If you just realized you sent money to a scammer through a bank transfer, GCash, Maya, or another mobile wallet, speed matters. The first goal is not yet to “file a case” — it is to freeze, trace, or preserve whatever funds and account information may still be available. This guide explains what to do in the first few hours, where to report the scam in the Philippines, what laws apply, what documents you need, and what to realistically expect from banks, e-wallets, the police, the NBI, the BSP, and other agencies.

First, Identify What Kind of Online Scam Happened

Online financial scams are handled differently depending on how the money left your account.

Situation	Example	Why it matters
You were tricked into sending money	Fake seller, fake job, fake investment, romance scam, “reservation fee,” fake courier fee	This is usually treated as fraud or estafa, even if you personally pressed “send.”
Someone accessed your account without permission	Account takeover, phishing link, stolen OTP, SIM-related fraud	This may involve unauthorized transaction rules, cybercrime, data privacy issues, and stronger refund arguments.
You sent money to the wrong account by mistake	Wrong account number, wrong QR, wrong mobile number	This is not always a scam, but recovery may still be possible through bank/e-wallet dispute processes.
Your account was used to receive scam money	Someone paid you to “receive and forward” funds, or borrowed your wallet	This may expose you to investigation as a possible money mule unless you can explain and document what happened.

The most urgent step in all cases is the same: report immediately to your own bank or e-wallet provider through its fraud or consumer assistance channel and ask for a case reference number.

Legal Basis in the Philippines

RA 12010: Anti-Financial Account Scamming Act

The most important current law for bank-transfer and mobile-wallet scams is Republic Act No. 12010, the Anti-Financial Account Scamming Act or AFASA, approved in 2024.

AFASA matters because it specifically covers financial accounts, including:

bank accounts;
transaction accounts with financial institutions;
credit card accounts;
e-wallets; and
other accounts used for financial products or services.

AFASA penalizes, among others:

money muling, such as selling, lending, renting, buying, or allowing the use of a financial account to receive or move proceeds of scams;
opening accounts under fake names or using another person’s identity documents;
recruiting people to lend or sell their bank or wallet accounts;
social engineering schemes, such as deceiving someone into giving sensitive information like passwords, OTPs, account details, or e-wallet credentials; and
attempts, aiding, or abetting these acts.

Under the BSP’s AFASA implementing regulations, banks and BSP-supervised institutions may temporarily hold disputed funds and conduct a coordinated verification process. The initial hold may be for up to 5 calendar days, and may be extended by up to 25 more calendar days, for a total of up to 30 calendar days, unless a court extends it.

This is why fast reporting is critical. If the scammer has already withdrawn, transferred, cashed out, or converted the money, recovery becomes much harder.

RA 11765: Financial Products and Services Consumer Protection Act

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, gives financial consumers rights such as fair treatment, protection of consumer assets against fraud and misuse, data privacy, and timely handling of complaints.

It also requires financial service providers to maintain a Financial Consumer Protection Assistance Mechanism or FCPAM. In practical terms, this means your bank, e-wallet, remittance provider, or other BSP-supervised provider should have a channel for complaints, fraud reports, and transaction disputes.

If the provider does not act, delays without proper explanation, or gives an unsatisfactory response, you may escalate the complaint to the BSP Consumer Assistance Mechanism through the BSP Online Buddy and other BSP consumer assistance channels.

Revised Penal Code: Estafa

Many online scams are also prosecuted as estafa, or swindling, under Article 315 of the Revised Penal Code.

A common form is estafa by false pretenses or fraudulent acts. In simple terms, this happens when:

the scammer made a false representation;
the false representation was made before or at the same time you parted with your money;
you relied on that lie; and
you suffered damage.

The Supreme Court has repeatedly described estafa as centered on fraud or deceit causing damage, and decisions such as G.R. No. 210612 explain the elements of estafa by deceit under Article 315(2)(a).

RA 10175: Cybercrime Prevention Act

If the scam was committed through Facebook, Messenger, Telegram, Viber, WhatsApp, email, fake websites, phishing links, online marketplaces, or other digital means, Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may also apply.

RA 10175 covers computer-related fraud and also increases penalties for crimes under the Revised Penal Code and special laws when committed through information and communications technology.

Other Laws That May Apply

Depending on the facts, authorities may also consider:

RA 8484, the Access Devices Regulation Act, especially if cards, account credentials, or access devices were misused;
RA 9160, the Anti-Money Laundering Act, if scam proceeds are being laundered through multiple accounts;
RA 10173, the Data Privacy Act of 2012, if personal data, IDs, selfies, account details, or sensitive information were misused;
RA 11934, the SIM Registration Act, if registered SIMs were used in fraud, identity misuse, or scam messages; and
securities laws and RA 11765 if the scam involved fake investments, Ponzi schemes, or unauthorized solicitation of investments.

What to Do Immediately After a Bank Transfer or E-Wallet Scam

1. Stop communicating with the scammer

Do not send more money for “refund processing,” “tax,” “unlocking,” “verification,” or “legal clearance.” Many victims lose more money after the first scam because the scammer pretends the funds can still be released.

Do not threaten the scammer with public posts. This often causes them to delete accounts, change usernames, move funds faster, or block you.

2. Secure your accounts

Immediately change passwords and PINs for:

your bank app;
GCash, Maya, ShopeePay, GrabPay, or other e-wallets;
email linked to your financial accounts;
Facebook or messaging accounts used in the transaction; and
online marketplace accounts.

If you clicked a link, installed an app, shared an OTP, or allowed screen sharing, assume your device may be compromised. Turn off remote access apps, uninstall suspicious apps, and avoid using the same device for banking until it is checked.

3. Call or message your own bank or e-wallet provider

Use the official app, hotline, or website of your sending institution — the bank or wallet where the money came from.

Tell them clearly:

“I am reporting a suspected scam or fraudulent transaction. Please create a fraud case, attempt to hold or recall the funds, coordinate with the receiving institution under AFASA, and give me a case reference number.”

Prepare these details:

your full name and account or wallet number;
date and exact time of transfer;
amount;
transaction reference number;
receiving bank, e-wallet, account number, QR code, mobile number, or account name;
screenshots of chats, posts, receipts, and profile pages;
short explanation of how you were deceived.

For example, GCash’s official Help Center has a page on how to report a scam involving GCash, while Maya provides a fraud report form. Banks have their own fraud hotlines and in-app dispute channels.

4. Ask for written confirmation and a case number

Do not rely only on a phone conversation. Ask for:

ticket number;
fraud case number;
email acknowledgment;
chat transcript;
complaint reference number; or
branch endorsement.

This matters because BSP escalation usually requires proof that you reported first to the provider’s FCPAM or customer service channel.

5. Preserve evidence before it disappears

Take screenshots immediately, but also preserve context. A useful screenshot shows:

the scammer’s profile name and username;
phone number or email address;
full conversation, not only selected lines;
timestamps;
payment instructions;
QR code or bank details sent by the scammer;
proof of transfer;
delivery tracking, product listing, fake investment dashboard, or website URL; and
any threats or promises made after payment.

For websites, copy the URL. For emails, keep the full email with headers if possible. For social media accounts, capture the profile URL, page ID if visible, and related posts.

6. Report to CICC or Scam Watch for quick cyber-fraud reporting

For online scam reporting, the Cybercrime Investigation and Coordinating Center works with the Inter-Agency Response Center. The Scam Watch Pilipinas reporting page lists the 1326 hotline and CICC Messenger reporting channel.

This is useful for fast reporting of scam links, numbers, fake pages, and online fraud patterns. It does not replace a bank complaint or a criminal complaint, but it helps route cyber-fraud information.

7. File with PNP Anti-Cybercrime Group or NBI Cybercrime Division

For criminal investigation, report to either:

PNP Anti-Cybercrime Group e-Complaint, or the nearest PNP ACG office; or
NBI Cybercrime Division or an NBI regional cybercrime center.

The NBI Citizen’s Charter for cybercrime complaints shows that complainants may proceed to the Cybercrime Division, undergo preliminary interview, fill out a complaint sheet, and execute sworn statements or submit prepared affidavits and supporting documents.

8. Escalate to BSP if the bank or e-wallet mishandles the complaint

The BSP is not a police agency and does not arrest scammers. Its role is different: it handles complaints against BSP-supervised financial institutions such as banks, e-money issuers, payment service providers, pawnshops, money service businesses, and similar entities.

Under BSP guidance, you should first report to the provider’s FCPAM or customer service channel. If you are not satisfied with the response, escalate through the BSP Consumer Assistance Mechanism, usually through BSP Online Buddy.

Where to Report an Online Scam in the Philippines

Where to report	Use this when	What to ask for
Your sending bank or e-wallet	Money left your account through transfer, QR, InstaPay, PESONet, wallet transfer, card, or cash-in/cash-out	Fraud case number, recall/hold attempt, AFASA coordinated verification
Receiving bank or wallet, if known	You know where the money went	Report the recipient account as suspected scam-related, but expect privacy limits
PNP Anti-Cybercrime Group	Scam happened through online platforms, social media, SMS, email, fake sites, or messaging apps	Complaint acknowledgment, investigation referral, cybercrime case handling
NBI Cybercrime Division	You need investigation, digital evidence handling, or formal complaint processing	Complaint sheet, sworn statement, assigned investigator
CICC / 1326 / Scam Watch	You want to quickly report scam numbers, links, pages, and online fraud patterns	Reference, routing, or record of report
BSP CAM	Bank/e-wallet failed to respond properly or mishandled your dispute	BSPCMS reference number
SEC	Fake investment, crypto investment scheme, Ponzi, “double your money,” fake company registration	File through the SEC iMessage portal
NPC	Personal data, IDs, selfies, or private information were misused or exposed	Complaint-affidavit process through the NPC complaint mechanics page
Telco / NTC	Scam SMS, spoofed sender, suspicious SIM number	Report number and screenshots to your telco and NTC channels

Evidence Checklist

Prepare a folder with the following:

Evidence	Practical notes
Government ID	Passport, driver’s license, UMID, national ID, PRC ID, or other valid ID
Transaction receipt	Screenshot or PDF showing amount, date, time, reference number
Bank or wallet statement	Highlight the disputed transaction
Scammer’s account details	Account name, number, mobile number, QR code, bank/e-wallet name
Chats and messages	Include full thread and timestamps
Profile or page screenshots	Capture username, URL, followers, posts, and profile photos
Advertisement or listing	Product post, job offer, investment pitch, marketplace listing
Website or app details	URL, domain, login page, fake dashboard, app name
Written narrative	Short timeline of what happened from first contact to payment
Prior reports	Bank ticket, BSP reference, CICC report, police blotter, NBI/PNP acknowledgment
Affidavit or sworn statement	Often needed for law enforcement, prosecutor, or extended holding support

Do not edit screenshots except to make copies. Keep originals. If you need to redact personal data for public sharing, preserve an unredacted copy for investigators.

How the Bank or E-Wallet Process Usually Works

In practice, the process often looks like this:

You report to your sending bank or e-wallet.
The provider verifies your identity and transaction details.
The provider checks whether the transaction can still be flagged, held, recalled, or traced.
If another institution received the funds, your provider may coordinate with that receiving institution.
You may be asked for a sworn complaint, affidavit, police report, or other supporting documents.
The provider informs you whether funds were held, moved, withdrawn, or still under verification.
If unresolved or mishandled, you may escalate to BSP.

Under AFASA’s temporary holding rules, the receiving account owner also has rights. If funds are held in their account, they may challenge the hold by proving the transaction was legitimate. This is why banks usually cannot simply “reverse” every reported transfer without verification.

How NBI or PNP Cybercrime Complaints Usually Work

A criminal complaint usually involves:

Initial intake or interview You explain what happened and show basic evidence.
Complaint sheet or incident report The officer or agent records the details.
Sworn statement or complaint-affidavit You may execute a sworn statement before the investigator or submit a prepared affidavit.
Evidence submission You submit screenshots, receipts, account details, IDs, links, messages, and device information if relevant.
Evaluation and investigation Investigators may trace accounts, coordinate with platforms, request preservation of data, or seek cybercrime warrants where legally justified.
Referral for preliminary investigation If evidence supports a criminal charge, the matter may be referred to the prosecutor’s office.

A police blotter or barangay report may help document that you complained early, but it is usually not enough by itself for a cybercrime investigation. For online scams, the better route is PNP ACG, NBI Cybercrime Division, or direct prosecutor filing with proper affidavits and evidence.

Can You Get the Money Back?

Sometimes, but not always.

Recovery is more likely when:

you report within minutes or hours;
the receiving account still contains the funds;
the scammer has not moved the money through multiple accounts;
the provider can identify and hold disputed funds;
you submit supporting documents quickly;
the receiving account appears suspicious or mule-related; and
law enforcement or BSP coordination happens early.

Recovery is harder when:

days or weeks have passed;
the money was withdrawn as cash;
the funds were converted to crypto;
the scammer used multiple mule accounts;
the recipient account was opened with fake or stolen identity;
the transfer was to an overseas account or foreign platform; or
the victim only reported through social media comments instead of official channels.

A criminal case may lead to restitution if there is a conviction, but criminal cases take time. Immediate bank/e-wallet reporting is still the fastest practical route for possible fund holding.

Common Mistakes That Hurt Scam Reports

Waiting too long

Many victims wait because the scammer promises delivery, refund, or account unlocking. By the time they report, the money is gone.

Reporting only on Facebook

Public posts may warn others, but they do not trigger formal AFASA holding, bank verification, or criminal investigation.

Deleting chats out of embarrassment

Embarrassing messages are still evidence. Keep them.

Sending more money to “recover” the first payment

Recovery-fee scams are common. A real bank, BSP, NBI, PNP, or court will not require payment through a personal wallet to release your funds.

Sharing OTPs or passwords with “investigators”

Banks, BSP, PNP, NBI, and CICC do not need your OTP or password to process a complaint.

Filing a false or exaggerated report

AFASA penalizes malicious reporting that causes improper holding of funds. Report accurately. Do not invent facts or name people as scammers unless you have a basis.

Posting the receiving account owner’s ID publicly

The named account holder may be a scammer, a mule, an identity-theft victim, or a trafficked person forced to participate. Give the details to authorities and providers instead of exposing personal data online.

Special Situations

If the scam involved GCash, Maya, or another e-wallet

Report through the wallet’s official help channel first. Provide the transaction reference number, alleged fraud number or wallet, screenshots, and police/NBI report if available. If the wallet does not respond properly, escalate to BSP.

If the scam involved InstaPay or PESONet

Report to your own bank immediately. Ask them to initiate the appropriate dispute, recall, or coordination process. You generally cannot directly force the receiving bank to disclose account owner information because of privacy and banking rules, but AFASA now gives regulated institutions and competent authorities mechanisms for coordinated verification and information-sharing.

If it was a fake investment

Report both the payment transaction and the investment scheme. File with the bank/e-wallet for the money trail, and with the SEC through its official portal if the person or entity solicited investments without authority, promised guaranteed returns, used fake SEC documents, or operated a Ponzi-type scheme.

If your personal data or ID was used

If the scammer used your ID, selfie, SIM, account, or private information, consider reporting to the National Privacy Commission using its formal complaint process. Also tell your bank or wallet that your identity may have been compromised.

If you are an OFW, foreigner, or victim outside the Philippines

You may still report if the money moved through a Philippine bank, Philippine e-wallet, Philippine SIM, Philippine-based scammer, or Philippine financial account. AFASA recognizes jurisdiction when elements happen in the Philippines, when Philippine computer or financial infrastructure is used, or when damage is caused to a person in the Philippines or to an account maintained with an institution operating in the Philippines.

Practical issues for overseas complainants include:

Philippine agencies may require a sworn statement or affidavit;
affidavits signed abroad may need consular acknowledgment or apostille, depending on the receiving office;
foreign-language documents may need English translation;
a trusted representative in the Philippines may need a Special Power of Attorney;
online reporting may start the process, but personal appearance or video coordination may still be requested later.

Typical Timelines and Costs

Step	Usual timing	Cost
Report to bank/e-wallet fraud channel	Immediately, ideally within minutes or hours	Usually free
Provider acknowledgment or ticket	Same day to a few days, depending on channel	Free
Initial AFASA-related temporary hold, if applicable and successful	Up to 5 calendar days	Free
Possible extended holding	Up to 25 more calendar days	Free
BSP CAM escalation	After provider first-level complaint is made or mishandled	Free
NBI/PNP cybercrime intake	Often same day for intake, depending on office workload	No filing fee, but expect photocopy/notarization costs
Prosecutor preliminary investigation	Weeks to months, depending on docket and complexity	No filing fee for criminal complaint, but document costs may apply
Court case	Months to years	Litigation-related costs vary

The biggest bottlenecks are usually not filing fees. They are speed of reporting, completeness of evidence, whether funds are still traceable, platform cooperation, and the number of accounts used to move the money.

Frequently Asked Questions

Can I report an online scam if I willingly sent the money?

Yes. A scam can still be a crime even if you personally approved the transfer. The legal issue is whether you were deceived into sending money. This is common in fake selling, fake job, fake investment, romance, impersonation, and advance-fee scams.

Should I report first to the bank, the police, or BSP?

Report first to your bank or e-wallet immediately because they are in the best position to flag, hold, recall, or trace the transaction. Then report to PNP ACG, NBI, or CICC for cybercrime investigation. Escalate to BSP if the bank or e-wallet mishandles your complaint or fails to respond properly.

Can the bank or GCash automatically reverse the transfer?

Not always. If the funds are still intact and the case meets the requirements, the provider may hold or coordinate verification. But if the money has already been withdrawn or transferred onward, reversal is difficult. The receiving account owner also has due process rights if funds are held.

What if the scammer used a real person’s bank account?

That account may belong to the scammer, a money mule, an identity-theft victim, or someone forced to participate. Under AFASA, selling, lending, renting, or allowing use of a financial account for scam proceeds can be punished. Give the account details to the bank and investigators.

Do I need a notarized affidavit?

For initial bank or e-wallet reporting, not always. For NBI, PNP, prosecutor, or extended holding support, you may be asked for a sworn complaint, affidavit, police report, or other supporting document. Having a clear affidavit helps, especially when the amount is significant.

Is a barangay blotter enough?

Usually no. A barangay blotter may document that you complained, but online scam cases involving bank transfers and e-wallets should be reported to the bank/e-wallet and to PNP ACG, NBI Cybercrime Division, CICC, or the prosecutor’s office.

Can I report if the scammer is outside the Philippines?

Yes, especially if a Philippine bank, e-wallet, SIM, victim, or financial account was involved. Cross-border cases are harder, but Philippine authorities can still investigate local accounts, mule networks, and platform traces.

What if the scam involved crypto?

Report the bank or wallet transfer used to buy or send funds, preserve wallet addresses and transaction hashes, and report the cybercrime aspect to PNP ACG, NBI, or CICC. Crypto recovery is difficult once assets move through foreign exchanges or mixers, but the peso entry and exit points may still be investigated.

Can I sue the bank or e-wallet for not helping?

Possibly, depending on the facts. Start with the provider’s FCPAM and keep records. If the response is inadequate, escalate to BSP. RA 11765 and AFASA impose consumer protection, information security, temporary holding, and complaint-handling obligations on covered financial institutions.

Should I hire a “fund recovery” service?

Be very careful. Many “recovery experts” are scammers who target previous victims. A legitimate recovery process does not require sending more money to a personal wallet, sharing OTPs, or giving remote access to your device.

Key Takeaways

Report to your bank or e-wallet immediately and ask for a fraud case number, recall or hold attempt, and AFASA coordinated verification.
Preserve screenshots, transaction receipts, account numbers, URLs, messages, and timestamps before the scammer deletes them.
Report cybercrime to PNP ACG, NBI Cybercrime Division, or CICC/1326, especially if the scam used social media, SMS, email, fake websites, or messaging apps.
Escalate to BSP only after reporting to the financial provider, unless the issue is about broader criminal investigation.
AFASA allows temporary holding and coordinated verification of disputed funds, but recovery is not guaranteed if the money has already been withdrawn or moved.
Fake investments should also be reported to the SEC, while misuse of IDs or personal data may involve the NPC.
Do not pay “refund fees,” share OTPs, delete evidence, or rely only on public social media posts.
Fast, accurate, well-documented reporting gives you the best chance of tracing funds, supporting a criminal complaint, and protecting yourself from further loss.