A practical legal article for victims, with a Philippine law and procedure focus.

1) What “counts” as an online scam under Philippine law

Online scams come in many forms, but legally they tend to fall into a few core buckets:

A. Fraud / Estafa (Swindling)

Most online scams are prosecuted as estafa under the Revised Penal Code (RPC), Article 315, typically where a person uses deceit to cause you to part with money or property, and you suffer damage or prejudice.

Common examples:

Paying for a product/service that never arrives
“Investment” or “crypto” schemes
Fake bookings, rentals, ticket sales
Romance scams and emergency money requests
Fake jobs requiring “fees”

B. Cybercrime-related offenses

If the scam uses ICT (social media, messaging apps, email, websites, etc.), the conduct may also be covered by RA 10175 (Cybercrime Prevention Act of 2012). Depending on the facts, this can include:

Online fraud-related conduct, identity misuse, or computer-related offenses
Enabling legal tools to obtain digital evidence (subscriber info, traffic data, preserved computer data) through proper procedure

A practical point: even when the underlying crime is “estafa,” the online element matters because it affects evidence, investigation, and sometimes charging strategy.

C. Identity misuse, card/e-wallet issues, and related statutes (fact-dependent)

Certain scams also implicate other laws, for example:

Access device / credit card misuse (RA 8484) (when cards or access devices are misused)
Data Privacy Act (RA 10173) (if personal data is unlawfully obtained/processed and causes harm; this is case-specific and not automatically triggered by every scam)
E-Commerce Act (RA 8792) (recognizes electronic data messages/documents and e-signatures; helpful for evidence and proving transactions)

2) The first hour: legally-smart actions that preserve your case (and your money)

Step 1 — Stop further loss immediately

Freeze the flow of funds: stop sending money, stop “verification deposits,” stop “tax releases,” stop “unlock fees.”
Cut access:
- Change passwords for email, bank/e-wallet, social media (start with email because it resets everything else).
- Enable 2FA (authenticator app preferred).
- Sign out of all sessions/devices where possible.
If you shared OTPs or remote access:
- Assume compromise. Remove unknown devices, revoke app permissions, uninstall remote-control apps used during the scam.

Step 2 — Preserve evidence before it disappears

Do not rely on memory. Capture what a prosecutor/investigator can use.

Minimum evidence set:

Screenshots (with visible timestamps/usernames/URLs where possible)
Full chat history exports (if the platform allows)
Transaction records:
- bank transfer receipts
- e-wallet reference numbers
- deposit slips
- card charge details
The scammer’s identifiers:
- names used, usernames, profile links
- phone numbers, emails
- bank/e-wallet account details
- delivery addresses, tracking numbers (even fake ones)
Any links used (phishing links, listing pages, payment pages)

Best practice: Make a folder and keep originals. If possible, also record a short screen video scrolling through chats/transactions to show continuity.

Step 3 — Write a “fresh narrative” while it’s still clear

A concise timeline is powerful evidence.

Include:

Date/time you first contacted the scammer
What was promised
What you paid, when, how, and to whom
What happened afterward (delays, excuses, threats, blocks)
When you realized it was a scam

Keep it factual. Avoid insults or speculation.

3) The first 24–72 hours: recovery moves and official reporting that matter

A. Try to claw back funds (this is time-sensitive)

Even when criminal prosecution is possible, recovering money often depends on quick financial action.

1) Bank transfers

Call your bank immediately and report suspected fraud.
Request:
- Recall/chargeback options (if applicable; depends on channel/type)
- Fraud investigation and whether they can coordinate with the receiving bank
- A copy of transaction details for documentation

Reality check: once funds have moved out, reversal may be difficult, but fast reporting improves odds.

2) E-wallets (GCash/Maya/others)

Report inside the app and through official support channels.
Provide:
- reference number
- recipient details
- screenshots/chats
Ask if they can temporarily restrict the recipient account pending investigation.

3) Credit/debit card transactions

For card-not-present fraud, contact the issuing bank:
- request card block/replacement
- file a dispute/chargeback (timelines and requirements vary)
Keep all emails/SMS confirmations and case reference numbers.

B. Report to the right law enforcement unit

For online scams, Philippine reporting is commonly routed through cybercrime-capable units.

Primary options:

PNP Anti-Cybercrime Group (PNP-ACG)
NBI Cybercrime Division (often referred to as the cybercrime capability within NBI)

Bring:

printed affidavit/narrative and timeline
IDs
evidence bundle (printed highlights + USB/cloud link if allowed)
transaction proofs

Why this matters: cybercrime units know how to request preservation/production of data through the correct legal channels.

C. Report to the platform (and preserve the report)

Report the account/page/listing to:

Facebook/Instagram/Marketplace
TikTok, X, Telegram, WhatsApp, Viber
Shopee/Lazada/Carousell or other marketplaces
Booking platforms, courier platforms, etc.

Take screenshots of:

your report confirmation
the profile page before it disappears
any posts/listings/comments

D. If the scam involves threats, extortion, or intimate images

Treat this as urgent.

Do not pay. Payment rarely ends extortion; it can escalate demands.
Preserve evidence of the threats.
Report promptly to cybercrime units.
Consider also documenting emotional distress and impact for potential damages.

4) Building a legally usable complaint: what investigators/prosecutors need

A. Elements you must be able to show (typical estafa pattern)

In many online scam cases, the case hinges on proving:

Deceit (false identity, false promise, fake proof, misrepresentation)
Reliance (you believed it and acted on it)
Disposition (you paid/sent property)
Damage (loss of money/property or prejudice)

Evidence should map to these elements.

B. Prepare an Affidavit-Complaint (practical format)

Your affidavit generally includes:

Your identity and contact details
How you encountered the scammer
Full timeline and amounts
Specific representations made by the scammer
Exact payment details (accounts, reference numbers)
What happened after payment
Attachments marked as Annexes (screenshots, receipts, IDs, chat logs)

Tip: label attachments clearly:

Annex “A” – Screenshot of scammer profile
Annex “B” – Chat excerpts showing the offer and promise
Annex “C” – Proof of payment / transaction receipt
Annex “D” – Follow-up messages / refusal / blocking evidence

C. Authentication of digital evidence (what makes it credible)

Digital evidence is stronger when you can show:

where it came from (platform/account link)
completeness (not cherry-picked)
timestamps and continuity
corroboration (transaction records matching chat demands)

If possible, keep:

the original files
device metadata
emails/SMS confirmations from banks/e-wallets

5) Where to file and what happens next (Philippine procedure overview)

A. Police/NBI intake vs. Prosecutor filing

You may:

report first to cybercrime units (for assistance and evidence handling), and/or
file directly with the Office of the City/Provincial Prosecutor for inquest (if applicable) or preliminary investigation (typical for most scams where the suspect isn’t arrested immediately).

B. Preliminary Investigation (common path)

You file the complaint and attachments.
The respondent is asked to submit a counter-affidavit.
The prosecutor determines probable cause.
If probable cause exists, an Information is filed in court, and the case proceeds.

C. Jurisdiction and “where the crime was committed” (practical realities)

Online transactions cross locations. In practice, venue/jurisdiction can be affected by:

where you were when you transacted,
where the money was received/withdrawn,
where key acts occurred.

Cybercrime-capable units help navigate this, but keep documents showing your location/time (e.g., bank app logs, SMS confirmations, screenshots with timestamps).

6) Legal tools unique to cybercrime investigations (why cyber units matter)

For online scams, the identity of the perpetrator is often the main problem. Cybercrime investigation can involve lawful requests/orders to:

preserve computer data (so it isn’t deleted)
obtain subscriber information (who controls a number/account, subject to legal process)
obtain traffic data (limited metadata about communications, under lawful conditions)
secure devices and data with proper authority

These are not things victims can typically compel by themselves; they must be pursued through proper legal channels.

7) Civil remedies: suing to get money back (and when it makes sense)

Criminal cases can include civil liability (restitution/damages) arising from the offense. In many cases, victims rely on this rather than filing a separate civil action.

However, a separate civil case may be considered when:

the suspect is identifiable and reachable,
you need faster or more tailored remedies,
the dispute is partly contractual (e.g., business transaction with fraudulent misrepresentation).

Practical limitation: civil recovery still depends on the defendant having assets you can reach.

8) Special scenarios and what to do

A. Marketplace scams (Facebook Marketplace, buy-and-sell groups)

Immediate steps:

preserve listing URL, seller profile, chat, payment proof
report to platform
file a complaint with cybercrime units
identify any courier details used (even fake tracking numbers can lead to patterns)

B. “Investment”/crypto and pig-butchering style scams

Red flags:

guaranteed returns
pressure to “top up” to withdraw
fake dashboards
“tax” or “verification” payments

Immediate steps:

stop payments
preserve wallet addresses, TX hashes, platform URLs
report to cybercrime units quickly (tracing may be time-sensitive)

C. Romance scams

Preserve:

the full chat history
images used (reverse-image searching can be useful later, but evidence preservation comes first)
payment requests and emotional manipulation messages (relevant to deceit)

D. Job/remote work scams

Preserve:

recruitment posts
HR emails/messages
“training fees,” “equipment fees,” “clearance fees”
any ID documents they sent (often fake; still evidence of deceit)

E. SIM/OTP scams and account takeover

Immediate steps:

lock email first, then e-wallet/bank/social accounts
request SIM-related checks from your telco if you suspect SIM-swap or unauthorized porting
preserve OTP messages and unusual login alerts
report promptly

9) Avoiding “secondary victimization” (common after you report)

After you post online or tell others you were scammed, you may be targeted by:

fake “recovery agents”
fake “lawyers”
fake “bank investigators”
“AMLC release fee” scams

Rules:

Do not pay anyone promising guaranteed recovery.
Only transact through official channels and verified offices.
Keep a single evidence log so you don’t get pressured into inconsistent statements.

10) A victim’s quick checklist (Philippines)

Within 1 hour

Stop payments; cut access; change passwords; enable 2FA
Screenshot/record chats, profile, listing, transaction proof
Draft a timeline while fresh

Within 24 hours

Call bank/e-wallet and report fraud; request case reference number
Report the account to the platform
Prepare affidavit-complaint with annexes
Report to PNP-ACG or NBI cybercrime capability

Within 72 hours

File with the Prosecutor’s Office if advised/ready
Organize evidence into labeled annexes
Track all reference numbers (bank, platform, police/NBI)

11) Simple affidavit-complaint structure you can follow (template-style)

1. Personal circumstances Name, age, address, ID, contact info.

2. How you encountered the respondent Platform, username/profile link, date/time.

3. Representations and inducement What was promised; screenshots as annex.

4. Payment / delivery / transfer details Amounts, dates, channels, reference numbers, receiving account.

5. After-payment events showing deceit Excuses, refusal to deliver, blocking, threats, repeated fee demands.

6. Damage suffered Total loss + other harms (if relevant and factual).

7. Prayer Request investigation and filing of appropriate charges; include civil damages if applicable.

8. Annex list Enumerate and label.

12) What to expect emotionally and procedurally

Online scam cases can move slowly because:

identification of the real person behind an account takes lawful process,
accounts may be mule accounts,
perpetrators may be outside your locality or outside the country.

Your best leverage is speed, organized evidence, and consistent documentation.

13) Key takeaways

Treat the first 24 hours as both a financial emergency and an evidence-preservation window.
Aim to prove deceit → payment → loss, with clean digital and transaction evidence.
Report to cybercrime-capable authorities early because they can pursue preservation and identification steps through lawful channels.
Do not pay “recovery” middlemen; document everything and stick to official processes.