Quick answer

Report the scam immediately to the bank, card issuer, or e-wallet that handled the payment; the shopping or social-media platform; and a cybercrime authority such as the Cybercrime Investigation and Coordinating Center (CICC), Philippine National Police Anti-Cybercrime Group (PNP-ACG), or National Bureau of Investigation Cybercrime Division (NBI-CCD). For a business-to-consumer purchase, also use the Department of Trade and Industry’s consumer-complaint process.

Do not wait for the seller to reply before securing compromised accounts or asking the financial institution to trace, recall, or temporarily hold the funds. Recovery is never guaranteed, but prompt reporting matters because scammers can quickly withdraw or transfer the money and digital records may later become harder to obtain.

What to do immediately

1. Stop further losses

If you disclosed a password, PIN, one-time password, card number, recovery code, or identification document:

Contact the bank, card issuer, e-wallet, or telecommunications provider through its official app, website, hotline, or branch—not through a link or number supplied by the seller.
Block or freeze affected cards and accounts.
Change the password of the affected account and the email account connected to it. Use a clean, trusted device if the original device may be compromised.
Sign out other sessions, remove unfamiliar devices, revoke suspicious app access, and enable multifactor authentication.
Tell the provider about every unauthorized or suspicious transaction, including pending transactions.
If your SIM stopped working unexpectedly, contact the telco immediately because a SIM swap may have occurred.

Never send another payment for “verification,” “tax,” “insurance,” “release,” “refund processing,” or “account recovery.” Legitimate authorities do not require payment to freeze a scammer’s account.

2. Report the payment as a disputed transaction

Contact the financial institution from which the money originated. Clearly state:

that the transfer resulted from an online-shopping or social-engineering scam;
whether you personally initiated the payment or it was made without your authority;
the amount, date, time, transaction reference, and recipient account;
how the scammer deceived you; and
whether your account credentials or device were compromised.

Ask for:

a fraud or dispute reference number;
immediate tracing, recall, or card chargeback, where available;
coordination with the receiving financial institution;
preservation of transaction and account-access records; and
consideration of a temporary hold under the Anti-Financial Account Scamming Act.

Under Republic Act No. 12010, the Anti-Financial Account Scamming Act, a transaction may be treated as disputed when there are reasonable grounds to believe it is unusual, lacks a clear economic purpose, comes from an illegal source or unlawful activity, or was facilitated through social engineering. The BSP’s Circular No. 1215 provides for an initial hold of up to five calendar days and a coordinated-verification period of up to 30 calendar days in total; any longer hold requires a court order.

A hold is not automatic and does not itself establish that the complainant owns the money. The institutions must verify the transaction, and recovery may be impossible if the funds have already left the covered financial system. Knowingly filing a malicious, completely unwarranted, or false report that causes funds to be held is punishable under the same law.

If the institution’s customer-service or Financial Consumer Protection Assistance Mechanism does not resolve the matter, escalate it through the BSP Consumer Assistance Mechanism. BSP is the second-level recourse: complain to the bank or e-wallet first, retain its reference number and response, and then use the BSP Online Buddy or submit the prescribed form to consumeraffairs@bsp.gov.ph.

A report to BSP addresses the conduct of a BSP-supervised institution. It does not replace a criminal report to the police, NBI, or CICC.

3. Use the platform’s internal reporting system

Report all of the following through the platform’s official order-dispute, buyer-protection, fraud, or account-reporting channel:

the order or transaction;
the seller’s shop, page, profile, listing, and advertisements;
any impersonated person or business;
the messages used to obtain payment; and
any continuing attempt to solicit money from other users.

Ask the platform to cancel the order where possible, preserve the seller’s account and transaction records, restrict the fraudulent account, and confirm your report in writing. Save the ticket number and every response.

The Internet Transactions Act of 2023 requires covered e-marketplaces and digital platforms to provide a responsive reporting mechanism. It also directs an aggrieved party to use the platform’s, marketplace’s, or e-retailer’s internal redress mechanism before filing an external e-commerce claim. That mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing.

File the internal complaint immediately, but do not interpret the seven-day period as a reason to delay account security, a bank fraud report, evidence preservation, or an urgent criminal report.

Where to make an official report

Different offices address different parts of the problem. A victim commonly needs both a financial or platform dispute and a law-enforcement report.

CICC

The CICC’s National Anti-Scam Hotline 1326 accepts cyber-fraud reports and operates 24/7. Reports may also be initiated through the CICC reporting portal or the contact channels published by the Department of Information and Communications Technology. Suspicious scam messages that have not yet caused a loss may also be reported through the eReport feature of the eGovPH app.

Give the responder your contact information, a short incident timeline, payment details, the scammer’s identifiers, and any bank or platform reference numbers. Ask where supporting files should be sent and retain the CICC reference number.

PNP or NBI

You may approach:

the PNP Anti-Cybercrime Group, a regional or provincial anti-cybercrime unit, or the nearest police station; or
the NBI online complaint channel, NBI Cybercrime Division, or an NBI regional or district office.

The NBI’s official procedure for computer-crime victims includes an interview, a sworn complaint or statement, supporting documents, and, when relevant, examination of the device involved. Its current directory lists the Cybercrime Division at ccd@nbi.gov.ph.

An online submission, hotline call, police blotter entry, or reference number records the incident but may not by itself complete a criminal complaint. Investigators may ask you to appear, execute a sworn complaint-affidavit, identify and authenticate evidence, or provide the device on which the communications were received. Follow up using the assigned reference number.

You do not need to know the scammer’s true name before reporting. Under the Internet Transactions Act, a competent authority investigating a sworn complaint may require a covered platform to provide identifying information when the platform was used to commit a fraudulent or unlawful act and the complainant cannot identify the perpetrator.

DTI for consumer transactions

For a purchase from a person or entity selling in the ordinary course of business, file through the DTI Consumer Complaints Assistance and Resolution System. You may also contact consumercare@dti.gov.ph or the appropriate DTI regional or provincial office.

Include:

the buyer’s and seller’s names and contact details;
the platform, shop, and order number;
a chronological account of what happened;
the product, price, payment, promised delivery, and actual outcome;
the remedy requested;
the platform complaint and proof that it was filed; and
receipts, messages, advertisements, photographs, delivery records, and other supporting evidence.

DTI mediation is generally required before formal consumer adjudication. If mediation fails, DTI may issue a Certificate to File Action and require a verified formal complaint, supporting evidence, requested relief, and a certificate against forum shopping.

The Internet Transactions Act gives online consumers possible remedies including repair, replacement, refund, and remedies available under the Consumer Act of the Philippines. The appropriate remedy depends on what was promised, what was delivered, whether the defect or nonconformity is attributable to the consumer, and the applicable warranty. A change of mind does not automatically create a right to a refund.

The seller or online merchant is primarily responsible for the transaction. Platform liability is not automatic. Depending on the evidence, a marketplace or platform may have subsidiary liability if its failure to exercise the legally required diligence caused the loss, if it failed to act on a proper takedown notice, or if a foreign merchant has no Philippine legal presence and the platform fails to provide the merchant’s contact details despite notice.

Specialized complaints

Use the regulator responsible for the underlying activity when the transaction is not an ordinary retail purchase:

Report investment solicitations, unlicensed securities offerings, financing or lending companies, and online-lending platforms to the SEC iMessage system.
Report unresolved complaints involving banks, e-money issuers, payment operators, and other BSP-supervised institutions through BSP after first complaining to the institution.
Complaints involving regulated food, medicines, cosmetics, medical devices, telecommunications, insurance, travel, or professional services may fall under the specialized agency’s jurisdiction. DTI may refer a complaint under its no-wrong-door policy, but direct reporting to the proper regulator may be faster.

Preserve evidence before it disappears

Keep the original evidence even after taking screenshots. Electronic evidence may need to be authenticated, and a cropped image alone may omit information that connects the message to its sender. Philippine courts apply authentication requirements to electronic documents, as illustrated in RCBC Bankard Services Corporation v. Oracion.

Preserve:

the complete chat or email thread, including dates, times, voice messages, attachments, and deleted-message notices;
an exported copy of the conversation, if the platform permits it;
the exact profile and listing URLs, usernames, shop names, numeric account IDs, page-transparency information, phone numbers, and email addresses;
screenshots and a screen recording showing how the page, listing, profile, and conversation are reached;
the advertisement, product description, price, promised delivery date, warranty, and representations that caused you to pay;
order confirmations, invoices, official receipts, payment slips, transaction references, bank statements, and recipient account details;
delivery tracking, rider or courier details, parcel labels, photographs, and an unboxing video where relevant;
call logs, text messages, email headers, and the original .eml file for phishing emails;
platform, bank, e-wallet, CICC, police, NBI, and DTI report numbers and responses;
the names and contact details of witnesses; and
a written timeline using exact dates, times, amounts, and actions.

Store an unedited copy in at least two secure locations. Do not reset, sell, discard, or repair a device that may contain important evidence without first consulting the investigator. Do not publicly post unredacted account numbers, IDs, addresses, or other sensitive data.

Prompt reporting also helps investigators obtain provider-held records. Under the Cybercrime Prevention Act of 2012, service providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months after receipt of a law-enforcement preservation order, subject to the law’s rules on extension, warrants, disclosure, and confidentiality.

Is every failed online sale a crime?

No. A late shipment, defective item, misunderstanding, or breach of warranty is not automatically criminal fraud. It may primarily be a consumer or contractual dispute.

A criminal case may be appropriate when the evidence indicates that the seller used false pretenses or fraudulent representations to obtain payment, never intended to deliver, impersonated another person or business, used a hacked account, fabricated payment or delivery documents, or deliberately concealed the scheme. Depending on the facts, authorities may investigate estafa under the Revised Penal Code in relation to Section 6 of the Cybercrime Prevention Act, computer-related fraud, identity theft, illegal access, or offenses under the Anti-Financial Account Scamming Act.

The precise offense and responsible persons depend on the communications, timing of the deception, payment trail, account ownership, and other evidence. A platform username or recipient account name alone does not conclusively identify the offender.

Important coverage and deadline rules

The Internet Transactions Act generally covers business-to-business and business-to-consumer internet transactions when a party is in the Philippines or the business or platform avails itself of the Philippine market and has sufficient contacts here. It does not cover purely consumer-to-consumer transactions.

A one-time sale of a personal item may therefore fall outside that Act and DTI’s ordinary consumer jurisdiction. That does not make deception lawful: the victim may still report suspected estafa, identity theft, account misuse, or other crime to law enforcement and dispute the payment with the provider. Whether a social-media seller is genuinely private or is operating as an online merchant is a factual question; repeated listings and other business activity may be relevant.

For claims governed by the Internet Transactions Act, Section 28 provides a two-year period from accrual of the cause of action to file a claim for damages before the court or DTI. Other criminal, civil, platform, card-network, warranty, and payment-dispute periods can differ—and contractual dispute windows may be much shorter. Report immediately rather than calculating the longest possible deadline.

Common mistakes to avoid

Waiting for repeated promises of delivery or refund while the money is being transferred elsewhere.
Reporting only to the platform and assuming it has opened a criminal investigation.
Reporting only to police and missing a short platform or payment-dispute window.
Describing a scam-induced transfer merely as a “wrong transfer” instead of explaining the deception.
Deleting the conversation, blocking the account before recording its identifiers, or losing access to the original device.
Sending investigators only cropped screenshots with no URL, username, date, or surrounding conversation.
Paying a supposed hacker, fixer, investigator, or “fund-recovery agent.”
Confronting, threatening, or arranging a personal meeting with the suspected scammer.
Publicly accusing or doxxing a person based solely on the name attached to a recipient account. The account may belong to a money mule, identity-theft victim, or another person whose role still requires investigation.
Exaggerating facts or claiming a transaction was unauthorized when you initiated it. Describe exactly what you did and how you were deceived.

When help is urgent

Contact the financial institution and CICC or law enforcement immediately when:

the transfer was made recently or additional transactions are pending;
your bank, e-wallet, email, social-media account, or SIM has been taken over;
the scammer has your IDs, facial images, biometrics, card details, passwords, or recovery codes;
unauthorized loans, account changes, or withdrawals are appearing;
the offender is threatening violence, extortion, exposure of intimate material, or harm to a child;
you are being directed to meet or deliver cash in person; or
the loss is substantial, involves several victims, or crosses national borders.

Call 911 if there is an immediate threat to physical safety. For a large loss, complicated evidence, multiple complainants, or an impending legal deadline, consult a Philippine lawyer promptly. A lawyer is not normally required to make an initial bank, platform, CICC, police, NBI, or DTI report.

Frequently asked questions

Can the bank or e-wallet reverse the transfer?

Possibly, but not automatically. Success depends on factors including how quickly the report was made, whether the funds remain traceable within participating institutions, what the coordinated verification establishes, and whether the provider’s controls and dispute rules were followed.

I personally pressed “Send.” Can I still report it?

Yes. A transfer can be genuinely authorized at the technical level but induced by fraud or social engineering. State that you initiated the transfer and describe the false representation that caused you to do so. Do not falsely characterize it as an account takeover.

The seller blocked me and used a fake name. Is reporting pointless?

No. Preserve the profile URL, username, messages, recipient account, phone number, and transaction record. Covered platforms and financial institutions may hold information unavailable to you, and investigators can seek it through the appropriate legal process.

Should I wait seven days before going to the police?

No. File the platform’s internal complaint immediately and preserve proof of it. The seven-calendar-day rule concerns exhaustion of the internal e-commerce redress mechanism; it should not delay urgent financial action, account security, evidence preservation, or reporting suspected criminal conduct.

Can I file with DTI if I bought from an individual on social media?

It depends. DTI is generally appropriate when the seller was acting as a business or online merchant. A purely private, consumer-to-consumer sale is excluded from the Internet Transactions Act, although criminal and payment-dispute remedies may remain available.

Does a report guarantee that charges will be filed?

No. The report begins assessment or investigation. Filing charges requires sufficient admissible evidence and the proper legal process. Keep every reference number and respond promptly when an investigator requests an affidavit, original records, or clarification.

Should I warn others by posting the suspect’s name and account number?

Report the account privately to the platform, financial institution, and authorities. Publicly posting personal or financial information can expose innocent account holders, interfere with the investigation, create safety risks, and potentially lead to separate legal issues.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and available remedies depend on the documents and facts. Official sources and reporting channels were last checked on August 4, 2026.