for online fraud, phishing, identity theft, social media scams, e-wallet/card fraud.
NBI Cybercrime Division – similar scope; sometimes preferable for complex or multi-jurisdictional cases.

Prepare:

Complaint-Affidavit (see outline in §10) with annexes (your evidence pack).
Government ID, proof of address, and authority letter if filing for someone else.
Be ready to execute a sinumpaang salaysay (sworn statement).

What happens next:

They may conduct a case build-up and, through prosecutors/courts, seek cybercrime warrants to obtain subscriber info, transaction logs, and to search/seize devices. If accounts are identified, they can coordinate with institutions for holds/freezes (subject to legal thresholds).

B. Public prosecutors / courts

You may go straight to the City/Provincial Prosecutor with a complaint-affidavit for Estafa and/or RA 10175 offenses. The prosecutor conducts inquest (if there’s an arrest) or preliminary investigation (if no arrest).
Upon filing of information, the case goes to the Regional Trial Court (often a designated cybercrime court).

C. Sector regulators (administrative & consumer redress)

BSP – for banks, e-money issuers, payment system operators (unauthorized transfers, failed recalls, poor complaint handling).
SEC – for investment scams, unregistered securities, Ponzi/pyramiding, abusive online lending entities.
Insurance Commission (IC) – if an insurance or HMO entity is involved.
National Privacy Commission (NPC) – for privacy abuses (e.g., loan app harassment, unauthorized use of your data).

Regulatory actions can compel firms to respond, credit back where warranted, improve handling, or face sanctions.

5) Money-back playbook (by scenario)

A) Unauthorized electronic transfer (phishing/smishing/vishing/malware)

Dispute with your bank/e-wallet: open a formal case; ask for temporary blocking and transaction recall (for interbank rails) or chargeback (for cards).
Document “lack of authorization.” Point to evidence of phishing, spoofing, session hijack, SIM swap, or malware.
Escalate if the provider’s decision is unacceptable: elevate internally (appeal) and file with the appropriate regulator (e.g., BSP for banks/e-wallets).
Criminal complaint against the fraudster(s)—helps unlock subpoenas/warrants and sometimes prompts institutions to cooperate more quickly.
Civil action (optional) against identified individuals/entities for damages (see §7).

B) Paid a seller who didn’t deliver / delivered counterfeit

Demand letter with a short deadline (3–5 days).
Platform complaint (marketplace/social media payment partner).
Bank/e-wallet recall (if recent) or card chargeback for non-delivery/merchandise not as described.
Criminal estafa if there’s deceit/false pretenses.
Small claims or ordinary civil action to recover the sum (see §7).

C) Investment/lending app scam

Stop payments; preserve ads and chats.
SEC complaint (unregistered securities/ponzi; abusive lending practices).
Bank/e-wallet recall (if transfers were recent).
Criminal estafa + RA 10175 (if online/tech-facilitated).
Civil recovery from identifiable operators/agents; consider preliminary attachment (Rule 57) if the defendant is absconding or disposing of assets.

6) Chargebacks, recalls, and freezes—what’s realistic

Chargeback (credit/debit cards): Your issuer files under card-network rules; grounds include fraud/unauthorized use and merchandise/service not received. Provide proof quickly; card rules have strict time limits (often counted from the statement/transaction date).
Transfer recall (instaPay/PESONet/e-wallet-to-wallet): Your provider can send a recall/hold request to the receiving institution. Success depends on whether funds remain and the recipient’s cooperation, or if law enforcement/freezing intervenes.
Freezing/forfeiture (AMLA route): Law enforcement may coordinate with the AMLC to freeze suspected proceeds in identified accounts, subject to legal thresholds and approvals. This is powerful but not automatic; it requires a case build-up.

Expectation-setting: Recoveries are best within hours to a few days. After funds are layered/cashed out, recovery odds drop sharply. Still file—cases can lead to restitution later.

7) Civil recovery in court (including Small Claims)

Small Claims (no lawyers required at hearing): useful for straightforward sum of money cases against an identified person/entity (e.g., non-delivery, simple fraud). Thresholds change over time; check the current Small Claims ceiling—if your claim is within it, this is usually the fastest civil route.
Ordinary civil action (with counsel) for larger or complex claims: sum of money, rescission, and damages under the Civil Code.
Venue: Generally where the plaintiff or defendant resides, or where the cause of action arose.
Barangay conciliation: Required for certain civil disputes where both parties reside in the same city/municipality and not otherwise exempt. Online scams often involve unknown or out-of-town defendants, so this may not apply.
Provisional remedies: Consider preliminary attachment to secure assets if you can show statutory grounds (e.g., defendant is about to depart/defraud creditors).

8) Criminal case basics (estafa & cybercrime)

Elements of estafa: deceit or abuse of confidence, and damage. Online lies, fake proofs, spoofed identities, and deliberate non-delivery can qualify.
Cybercrime overlay (RA 10175): when fraud uses a computer system (websites, apps, messaging, online banking), prosecutors commonly add computer-related fraud/identity theft.
Jurisdiction/Venue: Cybercrime cases may be filed where any element occurred, where any computer system was used, or where the damage was felt—this flexibility helps when the scammer is remote.
Electronic evidence: Screenshots, emails, logs, and metadata are admissible if you can authenticate them (e.g., your testimony on how you captured them; device/app records; certificates/logs from providers). Keep originals.

9) Working with banks/e-wallets—tips that improve outcomes

Be precise and chronological in your dispute letter: “On [date/time], ₱[amount] left my [account]. I did not authorize this. Here are the references… Attached are [screenshots/statements].”
Ask which specific rule they are relying on if they deny your claim; request the final written resolution and the appeals process.
Escalate externally (BSP/SEC/IC) with your complete file, especially if response times are unreasonable or reasoning is weak.
Never pay ‘recovery fees’ to anyone who contacts you on social media promising to get your money back.

10) Practical templates (copy-paste and edit)

A) Bank/e-wallet/card dispute (unauthorized transaction)

Subject: Dispute of Unauthorized Transaction – [Account/Card/E-Wallet No.]

Dear [Bank/E-Wallet Name] Fraud Team,

I am disputing the following unauthorized transaction(s) on my [account/card/e-wallet]:

• Date/Time:
• Amount:
• Reference/Trace No.:
• Recipient Name/Account/Wallet:
• Channel (instaPay/PESONet/Card/Other):

I did not authorize these transaction(s). I discovered them on [date/time] and immediately [blocked my card/app, changed passwords]. Attached are my ID, statements, app screenshots, and chat/SMS logs indicating a likely [phishing/SIM swap/malware].

Please (1) block or secure my account, (2) initiate a recall/chargeback, (3) investigate under RA 11765 consumer protection and applicable network rules, and (4) provide me a written report and case/reference number.

Regards,
[Full Name, mobile, email]

B) Demand for refund to a non-delivering seller

Subject: Final Demand for Refund – Non-Delivery of [Item/Service]

Dear [Seller/Company/Handle],

On [date], I paid you ₱[amount] via [mode] for [item/service], with the agreed delivery by [date]. Despite follow-ups, you failed to deliver and have not provided a valid explanation.

This constitutes fraud/estafa and a violation of consumer laws. I demand a full refund of ₱[amount] within [3] calendar days to [account details]. Failing this, I will file criminal and civil actions and report you to the proper authorities/platforms.

Sincerely,
[Full Name]

C) Complaint-Affidavit outline (for NBI/PNP/Prosecutor)

Affiant info (name, age, address, ID).
Narrative of events (chronological; who, what, when, where, how; include device/app used).
Why it’s fraud (false pretenses, unauthorized use, deceit).
Damage (exact amounts, fees, consequential loss).
Attachments (mark as Annex “A,” “B,” etc.).
Prayer (investigate, prosecute, recover funds, freeze accounts).
Jurat (sworn before administering officer).

11) Special issues

Identity theft / loan-app harassment

Report to law enforcement and the NPC for privacy violations; demand cessation and deletion of unlawfully obtained data; document all harassment.
Tell contacts not to engage with harassing messages; consider a cease-and-desist letter.

Cross-border scams

Still file locally. Authorities can request data from platforms and pursue mutual assistance. Recovery odds are lower, but complaints help takedowns and future restitution.

Minors and vulnerable persons

If the victim is a minor, guardians should file; preserve chats meticulously. If sexual extortion is involved, report urgently—special laws apply and handling is prioritized.

12) FAQs

Can I get my money back? Often, maybe—especially if you act within hours and funds haven’t been cashed out. Cards have the strongest recovery via chargebacks. Inter-wallet/bank transfers depend on rapid recalls or freezes.

Do I have to hire a lawyer? Not required to start complaints or small claims (lawyers aren’t allowed to appear in small claims), but legal counsel helps in strategy, evidence, and provisional remedies.

Will filing a criminal case delay card chargebacks or bank recalls? No—pursue them in parallel. Administrative consumer redress and criminal prosecution are different tracks.

What if the scammer used a money mule? File against the identified account holder and “John/Jane Does.” Law enforcement can trace upstream controllers via warrants and KYC records.

13) Recovery checklist (printable)

Freeze/block card/e-wallet; open dispute; get ticket no.
Ask sending bank to recall; notify the receiving bank/e-wallet.
Change passwords; enable 2FA; scan devices; coordinate with telco if needed.
Build your evidence pack (§3).
File law enforcement complaint (NBI/PNP ACG).
File with regulator (BSP/SEC/IC) as applicable.
Send demand letter (if seller known).
Consider small claims or civil action; evaluate attachment if defendant has assets.
Keep a timeline of every action and response.

14) Common pitfalls to avoid

Waiting days before telling your bank/e-wallet.
Deleting chats/posts “to clean up.”
Paying “recovery agents” you met on social media.
Posting full IDs/receipts publicly (protect your data; blur sensitive fields).
Accepting “partial refunds” tied to NDAs from scammers.

15) Final notes

Keep everything written. Verbal promises don’t move institutions.
Be polite but persistent—escalate with facts and attachments.
Even when recovery seems unlikely, a solid report helps authorities dismantle syndicates and may lead to restitution later.

If you want, tell me your exact scenario (card vs. e-wallet, amount, dates, what you still have access to), and I’ll map the fastest next three steps and tailor the letters for you.