Quick answer

If you paid an online seller or social-media account and believe you were scammed, act immediately:

Contact your bank, card issuer, or e-wallet through its official fraud channel. Report the transaction as fraudulent or scam-induced, ask whether the funds can be traced or temporarily held, and obtain a case reference number.
Open a dispute through the shopping platform or social-media marketplace. Preserve the listing and conversation before the account, post, or messages disappear.
Save the original digital evidence. Keep transaction records, complete chats, URLs, profile details, emails, delivery records, and the device used.
Report the suspected crime to the CICC, PNP Anti-Cybercrime Group, or NBI Cybercrime Division.
For a business-to-consumer purchase, pursue consumer redress through the DTI if the merchant or platform does not resolve the complaint.

Do these steps in parallel. Do not wait for the seller to reply before protecting your financial accounts or alerting authorities.

A report does not guarantee recovery. Recovery depends largely on how quickly the transaction is reported, whether the money remains traceable, and whether the available records can identify the recipient and establish fraud.

What to do in the first few hours

1. Stop further loss

Use only contact details shown in your bank or e-wallet’s official app, website, or card—not a number supplied by the seller.

Ask the institution to:

secure or temporarily restrict the affected account;
disable compromised online access, cards, or transfer functions when appropriate;
record the transaction as a fraud or disputed-transaction complaint;
trace the recipient account and any onward transfers;
coordinate with receiving financial institutions;
explain what affidavit, police report, or other supporting document is required; and
provide a case or complaint reference number.

Change compromised passwords from a clean device. Use a unique password for each account and enable multi-factor authentication. If you disclosed an OTP, PIN, recovery code, card security code, or online-banking credentials, tell the institution exactly what was disclosed and when.

Under the Anti-Financial Account Scamming Act and BSP Circular No. 1215, a complaint through a financial institution’s 24/7 fraud-reporting channel can trigger tracing, coordinated verification, and the temporary holding of qualifying disputed electronic transfers. The initial holding may last up to five calendar days and, when the regulatory requirements are met, may be extended by up to 25 additional calendar days, for a maximum of 30 days. Supporting documents such as a sworn complaint, affidavit, or police report may be required within the initial holding period. A temporary hold is not a final finding of fraud and does not assure reimbursement. BSP AFASA Booklet and Implementing Regulations

These holding rules principally cover electronic fund transfers between financial accounts. Erroneous transfers are governed separately, while ordinary credit-card purchases are outside these particular holding rules unless the card was used to make a covered electronic transfer through an automated clearing house. Card disputes and chargebacks remain subject to applicable law, network rules, and the issuer’s procedures. Report them immediately because issuer or platform deadlines may be much shorter than court deadlines.

2. Use the platform’s dispute system

Open the order or transaction and choose the appropriate option, such as “item not received,” “counterfeit,” “wrong item,” “unauthorized transaction,” or “seller fraud.” Ask the platform to preserve the seller’s registration and transaction records and to prevent release of any payment still in escrow.

Do not close a dispute merely because the seller promises an off-platform refund. Do not mark an undelivered order as received. Keep screenshots of every dispute submission, acknowledgment, reference number, and decision.

For transactions covered by the Internet Transactions Act, an aggrieved party must first use the internal redress mechanism of the digital platform, e-marketplace, or e-retailer. The mechanism is deemed exhausted when the complaint remains unresolved after seven calendar days. Start that process on the same day; the seven-day period is not a reason to postpone urgent bank-security measures or leave an ongoing crime or threat unreported. Republic Act No. 11967, Section 24

3. Preserve evidence before blocking or confronting the account

Create one folder containing:

the full product listing, advertisement, livestream, or social-media post;
the exact profile, page, group, website, and listing URLs;
the account username, display name, profile ID if visible, phone numbers, and email addresses;
uncropped screenshots showing dates, times, account names, and surrounding conversation;
exported chats or message data, if the service allows export;
emails in their original form, including headers when available;
payment confirmations, transaction IDs, account names and numbers, QR codes, receipts, and bank statements;
order numbers, invoices, delivery tracking, parcel labels, unboxing videos, and photographs;
voice messages, call logs, and recordings lawfully in your possession;
copies of the seller’s claimed permits, IDs, registration papers, or proof of ownership;
the platform, bank, e-wallet, CICC, PNP, NBI, or DTI reference numbers; and
a chronological account of what happened while the details are fresh.

Keep the original files and device. Make backup copies, but do not alter filenames, timestamps, message content, or metadata. Screenshots are useful, but original records and evidence showing where they came from are stronger. Electronic documents may require proof of authenticity, integrity, and reliability. Supreme Court Rules on Electronic Evidence

Do not publicly post unverified personal information, account details, or copies of IDs. Public accusations can create privacy, safety, and defamation issues and may warn the suspect before records or funds are secured.

Where to report the scam

CICC: immediate reporting and inter-agency referral

Contact the Cybercrime Investigation and Coordinating Center through:

National Anti-Scam Hotline: 1326
Email: report@cicc.gov.ph
Alternative mobile lines: 0991-481-4225, 0947-714-7105, or 0966-976-5971

Explain that the matter involves an online shopping or social-media scam and give the transaction date, amount, payment provider, recipient account, platform, URLs, and any bank or platform reference number. The CICC can receive and coordinate cybercrime reports, but a formal criminal investigation may still require referral to the PNP or NBI and the execution of a complaint-affidavit.

PNP Anti-Cybercrime Group

You may contact the PNP Anti-Cybercrime Group at:

Email: acg@pnp.gov.ph
Walk-in: PNP National Headquarters, Camp General Crame, EDSA, Quezon City

You may also go to the nearest police station and ask for assistance or referral to the appropriate regional anti-cybercrime unit. Bring a valid ID, a concise written chronology, printed copies of key evidence, and the original digital files on your device or storage media. Confirm beforehand whether the receiving unit requires a notarized complaint-affidavit or additional copies.

The Cybercrime Prevention Act expressly assigns cybercrime law enforcement to the PNP and NBI. Republic Act No. 10175, Sections 10–11

NBI Cybercrime Division

You may contact the NBI Cybercrime Division through:

Email: ccd@nbi.gov.ph
Trunkline: (02) 8523-8231 to 38, local 3455
Walk-in: NBI Building, Taft Avenue, Ermita, Manila

The NBI also maintains regional and district offices. Ask whether the complaint should be handled by the Cybercrime Division, Complaints and Assessment Division, or the office serving your location. NBI divisions and official contacts

DTI for an online consumer transaction

For a purchase from an online merchant, e-retailer, or person selling in the ordinary course of business, file through:

DTI Consumer Complaints Assistance and Resolution System
Email: consumercare@dti.gov.ph
the appropriate DTI regional or provincial office; or
the DTI Fair Trade Enforcement Bureau for complaints within its jurisdiction.

Attach proof that you used the merchant or platform’s internal redress process and include the complaint reference and result—or evidence that seven calendar days passed without resolution. State the relief requested, such as refund, replacement, cancellation, or other appropriate consumer remedy.

DTI proceedings ordinarily begin with mediation. If no settlement is reached, the complainant may be permitted to file a verified formal complaint for adjudication, supported by the required Certificate to File Action and evidence. DTI complaint-filing guidance

The Internet Transactions Act covers qualifying business-to-business and business-to-consumer internet transactions involving the Philippine market. It expressly excludes consumer-to-consumer transactions. An isolated sale by another private individual may therefore fall outside the Act, although the payment dispute, platform report, and criminal complaint may still proceed. Repeated or income-generating selling may indicate that the seller is acting as a business; DTI will assess the actual circumstances.

BSP if the bank or e-wallet mishandles the complaint

Your bank, e-wallet, or other BSP-supervised institution is the first-level recourse. If you are dissatisfied with its response, escalate through:

the BSP Online Buddy, accessible from the BSP website;
the BSP’s official Facebook page; or
the BSP Complaint/Inquiry/Reply Form sent to consumeraffairs@bsp.gov.ph.

Include proof that you first used the institution’s Financial Consumer Protection Assistance Mechanism. The BSP Consumer Assistance Mechanism facilitates complaints against BSP-supervised institutions; it is not a substitute for a criminal complaint against the scammer. Do not send PINs, passwords, OTPs, full card credentials, passbooks, or unnecessary identification documents to the BSP. BSP complaint instructions

SEC for investment or lending-related social-media scams

If the supposed purchase was actually an investment, trading scheme, lending transaction, or solicitation promising returns, file an investment-scam complaint through the SEC iMessage portal. A company’s SEC registration alone does not authorize it to solicit investments; the required secondary license or registration must also exist.

What to put in the complaint

Use a factual, chronological account. Include:

Your name and reliable contact details.
The date, time, and place where you were when the transaction occurred.
The platform, page, profile, website, or group involved.
What the seller represented before payment.
Why those representations appeared false.
The amount, payment method, transaction reference, source account, and recipient details.
What you received—or did not receive.
Your demands and the seller’s responses.
Any deleted, blocked, renamed, or replacement accounts.
The bank, platform, and government reports already made.
A numbered list of attachments.
The assistance requested, without asserting facts you cannot prove.

Describe the deception precisely. For example: “The account claimed that the item was on hand and would be shipped after payment; the photographs were later found to belong to another seller; no shipment was made; and the account blocked me after receiving ₱___.”

Avoid conclusions such as “this person is definitely part of a syndicate” unless supported by evidence.

When a failed order may be a crime

Not every delayed delivery, defective product, refund disagreement, or breach of contract is automatically estafa. Criminal fraud generally requires evidence that:

a false pretense, fraudulent act, or fraudulent means existed before or at the time of the transaction;
the buyer relied on it;
it induced the buyer to part with money or property; and
the buyer suffered damage.

The Supreme Court has distinguished deceit existing at or before payment from an ordinary failure to perform a contract. Montano v. People, G.R. No. 141980

Depending on the facts, authorities may consider:

estafa under the Revised Penal Code committed through information and communications technology;
computer-related fraud, where unauthorized alteration, deletion, input, or system interference caused damage with fraudulent intent;
computer-related identity theft;
access-device fraud;
offenses involving money-mule accounts or social-engineering schemes; or
consumer-law violations, which may exist even when the evidence does not establish a criminal offense.

Simple misrepresentation through chat is not automatically “computer-related fraud” under Section 4(b)(2) of the Cybercrime Prevention Act; that offense has specific requirements involving unauthorized computer data or system activity. The investigator and prosecutor must determine the proper offense from the evidence.

Important deadlines

There is no single deadline covering every online scam. Apply the shortest relevant period and act immediately.

Bank or e-wallet: report at once. Under the AFASA holding process, an initial hold is limited to five calendar days, and documents supporting an extension may be required during that period.
Platform dispute or chargeback: follow the platform, card network, or issuer’s deadline, which may be much shorter than a legal prescriptive period.
Internal online-merchant redress: unresolved complaints are deemed exhausted after seven calendar days under the Internet Transactions Act.
Internet Transactions Act damages claim: generally must be filed with the court or DTI within two years from accrual of the cause of action.
Consumer Act claim: generally prescribes within two years from consummation of the transaction or commission of the deceptive, unfair, or unconscionable act; hidden-defect claims run from discovery. The precise reckoning date can depend on the facts. Mazda Quezon Avenue v. Court of Appeals, G.R. No. 232688
Criminal complaint: the prescriptive period depends on the offense and applicable penalty. Do not assume the two-year consumer period controls a criminal case.

Under the Cybercrime Prevention Act, service providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time extension. These are provider-preservation rules, not permission to delay reporting. Ask the assigned investigator promptly whether a preservation order is needed. Republic Act No. 10175, Sections 13–14

Common mistakes to avoid

Waiting several days before notifying the payment provider.
Continuing to send “release,” “insurance,” “verification,” tax, or refund-processing fees.
Trusting a person who claims they can recover the money for an advance fee.
Deleting chats after blocking the scammer.
Saving only cropped screenshots without URLs, timestamps, or original files.
Closing a platform dispute in exchange for a promise of an off-platform refund.
Giving an OTP, PIN, password, or recovery code to someone claiming to investigate the scam.
Making a knowingly false or exaggerated report. Malicious reporting that causes funds to be held can itself create criminal liability under AFASA.
Attempting to hack, trace, threaten, or entrap the suspect without law-enforcement guidance.
Assuming that a DTI business-name or SEC corporate registration proves that the seller, investment, or solicitation is legitimate.
Assuming that the platform is automatically liable for every seller’s conduct. The Internet Transactions Act makes the merchant primarily liable and imposes platform liability only under specified conditions.

When legal help is urgent

Consult a lawyer or the Public Attorney’s Office, if qualified, when:

the loss is substantial or involves several victims;
the recipient or suspect is abroad;
the scam involves threats, extortion, intimate images, stalking, or physical danger;
your identity, SIM, email, or financial account was taken over;
you have received a subpoena, summons, counter-complaint, or demand;
the platform or financial institution refuses to record the complaint;
the case involves a company, investment, cryptocurrency, property, or complex commercial documents; or
you need to file a prosecutor’s complaint, civil action, or application for urgent court relief.

Call 911 or go to the nearest police station if anyone is in immediate danger. Do not arrange a personal meeting with the suspected scammer or conduct your own entrapment operation.

Frequently asked questions

Can I report a scammer who used a fake name or dummy account?

Yes. Report the account, URLs, payment destination, transaction identifiers, phone numbers, email addresses, and all available communications. Do not delay merely because you do not know the person’s legal name. Subscriber or account information generally must be obtained through lawful investigative procedures.

I authorized the transfer myself. Can I still report it?

Yes. A payment induced by deception may still be reported as a scam-related disputed transaction. Tell the institution that you initiated the transfer but did so because of specific false representations. Authorization does not automatically prove that the underlying transaction was legitimate, but reimbursement is not automatic.

Should I report to DTI or the police?

Often both. DTI addresses qualifying consumer transactions and remedies against businesses. The PNP and NBI investigate possible crimes. CICC can receive and coordinate a cybercrime report. Your bank or e-wallet handles the immediate payment dispute.

What if I bought from another private person on Facebook Marketplace?

The Internet Transactions Act excludes genuine consumer-to-consumer transactions. You should still use the platform dispute process, report the payment immediately, and contact CICC, PNP, or NBI if the evidence indicates fraud. If the seller regularly sells for income, ask DTI whether the transaction should be treated as business-to-consumer.

Are screenshots enough?

They are a useful starting point, but not always sufficient by themselves. Preserve the original messages, device, account URLs, transaction records, emails, and other evidence capable of authenticating the screenshots and linking the account to the transaction.

Will reporting guarantee that my money is returned?

No. Funds may already have been withdrawn, transferred through several accounts, converted into other assets, or sent abroad. Fast reporting improves the possibility of tracing and holding available funds, but each institution and agency must verify the transaction and follow due process.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Procedures and liability depend on the transaction, evidence, payment method, and parties involved. Official sources and reporting channels were checked as of JULY 29, 2026.