I. Overview

Online scams have become common in the Philippines because transactions now happen through social media, messaging apps, online marketplaces, banking apps, e-wallets, delivery platforms, cryptocurrency platforms, job sites, dating apps, and investment groups. A scam may involve a fake seller, fake buyer, fake lender, fake recruiter, fake investment manager, fake bank representative, fake courier, fake government officer, fake romance partner, or someone pretending to be a relative, employer, company, or public official.

When a person is deceived online and loses money, personal information, access to an account, or property, the victim may report the matter to law enforcement, banks, e-wallet providers, platforms, and government agencies. The proper action depends on the type of scam, the amount involved, the available evidence, and the identity or location of the scammer.

In the Philippine context, online scams may give rise to criminal, civil, administrative, banking, data privacy, consumer protection, and platform-based remedies. The victim’s goals are usually to:

Stop further loss;
Preserve evidence;
Freeze or trace funds where possible;
Identify the scammer;
File a criminal complaint;
Recover money or property;
Prevent the scammer from victimizing others.

II. What Is an Online Scam?

An online scam is a fraudulent scheme carried out through the internet or electronic communications. It usually involves deceit, misrepresentation, impersonation, false promises, or unauthorized access to obtain money, property, services, personal data, account access, or other benefit.

Common online scams in the Philippines include:

Fake online selling;
Fake payment confirmations;
GCash, Maya, or online banking scams;
Phishing;
Smishing through text messages;
Fake job offers;
Fake investment schemes;
Cryptocurrency scams;
Romance scams;
Sextortion;
Blackmail using private photos or videos;
Fake parcel or customs fees;
Fake loan apps;
Identity theft;
Social media account hacking;
Business email compromise;
Fake charity solicitations;
Marketplace deposit scams;
Fake rental listings;
Fake travel bookings;
Fake tickets;
Fake government assistance programs;
SIM-related fraud;
Unauthorized credit card or debit card transactions;
QR code scams;
Malware or remote-access scams.

III. Immediate Steps After Discovering the Scam

The first few hours matter. A victim should act quickly.

1. Stop communicating with the scammer

Do not continue arguing, negotiating, begging, or threatening the scammer. Continued communication may give the scammer more opportunities to manipulate, intimidate, or extract more information.

However, do not delete the conversation. Preserve it.

2. Do not send more money

Scammers often claim that a victim can recover money by paying additional “tax,” “release fee,” “verification fee,” “unlocking fee,” “courier charge,” “anti-money laundering clearance,” “processing fee,” or “lawyer fee.” These are usually additional scams.

3. Secure accounts

Change passwords for:

Email accounts;
Banking apps;
E-wallets;
Social media accounts;
Online shopping accounts;
Cloud storage;
Messaging apps.

Enable two-factor authentication where available. Log out unknown devices. Check linked emails, phone numbers, recovery contacts, and authorized apps.

4. Contact the bank or e-wallet immediately

If money was sent through a bank, e-wallet, remittance service, or payment gateway, report the transaction immediately. Ask if the transaction can be reversed, held, investigated, or flagged.

Provide:

Transaction reference number;
Date and time;
Amount;
Recipient name;
Recipient account number or wallet number;
Screenshots;
Proof that the transaction was fraudulent.

Speed is important because funds may be transferred quickly to other accounts.

5. Preserve all evidence

Do not delete messages, receipts, screenshots, posts, emails, profiles, links, call logs, tracking numbers, or transaction records.

The stronger the evidence, the better the chance of investigation.

6. Report the account or listing to the platform

Report the scammer’s account to Facebook, Messenger, Instagram, TikTok, X, Telegram, Viber, WhatsApp, Shopee, Lazada, Carousell, or the relevant platform.

Platform reporting does not replace a police complaint, but it may help prevent further victims and preserve account data.

7. Consider filing a police or NBI complaint

For serious loss, repeated scams, identity theft, threats, blackmail, hacking, or investment fraud, a formal complaint should be filed with the appropriate authority.

IV. Where to Report an Online Scammer in the Philippines

A victim may report to one or more of the following, depending on the case.

A. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group is a primary law enforcement unit for cybercrime complaints. Victims of online fraud, hacking, phishing, identity theft, cyber extortion, online threats, and other cyber-related offenses may report to the PNP cybercrime authorities.

The complainant should prepare:

Valid government ID;
Complaint-affidavit or written statement;
Screenshots of conversations;
Transaction receipts;
URLs, usernames, profile links, phone numbers, email addresses;
Bank or wallet details;
Device information if hacking occurred;
Other relevant proof.

B. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division may also receive complaints involving online scams, hacking, identity theft, phishing, cyber libel, sextortion, online blackmail, and similar offenses.

NBI complaints usually require personal appearance, identification, documentary evidence, and a sworn statement or complaint-affidavit.

C. Local Police Station

A victim may also begin at the nearest police station, especially if immediate documentation is needed. The police may record the incident in a blotter and refer the matter to the appropriate cybercrime unit.

A police blotter is useful as proof that the victim promptly reported the incident. However, a blotter alone does not always mean a full criminal case has been filed. Follow-up with the proper investigative unit may still be necessary.

D. Bank, E-Wallet, or Financial Institution

If funds were transferred through a bank, GCash, Maya, online banking, remittance center, credit card, debit card, or payment platform, report immediately to the financial institution.

Ask for:

Transaction dispute filing;
Account freezing or hold request, if allowed;
Investigation ticket number;
Written acknowledgment;
Copy of complaint or incident report;
Instructions for filing a formal dispute.

The financial institution may require a police report, affidavit, or complaint reference number.

E. Bangko Sentral ng Pilipinas Consumer Assistance

If the issue involves a bank, e-money issuer, payment service provider, or other BSP-supervised financial institution, the victim may seek assistance through the financial institution’s customer service channels and, if unresolved, through BSP consumer assistance mechanisms.

This is especially relevant when the complaint involves unauthorized transactions, mishandled dispute resolution, refusal to act on a timely report, or possible violation of financial consumer protection standards.

F. Securities and Exchange Commission

If the scam involves investment solicitation, fake trading platforms, Ponzi schemes, crypto investment groups, lending schemes, fake corporations, fake franchises, or promises of unusually high returns, the matter may be reported to the Securities and Exchange Commission.

Investment scams often use words such as:

Guaranteed profit;
Double your money;
Passive income;
Referral bonus;
Trading bot;
Crypto mining;
Forex mentor;
Binary options;
Daily payout;
No risk;
Locked-in earnings;
Membership investment;
Cooperative-style pooling;
Franchise packages.

The SEC may investigate unauthorized investment-taking, unregistered securities, and fraudulent investment schemes.

G. Department of Trade and Industry

If the issue involves a merchant, seller, online shop, defective product, non-delivery, deceptive sales practice, misleading advertisement, or consumer transaction, the Department of Trade and Industry may be relevant.

However, not every fake seller case is merely a consumer complaint. If the seller never intended to deliver and used deception to obtain payment, it may also be criminal fraud.

H. National Privacy Commission

If the scam involves misuse of personal data, unauthorized collection of IDs, identity theft, doxxing, unauthorized posting of personal information, or data breach concerns, a complaint or report to the National Privacy Commission may be appropriate.

I. DICT and Cybersecurity Channels

For phishing sites, malicious links, cybersecurity incidents, and compromised systems, reporting to government cybersecurity channels may help in takedown, advisory, or technical response.

J. Platform-Specific Reporting

Report to the app or website used by the scammer:

Facebook or Messenger for fake profiles and marketplace scams;
Instagram or TikTok for impersonation or fake selling;
Telegram or Viber for scam groups;
Shopee, Lazada, Carousell, or other marketplaces for fraudulent sellers;
LinkedIn or job sites for recruitment scams;
Dating apps for romance scams;
Crypto platforms for wallet abuse;
Email providers for phishing;
Web hosts or domain registrars for fake websites.

Platform reports may result in account suspension, content removal, preservation of logs, or internal investigation.

V. Laws Commonly Involved in Online Scam Cases

Online scams may violate several Philippine laws, depending on the facts.

1. Revised Penal Code: Estafa or Swindling

Estafa is one of the most common offenses in scam cases. It involves defrauding another person through abuse of confidence, deceit, false pretenses, fraudulent acts, or similar means.

Online selling scams, fake investment schemes, fake employment fees, and false representations may fall under estafa if the elements are present.

Common examples:

Seller accepts payment but never intended to deliver;
Person pretends to have goods for sale;
Fake agent collects placement or processing fees;
Scammer promises investment returns but diverts the money;
Person uses a fake identity to obtain funds.

2. Cybercrime Prevention Act

When fraud or other crimes are committed through information and communications technology, the Cybercrime Prevention Act may apply. Certain crimes under the Revised Penal Code can have increased penalties when committed through electronic means.

Cyber-related offenses may include:

Computer-related fraud;
Computer-related identity theft;
Illegal access;
Data interference;
System interference;
Misuse of devices;
Cybersex-related offenses;
Cyber libel, in proper cases;
Other offenses committed using ICT.

3. Access Devices Regulation Law

Unauthorized use of credit cards, debit cards, account numbers, online banking credentials, access devices, or similar payment instruments may implicate access device laws.

This may apply to:

Credit card fraud;
Debit card fraud;
Unauthorized online purchases;
Stolen card details;
Account takeover;
Use of another person’s payment credentials.

4. E-Commerce Act

Electronic documents, electronic signatures, and electronic evidence may be recognized in legal proceedings. This matters because online scam cases often rely on screenshots, emails, transaction confirmations, platform records, and electronic communications.

5. Data Privacy Act

If personal data is unlawfully collected, processed, shared, sold, posted, or used for identity theft, the Data Privacy Act may be relevant.

Examples:

Scammer uses someone’s ID to create fake accounts;
Loan app accesses contacts and harasses them;
Personal information is posted online;
Fake recruiter collects résumés, IDs, and bank details;
Phishing site collects login credentials;
Seller misuses buyer’s personal information.

6. Consumer Protection Laws

If the scam involves online commerce, defective goods, non-delivery, misleading advertising, unfair sales practices, or deceptive representations, consumer protection laws and regulations may apply.

7. Securities Regulation Laws

Investment scams may involve illegal sale of securities, unauthorized investment solicitation, Ponzi schemes, pyramiding, and fraudulent securities transactions.

8. Anti-Financial Account Scamming and Related Laws

Schemes involving money mule accounts, phishing, social engineering, account takeover, and financial account abuse may trigger laws and regulations protecting financial accounts and penalizing account scamming.

9. Anti-Money Laundering Rules

Large or organized scams may involve money laundering, especially when proceeds pass through multiple bank accounts, e-wallets, crypto wallets, remittance channels, or corporate fronts.

VI. What Evidence Should Be Collected?

Evidence is crucial. A weak complaint may fail because the scammer’s identity, transaction, deceit, or loss cannot be proven.

Collect and preserve the following:

A. Identity Evidence

Name used by the scammer;
Profile link;
Username;
Display name;
Phone number;
Email address;
Wallet number;
Bank account name;
Bank account number;
Shipping address;
Business name;
Page name;
Group name;
Government ID sent by the scammer, if any;
Photos used by the scammer;
Vehicle plate, courier details, or address if relevant.

B. Communication Evidence

Screenshots of chats;
Full conversation history;
Voice messages;
Emails;
SMS;
Call logs;
Video call records, if available;
Links sent by the scammer;
Group chat messages;
Comments and replies;
Posts or advertisements;
Terms of offer;
Proof of promises, representations, or threats.

C. Payment Evidence

Bank transfer receipt;
GCash or Maya receipt;
Remittance slip;
Credit card statement;
Debit card transaction record;
Crypto transaction hash;
QR code used;
Payment link;
Reference number;
Date and time of transfer;
Amount;
Recipient account details;
Screenshot of payment confirmation.

D. Product or Service Evidence

Listing or advertisement;
Product photos;
Order confirmation;
Invoice;
Tracking number;
Delivery conversation;
Proof of non-delivery;
Proof that item was fake, defective, or different;
Refund refusal;
Warranty promise.

E. Website or Technical Evidence

URL;
Domain name;
IP-related information, if available;
Screenshots of website pages;
Downloaded emails with headers, if available;
Phishing link;
Malware message;
Login alert;
Device activity logs;
Unauthorized login notifications.

F. Damage Evidence

Amount lost;
Bank charges;
Unauthorized loans;
Damage to credit standing;
Identity theft consequences;
Emotional distress, if relevant;
Business losses;
Account lockout;
Extortion demands.

VII. How to Preserve Digital Evidence Properly

Digital evidence can be challenged. Preserve it carefully.

1. Take clear screenshots

Screenshots should show:

Date and time where possible;
Profile name and link;
Message content;
Transaction details;
Full context of the conversation.

Avoid cropping too much. A screenshot that hides context may be questioned.

2. Export chats where possible

Some messaging apps allow export of chat history. Exported chats may help show continuity.

3. Save URLs

Copy the exact links to profiles, posts, groups, pages, listings, websites, and documents.

4. Record screen video

A screen recording showing the profile, messages, and transaction details may help demonstrate that the screenshots were not fabricated.

5. Keep original files

Do not rely only on compressed screenshots sent through messaging apps. Keep original image files, PDFs, receipts, emails, and downloads.

6. Do not edit evidence

Do not annotate, alter, crop, or enhance the only copy. Make separate marked copies if needed, but keep originals.

7. Note the timeline

Write a chronological account while events are fresh.

Include:

When you first contacted the scammer;
What was promised;
When payment was made;
What happened after payment;
When you realized it was a scam;
What steps you took to report it.

8. Keep devices available

If the case involves hacking, malware, unauthorized access, or account takeover, the device itself may contain relevant evidence.

VIII. Preparing a Complaint-Affidavit

A complaint-affidavit is a sworn written statement narrating the facts and identifying the evidence. It is commonly required in criminal complaints.

A good complaint-affidavit should include:

Full name, age, address, and contact details of the complainant;
Statement that the complainant is executing the affidavit voluntarily;
Identification of the scammer, if known;
Explanation of how the parties communicated;
Description of the scam;
Exact representations made by the scammer;
Date, time, and amount of payment;
Recipient account details;
What happened after payment;
Efforts to contact the scammer;
Evidence attached;
Statement of damages;
Request for investigation and filing of appropriate charges;
Jurat before a notary public or authorized officer.

The affidavit should be factual, chronological, and specific. Avoid exaggerations or unsupported accusations.

IX. Sample Structure of a Complaint-Affidavit

A complaint-affidavit may follow this structure:

Republic of the Philippines City/Municipality of ________

Affidavit-Complaint

I, [name], Filipino, of legal age, [civil status], and residing at [address], after being duly sworn, state:

I am the complainant in this case.
On [date], I saw an online post/listing/message from [name/profile/page] offering [item/service/investment/job/etc.].
The respondent represented that [specific promise or false statement].
Relying on said representation, I sent the amount of ₱[amount] on [date/time] through [bank/e-wallet/remittance] to [account name/account number].
After receiving payment, the respondent [blocked me/stopped responding/failed to deliver/sent fake tracking/asked for more money/etc.].
I later discovered that [facts showing fraud].
Attached are copies of the relevant screenshots, transaction receipts, profile links, and other evidence.
I am executing this affidavit to request investigation and the filing of appropriate criminal charges.

Affiant [Signature]

Subscribed and sworn to before me this ___ day of ________.

This is only a general format. The actual affidavit should be tailored to the facts and evidence.

X. Filing a Report: Step-by-Step

Step 1: Secure yourself first

Change passwords, lock cards, contact banks, and prevent further unauthorized transactions.

Step 2: Contact the payment channel

Report to the bank, e-wallet, payment provider, remittance center, or credit card company.

Ask for a case number. Save all communications.

Step 3: Gather evidence

Collect screenshots, receipts, links, account details, and timeline.

Step 4: Prepare a written narrative

Write a clear timeline of what happened.

Step 5: Execute a complaint-affidavit

For formal criminal complaints, prepare and notarize a complaint-affidavit if required.

Step 6: File with cybercrime authorities

Submit your complaint to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or appropriate law enforcement unit.

Step 7: File related reports

Depending on the scam, file with the bank, BSP, SEC, DTI, NPC, or platform.

Step 8: Follow up

Keep your complaint reference numbers. Follow up politely and regularly.

Step 9: Cooperate with investigators

You may be asked for additional documents, device access, sworn statements, or clarification.

Step 10: Consider civil remedies

If the scammer is identified and has recoverable assets, civil action or restitution may be considered.

XI. Online Selling Scam

A fake online seller scam usually involves payment for goods that are never delivered.

Evidence to collect

Seller profile or page;
Listing;
Chat messages;
Payment receipt;
Tracking number, if any;
Proof of non-delivery;
Other victim posts, if available;
Seller’s account details.

Possible offenses

Estafa;
Computer-related fraud;
Consumer law violations;
Identity theft if fake identity was used.

Practical advice

Report both to law enforcement and the platform. If payment was through an e-wallet or bank, report immediately to the payment provider.

XII. Fake Buyer Scam

In fake buyer scams, the scammer pretends to buy an item and sends a fake payment confirmation or asks the seller to pay a fee to “release” funds.

Common signs:

Fake screenshot of payment;
Fake escrow email;
Overpayment scheme;
Courier pickup before payment clears;
Request for seller to pay insurance or verification fee;
Fake bank notice.

Victims should verify funds directly in their bank or wallet before releasing goods.

XIII. Phishing and Smishing

Phishing involves fake emails, websites, or messages that trick victims into giving passwords, OTPs, card numbers, or account information.

Smishing is phishing through SMS.

What to do

Do not click the link again;
Change passwords immediately;
Call the bank or e-wallet provider;
Report unauthorized transactions;
Preserve the message and link;
File a cybercrime report if loss occurred;
Warn contacts if your account was compromised.

Important rule

Never share OTPs, MPINs, passwords, recovery codes, card CVVs, or authentication links. Legitimate institutions generally do not ask for these through chat or SMS.

XIV. Account Takeover

An account takeover occurs when a scammer gains control of a social media, email, bank, e-wallet, or shopping account.

Immediate steps

Use account recovery tools;
Change passwords;
Log out other devices;
Revoke suspicious app permissions;
Notify contacts;
Report impersonation to the platform;
Report unauthorized transactions to the bank or wallet provider;
Preserve login alerts and emails.

If the compromised account was used to scam others, the owner should promptly document the takeover to avoid being mistaken as the scammer.

XV. Identity Theft

Identity theft occurs when someone uses another person’s identity to commit fraud or hide the true perpetrator.

Examples:

Using someone else’s ID to open accounts;
Creating fake social media profiles;
Using stolen photos;
Impersonating a professional, officer, or business owner;
Applying for loans using another person’s information;
Using another person’s name as the recipient of scam funds.

Victims should report to law enforcement, affected platforms, banks, credit providers, and the National Privacy Commission when personal data is misused.

XVI. Investment Scams

Investment scams are especially serious because they often involve many victims and large amounts.

Warning signs include:

Guaranteed returns;
High profit with no risk;
Referral commissions;
Pressure to recruit others;
No clear business model;
No registration to solicit investments;
Fake SEC certificate;
Celebrity endorsements;
Crypto buzzwords;
Secret trading strategy;
“Limited slots” urgency;
Payouts funded by new investors.

A registration certificate is not the same as authority to solicit investments. A business may be registered but still unauthorized to sell securities or investment contracts.

Victims should report to law enforcement and the SEC. If funds passed through banks or e-wallets, report there as well.

XVII. Romance Scams

Romance scams involve emotional manipulation to obtain money, gifts, bank access, identity documents, or intimate images.

Common stories include:

Overseas worker needing emergency funds;
Soldier or foreigner sending a package;
Hospital emergency;
Customs fee;
Investment opportunity;
Travel expenses;
Frozen account;
Family tragedy.

Victims should preserve all communications and payment records. If intimate images are involved, the case may also involve blackmail, threats, cybersex-related offenses, or violations involving image-based abuse.

XVIII. Sextortion and Online Blackmail

Sextortion occurs when a scammer threatens to release private images, videos, or conversations unless the victim pays money or does something demanded.

What to do

Do not pay;
Stop engaging;
Preserve messages and threats;
Report the account;
Tell a trusted person;
File a cybercrime report;
Secure social media privacy settings;
Document any posting or sharing.

Payment often results in more demands, not deletion.

If the victim is a minor, the matter is extremely serious and should be reported immediately to law enforcement and child protection authorities.

XIX. Fake Job or Recruitment Scam

Fake recruiters may offer jobs abroad, work-from-home positions, or high-paying local jobs in exchange for processing fees, training fees, medical fees, equipment deposits, or placement fees.

Evidence may include:

Job post;
Recruiter profile;
Company name used;
Emails;
Interview messages;
Payment receipts;
Fake contracts;
IDs or documents submitted.

Depending on the facts, the case may involve estafa, illegal recruitment, identity theft, labor violations, or data privacy issues.

XX. Fake Loan App or Lending Scam

Loan-related scams may include:

Fake lenders collecting advance fees;
Apps harvesting contacts;
Harassment of borrower and contacts;
Threats and shaming;
Unauthorized deductions;
Misuse of IDs;
Excessive interest or hidden charges.

Possible reporting channels include law enforcement, SEC for lending company issues, NPC for data privacy violations, and platform app stores for abusive apps.

XXI. Crypto and Forex Scams

Crypto and forex scams often involve fake exchanges, fake brokers, fake trading bots, or manipulated dashboards showing false profits.

Victims should collect:

Wallet addresses;
Transaction hashes;
Platform URLs;
Chat logs;
Deposit instructions;
Screenshots of dashboards;
Names of recruiters or uplines;
Bank or wallet transfer records.

Because blockchain transfers are often irreversible, early reporting is important, but recovery can be difficult.

XXII. Fake Bank or Government Representative Scam

Scammers may pretend to be from a bank, e-wallet company, police office, court, BIR, customs, immigration, NBI, PNP, SEC, or other government agency.

They may ask for:

OTP;
Password;
Bank details;
“Clearance fee”;
“Tax payment”;
“Penalty settlement”;
Remote access installation;
Personal documents.

Government agencies and banks do not normally resolve official matters by demanding secret credentials or urgent private transfers to personal accounts.

XXIII. Can You Recover the Money?

Recovery depends on several factors:

How quickly the scam was reported;
Whether the receiving account still contains funds;
Whether the bank or e-wallet can freeze or hold the funds;
Whether the scammer can be identified;
Whether the account holder is a money mule or the main scammer;
Whether the recipient cooperates;
Whether law enforcement can obtain records;
Whether a criminal case or civil action succeeds;
Whether restitution is ordered or agreed.

Reporting does not guarantee recovery. However, delayed reporting makes recovery harder.

XXIV. Can the Bank or E-Wallet Reverse the Transfer?

Not always.

If the victim voluntarily transferred money, even because of deception, the transaction may not be automatically reversible. Financial institutions must follow rules on account confidentiality, investigation, due process, and internal procedures.

However, a timely report can help:

Flag the receiving account;
Preserve transaction records;
Investigate suspicious activity;
Coordinate with law enforcement;
Possibly freeze funds, depending on circumstances and authority;
Support dispute resolution.

Unauthorized transactions may follow a different dispute process from authorized-but-scammed transfers.

XXV. The Role of Money Mules

Many scammers use money mule accounts. A money mule is a person whose bank or e-wallet account receives scam proceeds and transfers them elsewhere.

Sometimes the mule is part of the scam. Sometimes the mule claims to have been tricked, rented the account, sold the SIM, or allowed another person to use the account.

Victims should include the recipient account details in the complaint. Even if the account holder is not the mastermind, that person may be important to the investigation.

XXVI. What If the Scammer Used a Fake Name?

A fake name does not prevent reporting. Investigators may trace:

Phone numbers;
SIM registration records, subject to legal process;
Bank or e-wallet KYC records;
IP logs;
Device identifiers;
Platform account data;
Delivery addresses;
Linked accounts;
Withdrawal points;
CCTV at cash-out locations;
Other transaction trails.

The victim should provide all available identifiers, even if they appear fake.

XXVII. Should You Post the Scammer Online?

Victims often want to post the scammer’s name, face, account number, or screenshots online.

This can warn others, but it also carries legal risks.

Possible risks include:

Cyber libel;
Defamation;
Privacy complaints;
Mistaken identity;
Posting someone’s ID without authority;
Interference with investigation;
Retaliation.

A safer approach is to report to authorities and platforms. If posting a warning, keep it factual, avoid insults, avoid unsupported accusations, and avoid exposing sensitive personal information beyond what is necessary. For serious cases, seek legal advice before public posting.

XXVIII. What If You Only Know the GCash, Maya, or Bank Account?

That is still important evidence.

Provide:

Account name;
Account number or mobile number;
Transaction reference number;
Date and time;
Amount;
Screenshot of receipt;
Conversation showing why payment was made.

The account may be traceable through the provider, but private individuals cannot usually obtain full account information without proper legal process.

XXIX. What If the Scammer Is Abroad?

A scammer outside the Philippines may still be reported if the victim is in the Philippines or Philippine systems were used. However, cross-border enforcement is harder.

Possible steps include:

Reporting to Philippine cybercrime authorities;
Reporting to the platform;
Reporting to the foreign platform, bank, or payment provider;
Preserving cross-border transaction records;
Reporting to embassy or foreign cybercrime channels where appropriate;
Coordinating through law enforcement mechanisms.

Recovery may be more difficult, but reporting still matters.

XXX. What If the Victim Is a Minor?

If the victim is a minor, parents, guardians, school officials, or trusted adults should help report the matter.

Cases involving minors may involve child protection laws, especially if there are sexual images, grooming, threats, exploitation, or coercion.

Immediate steps:

Preserve evidence;
Stop communication;
Do not blame the minor;
Report to cybercrime authorities;
Seek psychological and legal support;
Report abusive content to platforms for removal.

XXXI. What If the Scam Involves Intimate Photos or Videos?

The priority is safety, evidence preservation, and rapid reporting.

Do not pay the blackmailer. Preserve threats and account details. Report the platform account. File a cybercrime complaint. If the material is posted, document the URL and request takedown.

Victims should avoid forwarding the intimate material to others. Submit evidence only through proper reporting channels.

XXXII. What If the Scam Involves a Business Page?

If a business page was hacked and used for scams:

Announce account compromise through other verified channels;
Report the hacked page to the platform;
Preserve admin logs, emails, and unauthorized access notices;
File a cybercrime report;
Inform affected customers;
Change passwords and secure connected emails;
Review ad accounts and payment methods;
Document all unauthorized posts and messages.

If customers lost money, the business may need legal advice on liability, data privacy, and consumer communication.

XXXIII. What If the Scam Uses Your Name or Photos?

If a scammer impersonates you:

Screenshot the fake account;
Copy the profile link;
Report impersonation to the platform;
Warn contacts;
File a police or cybercrime report if money is solicited;
Report misuse of personal data;
Preserve proof that the account is fake.

If your ID was used, notify affected banks, wallets, lenders, or platforms.

XXXIV. What If You Accidentally Sent Your ID or Personal Documents?

If you sent IDs, selfies, signatures, bank details, or other sensitive information to a scammer:

Report the incident;
Monitor bank and credit activity;
Notify institutions if the document may be misused;
Change account credentials;
Watch for loan applications or account openings;
Report fake accounts using your identity;
Consider filing a data privacy or identity theft complaint if misuse occurs.

XXXV. Criminal Complaint vs. Civil Case

Criminal complaint

A criminal complaint aims to investigate and prosecute the scammer for an offense such as estafa, computer-related fraud, identity theft, or other crimes.

Possible outcomes include:

Investigation;
Subpoena;
Inquest or preliminary investigation;
Filing in court;
Warrant;
Trial;
Conviction;
Penalties;
Restitution or civil liability.

Civil case

A civil case aims to recover money, damages, or property. It may be filed separately or included as civil liability arising from the crime, depending on the situation.

A civil case may be useful when the scammer is known and has assets.

XXXVI. Barangay Conciliation

Some disputes between individuals in the same city or municipality may require barangay conciliation before court action.

However, many online scam cases involve criminal offenses, unknown respondents, different locations, corporations, cybercrime, or urgent matters, so barangay conciliation may not be the proper first step.

When in doubt, victims may still report directly to law enforcement, especially for cybercrime, fraud, threats, hacking, or identity theft.

XXXVII. Prescription Periods

Crimes and civil claims have prescriptive periods. Victims should not delay.

The applicable period depends on the offense, penalty, amount involved, and legal classification. Online scam cases should be reported as soon as possible because digital evidence may disappear and funds may be moved quickly.

XXXVIII. What Happens After Filing a Report?

After filing, the authorities may:

Evaluate the complaint;
Request additional documents;
Ask for a sworn statement;
Conduct cyber investigation;
Send preservation requests where available;
Coordinate with banks, e-wallets, or platforms;
Identify the account holder;
Invite or subpoena persons;
Refer the matter for preliminary investigation;
File charges if evidence is sufficient.

The process may take time. Victims should keep copies of everything and follow up using official channels.

XXXIX. Common Mistakes Victims Should Avoid

Avoid these mistakes:

Deleting messages;
Continuing to pay the scammer;
Sending threats;
Posting unverified accusations online;
Relying only on a social media report;
Waiting too long to contact the bank;
Failing to save transaction reference numbers;
Cropping screenshots too much;
Losing the scammer’s profile link;
Not filing a formal complaint;
Giving OTPs to “recovery agents”;
Hiring fake hackers to recover funds;
Believing someone who promises guaranteed recovery for a fee.

Recovery scammers often target people who have already been scammed.

XL. Red Flags of Recovery Scams

After reporting or posting about a scam, victims may be contacted by supposed “fund recovery agents,” “hackers,” “crypto tracing experts,” or “inside bank contacts.”

Warning signs:

They guarantee recovery;
They ask for upfront payment;
They claim to hack the scammer;
They ask for your bank login or OTP;
They use fake police, lawyer, or government IDs;
They pressure you to act secretly;
They ask for “activation fees” or “clearance fees.”

Do not give more money or credentials to recovery scammers.

XLI. Special Considerations for Small Amounts

Even small online scams can be reported. However, practical enforcement may vary depending on evidence, resources, amount, and number of victims.

If many victims were scammed by the same person, coordinated complaints may strengthen the case. Victims may share information but should avoid unlawful harassment or doxxing.

XLII. Group Complaints

For investment scams, fake sellers with many victims, or organized schemes, a group complaint may be effective.

A group should organize:

List of victims;
Individual amounts lost;
Individual transaction receipts;
Common scammer accounts;
Common representations;
Timeline;
Total amount involved;
Evidence folder;
Lead complainants;
Counsel, if available.

Each victim may still need to execute a separate affidavit.

XLIII. Reporting Checklist

Before going to law enforcement or a government office, prepare:

Valid government ID;
Printed screenshots;
Digital copies of screenshots;
Transaction receipts;
Bank or wallet statements;
Scammer profile links;
Phone numbers and email addresses;
Written timeline;
Complaint-affidavit, if available;
Proof of account ownership;
Device used in the transaction, if relevant;
Names of witnesses;
Copies of platform reports;
Bank or wallet complaint ticket numbers.

Bring both printed and digital copies if possible.

XLIV. Practical Evidence Folder Format

A victim may organize files like this:

Folder 1: Identity of Scammer

Profile screenshots;
Account links;
Phone numbers;
Email addresses;
IDs sent by scammer.

Folder 2: Conversations

Chat screenshots;
Exported chat files;
Emails;
SMS.

Folder 3: Payment Proof

Receipts;
Bank statements;
Wallet transaction history;
Reference numbers.

Folder 4: Scam Proof

Listing;
Advertisement;
Fake website;
False promises;
Other victim posts.

Folder 5: Reports Made

Bank report;
Platform report;
Police blotter;
NBI or PNP complaint acknowledgment.

Folder 6: Timeline

Written chronology;
Summary of losses;
Contact attempts.

XLV. Sample Timeline Format

A simple timeline may look like this:

Date and Time	Event	Evidence
May 1, 2026, 9:00 AM	Saw Facebook listing for phone	Screenshot A
May 1, 2026, 9:30 AM	Seller promised delivery after payment	Screenshot B
May 1, 2026, 10:00 AM	Sent ₱8,000 via GCash	Receipt C
May 1, 2026, 2:00 PM	Seller sent fake tracking number	Screenshot D
May 2, 2026	Seller stopped replying	Screenshot E
May 3, 2026	Reported to e-wallet and platform	Report F

This helps investigators understand the case quickly.

XLVI. Can a Screenshot Be Used as Evidence?

Yes, electronic evidence can be used, subject to rules on admissibility, authentication, relevance, and integrity.

A screenshot is stronger when supported by:

Original device;
Full conversation;
URL;
Metadata where available;
Transaction records;
Witness testimony;
Platform or bank records;
Screen recordings;
Email headers;
Affidavit explaining how it was obtained.

Screenshots alone may not always be enough, but they are important starting evidence.

XLVII. What If the Scammer Blocks You?

Being blocked can support the inference of fraud, especially if it happens after payment. Take screenshots showing that messages are no longer delivered, the profile disappeared, or the account blocked you.

Do not create fake accounts to harass or threaten the scammer. Preserve evidence and report.

XLVIII. What If the Scammer Offers a Refund?

If the scammer offers a refund, be cautious. Do not provide OTPs, bank passwords, or additional payments.

A real refund should not require you to send more money first.

If a partial refund is made, save the proof. It may still be relevant to the complaint.

XLIX. What If the Scammer Is Someone You Know?

If the scammer is identifiable and known personally, options may include:

Demand letter;
Barangay proceedings, if applicable;
Police complaint;
Criminal complaint for estafa or related offenses;
Civil action for collection or damages;
Settlement agreement with safeguards.

A written settlement should be clear, signed, dated, and preferably reviewed by counsel. Avoid verbal promises.

L. Demand Letter

A demand letter is not always required, but it may be useful, especially where the facts involve payment, non-delivery, breach of promise, or identifiable respondent.

A demand letter may:

State the facts;
Demand refund or performance;
Set a deadline;
Warn of legal action;
Preserve proof of demand.

However, in many online scam cases, immediate reporting may be more urgent than sending a demand letter, especially if the scammer is unknown, funds are moving, or many victims are involved.

LI. When to Consult a Lawyer

A lawyer is especially useful when:

The amount is substantial;
The scammer is known;
A business is involved;
There are many victims;
A complaint-affidavit must be prepared;
The case involves investment solicitation;
The case involves intimate images or blackmail;
The victim is accused of participating;
The victim’s account was used as a mule;
A civil case is being considered;
The bank denied reimbursement;
A settlement is proposed;
The scam involves corporations, contracts, or cross-border parties.

LII. How Businesses Should Respond to Online Scams

Businesses may be victims or channels of scams. A business should:

Preserve logs and transaction records;
Notify affected customers where appropriate;
Report hacked pages or fake pages;
Coordinate with payment providers;
File police or cybercrime reports;
Review cybersecurity controls;
Revoke unauthorized access;
Reset credentials;
Document all steps taken;
Seek legal and data privacy advice if customer data was exposed.

Businesses should avoid making admissions of liability before facts are confirmed, but they should communicate responsibly.

LIII. Preventive Measures

To avoid becoming a victim:

Verify seller identity;
Avoid unusually cheap offers;
Use platform escrow when available;
Do not transact outside the platform;
Confirm bank or wallet account names;
Avoid advance payments to unknown persons;
Never share OTPs or passwords;
Check SEC advisories for investments;
Be skeptical of guaranteed returns;
Verify job offers directly with companies;
Do not install remote access apps at someone’s instruction;
Use strong passwords;
Enable two-factor authentication;
Keep apps and devices updated;
Avoid clicking unknown links;
Check URLs carefully;
Use official apps and websites only;
Be cautious with QR codes;
Do not send IDs unless necessary and verified.

LIV. Frequently Asked Questions

1. Can I report an online scam even if the amount is small?

Yes. A small amount does not make the act lawful. However, practical investigation may depend on evidence, resources, and whether there are multiple victims.

2. Should I report to PNP or NBI?

Either may be appropriate for cybercrime-related complaints. For urgent financial transactions, also report immediately to the bank or e-wallet.

3. Is a police blotter enough?

Usually, no. A blotter documents the incident, but a formal complaint with evidence is usually needed for investigation and prosecution.

4. Can I get my money back from GCash, Maya, or my bank?

Possibly, but not guaranteed. Report immediately. The outcome depends on the facts, timing, transaction type, and whether funds can still be traced or held.

5. What if I voluntarily sent the money?

You may still be a fraud victim if you sent money because of deceit. Voluntary transfer does not automatically prevent a criminal complaint.

6. What if the scammer used a real bank account?

Report the account. The account holder may be investigated as the scammer, a participant, or a money mule.

7. Can I sue the scammer?

Yes, if the scammer can be identified and the evidence supports a civil or criminal case.

8. What if the scammer deleted the account?

Report anyway. Save old links, screenshots, phone numbers, payment details, and transaction records. Platforms and financial institutions may still have records.

9. Can I post the scammer’s face online?

Be careful. Public accusation may expose you to cyber libel, privacy, or defamation issues, especially if the identity is uncertain.

10. What if I only have screenshots?

Screenshots are useful, but strengthen them with receipts, links, account details, screen recordings, and your sworn statement.

11. What if the scammer threatens me?

Preserve the threats and report immediately. Threats, blackmail, extortion, and harassment may be separate offenses.

12. What if intimate photos are involved?

Do not pay. Preserve evidence. Report urgently to cybercrime authorities and the platform.

13. What if the scammer is using my name?

Report impersonation to the platform and law enforcement. Preserve links and screenshots.

14. How long does an investigation take?

It varies. Cybercrime investigations may depend on records from platforms, banks, e-wallets, telcos, and other entities.

15. Do I need a lawyer to report?

Not always. A victim may report directly. A lawyer can help prepare affidavits, organize evidence, and pursue legal remedies.

LV. Key Takeaways

An online scam in the Philippines should be treated as both a financial emergency and a legal matter. The victim should act quickly, preserve evidence, secure accounts, report to the payment channel, and file with the proper law enforcement or regulatory agency.

The most important steps are:

Stop further loss;
Preserve all digital evidence;
Report immediately to the bank or e-wallet;
File a cybercrime complaint when appropriate;
Report to the platform;
Use specialized agencies for investment, consumer, financial, or privacy issues;
Avoid recovery scams;
Seek legal help for serious or complex cases.

A successful report depends on speed, evidence, documentation, and proper filing. Even when recovery is uncertain, reporting helps create a record, assists investigation, and may prevent further victimization.