If you sent money to an online scammer, lost access to your bank or e-wallet account, or discovered unauthorized transfers, the first few hours matter. In the Philippines, the practical goal is not only to “report the scam,” but to create a paper trail strong enough for your bank, e-wallet, the PNP or NBI cybercrime unit, and possibly the courts to trace the funds, preserve digital evidence, and stop withdrawals while the money is still inside the financial system.

The important point is this: an ordinary victim cannot personally “freeze” another person’s bank account by demand letter or social media post. What you can do is immediately request temporary holding of disputed funds through your bank or e-wallet under the Anti-Financial Account Scamming Act, and file a cybercrime or fraud complaint so law enforcement can investigate, request data, and pursue the scammer.

What online fraud usually means in Philippine law

“Online fraud” is a broad practical term. Depending on what happened, the same incident may involve several Philippine laws.

Common examples include:

A fake seller takes your payment through bank transfer, GCash, Maya, QR Ph, InstaPay, PESONet, or crypto and never delivers the item.
Someone pretends to be your bank, e-wallet, telco, courier, relative, boss, government office, or online platform to get your OTP, password, PIN, card number, or login link.
A scammer takes over your social media account and asks your contacts to send money.
A “job,” “tasking,” “investment,” “forex,” “crypto,” or “trading” scheme asks for deposits and then blocks withdrawals.
A fraudster uses a mule account, meaning an account opened, rented, sold, borrowed, or used to receive scam proceeds.

Legally, the case may be treated as:

Situation	Possible legal basis
Deceit caused you to send money	Estafa or swindling under Article 315 of the Revised Penal Code, often in relation to cybercrime law
Fraud used a computer, app, website, email, phone, or online account	Computer-related fraud or computer-related identity theft under Republic Act No. 10175, the Cybercrime Prevention Act of 2012
A bank, e-wallet, card, account number, OTP, access code, or payment credential was misused	Republic Act No. 8484, the Access Devices Regulation Act of 1998, as strengthened by Republic Act No. 11449
The account was used as a money mule, or the scammer obtained your sensitive financial information through deception	Republic Act No. 12010, the Anti-Financial Account Scamming Act or AFASA
The fraud involved scam texts, spoofed sender names, or SIM misuse	Republic Act No. 11934, the SIM Registration Act
The funds appear to be proceeds of unlawful activity or money laundering	Republic Act No. 9160, the Anti-Money Laundering Act, as amended

For most victims, the immediate remedy is not an AMLC freeze order. It is the temporary holding of disputed funds by the bank, e-wallet, or other Bangko Sentral-supervised institution, followed by coordinated verification.

The difference between “freezing an account” and “holding disputed funds”

People often use the word “freeze” loosely. Philippine law uses different mechanisms.

Remedy	Who can trigger or request it	What it does	Typical timeline
Blocking your own account, card, app, or online banking access	You, through your bank/e-wallet fraud channel	Stops further unauthorized access to your own account	Immediate or same day, depending on provider
Temporary holding of disputed funds under AFASA	The source account owner reports to the originating bank/e-wallet; the institution initiates the process	Holds the disputed funds in the beneficiary account if still traceable and still inside the financial system	Initial hold of up to 5 calendar days; may be extended up to a total of 30 calendar days
Court extension of temporary holding	Financial institution or proper party through court process	Extends the hold beyond 30 days when legally justified	Depends on court action
AMLA freeze order	Anti-Money Laundering Council applies before the Court of Appeals	Freezes monetary instruments or property related to unlawful activity or money laundering	Initially effective immediately; court process governs extension
Cybercrime warrants and preservation orders	PNP, NBI, BSP in AFASA cases, or other authorized law enforcement through proper procedure	Preserves or obtains digital evidence, subscriber data, traffic data, or computer data	Depends on docketing, warrant application, and service provider compliance

Under BSP Circular No. 1215, Series of 2025, which implements AFASA rules on temporary holding and coordinated verification, banks and other BSP-supervised institutions may temporarily hold disputed funds for not more than 30 calendar days, inclusive of the initial and extended holding periods. The initial holding period is generally up to 5 calendar days, and it may be extended by up to 25 more calendar days if the requirements are met.

That is why speed matters. If the scammer withdraws the money, moves it to another account, converts it to crypto, or cashes out through an agent before the hold is triggered, recovery becomes much harder.

Step-by-step guide: what to do immediately after online fraud

1. Secure your own accounts first

Before preparing affidavits or going to the police, stop additional losses.

Do these immediately:

Change your online banking, e-wallet, email, and social media passwords.
Log out all devices if the app or platform allows it.
Disable or lock your card, app, or online banking access if there was unauthorized access.
Call your bank or e-wallet’s verified fraud hotline through the official app or website.
Do not click any “recovery,” “refund,” or “case verification” link sent by strangers after the scam.

If your phone was stolen, your SIM was compromised, or your email was taken over, report that separately to your telco, email provider, and financial institutions. Many unauthorized transfers happen because the scammer controls the victim’s phone number, email inbox, or OTP channel.

2. Report to your bank or e-wallet and request temporary holding under AFASA

Your first financial report should be to the originating financial institution — the bank, e-wallet, payment app, or account from which the money came.

Ask for three things clearly:

Block or secure your own account if there is any risk of further unauthorized transactions.
Treat the transfer as a disputed transaction.
Initiate temporary holding and coordinated verification under AFASA and BSP Circular No. 1215, Series of 2025.

Use simple wording like this:

I am reporting an online fraud transaction and requesting immediate temporary holding of the disputed funds under the Anti-Financial Account Scamming Act. Please initiate coordinated verification with the receiving financial institution and provide a case reference number.

Give the bank or e-wallet the exact transaction details:

Transaction reference number
Date and time of transfer
Amount
Source account name and number or mobile wallet number
Receiving account name, account number, mobile number, QR code, or wallet ID, if available
Receiving bank, e-wallet, or payment provider
Screenshots of chats, listings, emails, SMS, receipts, QR codes, and profile pages
Short explanation of why the transaction is fraudulent

Ask for a case reference number. Take a screenshot of the report confirmation. If you reported by phone, write down the date, time, agent name or ID if given, and summary of the call.

3. Submit supporting documents within the initial holding period

A common mistake is assuming that the phone report is enough. Under BSP rules, the initial holding period is short. For extended holding, the source account owner may be asked to submit supporting documents such as:

Sworn complaint
Affidavit
Police report
Screenshots and transaction records
Other documents explaining why the transaction is probably fraudulent

Prepare these quickly. If you cannot get a full police report immediately, ask the bank what temporary documentation it will accept while you are filing with the PNP or NBI. Some institutions initially accept a complaint narrative, screenshots, and ID, but may later require a sworn affidavit or law enforcement report to continue the hold.

4. Report the incident to CICC or through eGovPH for scam coordination

For cyber fraud and scam messages, the Cybercrime Investigation and Coordinating Center (CICC) has promoted reporting through the Inter-Agency Response Center Hotline 1326 and the eGovPH app eReport feature, especially for suspicious messages and cyber fraud. The Philippine News Agency has reported CICC guidance that victims of cyber fraud should call 1326, while suspicious text scams may be reported through the eGovPH app’s eReport feature.

This is useful for:

Scam texts and phishing links
Suspicious mobile numbers
Online fraud incidents needing inter-agency referral
Reports that may help NTC or other agencies identify and block scam numbers

For text scams, keep the full message, sender number or sender ID, date and time, and link. Do not just delete the SMS.

5. File a complaint with the PNP Anti-Cybercrime Group or NBI Cybercrime Division

For a criminal investigation, file with either:

PNP Anti-Cybercrime Group (PNP-ACG); or
NBI Cybercrime Division, including regional cybercrime units where available.

The NBI’s Citizen’s Charter for investigative assistance for victims of computer crimes identifies the Cybercrime Division as the office handling these complaints, with preliminary interview, complaint sheet, sworn statements, and supporting documents forming part of the intake process.

Bring or prepare:

Valid government ID or passport
Printed and digital copies of receipts and transaction records
Screenshots of the scammer’s profile, chat thread, post, listing, email, SMS, QR code, website, and payment instructions
The scammer’s account name, account number, mobile number, email, username, URL, or group/page name
Your bank or e-wallet complaint reference number
A chronological narrative: what happened, when, who said what, how payment was made, and what happened after payment
Affidavit or sworn statement, if already prepared

A police blotter at a local station can help document that you reported the incident, especially if the bank requires a police report. But for online fraud, a cybercrime-capable unit is usually more useful because it can request technical preservation, coordinate with platforms, and pursue cybercrime warrants.

6. Ask law enforcement about preservation of digital evidence

Under RA 10175, law enforcement authorities can require preservation of certain computer data and, with proper court authority, obtain disclosure of relevant subscriber or traffic data. This matters because platforms, telcos, email services, and payment channels may not keep all useful logs forever.

Ask the investigator whether preservation requests should be sent to:

The social media platform
The marketplace platform
The email provider
The telco
The payment service provider
The bank or e-wallet
The website host or domain registrar

Do not edit screenshots in a way that removes dates, URLs, account names, or message context. Keep the original files on your phone or computer.

7. Escalate to BSP if your bank or e-wallet mishandles the complaint

If your bank, e-wallet, payment provider, or other BSP-supervised institution ignores your report, fails to give a case number, refuses to act on a properly documented fraud report, or gives an unclear response, you can escalate the consumer complaint to the Bangko Sentral ng Pilipinas.

The BSP Consumer Assistance Mechanism is generally a second-level recourse. Report first to the institution’s own Financial Consumer Protection Assistance Mechanism or customer service channel, then escalate if unresolved. The BSP explains its complaint channels through BSP Consumer Assistance Channels and the BSP Online Buddy.

Prepare:

Your bank/e-wallet complaint reference number
Proof that you first reported to the institution
The institution’s reply, if any
Your transaction records and screenshots
The result you are requesting, such as refund, proper investigation, or explanation of why the hold was not made

BSP escalation is not the same as filing a criminal case. It addresses the conduct of the BSP-supervised institution and may help with consumer redress, but the PNP or NBI report remains important for pursuing the scammer.

Required documents for reporting online fraud and requesting account freezing

Document or information	Why it matters
Valid ID or passport	Confirms you are the source account owner or authorized representative
Transaction receipt or reference number	Allows the institution to trace the transfer quickly
Date, time, amount, and channel used	Needed for InstaPay, PESONet, QR, e-wallet, card, or account tracing
Source and beneficiary account details	Helps identify which institutions must coordinate
Screenshots of chats, posts, listings, emails, SMS, URLs, and profiles	Shows deceit, identity, payment instructions, and sequence of events
Bank or e-wallet case reference number	Proves timely reporting and helps law enforcement follow up
Sworn affidavit or complaint	Supports extended holding and criminal investigation
Police or NBI report	Often required by financial institutions for further action
Special Power of Attorney, if filing through a representative	Needed if the victim is abroad, incapacitated, or represented by another person
Corporate authorization, if the victim is a company	Shows the representative is authorized to file and receive updates

For affidavits, a notarized statement is stronger than an unsigned narrative. If you are abroad, you may execute documents before a Philippine Embassy or Consulate, or use notarization/apostille procedures depending on the country and the receiving office’s requirements.

Timelines and practical expectations

Step	Usual timing	Practical note
Report to bank/e-wallet fraud hotline	Immediately, ideally within minutes or hours	This is the most urgent step if funds may still be traceable
Initial temporary holding under AFASA	Up to 5 calendar days	Works only if disputed funds are still in the account or traceable within the covered financial chain
Submission of affidavit, sworn complaint, police report, or supporting documents	Within the initial holding period, unless the institution’s protocol allows otherwise	Do not wait for the 5th day
Extended holding	Up to 25 additional calendar days	Total temporary holding by institutions generally cannot exceed 30 calendar days without court extension
Coordinated verification where funds were held	Within the 30-day holding period, unless extended by court	Institutions verify whether the transaction was legitimate or fraudulent
Coordinated verification where no funds were held	Generally within 30 calendar days; may extend up to 60 calendar days for meritorious reasons	Useful for tracing and accountability, but recovery may be harder
NBI/PNP intake	Same day to several hours, depending on queue and completeness	Actual investigation, subpoenas, warrants, and referral for prosecution take longer
Prosecutor preliminary investigation	Often weeks to months	Depends on respondent identification, evidence, counter-affidavits, and docket congestion
BSP consumer escalation	After first reporting to the institution	Useful for unresolved or mishandled bank/e-wallet complaints

There is usually no government filing fee for reporting to police or NBI for investigation. You may still spend for printing, notarization, transportation, certified copies, translations, apostille or consular services, and representation if needed.

What happens during coordinated verification

When a disputed transaction is reported, the originating institution may coordinate with the receiving institution and any subsequent receiving institutions. Under BSP rules, involved institutions may trace, verify, and validate the transaction by reviewing:

Account owner names and contact details
Transaction reference numbers
Dates, times, amounts, and receiving accounts
Fraud indicators and unusual activity
Sworn complaints, affidavits, police reports, and investigation reports
The relationship of the parties
The purpose of the transaction
Source of funds and account behavior

If the evidence supports that the funds are disputed funds derived from social engineering, money muling, unlawful activity, or a transaction without clear economic purpose, the funds may be returned through the financial institutions’ process. If the transaction appears legitimate, the hold may be lifted and the funds released to the beneficiary account owner.

The receiving account owner also has rights. A person whose funds are held may challenge the hold and submit evidence that the transaction was legitimate. This is why false or malicious reporting is dangerous. AFASA penalizes malicious reporting that causes unwarranted temporary holding of funds.

When an AMLC freeze order may become relevant

The Anti-Money Laundering Council is not a customer-service office for ordinary refund requests. It becomes relevant when the facts suggest money laundering or proceeds of unlawful activity.

Under the Anti-Money Laundering Act, the AMLC may apply to the Court of Appeals for a freeze order over monetary instruments or property related to unlawful activity. In Manganip v. Republic of the Philippines, Powerlink.com Corp. v. Republic of the Philippines, and Codeworks.ph Inc. v. Republic of the Philippines, decided on May 20, 2025, the Supreme Court explained that freeze orders may cover related and materially linked accounts, subject to safeguards protecting account owners. The Supreme Court summary is available here: SC: Freeze Orders in Money Laundering May Include Related Accounts.

For an ordinary scam victim, this means:

You do not personally file an AMLC freeze petition.
Your report to law enforcement and financial institutions may help identify suspicious accounts.
AMLC action is separate from your bank’s AFASA temporary holding process.
A court-issued freeze order is different from a bank’s short-term hold of disputed funds.

If the scammer used GCash, Maya, online banking, QR Ph, InstaPay, PESONet, or a digital bank

The process is similar, but your report must be precise.

Provide:

Exact reference number
Screenshot of the successful transfer
Sender and receiver account names, numbers, or mobile numbers
Transfer channel used
Time and date down to the minute, if available
The scammer’s instruction showing where you were told to send the money

For InstaPay and QR transfers, speed is critical because funds can move almost instantly. Report to your own provider first, then give the receiving provider’s details if known. Your institution should be the one to initiate formal coordinated verification, but separately notifying the receiving provider’s fraud team may help create an early record.

If the fraud happened on Facebook Marketplace, Shopee, Lazada, TikTok, Instagram, Telegram, Viber, or WhatsApp

Report both the payment trail and the platform trail.

For the platform trail, preserve:

Profile URL or username
Page or group name
Listing URL
Chat history
Photos used in the listing
Delivery promises or tracking numbers
Proof that the seller blocked you, changed names, deleted posts, or refused delivery after payment

For the payment trail, report to the bank or e-wallet as soon as possible. Platforms may remove accounts, but removal alone does not recover money. The payment institution needs transaction details to trace funds.

If you are a foreigner or a Filipino abroad

Foreigners and overseas Filipinos can still report Philippine online fraud, especially if:

The receiving account is in the Philippines;
The scammer used a Philippine mobile number, bank, e-wallet, or platform account;
Part of the fraud happened through systems located in the Philippines; or
The victim was in the Philippines when the damage occurred.

Practical steps:

Report to the bank, e-wallet, card issuer, or remittance company immediately through official international channels.
File a report through available online reporting channels, such as CICC/eGovPH when applicable.
Contact the PNP Anti-Cybercrime Group or NBI Cybercrime Division for instructions on filing from abroad.
Prepare a sworn affidavit. If executed abroad, ask whether the receiving office requires consular acknowledgment, apostille, or other authentication.
If someone in the Philippines will file for you, prepare a Special Power of Attorney and copies of your ID or passport.
If documents are not in English or Filipino, prepare certified translations if required.

Foreign victims should be ready for identity verification. Philippine authorities and financial institutions may be cautious because scammers also file false reports to attack innocent account holders.

Common mistakes that reduce the chance of recovery

Waiting too long before reporting

Many victims spend the first day arguing with the scammer or posting warnings online. By then, the money may already be withdrawn or moved through several accounts. Report first; post later only if it will not expose private information or harm the investigation.

Reporting only to the receiving bank

The fastest formal route is usually through your own bank or e-wallet as the source institution. It can identify the disputed transaction and initiate the proper request to the receiving institution.

Sending incomplete screenshots

A cropped screenshot showing only the scammer’s message is often weak. Preserve the full context: profile name, URL, number, date, time, payment instruction, proof of payment, and follow-up messages.

Deleting the conversation

Even if the scammer’s messages are embarrassing or upsetting, do not delete them. Investigators need the original thread.

Assuming a police report automatically freezes an account

A police report supports your request, but it does not by itself freeze funds. The bank/e-wallet’s AFASA process, a court order, or AMLC/court action is what restricts funds.

Paying “recovery agents”

After a scam, victims are often targeted again by people claiming they can “hack back,” “reverse GCash,” “freeze any bank account,” or “recover crypto” for a fee. These are often recovery scams. Do not give them your IDs, OTPs, passwords, seed phrases, or additional money.

Filing a false or exaggerated report

AFASA penalizes malicious reporting. Report facts accurately. If you are unsure whether the account holder is the scammer or merely a mule, say so.

Frequently Asked Questions

Can I personally ask a bank to freeze the scammer’s account?

You can report the receiving account and request action, but the stronger and proper route is to report to your own bank or e-wallet and ask it to initiate temporary holding and coordinated verification under AFASA. A bank will usually not freeze a third party’s account based only on an informal demand from a stranger.

How fast should I report online fraud?

Immediately. Minutes can matter, especially for InstaPay, e-wallet, QR, and digital bank transfers. Report to your bank or e-wallet first, then file with CICC, PNP-ACG, or NBI. Do not wait until you have a notarized affidavit before making the initial fraud report.

What if the scammer already withdrew the money?

Still report. The institution may trace where the funds went, identify receiving or subsequent accounts, and preserve records. Recovery becomes harder once cash is withdrawn, but the trail may support a criminal complaint, money mule investigation, account closure, or future restitution.

Is a barangay blotter enough for a bank or e-wallet scam?

Usually no. A barangay blotter may document that you complained, but it does not substitute for a bank fraud report, cybercrime complaint, sworn affidavit, or police/NBI report. For online fraud, go to the financial institution and a cybercrime-capable law enforcement office.

Do I need a lawyer to report online fraud?

Not necessarily for the initial bank/e-wallet report or police/NBI complaint. Many victims file directly. A lawyer may help when the amount is large, documents must be carefully prepared, the suspect is known, the bank denies liability, or you need representation from abroad.

Can I recover money from a fake online seller?

Possibly, but it depends on speed, traceability, and evidence. If the funds are still in the receiving account or within the financial system, AFASA temporary holding and coordinated verification may help. If withdrawn, you may need criminal proceedings, civil action, settlement, or other remedies after the person is identified.

What if I willingly sent the money but was deceived?

Voluntary transfer does not automatically defeat a fraud complaint. Many scams involve the victim authorizing a transfer because of deceit. The legal question is whether the transfer was induced by fraud, false pretenses, social engineering, identity theft, or another unlawful scheme.

What if the transfer was just a wrong send, not a scam?

An erroneous transfer is different from online fraud. BSP Circular No. 1215 expressly distinguishes disputed fraud transactions from erroneous transactions. For wrong sends, use your bank or e-wallet’s mistaken-transfer process and request assistance, but do not falsely label it as fraud.

Can the bank or e-wallet refund me automatically?

Not always. Refund depends on the facts, timing, whether funds were held, whether the transaction was unauthorized or induced by fraud, and whether the institution complied with its legal duties. AFASA recognizes possible restitution where an institution fails to use adequate risk management systems or fails to exercise the required diligence, but each case turns on evidence.

Should I post the scammer’s account details online?

Be careful. Public warnings can help others, but do not expose private data beyond what is necessary, and avoid accusing unrelated persons without evidence. Focus first on official reports, preservation of evidence, and financial tracing.

Key Takeaways

Report to your bank or e-wallet immediately and ask for temporary holding of disputed funds under AFASA.
The initial hold can be up to 5 calendar days, with possible extension up to a total of 30 calendar days unless extended by a court.
File with the PNP Anti-Cybercrime Group or NBI Cybercrime Division for criminal investigation and digital evidence preservation.
Use CICC Hotline 1326 or the eGovPH eReport feature for cyber fraud and scam-message reporting where applicable.
Escalate to BSP Consumer Assistance if a BSP-supervised institution mishandles or ignores your complaint.
Keep full screenshots, transaction receipts, URLs, account numbers, messages, and case reference numbers.
A police report supports your request, but it does not automatically freeze an account.
Do not delay, delete evidence, pay recovery scammers, or file false reports.