Here’s a Philippines-focused, practitioner-style guide to getting your money back after fraud—covering criminal, civil, regulatory, and practical recovery routes. It’s meant for victims, in-house teams, and counsel planning a fast response. (General information only, not legal advice.)

Money Recovery After Fraud (Philippines): Evidence, Procedure, and Playbooks

1) What “fraud” usually looks like (and why the label matters)

“Fraud” isn’t a single statute. Your recovery options depend on the legal box the conduct fits into:

Estafa (swindling) under the Revised Penal Code (RPC Art. 315) — deceit, abuse of confidence, bouncing checks in some modalities.
Qualified theft (taking by one in a position of trust).
Cybercrime-enabled fraud (phishing, account takeovers, SIM-swap, card-not-present) punishable or qualified under RA 10175 (Cybercrime Prevention Act) and related laws.
B.P. 22 (bouncing checks) — parallel/alternative to estafa where a check was used.
Securities/investment scams — Securities Regulation Code violations (SEC jurisdiction).
Insurance/healthcare fraud — Insurance Code/PhilHealth rules.
Financial consumer abuses — Financial Consumer Protection Act (RA 11765) enables monetary relief through regulators (BSP, SEC, IC, CDA) on top of court cases.
Consumer sales fraud — Consumer Act (RA 7394), DTI jurisdiction.
Data-enabled fraud — possible Data Privacy Act angles (NPC jurisdiction).

Your fastest route to actual pesos often mixes (a) private recovery tools (chargebacks/recalls, asset freezes, civil suits) and (b) State coercive tools (criminal cases, AML freezing, regulatory orders).

2) First 24–72 hours: Incident response playbook (money rails)

Speed is king. Funds move quickly across banks, e-wallets, and crypto. Do these in parallel:

Contain & document
- Freeze access: change passwords/PINs; enable multi-factor authentication; SIM-lock and report SIM-swap.
- Forensically preserve evidence (see §10): device images or, at minimum, unedited screenshots with full headers, dates, reference numbers, and transaction IDs.
Bank/e-money operator (EMI) recall
- File an official fraud report/dispute with your bank/e-wallet immediately (get a case/reference number in writing).
- Ask for a recall/trace of transfers (PESONet/Instapay), merchant chargeback (cards), and account freezing at the beneficiary institution via interbank coordination.
- For card fraud: initiate chargeback (issuer investigates; scheme rules apply; keep the timelines—often measured in days/weeks).
Police & cyber units
- File a criminal complaint (see §6) with PNP-ACG/NBI Cybercrime for phishing/online cases or local police/prosecutor for face-to-face scams.
- Provide bank letters, affidavits, IDs, transaction proofs, and any IP/device info; ask for subpoena duces tecum to pull beneficiary KYC, CCTV, and logs.
Regulators with money-back hooks
- BSP/SEC/IC complaint if the entity is a bank/EMI, an investment scheme, or an insurer (see §7).
- These agencies can order restitution/cease-and-desist and pressure supervised entities to cooperate with recalls and freezes.
AMLC angle (asset freezing)
- If amounts are significant or show suspicious layering, request referral to AMLC for freeze orders on accounts and crypto wallets (see §8). Early escalation helps.
Platform cooperation
- Report to platforms/marketplaces (seller takedown, escrow hold), telecoms (SIM info), email providers, and social networks (account preservation).

3) Choosing your legal track(s): criminal, civil, administrative (often all three)

A) Criminal cases (to punish and support civil recovery)

Estafa fits most scams (false pretenses, misappropriation). Cyber-elements can qualify or add separate offenses (e.g., illegal access, computer-related fraud).
B.P. 22 runs in parallel for bad checks—useful leverage for settlement.
Effect on recovery: Criminal filing preserves claims, triggers subpoenas/search warrants, and automatically includes civil liability unless waived or reserved. Courts can award restitution upon conviction.

Prescription (time limits):

Depends on the penalty tied to the amount defrauded (thresholds updated by RA 10951). As a rule of thumb:
- Offenses with afflictive penalties: 15 years.
- With correctional penalties: 10 years.
- B.P. 22: 4 years from commission (practical view: file early).
For cyber-enabled estafa, compute from discovery/commission per the offense; don’t assume longer just because it’s “cyber.”

B) Civil actions (to actually collect)

Annulment/voiding of contracts for fraud (dolo) → rescission/restitution.
- Voidable contract for fraud: file within 4 years from discovery.
Damages: under Civil Code Arts. 19/20/21 (abuse of rights, tort), quasi-delict (Art. 2176 — 4 years), written contracts (10 years), quasi-contracts like solutio indebiti/accion in rem verso (6 years).
Constructive trust/reconveyance (when property is wrongfully acquired) — specialized timelines; seek counsel.
Provisional remedies to grab assets early (see §5): preliminary attachment, garnishment, injunction.

C) Administrative/regulatory

Financial Consumer Protection Act (RA 11765) empowers BSP/SEC/IC/CDA to order restitution, disgorgement, and compliance; useful when a supervised entity’s act/omission contributed to loss.
DTI (Consumer Act) for deceptive sales.
NPC for data breaches that enabled fraud (can compel fixes; administrative fines).

4) Who do you sue/report? (and in what order)

Primary wrongdoers: the scammer, account mule/beneficiary, insiders (qualified theft/estafa).
Institutions: where negligence or regulatory breaches exist (e.g., failure to observe KYC, red-flag rules, dispute-handling duties).
Platforms/marketplaces: for injunctive relief and preservation orders; liability depends on facts and terms.
Don’t wait for perfect IDs—“John Doe” beneficiaries can be named with leave to amend after subpoenas unmask them.

5) Freezing and finding assets (the muscle)

A) Preliminary attachment (Rule 57, Rules of Court)

File with your civil complaint (or as an incident to the criminal case’s civil aspect) when the claim is for money arising from fraud or from a wrongful taking.
Post a bond; court can attach real/personal property, garnish bank balances/receivables.
Speed: Ex-parte issuance is possible; service & levy must follow quickly.

B) Preliminary injunction/TRO

Stop transfers, enforce account holds, or compel platforms to preserve evidence and keep funds on hold.

C) Subpoena duces tecum / 3rd-party discovery

To banks/e-wallets/telcos/hotels/ISPs/exchanges for KYC, CCTV, IP logs, transaction trails.
In criminal matters, law enforcement/prosecutors issue/seek these; in civil cases, use court processes.

D) Search warrants (criminal)

For devices, documents, and premises of suspects (coordinate with NBI/PNP).

6) How to file a criminal complaint (step-by-step)

Draft a Sworn Complaint-Affidavit
- Parties, exact amounts, dates, modus (phishing link, fake investment, romance scam, check), bank refs/trace nos.
- Attach Annexes: IDs, bank letters, screenshots with full headers/URLs, device photos, chat logs, call recordings (ensure wiretap law compliance; see §10).
File with the Office of the City/Provincial Prosecutor (venue: where deceit or receipt/transfer occurred; cyber cases allow flexible venue where any essential element transpired).
- Get a receiving copy with stamp.
Preliminary Investigation
- Subpoena to respondents → Counter-Affidavit → Reply → (optional) Clarificatory hearing.
- Prosecutor’s Resolution: probable cause? If yes, Information is filed in the proper trial court.
Arrest/Bail → Arraignment → Trial
- You, as private complainant, may reserve or pursue civil action within the criminal case.
- On conviction: restitution/civil indemnity is awarded; even on acquittal, civil liability may still be adjudged on a lower standard (preponderance of evidence) if the act is distinct from the criminal aspect.

7) Sector-specific rescue levers

A) Banks & e-wallets

Use formal dispute/chargeback channels; meet documentary timelines (often short).
Ask the bank/EMI to flag beneficiary accounts and initiate inter-FI recalls; keep all case numbers.
For erroneous transfers (mis-keyed accounts), pursue solutio indebiti (quasi-contract) and bank recall requests; if the recipient refuses, file civil suit + attachment/garnishment.

B) Cards & merchants

Chargebacks on fraud or non-delivery; supply compelling evidence (proof of non-receipt, IP/geolocation mismatch, device fingerprints).
For merchant fraud (no delivery/false goods), combine chargeback with DTI complaint and civil damages.

C) Investments

SEC complaint (unregistered securities, Ponzi/pyramids); seek cease-and-desist; coordinate with DOJ for estafa/SRC cases; trace payouts upstream (early investors) for recovery theories (constructive trust/unjust enrichment).

D) Insurance/healthcare

IC complaint; pursue rescission/claims; consider estafa if falsity was willful.

E) Data-driven fraud

NPC complaint for privacy lapses enabling fraud; regulatory outcomes (orders/fines) bolster your civil case.

8) Anti-Money Laundering (AMLA) pathway (for bigger or layered losses)

File or seek referral for AMLC action: freeze orders on accounts/wallets reasonably linked to the fraud.
Coordinate with banks/EMIs for STRs (suspicious transaction reports).
Civil forfeiture proceedings may follow; victims can intervene to assert claims to frozen assets.

9) Cross-border & crypto

Exchanges/VASPs (licensed locally or abroad): send preservation letters; request regulator-to-regulator contact; pursue KYC & transaction history via subpoena/MLAT.
On-chain tracing supports probable cause and civil tracing claims; pair with freezing at off-ramps.
MLAT/letters rogatory for evidence and asset restraint overseas; expect longer timelines—start early.

10) Evidence: make it court-proof

A) Electronic evidence (Rules on Electronic Evidence)

Authenticate: who created/received/kept the record; how it was generated; device and account ownership.
Preserve original devices or forensic images; keep hash values.
Printouts/screenshots should show URLs, timestamps, reference numbers; avoid edits/markup.

B) Chain of custody & sources

Keep a log of when/how you obtained each item.
Use lawful means only:
- Anti-Wiretapping Law: secret audio recordings of private conversations generally illegal without consent of all parties (risk of exclusion and your own liability).
- Don’t hack accounts or deploy spyware.
- Get consent or subpoenas.

C) Banking & platform docs

Dispute letters, recall requests, chargeback filings, merchant responses, KYC certifications, transaction logs, CCTV, IP logs, SIM change records.

11) Civil case toolkit (to collect faster)

Complaint for Sum of Money + Damages with Preliminary Attachment (fraud ground).
Injunction/TRO to keep funds from moving.
Garnishment post-judgment (or pre-judgment via attachment) on bank accounts, receivables, e-wallets.
Replevin for specific property obtained by fraud.
Small Claims (no lawyers in hearing; fast): up to ₱1,000,000 (current threshold) — ideal for many fraud losses; attach documentary proof and ask for garnishment post-judgment.

Venue & jurisdiction: File where plaintiff resides or where defendant resides/does business, or where cause of action arose, subject to rules for small claims/special courts and cybercrime venue flexibility.

12) Recovery against intermediaries (when they’re part of the problem)

Negligence (failure to implement reasonable security/KYC/dispute handling) → damages under Arts. 19/20/21 and quasi-delict.
Statutory duties (e.g., financial consumer protection standards) → administrative relief and restitution.
Contractual: breach of terms/SLA or written contract (10-year prescriptive period).

13) Templates (short, adaptable)

A) Demand & Preservation Letter (to bank/EMI/exchange)

Subject: URGENT — Fraud Loss, Recall/Freeze Request I am [Name], account [last 4 digits]. On [date/time], fraudulent transactions totaling ₱[amount] occurred (refs: [IDs]). Please: (1) recall/trace these transfers; (2) freeze beneficiary accounts/wallets pending investigation; (3) preserve KYC/transaction logs, CCTV, IP/device data; and (4) confirm written case number and point of contact. Attached: ID, transaction proofs, incident report, police blotter.

B) Criminal Complaint (skeleton)

Parties; narration of facts (modus, deceit, reliance, loss, bank refs).
Offenses invoked (e.g., Estafa; Computer-related fraud; B.P. 22).
Prayer for issuance of subpoenas/search warrants; annex list (A–Z).
Sworn and properly notarized.

C) Civil Complaint with Attachment (high-level)

Cause of action: sum of money arising from fraud/deceit; damages; interim attachment (Rule 57) with supporting affidavit showing fraud ground and specific attachables (bank name/branch, plate nos., property titles if any).
Prayer: issuance ex parte of writ of attachment, summons, injunction; post bond.

14) Common pitfalls (and how to avoid them)

Delay: most recalls/holds depend on hours/days, not weeks.
Thin evidence: screenshots without context/headers; edited images; no link from account to person.
Illegal recordings: risk exclusion and countersuits.
Single-track approach: relying solely on police report or solely on chargeback — use combined tracks.
No interim relief: filing civil case without attachment/injunction lets assets vanish.
Venue mistakes: pick a venue that supports subpoenas to institutions holding the money/logs.

15) Timelines & prescription (quick map)

Criminal estafa: 10 or 15 years depending on penalty bracket tied to amount (file early; compute carefully).
B.P. 22: typically treated within 4 years.
Annulment for fraud: 4 years from discovery.
Quasi-delict (tort): 4 years.
Quasi-contract (solutio indebiti/accion in rem verso): 6 years.
Written contract: 10 years.
Small Claims: file anytime within the above limits (practical aim: weeks, not months).

16) FAQs

Q: I sent money to the wrong account via InstaPay. Can I force a reverse? A: Ask your bank for an immediate recall; if the recipient refuses, sue under solutio indebiti and seek attachment/garnishment. Keep all reference numbers and timestamps.

Q: Can I recover if the scammer used a “mule” account? A: Yes. Sue the beneficiary accountholder (unjust enrichment/estafa/anti-money laundering angles) and use subpoenas to get KYC; attach the mule’s assets.

Q: Do I need a conviction to get my money back? A: No. You can win a civil judgment (or small claims) independent of a criminal conviction; criminal acquittal doesn’t always erase civil liability.

Q: The bank says I “authorized” the transaction (OTP used). A: Provide evidence of account takeover/social engineering; argue financial consumer protection standards and negligence (e.g., red-flag failures). Consider regulatory and civil routes, not just the bank’s internal ruling.

Q: Crypto was involved—am I doomed? A: Not necessarily. Move fast to preserve at exchanges, trace on-chain, and freeze at off-ramps; combine AMLC and civil attachment.

17) Bottom line

Act immediately, in parallel: recalls/chargebacks, criminal filings, civil attachment, and regulatory complaints.
Build admissible, lawfully obtained evidence and name beneficiaries even if the ultimate mastermind is unknown.
Use preliminary attachment/injunction to pin assets down early.
Escalate to AMLC and sector regulators for institutional leverage and restitution.
Aim for practical recovery (money back), not just punishment—design your filings around the accounts and assets you can actually reach.

If the amounts are material or the fraud is sophisticated (layered transfers, crypto, corporate vehicles), engage counsel early to synchronize the criminal, civil, and regulatory tracks and to move for asset freezes within days, not months.