VAn HR impersonation or fake job application scam can cause more than financial loss. Victims may hand over passport copies, government IDs, résumés, bank details, signatures, selfies, one-time passwords, or access to their devices before discovering that the supposed recruiter never worked for the company. In the Philippines, the proper response is usually a combination of urgent financial action, evidence preservation, notification to the impersonated employer, and reports to cybercrime, labor, privacy, and financial regulators. The correct agencies depend on whether the offer was for local or overseas work, whether money was transferred, and whether personal data or online accounts were compromised.

What Is an HR Impersonation or Job Application Scam?

HR impersonation happens when a scammer pretends to be:

An HR employee or hiring manager of a legitimate company
A representative of a real recruitment agency
An executive personally selecting candidates
A government recruiter or public employment officer
A foreign employer hiring Filipinos directly
A staffing company handling confidential or “priority” recruitment

The scammer may use a real employee’s name, photograph, LinkedIn profile, company logo, email signature, vacancy announcement, or interview script. Some create email addresses that closely resemble a legitimate company domain, such as replacing a letter or adding words like “careers,” “recruitment,” or “global.”

Common schemes include:

Asking for a “processing,” “reservation,” “training,” “medical,” or “equipment” fee
Sending a fake employment contract before requesting payment
Asking the applicant to buy equipment from a designated supplier
Conducting interviews entirely through Telegram, WhatsApp, Viber, or Messenger
Requiring applicants to complete paid “tasks” before employment
Asking for an OTP, banking password, card number, or e-wallet PIN
Sending links to fake applicant portals that steal login credentials
Collecting passport copies, IDs, selfies, signatures, or tax information
Offering overseas work without a licensed Philippine recruitment agency or approved job order
Asking applicants to receive or transfer money through their own bank or e-wallet accounts

A legitimate company may collect personal information during recruitment, but it should be able to explain who is collecting the data, why it is needed, how it will be protected, and how the applicant can contact the company through independently verifiable channels.

Which Philippine Laws May Apply?

The same incident may violate several laws. The final charges depend on the scammer’s acts and the available evidence.

Cybercrime Prevention Act

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, penalizes computer-related offenses that commonly appear in fake recruitment schemes.

Relevant offenses may include:

Computer-related identity theft — intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting another person’s identifying information without right
Computer-related fraud — manipulating computer data or systems with fraudulent intent and causing damage
Computer-related forgery — altering or entering computer data so that it appears authentic when it is not
Illegal access — accessing a computer system or account without authority

The law also covers crimes under the Revised Penal Code when committed through information and communications technology. Section 6 generally imposes a penalty one degree higher for a Revised Penal Code offense committed through ICT. The Supreme Court discussed and sustained this provision in Disini v. Secretary of Justice. See the Cybercrime Prevention Act and Disini v. Secretary of Justice. (Lawphil)

Estafa and falsification

A fake recruiter who obtains money through false representations may be investigated for estafa, or swindling, under Article 315 of the Revised Penal Code. The usual issue is whether the accused made a fraudulent representation before or at the time the victim parted with money, and whether the victim relied on that representation and suffered damage.

Fabricated contracts, identification cards, receipts, certificates, letters, or company documents may also raise possible falsification offenses under Articles 171 or 172, depending on the document and the person responsible. The applicable penalties for estafa were adjusted by Republic Act No. 10951. See the Revised Penal Code and Republic Act No. 10951. (Lawphil)

Illegal recruitment for local or overseas work

Article 38 of the Labor Code, Presidential Decree No. 442, treats recruitment activities undertaken by a non-licensee or non-holder of authority as illegal recruitment in circumstances covered by the law. Recruitment activities may include canvassing, enlisting, contracting, transporting, utilizing, hiring, procuring, referring, promising, or advertising for employment. (Lawphil)

For overseas employment, Section 6 of Republic Act No. 8042, as amended by Republic Act No. 10022, provides a broader definition of illegal recruitment. It may cover recruitment by an unlicensed person and specified prohibited practices committed even by licensed agencies. Illegal recruitment becomes economic sabotage when committed by a syndicate of three or more conspirators or in large scale against three or more victims. (Lawphil)

Republic Act No. 11641 created the Department of Migrant Workers and transferred to it major functions involving overseas employment, including action against illegal recruitment and trafficking. (Lawphil)

Data Privacy Act

Republic Act No. 10173, or the Data Privacy Act of 2012, may apply when personal information is collected, used, disclosed, or retained without a lawful basis or for an unauthorized purpose.

Applicants have rights concerning their personal data, including rights to information, access, correction, blocking or deletion in appropriate cases, and indemnification for damage caused by unauthorized use. Organizations controlling applicant data must implement reasonable organizational, physical, and technical security measures. (National Privacy Commission)

A privacy complaint may be especially relevant when:

A scammer used information that appears to have come from a real employer’s applicant database
An employer or recruitment platform exposed applicant records
A legitimate organization ignored a request to secure, correct, or remove compromised data
An identifiable person or entity unlawfully processed the applicant’s IDs, résumé, medical information, or other personal data

A privacy complaint is not a substitute for a criminal complaint. When the scammer is unknown, law enforcement may first need to identify the person behind the account.

Anti-Financial Account Scamming Act

Republic Act No. 12010, the Anti-Financial Account Scamming Act of 2024, addresses financial-account scams, money-mule activities, and social-engineering schemes.

The law covers bank accounts, e-wallets, credit card accounts, and other financial accounts. It penalizes activities such as selling or lending accounts for criminal proceeds and using deception to obtain sensitive information that results in unauthorized access and control over another person’s financial account. It also provides mechanisms for the temporary holding of funds involved in disputed transactions, subject to the law and Bangko Sentral ng Pilipinas rules. A hold is not automatic and does not guarantee recovery, so reporting speed matters. (Lawphil)

What to Do Immediately After Discovering the Scam

1. Contact the bank or e-wallet before doing anything else

When money has been transferred, immediately contact the sending bank or e-wallet through its official fraud or customer-service channel.

Provide:

Transaction reference number
Date and exact time
Amount
Recipient account name and number
Screenshots of the payment instruction
Explanation that the transfer resulted from a job or recruiter impersonation scam
Police, CICC, or NBI reference number, if already available

Ask the institution to:

Mark the transaction as disputed or fraudulent
Contact the receiving institution
Preserve transaction and account records
Consider temporarily holding remaining disputed funds under applicable rules
Secure or restrict your account if credentials were exposed
Issue a written complaint reference number

Do not wait for a notarized affidavit before making the first fraud report. A complete affidavit can follow, but the recipient may withdraw or transfer the money within minutes.

If the financial institution does not resolve the complaint through its internal Financial Consumer Protection Assistance Mechanism, the matter may be escalated through the BSP Online Buddy and Consumer Assistance Mechanism. The BSP asks complainants to include the complaint made to the financial institution, its reply if any, and supporting records. (Bangko Sentral ng Pilipinas)

2. Secure compromised accounts

When you clicked a suspicious link, installed an application, gave an OTP, or shared passwords:

Use a different trusted device to change your email password.
Change passwords for banking, e-wallet, social media, cloud-storage, and job-platform accounts.
Log out all other sessions.
Turn on multi-factor authentication.
Remove unknown recovery emails, phone numbers, devices, and application permissions.
Call your mobile network if your SIM stopped working unexpectedly.
Freeze cards or accounts that may have been exposed.
Scan affected devices or have them professionally checked before using them for financial transactions.

The email account should usually be secured first because it may be used to reset all other passwords.

3. Preserve evidence before blocking the scammer

Do not rely only on cropped screenshots. Preserve the full context.

Save:

Complete chat history, including account name, username, phone number, and profile URL
Full email messages, preferably with original headers
Job advertisement URL and screenshots
Fake employment contract, offer letter, invoice, receipt, or ID
Audio recordings or voicemail lawfully obtained
Meeting links, interview invitations, and calendar records
Bank or e-wallet transfer confirmations
Recipient account information
QR codes and payment links
Telephone call logs
Files sent by the scammer
The original electronic device used for the communications
Written confirmation from the impersonated company that the recruiter or vacancy was fake

Create a simple chronology showing the date, time, platform, event, amount paid, and evidence filename. This saves investigators from reconstructing the incident from hundreds of unorganized screenshots.

Electronic documents can be admitted in Philippine proceedings when properly authenticated. The Rules on Electronic Evidence place importance on integrity, reliability, and proof that the evidence is what the submitting party claims it to be. Keeping original messages, files, devices, metadata, and uncropped captures is therefore better than keeping screenshots alone. See the Rules on Electronic Evidence. (Lawphil)

4. Verify the recruiter directly with the company

Contact the impersonated company using details found independently on its official website, verified social-media page, SEC records, office directory, or published customer-service channel.

Ask the company to confirm in writing:

Whether the vacancy exists
Whether the named recruiter works for the company
Whether the email domain, phone number, and social-media account are authorized
Whether the company charges applicants any fee
Whether other applicants have reported the same scheme
Where the company wants evidence sent

Do not use a phone number, website, or email address supplied by the suspected scammer for verification.

A written denial from the real company can become important evidence of misrepresentation. The company may also be able to preserve internal email records, notify its real employee, report trademark or account impersonation, and request platform takedowns.

Where to Report an HR Impersonation or Job Scam

Situation	Primary report	What the agency or organization can do
Online scam, phishing, fake recruiter account	CICC, PNP Anti-Cybercrime Group, or NBI Cybercrime Division	Record the incident, investigate, coordinate referrals, and seek digital evidence through lawful processes
Money sent to a bank or e-wallet	Sending institution immediately; BSP if unresolved	Dispute the transaction, coordinate with recipient institutions, secure accounts, and apply applicable fund-holding procedures
Fake overseas job or agency	Department of Migrant Workers	Verify licenses and job orders, investigate illegal recruitment, and coordinate enforcement
Fake local job	DOLE regional office, Bureau of Local Employment, PESO, and law enforcement	Verify job postings, receive labor-related reports, and refer possible illegal recruitment or fraud
Misuse or exposure of applicant data	National Privacy Commission and the organization’s Data Protection Officer	Investigate possible Data Privacy Act violations and order appropriate privacy remedies
Fake account, advertisement, domain, or listing	Platform, domain registrar, email provider, and impersonated company	Preserve reports, restrict accounts, remove content, and provide records when lawfully required

Reporting to the CICC

The Cybercrime Investigation and Coordinating Center operates the 1326 cybercrime hotline and the CICC Cybercrime Complaint Center. It receives reports involving online scams and may provide initial assistance or refer the matter to the appropriate investigative agency. The CICC also publishes mobile and email reporting channels through its official pages. (Facebook)

A CICC report is useful for quick triage and referral, but a victim may still need to execute a sworn complaint before the PNP, NBI, or prosecutor.

Filing with the PNP or NBI

A formal cybercrime complaint may be filed with:

The PNP Anti-Cybercrime Group or its regional anti-cybercrime units
A local police station, which may refer the case to a specialized unit
The NBI Online Complaint system
The NBI Cybercrime Division or an NBI regional or district office

The NBI’s published citizen’s charter describes an initial process involving a complaint sheet, preliminary interview, sworn statements, supporting documents, and examination of relevant devices. Its stated frontline intake time is approximately one hour and ten minutes, excluding the investigation itself and the time needed to obtain external records. (National Bureau of Investigation)

Bring at least:

Government-issued identification
Printed incident chronology
Printed and electronic copies of evidence
Proof of payment or account statements
The device containing original messages, when requested
Names and contact details of witnesses
Written confirmation from the real employer
Copies of previous reports to the bank, platform, CICC, DMW, DOLE, or NPC

A police blotter entry is not always the same as a completed criminal complaint. Ask whether you must execute a complaint-affidavit and whether the case has been assigned to an investigator. Obtain the investigator’s name, unit, contact details, and reference number.

Reporting a fake overseas job to the DMW

For overseas work, verify both the recruitment agency and the job order. A real agency name is not enough because scammers sometimes impersonate licensed agencies or advertise positions for which the agency has no approved job order.

Use the official:

DMW directory of licensed recruitment agencies
DMW approved job-order database
DMW hotline 1348
DMW Anti-Illegal Recruitment and Trafficking in Persons Program

As of July 2026, the DMW also publishes (02) 8721-0619 and airtipinfo@dmw.gov.ph for reports to its anti-illegal-recruitment and trafficking program. Because contact details can change, verify them on the official DMW website before submitting sensitive records. (Department of Migrant Workers)

Warning signs identified in official overseas-employment guidance include dealing with an unlicensed agency, dealing with an unauthorized representative, transacting outside the agency’s registered address, paying without a valid contract and official receipt, and accepting deployment under a tourist visa. (Department of Migrant Workers)

Reporting a fake local job

For a local position, report the posting to:

The concerned DOLE regional office
The Bureau of Local Employment
The city or municipal Public Employment Service Office
The job platform
The impersonated employer
The PNP or NBI when fraud, identity theft, or payment is involved

Applicants can check legitimate local vacancies and accredited employers through PhilJobNet, the government’s official job-matching portal. (PhilJobNet)

DOLE or PESO reporting does not replace a criminal complaint when money, forged documents, account compromise, or identity theft is involved.

Filing a complaint with the National Privacy Commission

Before filing with the NPC, identify the privacy violation and the respondent as clearly as possible. A complaint is stronger when it explains:

What personal information was collected or exposed
Who collected, disclosed, or failed to protect it
Why the processing was unauthorized or insecure
What harm or risk resulted
What action was requested from the organization or its Data Protection Officer
How the organization responded

The NPC requires a formal complaint in the prescribed format. Its current instructions state that the form must be completed, notarized, and submitted in person, by courier, or by scanned email. Supporting evidence and witness affidavits should be attached when available. A separate complaint form is generally used for each respondent. See the NPC complaint-filing instructions. (National Privacy Commission)

If a representative files for the victim, the NPC may require a special power of attorney. Additional corporate authority documents are required when a juridical entity acts as representative. (National Privacy Commission)

What Happens After a Formal Criminal Complaint?

The process commonly has several stages:

Intake and initial assessment. Investigators review the narrative, evidence, possible offenses, jurisdiction, and urgency.
Evidence preservation and identification. Law enforcement may seek preservation of computer data, subscriber information, transaction records, IP records, or account details.
Cybercrime warrants or court orders. Certain data cannot simply be demanded informally. Investigators may need warrants or other legal process under Republic Act No. 10175 and the Rule on Cybercrime Warrants.
Case build-up. The investigator may request additional affidavits, certified financial records, company confirmation, device examination, or identification of other victims.
Preliminary investigation by prosecutors. The prosecution determines whether the evidence meets the applicable standard for filing charges. The DOJ’s 2024 rules govern preliminary investigations conducted by prosecutors, and the Supreme Court upheld the DOJ’s authority over that executive process in 2026. (Supreme Court of the Philippines)
Court proceedings. If charges are filed, the court handles warrants, arraignment, pretrial, trial, and judgment.

There is no reliable fixed end-to-end timeline. Initial reporting may be completed in one visit, but identifying an anonymous account, obtaining records from several financial institutions, or securing data from a foreign platform can take weeks or months. Prosecution and court proceedings can take substantially longer.

The most common bottlenecks are:

Incomplete account names or transaction details
Deleted conversations
Failure to preserve email headers or original files
Recipient accounts opened using false or stolen identities
Money moved through several “mule” accounts
Platforms or service providers located abroad
Duplicate complaints that are not disclosed to investigators
Victims becoming unreachable after filing
Witnesses refusing to execute affidavits
Delayed reports after provider data has been deleted

Republic Act No. 10175 requires specified computer data to be preserved for a minimum period, but investigators should still be approached promptly because platform practices, foreign-law issues, and the type of data available can differ. (Lawphil)

Common Mistakes That Can Weaken a Report

Paying an alleged “recovery agent”

Scammers sometimes contact victims again while pretending to be investigators, lawyers, hackers, bank employees, or government officials who can recover the money for an advance fee. Verify every person through the agency’s publicly listed contact details.

Publicly posting all evidence

Warning other applicants can be helpful, but publicly posting passports, bank-account numbers, phone numbers, signatures, addresses, or unverified accusations may create additional privacy, safety, or defamation problems. Give complete records privately to investigators and publish only properly redacted information.

Deleting the conversation after taking screenshots

Screenshots may omit usernames, links, dates, message context, metadata, or attachments. Keep the original conversation and device whenever possible.

Continuing to communicate without coordinating with investigators

Do not threaten the scammer or announce that authorities are tracing the account. This may cause the person to delete accounts, move money, intimidate victims, or destroy evidence. When investigators propose a controlled communication or entrapment operation, follow their instructions closely.

Assuming a real company name means a real recruiter

A scammer may impersonate a real company, copy a genuine vacancy, and use a real employee’s identity. Verify the email domain, recruiter, job reference number, interview process, and payment instructions independently.

Treating a barangay blotter as the only report

A barangay can document local events and assist in matters within its authority, but it cannot obtain bank, telecommunications, or platform records. Cybercrime and financial-fraud reports should be brought directly to the appropriate institution and law-enforcement agency.

Special Situations

The victim is outside the Philippines

A Filipino abroad can report through online channels, the relevant Philippine embassy or consulate, the Migrant Workers Office where available, the DMW, and Philippine law enforcement. The victim should also report to the police and financial institutions in the country where the payment or account compromise occurred.

Foreign documents required for Philippine proceedings may need notarization and, depending on the country and intended use, an apostille or consular authentication. Investigators or prosecutors should first confirm the exact form required before the victim incurs authentication expenses.

The victim is a foreigner

A foreign applicant dealing with a Philippine scammer may report to the PNP, NBI, CICC, the financial institution, the platform, and the foreigner’s local police. Philippine jurisdiction depends on the acts, persons, systems, and harm connected to the Philippines.

The Data Privacy Act can apply to some acts outside the Philippines when the processing concerns Philippine citizens or residents or when the entity has legally relevant links to the Philippines. (National Privacy Commission)

No money was lost, but IDs were submitted

Report the fake account and notify the impersonated company. Preserve evidence and consider reporting to the CICC, PNP, or NBI because the IDs may later be used for account opening, loan applications, SIM registration, fake employment records, or further impersonation.

Ask relevant organizations to flag the compromised documents. Monitor financial accounts and communications for password resets, loan messages, account-verification requests, or unfamiliar transactions.

A real HR employee’s identity was copied

Notify both the company and the employee through verified channels. The employee is also a potential victim of identity theft. The company should preserve reports, confirm the employee’s genuine contact details, warn applicants, request platform takedowns, and assess whether internal applicant information was exposed.

Several applicants were victimized

Each victim should preserve individual proof and execute a separate statement. A master list can help investigators identify common recipient accounts, phone numbers, devices, scripts, and payment patterns.

Three or more victims may be legally significant in an overseas illegal-recruitment case because illegal recruitment committed in large scale is treated as economic sabotage. (Lawphil)

Frequently Asked Questions

Where do I report a fake HR recruiter in the Philippines?

Report the account to the impersonated company and platform, then contact the CICC through 1326 or its complaint portal. For a formal investigation, file with the PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the NBI Cybercrime Division. Report overseas recruitment to the DMW and local recruitment concerns to DOLE or PESO.

Can I recover money sent to a fake recruiter?

Recovery is possible in some cases but is never guaranteed. Immediately report the transaction to the sending bank or e-wallet and ask it to coordinate with the recipient institution. Delays reduce the chance that funds remain available. Provide transaction references and law-enforcement report numbers as soon as possible.

Is it illegal for a recruiter to charge an application fee?

A demand for payment is a major warning sign, especially when made through a personal bank or e-wallet account. The legality of a recruitment-related charge depends on whether the job is local or overseas, the recruiter’s authority, the type of fee, applicable regulations, and whether an official receipt and valid contract exist. Overseas applicants should verify the agency, job order, and permitted charges directly with the DMW before paying.

Can a scammer be charged even if I did not pay?

Yes. Depending on the acts, attempted fraud, identity theft, forgery, illegal access, unlawful processing of personal data, illegal recruitment, or other offenses may still be investigated even when no money was transferred.

Are screenshots enough to file a complaint?

Screenshots are useful for initial reporting, but they should be supported by original messages, email headers, URLs, files, payment records, devices, witness statements, and company verification. Uncropped records with visible dates and account identifiers are more useful than isolated images.

Should I report to both the PNP and NBI?

You may seek assistance from either agency. Reporting the same incident to several channels may be appropriate for urgent referrals, but disclose all prior reports and reference numbers. Avoid submitting inconsistent sworn narratives or creating confusion over which unit is conducting the primary investigation.

Can I file an anonymous report?

Tip lines and platforms may accept information without a full sworn complaint. However, criminal prosecution usually requires an identifiable complainant or witness who can authenticate communications, explain the payment, and execute an affidavit. Anonymous information may start intelligence gathering but can be insufficient by itself.

Can I report a recruiter using a foreign phone number?

Yes. A foreign number does not prove that the scammer is abroad. Internet-based numbers, roaming SIMs, and messaging accounts can be operated from different locations. Preserve the full number with country code, username, profile URL, and all linked payment details.

Should I send my phone or laptop to the investigator?

Do not surrender a device to an unknown person. A legitimate investigator should identify the agency, explain the examination or turnover process, document receipt, and preserve the chain of custody. Back up personal information where appropriate, but do not alter or wipe relevant evidence.

Key Takeaways

Report transferred money to the bank or e-wallet immediately; do not wait for a notarized complaint.
Preserve original chats, emails, files, URLs, transaction records, and devices—not only cropped screenshots.
Verify the recruiter through the company’s independently located official contact details.
Use CICC 1326 for cybercrime assistance and file a formal complaint with the PNP Anti-Cybercrime Group or NBI when investigation is needed.
Report overseas job scams to the DMW and verify both the agency license and approved job order.
Report local fake-job concerns to DOLE, PESO, the employer, the platform, and law enforcement when fraud is involved.
File with the NPC when applicant information was unlawfully used, disclosed, or inadequately protected.
A police or barangay blotter is not always a complete complaint; obtain a case reference and confirm whether a sworn complaint-affidavit is required.