If you just discovered that money was sent to a scammer through a bank transfer, e-wallet, online seller, fake investment platform, phishing link, or romance scam, the most important thing is speed. In the Philippines, recovering scam money is possible in some cases, but it usually depends on whether the funds are still inside a bank, e-wallet, payment gateway, or crypto exchange before they are withdrawn, transferred, or converted. This guide explains how tracing works, what Philippine laws apply, where to report, what documents to prepare, and what recovery paths are realistically available.

What “tracing scam money” means in the Philippines

Tracing money does not mean that a private person can force a bank, e-wallet, telco, or social media platform to reveal the scammer’s identity.

In practice, tracing means building a clear paper trail so that the proper institution or authority can lawfully follow the funds. This usually involves:

Your transaction reference number
The sender and receiver account details shown in your app
The date, time, and exact amount
Screenshots of chats, listings, ads, calls, emails, links, and profiles
The device, phone number, username, account name, wallet address, or QR code used
A bank, e-wallet, police, NBI, CICC, BSP, or SEC reference number

Banks and e-wallets generally cannot disclose the recipient’s full identity directly to you because of bank secrecy, data privacy, and internal security rules. However, under newer anti-scam laws, financial institutions, regulators, and law enforcement agencies have clearer mechanisms to verify disputed transactions, hold funds temporarily, investigate financial accounts, and coordinate with each other.

The key is to report quickly and in writing.

Legal basis: Philippine laws that may apply to online scams

Anti-Financial Account Scamming Act: RA 12010

Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA), is now one of the most important laws for online bank and e-wallet scams in the Philippines. It covers financial account scamming, money muling, and social engineering schemes involving bank accounts, e-wallets, credit accounts, and similar financial accounts. The law allows institutions to temporarily hold funds subject of a disputed transaction for a period prescribed by the BSP, not exceeding 30 calendar days unless extended by a court. It also states that conviction is not required before restitution when an institution failed to use adequate risk management systems or failed to exercise the required diligence. (Lawphil)

In simple terms, this matters because a scam victim should not merely ask the bank or e-wallet to “trace” the money. The better request is:

“Please treat this as a disputed transaction involving possible financial account scamming, coordinate with the receiving institution, and determine if temporary holding, recall, reversal, or restitution is available under RA 12010 and BSP rules.”

Cybercrime Prevention Act: RA 10175

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, applies when the scam involves a computer system, mobile phone, social media account, email, fake website, phishing link, online banking credentials, or digital identity. It penalizes computer-related fraud, computer-related identity theft, illegal access, data interference, and crimes under the Revised Penal Code or special laws committed through information and communications technology. It also authorizes the NBI and PNP to handle cybercrime investigations and allows court-warrant processes for disclosure, search, seizure, and preservation of computer data. (Supreme Court E-Library)

Revised Penal Code: Estafa and other swindling

Many online scams are still prosecuted as estafa, or swindling, under Article 315 of the Revised Penal Code. Estafa commonly applies when a person uses deceit, false pretenses, abuse of confidence, or fraudulent promises to make the victim part with money.

Examples include:

Fake online selling where the seller never intended to deliver
Fake job processing fees
Romance scams asking for “emergency” transfers
Fake loan release fees
Fake investment payouts
Impersonation of a bank, courier, government office, or relative

If the deceit happened online, prosecutors may consider both estafa and cybercrime-related provisions.

Financial Products and Services Consumer Protection Act: RA 11765

Republic Act No. 11765 protects financial consumers and covers digital financial products and services, including deposits, payments, remittances, investments, securities, insurance, and similar products. It recognizes consumer rights such as protection of assets against fraud and misuse, data privacy, and timely complaint handling. It also gives the BSP and SEC authority to handle certain financial consumer complaints and, for purely civil financial transaction claims, adjudicate payment or reimbursement claims up to ₱10 million. (Supreme Court E-Library)

This law is especially relevant when the complaint is against a regulated bank, e-wallet, payment service provider, investment platform, lending company, or similar financial service provider.

Access Devices Regulation Act: RA 8484, as amended by RA 11449

RA 8484, as amended by RA 11449, may apply to scams involving credit cards, debit cards, online banking access, account numbers, OTPs, PINs, passwords, SIM cards, or other “access devices” used to obtain money or initiate transfers. It penalizes unauthorized use, trafficking, possession, or fraudulent use of access devices. (Lawphil)

Electronic Commerce Act: RA 8792 and electronic evidence

RA 8792 recognizes electronic documents and data messages. This is why screenshots, transaction confirmations, email records, chat logs, app receipts, and similar electronic records can matter. You should still preserve them carefully because authenticity, completeness, and chain of custody may be questioned later. (Lawphil)

Civil Code remedies

Aside from criminal remedies, a victim may have civil claims for return of money, damages, or unjust enrichment. Relevant Civil Code provisions include:

Article 19: everyone must act with justice, give everyone his due, and observe honesty and good faith
Article 20: a person who, contrary to law, causes damage must indemnify the injured party
Article 21: willful acts contrary to morals, good customs, or public policy may give rise to damages
Article 22: a person who receives something at another’s expense without legal ground must return it
Article 33: in cases of fraud, a separate civil action for damages may be brought independently of the criminal case (Lawphil)

What to do immediately after discovering an online scam

1. Stop communicating with the scammer

Do not negotiate, threaten, or tell the scammer that you are reporting them. Many scammers immediately move funds after sensing that the victim is aware.

Also avoid “recovery agents,” “ethical hackers,” or people claiming they can recover your funds for a fee. These are often second-layer scams.

2. Secure your accounts

Do this before preparing a long complaint:

Change passwords for your email, banking apps, e-wallets, and social media accounts.
Enable multi-factor authentication.
Log out all devices.
Block your card or freeze your online banking if credentials were compromised.
Call your bank or e-wallet through official channels only.
If your SIM or phone was compromised, report immediately to your telco.

Never share your PIN, OTP, password, account number, card number, CVV, passport, or ID details with anyone claiming to be from BSP, police, NBI, CICC, or a bank. BSP’s own consumer complaint instructions warn that these are not required for processing a BSP consumer complaint.

3. Report to the sending bank or e-wallet

Contact the bank or e-wallet used to send the money. Use the fraud hotline, in-app help center, branch, email, or official website.

Ask for:

A fraud or dispute case number
Immediate blocking of your compromised account, if applicable
A request to trace or recall the funds
Coordination with the receiving institution
Temporary holding of disputed funds, if still possible
Written confirmation that you reported the transaction

Use clear wording:

“I am reporting a suspected online scam and disputed transaction. The funds were transferred on [date/time] to [recipient details shown in app] for ₱[amount], reference number [number]. Please coordinate with the receiving institution and determine whether the funds may be temporarily held, recalled, reversed, or subjected to investigation under RA 12010, RA 11765, and applicable BSP rules.”

4. Report to the receiving bank or e-wallet if you know it

If your app shows the recipient bank, e-wallet, account name, account number, QR code, or mobile number, report to the receiving institution too.

Some institutions will say they can only act through the sending institution or law enforcement. Still, ask them to create a case number. The receiving institution may be able to flag the account internally.

5. Preserve evidence before accounts disappear

Take screenshots and export files immediately. Scam pages, Facebook profiles, Telegram accounts, TikTok shops, websites, and marketplace listings often disappear within hours.

Save:

Full chat conversations, not just selected lines
The profile page and username
Phone numbers and email addresses
Payment instructions
QR codes
Receipts and reference numbers
Tracking numbers, if any
Links and URLs
Screenshots showing date and time
Voice call logs
Delivery app records
Your bank or e-wallet transaction history

Do not edit screenshots. Keep original files where possible.

Where to report an online scam in the Philippines

Office or institution	Best used for	Practical notes
Sending bank or e-wallet	First attempt to hold, recall, reverse, or investigate the transaction	Report immediately and get a ticket number
Receiving bank or e-wallet	Flagging the recipient account or wallet	Provide transaction reference number and proof
CICC / I-ARC Hotline 1326	Initial cyber scam reporting and coordination	I-ARC Hotline 1326 is a centralized anti-scam reporting channel connected with CICC, DICT, NTC, NPC, PNP, and NBI support channels. (Philippine News Agency)
PNP Anti-Cybercrime Group	Criminal cybercrime complaint	Useful for phishing, hacking, fake accounts, online seller scams, and account takeovers
NBI Cybercrime Division	Criminal cybercrime investigation	NBI’s citizen charter describes filing, interview, sworn statements, and evidence submission for computer crime complaints. (National Bureau of Investigation)
BSP Consumer Assistance Mechanism	Complaints against BSP-supervised institutions	BSP requires consumers to report first to the institution’s consumer assistance channel before escalating to BSP-CAM through BOB or email.
SEC iMessage Portal	Investment scams, lending companies, financing companies, online lending apps, and collection agencies	SEC handles matters involving regulated companies, investment solicitation, and lending/financing complaints. (imessage.sec.gov.ph)
Prosecutor’s Office	Preliminary investigation for criminal complaint	Usually requires a complaint-affidavit and supporting evidence
First-level courts / Small Claims Court	Civil recovery when the scammer or account holder is identified	Small claims may apply for money claims up to ₱1,000,000 under the Rules on Expedited Procedures in First Level Courts. (Supreme Court of the Philippines)

Documents to prepare

Document	Why it matters
Government ID or passport	Establishes your identity as complainant
Chronology of events	Helps banks, police, NBI, prosecutors, and BSP understand the case quickly
Transaction receipts	Shows amount, date, time, reference number, and account details
Bank or e-wallet statement	Confirms the debit from your account
Screenshots of chats and ads	Shows deceit, false promises, identity used, and payment instructions
URLs, usernames, phone numbers, emails	Helps investigators identify accounts, platforms, and possible subscriber data
Complaint-affidavit	Required for many criminal complaints and prosecutor filings
Bank/e-wallet ticket numbers	Shows you reported promptly and tried institutional remedies
Police/NBI/CICC report number	Helps banks and regulators treat the case as formally reported
Demand letter, if the person is known	Useful for civil recovery or settlement attempts

For OFWs and foreigners abroad

If you are outside the Philippines, you may still report to your bank, e-wallet, CICC, PNP, NBI, BSP, or SEC through online channels where available. The practical issue is usually the complaint-affidavit.

For documents signed abroad and intended for use in the Philippines, common options are:

Consular notarization before a Philippine Embassy or Consulate
Local notarization abroad followed by apostille, if applicable
A Special Power of Attorney authorizing someone in the Philippines to file, follow up, or attend proceedings

Philippine consulates commonly notarize affidavits and Special Powers of Attorney intended for use in the Philippines, while apostille rules depend on whether the document is Philippine or foreign and where it will be used. (Philippine Embassy)

How money recovery usually happens

Recovery path 1: temporary hold, recall, or reversal

This is the fastest route, but it only works if the funds are still traceable and available within the financial system.

Possible outcomes include:

The receiving account is temporarily held
The transfer is reversed
The bank requests more documents
The bank says the funds were already withdrawn or moved
The bank refers you to law enforcement

Under RA 12010, institutions have authority to temporarily hold disputed funds under BSP rules, and coordinated verification may proceed even if the funds have already moved. (Lawphil)

Recovery path 2: bank or e-wallet reimbursement

A bank or e-wallet does not automatically reimburse every scam victim, especially when the victim voluntarily authorized the transfer. However, reimbursement may be considered where there was unauthorized access, system weakness, failure to protect the account, failure to act on a disputed transaction, or failure to follow required fraud controls.

RA 12010 specifically recognizes restitution where an institution failed to employ adequate risk management systems and controls or failed to exercise the highest degree of diligence in preventing loss. (Lawphil)

Recovery path 3: BSP consumer complaint

BSP-CAM is a second-level remedy. This means you generally report first to the bank, e-wallet, or BSP-supervised institution. If the response is unsatisfactory, delayed, incomplete, or dismissive, you may escalate to BSP through the BSP Online Buddy or the CIR form and email process.

BSP is not a police agency. It does not arrest scammers. Its role is more focused on regulated financial institutions, consumer protection, complaint handling, and compliance.

Recovery path 4: criminal complaint and restitution

A criminal complaint may lead to preliminary investigation, filing of information in court, trial, conviction, and civil liability or restitution. This can take time, especially if the scammer used mule accounts, fake IDs, unregistered SIMs, foreign platforms, or crypto wallets.

Still, a criminal complaint is often necessary because banks, platforms, telcos, and service providers may require official law enforcement processes before releasing sensitive information.

Recovery path 5: civil case or small claims case

If the recipient or scammer is identified, a civil case may be possible. For smaller claims, the Small Claims Court may be useful because lawyers are generally not required and the procedure is simplified.

Small claims are most practical when:

The defendant is identifiable
The address is known
The claim is for a definite amount of money
The evidence is documentary
The case fits within the small claims rules

If both parties are individuals in the same city or municipality, barangay conciliation may sometimes be required before filing a civil action, unless the case falls under an exception. For serious criminal offenses like cybercrime or estafa involving penalties beyond barangay jurisdiction, barangay settlement is usually not the main route.

Recovery path 6: SEC action for investment scams

If the scam involved an investment, trading group, crypto “staking” platform, forex pool, casino financing, cooperative-type investment, franchising promise, or guaranteed return scheme, check whether the person or company was authorized by the SEC to solicit investments.

A company’s SEC registration as a corporation is not the same as authority to sell securities or solicit investments from the public. Under RA 11765, investment fraud includes deceptive solicitation of investments, Ponzi schemes, and public offerings of investment schemes without the necessary SEC license or permit. (Supreme Court E-Library)

Common situations and what to do

“I sent money through GCash, Maya, or online bank transfer”

Report to both the sending and receiving institutions immediately. Ask for a disputed transaction case, coordinated verification, and temporary holding if available. Then file with CICC, PNP-ACG, or NBI Cybercrime if the institution asks for a police or cybercrime report.

“The bank says I authorized the transfer, so they cannot help”

Do not stop at a verbal answer. Ask for a written final response. If you believe there was phishing, account takeover, SIM compromise, malware, failure of fraud controls, or delayed response despite prompt reporting, escalate through the bank’s formal complaint channel and then BSP-CAM.

“The account name is probably a mule”

A mule account is an account used to receive or move scam proceeds. Under RA 12010, money muling activities are penalized, including using, lending, selling, buying, renting, or recruiting others to use financial accounts for proceeds known to be from crimes or social engineering schemes. (Lawphil)

Even if the account holder says “pinagamit lang,” that person may still face investigation.

“The scammer used a fake name”

This is common. Focus on the traceable points: transaction reference number, recipient account, receiving institution, phone number, username, device login, IP-related data, delivery address, or cash-out channel. Law enforcement can pursue subscriber and account data through proper legal processes.

“The money went to crypto”

Recovery is harder once money is converted to crypto and moved to a private wallet or foreign exchange. Still, preserve the wallet address, transaction hash, exchange name, screenshots, and chat instructions. Report to the exchange if known, and include the crypto details in your cybercrime complaint.

“I am a foreigner scammed by someone in the Philippines”

You can still report if the transaction, scammer, bank account, e-wallet, platform user, or damage has a Philippine connection. Prepare passport identification, proof of remittance or transfer, a clear affidavit, and properly notarized or apostilled documents if you are filing from abroad.

Practical timelines

Stage	Typical timing in practice
Bank/e-wallet urgent fraud report	Immediately to 24 hours
Possible temporary hold or recall	Often time-sensitive; best chance is within hours
CICC 1326 initial report	Same day if hotline is reachable
NBI Cybercrime initial filing steps	NBI’s citizen charter lists intake, interview, sworn statement, and approval steps with no filing fee for the initial investigative assistance process. (National Bureau of Investigation)
BSP escalation	After first reporting to the institution, unless the situation is exceptional
Prosecutor preliminary investigation	Often several months, depending on docket and evidence
Court case	May take months to years
Small claims	Usually faster than ordinary civil cases, but still depends on service of summons and court calendar

Frequently Asked Questions

Can I recover money from an online scam in the Philippines?

Yes, but it depends on how fast you report, whether the funds are still in the receiving account, whether the bank or e-wallet can hold or reverse the transaction, and whether the scammer or account holder can be identified. Recovery is harder once the money is withdrawn, cashed out, converted to crypto, or moved through several mule accounts.

Can I ask the bank to freeze the scammer’s account?

You can ask the bank or e-wallet to treat the transaction as disputed and determine whether temporary holding is available. A private victim does not usually obtain a full legal freeze order personally. Formal freeze orders under anti-money laundering procedures involve the AMLC and the courts, while RA 12010 gives institutions a mechanism to temporarily hold disputed funds under BSP rules.

Should I report first to the bank or to the police?

Do both, but report to the bank or e-wallet first if the transfer just happened. Minutes matter. Then file with CICC, PNP-ACG, or NBI Cybercrime so there is a formal law enforcement record.

What if the scammer only gave a mobile number or GCash number?

Save the number, account name shown in the app, QR code, receipt, reference number, and screenshots. Report to the e-wallet and law enforcement. Do not assume the displayed name is the real mastermind; it may belong to a mule account.

Is an online seller scam estafa?

It can be, especially if the seller used false pretenses and never intended to deliver the item. It may also involve cybercrime if the deceit happened through online platforms, messages, fake pages, or digital payment systems.

Can I file a small claims case against the recipient account holder?

Possibly, if you can identify and locate the person, and your claim fits the small claims rules. This is more practical when the person is not just an unknown mule but someone with a known address and documentary evidence linking them to the transaction.

What if the bank refuses to give me the recipient’s full name and address?

That is common. Banks and e-wallets are restricted by privacy and secrecy rules. Instead of demanding disclosure to you personally, ask them to preserve records, coordinate with the receiving institution, and respond to law enforcement or regulator requests through proper channels.

Can the BSP order my bank or e-wallet to return the money?

BSP can handle consumer complaints involving BSP-supervised institutions and has regulatory and consumer protection powers. Whether reimbursement is ordered or achieved depends on the facts, the institution’s conduct, the applicable BSP rules, and whether the claim falls within BSP’s mechanisms.

Are screenshots enough evidence?

Screenshots help, but stronger evidence includes complete chat exports, transaction receipts, account statements, URLs, phone logs, email headers where available, device notices, and written responses from banks or e-wallets. Keep originals and avoid editing files.

What should I avoid after being scammed?

Avoid paying recovery agents, deleting messages, sending threats, posting unverified personal information online, or sharing OTPs and passwords with anyone. Also avoid filing false or exaggerated reports; RA 12010 penalizes malicious reporting that results in unwarranted holding of funds. (Lawphil)

Key Takeaways

Report to your bank or e-wallet immediately and ask for a disputed transaction case number.
Ask about temporary holding, recall, reversal, coordinated verification, and restitution under RA 12010 and BSP rules.
Preserve complete digital evidence before scam accounts disappear.
File with CICC 1326, PNP-ACG, or NBI Cybercrime for law enforcement tracing.
Escalate to BSP if the issue involves a BSP-supervised financial institution and the institution’s response is unsatisfactory.
Report to SEC if the scam involves investment solicitation, lending, financing, or online lending platforms.
Money recovery is most realistic when action is taken within hours, not weeks.
Criminal, regulatory, and civil remedies can proceed separately, depending on the facts and evidence.