When you discover that you have sent money to an online scammer, speed matters. The first goal is not to confront the person or expose them on social media. It is to stop the movement of funds, preserve evidence before accounts disappear, and create a formal record that investigators can use to identify the people behind the scam. This guide explains what you can legally trace yourself, what banks and platforms may disclose only to authorities, where to report an online scam in the Philippines, and what usually happens after you file a complaint.
What It Means to “Trace” an Online Scammer
Tracing an online scammer rarely means typing a mobile number into a website and immediately finding the person’s home address.
A proper investigation usually connects several pieces of information:
- The bank or e-wallet account that received the money
- The registered subscriber information behind a mobile number
- Login records, internet protocol addresses, and device information held by an online platform
- Email headers and account-recovery details
- Courier records, delivery addresses, and identification presented during pickup
- Cryptocurrency wallet movements and exchange accounts
- Other complaints involving the same name, account, number, or online profile
Some of this information is publicly visible. Most of the important identifying information is not.
Banks, telecommunications companies, e-wallet providers, social media platforms, and internet service providers generally cannot hand another customer’s private records directly to a victim. Disclosure normally requires a lawful request from investigators and, for protected subscriber or traffic data, an appropriate court-issued cybercrime warrant.
The Supreme Court has recognized that banks may be treated as service providers under the Cybercrime Prevention Act when they hold identifying data relevant to a cybercrime investigation. This means investigators may compel disclosure through the proper legal process, even though the victim cannot personally demand the same records from the bank.
Philippine Laws That Commonly Apply to Online Scams
The exact criminal charge depends on how the scam was carried out.
| Situation | Possible legal basis | Why it may apply |
|---|---|---|
| Fake online seller receives payment but never intends to deliver | Article 315(2)(a), Revised Penal Code | Estafa through false pretenses or fraudulent representations |
| Fake investment, job, loan, romance, or emergency scheme | Article 315, Revised Penal Code | The victim parted with money because of deceit |
| Fraud committed using social media, messaging apps, email, or other ICT systems | Section 6, Republic Act No. 10175 | A crime under the Revised Penal Code or another law committed through information and communications technology may carry a penalty one degree higher |
| Account owner knowingly lends, sells, or rents a bank or e-wallet account for scams | Republic Act No. 12010 | Prohibits money muling and certain financial-account scamming activities |
| Scammer tricks a victim into revealing an OTP, password, PIN, or financial credentials | Republic Act No. 12010 | Covers social engineering schemes involving sensitive financial information |
| Fraudulent use of credit cards or other access devices | Republic Act No. 8484 | Penalizes specified fraudulent acts involving access devices |
| Unauthorized access, account takeover, or interference with computer data | Republic Act No. 10175 | May constitute illegal access, data interference, or another cybercrime offense |
| Use of a registered SIM in fraudulent communications | Republic Act No. 11934 and its implementing rules | Registration records may assist an investigation, subject to lawful disclosure procedures |
Under Article 315 of the Revised Penal Code, estafa generally requires deceit or fraudulent representation, reliance by the victim, and resulting damage. A failed transaction is not automatically estafa. Investigators and prosecutors look for evidence that the seller or promoter intended to deceive the victim, such as a false identity, fabricated documents, multiple victims, immediate blocking after payment, or repeated use of mule accounts.
Section 6 of the Cybercrime Prevention Act of 2012 applies when an offense under the Revised Penal Code or a special law is committed through information and communications technology. (Lawphil)
The Anti-Financial Account Scamming Act of 2024, or Republic Act No. 12010, is particularly important when stolen funds pass through bank or e-wallet accounts. It criminalizes money muling and social engineering schemes and gives financial institutions tools to hold disputed funds and coordinate with other institutions. (Lawphil)
What to Do Immediately After Sending Money to a Scammer
1. Contact your bank or e-wallet provider immediately
Use the institution’s official fraud hotline, in-app reporting facility, branch, or verified customer-service channel.
Tell the institution:
- You are reporting an allegedly fraudulent transaction
- The exact amount, date, and time
- Your account number or wallet number
- The receiving account, wallet, QR code, or mobile number
- The transaction reference number
- How the scammer induced you to send the money
- Whether your password, OTP, PIN, or device may also have been compromised
Ask for:
- A fraud case or ticket number
- Written confirmation that the report was received
- Immediate account security measures
- Coordination with the receiving institution
- Preservation of transaction and account records
- Application of the disputed-funds holding procedure under Republic Act No. 12010, when applicable
Under the law and BSP’s AFASA implementing rules, a financial institution may initially hold disputed funds for up to five calendar days while verification is conducted. Extensions may be made within the law’s total ceiling of 30 calendar days; a longer hold requires a court order. The hold does not guarantee recovery, especially if the money has already been withdrawn, transferred repeatedly, converted to cryptocurrency, or moved outside participating institutions. (Bureau of the Treasury)
Do not wait for the scammer’s promise to refund you. A delay of even a few hours can allow funds to pass through several accounts.
2. Secure your accounts and devices
Change passwords immediately if you disclosed credentials, clicked a suspicious link, installed an application, shared your screen, or allowed remote access.
Also:
- Change the password of the connected email account
- Sign out of all active sessions
- Remove unfamiliar devices
- Reset payment PINs
- Ask your mobile provider to protect your SIM from unauthorized replacement
- Temporarily block cards or accounts when appropriate
- Run a security scan and remove remote-access applications
- Inform the bank if the scammer obtained an OTP or persuaded you to approve a transaction
Do not factory-reset the device until you have preserved the relevant messages, files, and application records.
3. Preserve evidence before reporting the profile
Scammers often delete messages, rename accounts, deactivate pages, or block victims after being reported. Preserve the material first, then use the platform’s reporting tools.
Save:
- The full conversation from beginning to end
- The profile name, username, profile URL, account ID, and profile photograph
- Advertisements, posts, listings, comments, and sponsored content
- Mobile numbers, email addresses, websites, and domain names
- Bank and e-wallet account details
- QR codes and payment instructions
- Transaction receipts and reference numbers
- Voice notes, call logs, and video-call details
- Contracts, invoices, identification cards, permits, and certificates sent by the scammer
- Courier receipts, tracking numbers, parcel labels, and delivery addresses
- Names of witnesses or other victims
- Messages showing demands for additional payment
Take screenshots that show the date, time, sender, platform, and surrounding conversation. Avoid relying only on cropped images of isolated statements.
Where possible, export the chat, download the original files, and make a screen recording while scrolling through the account and conversation. Keep the original phone or computer available. The Rules on Electronic Evidence allow electronic documents to be used in court when their authenticity and reliability are properly established. (Lawphil)
4. Report the account to the platform or telecommunications provider
Report the fraudulent account through the official reporting process of Facebook, Instagram, TikTok, Telegram, WhatsApp, an online marketplace, dating application, email provider, or other service involved.
For scam calls or text messages, report the mobile number to the telecommunications company and the National Telecommunications Commission.
A platform report may lead to suspension or preservation of an account, but it is not a substitute for a criminal complaint. Ask the platform to preserve the account and transaction records for law-enforcement purposes. Do not expect the platform to disclose the account owner’s private information directly to you.
How You Can Legally Trace the Scammer Yourself
You may conduct basic open-source research using information already available to the public. The purpose is to develop leads for investigators—not to hack accounts, impersonate another person, threaten the suspect, or publicly accuse someone without sufficient proof.
Useful checks include:
- Search the exact mobile number, email address, username, account name, and payment-account name using quotation marks.
- Run the profile photograph or product image through a reverse-image search.
- Check whether the same username appears on other platforms.
- Search for complaints involving the same receiving account or mobile number.
- Check claimed corporations or partnerships through the Securities and Exchange Commission.
- Verify sole-proprietorship claims through the Department of Trade and Industry’s business-name records.
- Examine website-registration information, archived pages, domain age, and contact details.
- Check whether the displayed account name before payment matches the claimed seller or business.
- Preserve online listings showing the same payment instructions being given to other people.
- Record inconsistencies in addresses, identification cards, permits, invoices, and company details.
Treat every match as a lead rather than conclusive identification. A receiving account may belong to a paid money mule, an identity-theft victim, an employee, or a person whose account was taken over.
Do not secretly intercept private communications or record calls in violation of Republic Act No. 4200, the Anti-Wiretapping Act. Do not attempt to access the scammer’s email, social media, financial account, cloud storage, or device. Unauthorized access can expose the victim to a separate criminal complaint.
Information That Investigators Can Obtain
Under Sections 13 and 14 of Republic Act No. 10175, service providers may be ordered to preserve and disclose relevant data.
Traffic data and subscriber information must generally be preserved for at least six months from the transaction. Content data may also be preserved after receipt of a lawful preservation order. Upon issuance of the proper court warrant, law-enforcement authorities may require disclosure of subscriber information, traffic data, and other relevant records connected with a valid, docketed complaint.
The Supreme Court’s decision in Disini v. Secretary of Justice upheld the disclosure mechanism because access to protected information requires judicial intervention. (Supreme Court E-Library)
Depending on the case, investigators may seek:
| Source | Potentially useful information |
|---|---|
| Bank or e-wallet | Account-opening records, verified identity, linked number, transaction trail, devices, login information, and withdrawal details |
| Telecommunications company | SIM registration information, activation records, and relevant connection data |
| Social media or messaging platform | Subscriber information, linked email or number, login records, devices, and account activity |
| Internet service provider | Subscriber information corresponding to an IP address and time |
| Courier or delivery service | Sender details, pickup branch, delivery address, identification used, and CCTV availability |
| Cryptocurrency exchange | Account verification records, wallet deposits and withdrawals, and linked bank accounts |
| Online marketplace | Seller-registration records, order history, payout accounts, delivery information, and platform messages |
The SIM Registration Act does not allow a victim to demand the registered name behind a mobile number. Registration data remains confidential and is disclosed only under circumstances allowed by law. A registered name is also not always the mastermind’s identity because scammers may use stolen credentials, illegally transferred SIMs, or accounts registered to accomplices. (Lawphil)
How to Report an Online Scammer in the Philippines
1. Prepare a clear incident summary
Create a one- or two-page chronology containing:
- When and where you first encountered the scammer
- What the scammer represented or promised
- Why you believed the representation
- Every payment made
- What happened after payment
- When you realized it was fraudulent
- What steps you took with the bank, platform, or telecommunications provider
- The total amount lost
Use a transaction table:
| Date and time | Amount | Sending account | Receiving account | Reference number | Reason given |
|---|
A clear chronology helps the investigator understand the case quickly and prevents important details from being lost during the interview.
2. Prepare a complaint-affidavit
A complaint-affidavit is a sworn written statement explaining the facts and identifying the offense you believe was committed.
It should include:
- Your complete name, address, nationality, and contact details
- The respondent’s known name, alias, username, number, or account details
- A chronological narration based on personal knowledge
- The exact fraudulent representations
- The payments or property you surrendered
- The resulting loss
- A numbered list of attached evidence
- A statement that the allegations are true based on your personal knowledge and authentic records
Bring valid government identification. The affidavit may be sworn before the investigating officer, prosecutor, or another officer authorized to administer oaths, depending on the office’s procedure. Avoid notarizing an incomplete affidavit or one containing facts you cannot personally verify.
3. File with the NBI or PNP Anti-Cybercrime Group
You may file through:
- The NBI online complaint facility
- The NBI CyberCrime Division or the nearest appropriate NBI office
- The PNP Anti-Cybercrime Group e-Complaint facility
- A PNP Regional Anti-Cybercrime Unit or local police station for referral
- The DOJ cybercrime incident reporting page
- The Cybercrime Investigation and Coordinating Center reporting portal
For walk-in complaints, bring printed and electronic copies of the evidence. The NBI CyberCrime Division’s published citizen’s charter states that investigative assistance is available to the general public without a filing fee. Initial processing involves completing a complaint sheet, an interview, preparation of sworn statements, and examination of supporting documents or devices when necessary. The published processing time covers front-desk intake, not the full investigation. (National Bureau of Investigation)
When filing, specifically ask the investigator to consider sending immediate preservation requests to the receiving financial institution, telecommunications provider, platform, courier, or other service provider. Preservation does not automatically disclose the data, but it can prevent potentially useful records from being routinely deleted while warrants and other legal processes are being obtained.
4. Obtain and keep your reference numbers
Keep copies of:
- The police or NBI complaint reference
- Bank or e-wallet fraud ticket
- Platform report confirmation
- Telecommunications-provider report
- Complaint-affidavit and attachments
- Receiving stamp, acknowledgment receipt, or official email confirmation
- Investigator’s name, unit, and official contact channel
Follow up using the reference number rather than repeatedly filing new complaints through different channels. Tell each agency about the other reports so records can be coordinated.
5. Escalate unresolved bank or e-wallet complaints
A complaint about how a bank or BSP-supervised e-wallet handled the disputed transaction should first be submitted through the institution’s Financial Consumer Protection Assistance Mechanism.
If the institution does not resolve the complaint, it may be escalated through the Bangko Sentral ng Pilipinas consumer-assistance channels, including the BSP Online Buddy. Attach the institution’s final response or proof that the complaint was first submitted to it. (Bureau of the Treasury)
A BSP consumer complaint addresses the financial institution’s handling of the matter. It does not replace an estafa or cybercrime complaint against the scammer.
6. Proceed to preliminary investigation when the respondent is identified
After evidence is gathered, the complaint may be referred to or directly filed with the Office of the City or Provincial Prosecutor.
During preliminary investigation, the prosecutor determines whether there is probable cause—a reasonable basis to believe that a crime was committed and that the respondent probably committed it.
The prosecutor may:
- Review the complaint-affidavit and evidence.
- Issue a subpoena requiring the respondent to submit a counter-affidavit.
- Require clarificatory documents or a hearing.
- Dismiss the complaint or find probable cause.
- File an Information, the formal criminal charge, in the proper court.
The Department of Justice’s published requirements generally call for the complaint-affidavit, witness affidavits, and supporting documents, with multiple copies depending on the number of respondents. Local prosecutor offices may impose additional filing and copy requirements. (Department of Justice)
Documents to Bring
| Document or evidence | Why it matters |
|---|---|
| Government-issued identification | Confirms the complainant’s identity |
| Complaint-affidavit | Provides the sworn factual basis of the case |
| Chronology and loss summary | Helps investigators understand the scheme |
| Bank or e-wallet statements | Establishes the transfer and financial loss |
| Transaction receipts and reference numbers | Allows the receiving transaction to be located |
| Full chats and exported conversations | Shows the scammer’s representations and intent |
| Profile URLs, usernames, account IDs, and screenshots | Identifies the online accounts involved |
| Emails with full headers | May reveal routing and account information |
| Advertisements, listings, invoices, and contracts | Shows what was promised |
| Copies of IDs or permits sent by the scammer | May reveal forgery, impersonation, or identity theft |
| Courier and delivery records | May identify pickup or delivery locations |
| Bank and platform complaint acknowledgments | Shows prompt reporting and creates record trails |
| Device containing the original evidence | May be needed for verification or forensic examination |
| Witness affidavits | Corroborates the events |
| Evidence involving other victims | May show a deliberate pattern |
Bring copies rather than surrendering your only original. If an agency takes custody of a device or document, request a written inventory or acknowledgment receipt describing what was received.
Typical Fees and Timelines
| Stage | Typical practical expectation | Usual direct government fee |
|---|---|---|
| Bank or e-wallet fraud report | Immediate acknowledgment or ticket; verification may take days or longer | None |
| Initial disputed-funds hold under AFASA rules | Up to five calendar days initially, subject to extension within the 30-day statutory ceiling | None |
| NBI or PNP complaint intake | Often completed on the filing day if documents are complete | None |
| Record preservation and warrant applications | May take days, weeks, or longer depending on urgency and completeness | Usually none for the complainant |
| Technical tracing and coordination | Several weeks to months; longer for foreign platforms or layered accounts | None, apart from document expenses |
| Prosecutor preliminary investigation | Commonly several months, depending on subpoenas, submissions, and caseload | Generally no complaint filing fee |
| Court proceedings | Months or years, depending on the charge, court, and availability of witnesses | Possible incidental litigation expenses |
These are practical estimates, not guaranteed deadlines. Common bottlenecks include incomplete transaction details, fake identities, delayed reporting, overseas service providers, rapidly deleted data, mule-account layers, missing witnesses, and difficulty serving subpoenas on an unknown or false address.
Is a Barangay Report Required?
A barangay blotter may help document when the incident was reported, but the barangay cannot compel a bank, telecommunications company, or online platform to reveal subscriber records.
Barangay conciliation is also generally not required when:
- The respondent’s identity or address is unknown
- The parties live in different cities or municipalities, subject to statutory exceptions
- The offense falls within an exception based on the possible penalty
- The complaint involves a corporation or another juridical entity
- Urgent law-enforcement or court action is necessary
Many substantial online estafa and cybercrime complaints fall outside mandatory barangay conciliation. Filing only a barangay report may waste critical time if financial or digital records need to be preserved. (Lawphil)
Common Mistakes That Make Online Scam Cases Harder
Waiting for the scammer to return the money
Scammers often promise refunds to delay reporting while they empty or transfer the receiving account.
Saving only cropped screenshots
Cropped screenshots may omit the sender’s identity, timestamps, URL, and surrounding context. Preserve the full conversation and original files.
Assuming the receiving account holder is the mastermind
The account may belong to a mule or identity-theft victim. Report the account, but allow investigators to determine each person’s role.
Publicly doxxing or threatening a suspected person
A wrong identification can harm an innocent person and expose the victim to civil or criminal complaints. Give the evidence to investigators instead.
Paying an online “recovery hacker”
Fraud victims are frequently targeted a second time by people claiming they can hack the scammer, unlock frozen funds, or recover cryptocurrency for an advance fee.
Filing only with the platform
A platform report may remove the profile but may not start a Philippine criminal investigation or trace the money.
Deleting messages after taking screenshots
Original messages, metadata, files, and device records may be more useful than screenshots alone.
Sending more money as a “release,” “tax,” or “verification” fee
Legitimate banks, courts, police officers, and government agencies do not require a victim to send money to the scammer’s private account to release recovered funds.
Special Situations
The scammer used a mule account
Republic Act No. 12010 prohibits certain acts involving the lending, selling, renting, or transfer of financial accounts for fraudulent purposes. A mule may face criminal liability even if that person did not personally speak with the victim, depending on knowledge and participation.
Investigators should trace both the account holder and the persons who controlled, withdrew, or received the funds.
The money was converted to cryptocurrency
Preserve the wallet address, transaction hash, exchange name, QR code, timestamps, and screenshots. A blockchain transaction is visible, but the person behind a wallet may remain unknown until the funds reach a regulated exchange or another service holding identity records.
Several victims were scammed by the same account
Victims should preserve their own evidence and file individual sworn statements. A coordinated list of account numbers, usernames, transactions, and complaint references can help investigators recognize a pattern, but one victim’s screenshots do not replace another victim’s personal testimony.
The victim is abroad
An overseas Filipino or foreign victim may still report a scam with a Philippine connection, such as a Philippine receiving account, Philippine mobile number, Philippine-based suspect, or loss involving Philippine transactions.
A complaint-affidavit or Special Power of Attorney executed abroad may be:
- Notarized before a Philippine Embassy or Consulate; or
- Notarized locally and apostilled when executed in a country covered by the Apostille Convention
Documents in another language may require a certified English or Filipino translation. A representative in the Philippines may submit and follow up documents under a properly executed Special Power of Attorney, although investigators, prosecutors, or courts may later require the complainant’s direct testimony or appearance. (Lawphil)
Can You Recover the Money?
Recovery is possible, but it is never automatic.
The best chance usually exists when:
- The transaction is reported immediately
- Funds remain in the receiving account
- The receiving institution can identify and hold the disputed amount
- The account holder and downstream recipients can be traced
- Investigators obtain preservation and disclosure orders promptly
- The accused has recoverable assets
- The victim has complete proof connecting the deceit to the payment
A criminal case may include civil liability for restitution or damages. Depending on the facts, a victim may also consider a separate civil action under Civil Code Articles 19, 20, 21, or 22, which address abuse of rights, unlawful acts causing damage, conduct contrary to morals or public policy, and unjust enrichment.
A civil case becomes difficult when the defendant’s true name or address is unknown. Even after obtaining a favorable judgment, actual collection depends on locating funds or property that can lawfully be attached or enforced against.
Frequently Asked Questions
Can the police trace a GCash, Maya, or bank account?
Yes, investigators can seek the verified identity, transaction trail, linked accounts, and other relevant records through lawful requests and cybercrime warrants. The victim should provide the exact account number, transaction reference, amount, date, and time.
Can I ask the bank for the scammer’s complete name and address?
Usually not. Banks and e-wallet providers must protect customer information. They may confirm receipt of your fraud report and coordinate with the receiving institution, but identifying records are normally disclosed to authorized investigators under lawful process.
Where should I report a Facebook or online seller scam?
Report the profile and listing to the platform, notify your bank or e-wallet, and file a formal complaint with the NBI CyberCrime Division, PNP Anti-Cybercrime Group, or another appropriate cybercrime unit. Preserve the profile URL and messages before the account is removed.
What if I lost only a small amount?
You may still report it. Small transactions may be part of a scheme involving hundreds of victims. Your account number, mobile number, or username may connect the suspect to larger complaints.
Is a barangay blotter enough?
No. It may document the incident but does not authorize the barangay to trace financial, telecommunications, or platform records. File with the appropriate bank, NBI, PNP, or cybercrime authority.
Will the scammer be arrested immediately after I report?
Not normally. Investigators must identify the responsible person, gather admissible evidence, and follow the rules on warrants, subpoenas, preliminary investigation, and arrest. Immediate arrest is generally possible only under the limited circumstances allowed for warrantless arrests.
What if the SIM or bank account is registered under another person’s name?
Report both the account and all persons who communicated with you. The registered owner may be a mule, accomplice, identity-theft victim, or account-takeover victim. Investigators must trace who actually controlled and benefited from the account.
How quickly should I report the transaction?
Immediately—preferably within minutes or hours. Fast reporting improves the chance that money remains available for a hold and that digital records, CCTV footage, courier records, and account data can be preserved.
Can an OFW or foreigner file a complaint without returning to the Philippines?
Initial reports and supporting documents may often be submitted remotely or through an authorized representative. Sworn documents executed abroad may need consular notarization or an apostille. Personal testimony or appearance may still be required later.
What should I do if my bank does not respond?
Use the bank’s formal consumer-assistance process and keep proof of submission. If unresolved, escalate the complaint through the BSP’s consumer-assistance channels. Separately file the criminal complaint because a BSP consumer case does not replace a police, NBI, or prosecutor investigation.
Key Takeaways
- Report the transaction to the bank or e-wallet immediately and obtain a fraud reference number.
- Preserve complete chats, account URLs, transaction records, emails, call logs, and original files before reporting the profile.
- You may gather public information, but private subscriber, banking, and platform records normally require lawful investigative and court processes.
- File a sworn complaint with the NBI CyberCrime Division, PNP Anti-Cybercrime Group, or another appropriate cybercrime authority.
- Ask investigators to preserve bank, platform, telecommunications, courier, and other relevant records promptly.
- A receiving account name is an investigative lead, not automatic proof of who masterminded the scam.
- Barangay and platform reports do not replace a formal cybercrime or estafa complaint.
- Recovery is most likely when the victim reports quickly, provides complete transaction details, and the funds have not yet been withdrawn or transferred.