Executive summary

If you’ve been duped by an “investment” (Ponzi/pyramiding, crypto/forex “managed accounts,” unlicensed lending, or sham real-estate/agribusiness), pursue parallel tracks right away: (1) Stop the bleeding & preserve evidence; (2) Regulatory action (SEC and sector regulators) to halt the scheme; (3) Criminal complaints (estafa, securities-law violations, cybercrime); (4) Civil recovery (rescission/damages/freeze/asset tracing); and (5) Payment recall/chargeback & AML coordination to chase funds. Speed and documentation largely decide outcomes.

I. What counts as an “investment scam” in PH law

A. Core legal hooks

Securities Regulation Code (SRC): Selling or offering securities (incl. investment contracts) without registration (Sec. 8) or without a secondary license to sell/act as broker/agent (Secs. 28–30); fraud/manipulation (Sec. 26).
Revised Corporation Code (RCC): Misuse of corporate personality; SEC can revoke registration and hold directors/officers accountable.
Financial Products and Services Consumer Protection Act (FCPA): Duties of fair treatment, disclosure, redress; empowers regulators to enforce and sanction.
Revised Penal Code (RPC) Art. 315 (Estafa); PD 1689 (syndicated estafa) where offenders form a syndicate defrauding the public.
Cybercrime Prevention Act: computer-related fraud, phishing, online deception.
Anti-Money Laundering Act (AMLA): proceeds of unlawful activities; freezing/forfeiture mechanisms.
Data Privacy Act: unlawful processing/leaks fueling fraud (e.g., contact harvesting).

B. Classic scam patterns

Ponzi/pyramid “profit sharing” or “slots” with referral uplines.
Unregistered crypto/forex “guaranteed” returns, “AI trading bots,” or “staking.”
Commodity/agribusiness/real-estate with impossible yields, no tangible operations.
Unlicensed “wealth managers,” influencers acting as investment solicitors without SEC secondary licenses.
Pretext lending: collects “placement” then disappears.

Tip: If the public is induced to invest money in a common enterprise with expectation of profits primarily from efforts of others, you’re squarely in investment contract territory (thus a security under the SRC), regardless of “membership,” “subscription,” “donation,” or “points” labels.

II. First 24–72 hours: triage & containment

Freeze exposure
- Stop further transfers; change passwords; secure email/phone; remove remote-access apps; enable MFA.
- Notify your banks/e-wallets to flag accounts and attempt recall (InstaPay/PESONet) or chargeback (cards).
Preserve evidence
- Take full-screen screenshots (include URL bars and timestamps); export chats/emails; save pitch decks, posts, and ads; download transaction history and bank statements.
- Keep receipts, deposit slips, crypto TXIDs, wallet addresses, and referral trees.
- Record names/aliases, mobile numbers, pages, domain WHOIS, and group admins/moderators.
Alert co-victims privately**;** avoid tipping suspects before takedown if law enforcement is preparing a sting.

III. Where to file: forums & what each can do

A. Securities and Exchange Commission (SEC) – Enforcement & Investor Protection

Use for: Unregistered securities, unlicensed selling/solicitation, corporate abuse.
Powers: Advisories, Show-Cause, Cease-and-Desist Orders (CDO) (often ex parte), revocation/suspension of corporate papers, referral for criminal prosecution.
What to file: Complaint-Affidavit with annexes (IDs; proof of payments; contracts/receipts; ads/screenshots; list of other victims; officer/agent identities; bank/e-wallet/crypto details).

B. Criminal route – City/Provincial Prosecutor / DOJ

Crimes: Estafa, syndicated estafa, SRC violations, cybercrime, illegal solicitation, falsification.
Output: Information filed in court; warrants; hold-departure requests; restitution as part of sentencing.
File: Sworn Complaint-Affidavit + witness affidavits + documentary/forensic proof.

C. Law enforcement – NBI Cybercrime / PNP-ACG

Use for: Digital forensics, subpoenas/requests to platforms, preservation of evidence, stings, arrests.
Bring: Reference numbers of your regulatory/criminal complaints, device dumps, TXIDs, bank trails.

D. AMLC (through your case agents or counsel)

Use for: Freeze/monitor accounts, bank-to-bank inquiries, asset tracing.
Mechanics: Ex parte freeze via Court of Appeals (for AMLA proceeds) or AMLC administrative freeze in specific cases; subsequent forfeiture proceedings.

E. Sector regulators (as applicable)

BSP (banks, EMI, pay ops), IC (insurance), DTI (consumer sales, direct selling), CDA (co-ops), NPC (data privacy) — to sanction regulated entities or data abuses intersecting with the scam.

IV. Building a prosecutable file

Minimum pack (organize in a binder or indexed PDF):

Complaint-Affidavit (facts in chronology; elements of the offense; prayer for relief).
Identity/KYC (your IDs; suspects’ IDs/links, if any).
Proof of inducement (ads, chats, vlogs, webinars).
Proof of investment (receipts, bank slips, hashes/TXIDs, smart-contract calls).
Use of funds (on-chain traces, bank flows to “mule” accounts; screenshots of “dashboards”).
Loss computation (principal, promised yield, actual recovery).
Witness roster (co-investors, recruiters, employees).
Expert/forensic notes (optional): chain analysis, IP/device correlation.

E-evidence hygiene: keep original files; export metadata; avoid editing images; log who collected what, when (a simple chain-of-custody table).

V. Legal theories & charging options

SRC Sec. 8/28: Unregistered sale of securities; acting as unlicensed broker/agent.
SRC Sec. 26: Fraudulent transactions (misstatements/omissions; scheme to defraud).
Estafa (RPC 315)/Syndicated estafa (PD 1689): deceit + damage; syndicate when offenders form a group to carry out fraud against the public.
Cybercrime enhancements if committed via computer systems/online platforms.
AMLA: laundering of scam proceeds (add defendants: money mules, exchangers).
Data Privacy violations if personal data was harvested/abused in the scheme.
RCC liabilities of directors, trustees, officers, and controlling persons who authorized or tolerated the acts.

VI. Asset protection & fund recovery

A. Banking rails

InstaPay/PESONet: Request recall/hold immediately via your bank; success depends on speed and whether funds remain.
Cards: Trigger chargebacks under fraud reason codes (3-D Secure status matters but is not always conclusive).
Cross-border wires: Ask for SWIFT recall/AML flags; coordinate with receiving FI via case agents.

B. E-wallets/OTCs/crypto

Provide TXIDs, wallet addresses, exchange order numbers; request KYT (know-your-transaction) review and account locks.
For on-chain assets, use public explorers to map hops and preserve URLs; law enforcement may request exchange KYC via MLAT or domestic legal process.

C. Freezing & forfeiture

SEC CDO halts continuing solicitation.
AMLC/CA freeze orders target accounts holding proceeds; follow with petitions for forfeiture.
In criminal cases, seek writs of attachment or hold-departure and travel record orders (through prosecutors/courts).

VII. Civil remedies (parallel to criminal/regulatory)

Rescission/Annulment of void/voidable “investment” contracts (lack of SEC registration; illicit cause).
Damages (actual, moral, exemplary) and attorney’s fees.
Unjust enrichment/constructive trust theories against recipients (incl. uplines).
Representative/joinder: PH has no U.S.-style class actions for securities fraud; coordinate consolidated or intervenor filings; use representative suits where appropriate under procedural rules.

Venue & prescription:

SRC offenses and special-law crimes generally follow Act No. 3326 (prescriptive periods vary by penalty). Estafa prescriptive periods run under the RPC as amended. File early to avoid prescription fights.

VIII. Managing expectations & timelines

Advisory/CDO (SEC): fast if evidence is strong; helps stop ongoing solicitations.
Criminal cases: preliminary investigation (weeks–months), then trial (longer).
Asset recovery: highly dependent on speed and traceability; layered funds are harder to claw back.
Chargebacks/recalls: network and bank calendars; push for written status updates.

IX. Victim coordination and safety

Avoid doxxing suspects; let agents work.
Use a secure chat group for victims to coordinate affidavits and share proofs.
Be alert to secondary scams: “recovery agents” demanding fees, fake “AMLC/SEC” emails.
Consider psychosocial and financial counseling; scams often trigger cascading debts.

X. Templates (adapt as needed)

A. Complaint-Affidavit (outline)

Parties & capacity (victim; accused, aliases, corporate shells).
Jurisdiction & venue (where acts/transactions occurred; where funds were paid).
Facts (clear timeline: solicitation → payments → promises → non-delivery).
Offenses charged (SRC §§ 8/26/28; Estafa; Cybercrime; AMLA).
Evidence list (Annexes A–Z).
Prayers (filing of Information; issuance of subpoenas; coordination with AMLC; freeze/attachment; restitution).
Verification & jurat.

B. Demand/Notice to Suspects

Cease-and-desist; demand return of funds within 5 days; hold you liable civilly/criminally; copy furnished to regulators/law enforcement.

C. Bank/E-wallet Recall Request

Identify amounts, timestamps, reference numbers, beneficiary details, and grounds: fraud/illegal securities solicitation; request urgent recall/hold and FIs-to-FI alerts.

XI. Red flags (teach your team/clients)

“Guaranteed 25–60% monthly,” “no risk,” “earnings every day.”
Solicitors without SEC secondary licenses; companies without SEC registration or with non-investment purpose clauses.
Pressure tactics: “last slot,” “VIP tier ends tonight,” heavy focus on referrals.
Walled-garden dashboards showing “profits” but no real cash-outs or complex withdrawal conditions.
Use of celebrity images/government logos without authority; crypto jargon to obscure basic questions.

XII. Practical checklist (one-pager)

☐ Stop transfers; secure accounts/devices
☐ Evidence pack (screens, receipts, chats, TXIDs, identities)
☐ File with SEC (unregistered securities/unlicensed selling)
☐ File criminal complaint (estafa + SRC + cybercrime)
☐ Engage NBI/PNP-ACG (forensics, preservation, stings)
☐ Trigger recall/chargeback; share case refs with FIs
☐ Coordinate AMLC for freezes/tracing
☐ Consider civil suit (rescission/damages/attachment)
☐ Keep victims coordinated; beware of recovery scams

Key takeaways

Work in parallel: SEC, prosecutors, law enforcement, and financial rails—don’t wait for one to finish.
Documentation wins: timelines, money trails, identities, and on-chain/banking artifacts.
Speed is everything for recalls and freezes.
You can recover via criminal restitution, civil damages, chargebacks/recalls, and forfeiture—but success hinges on early, organized action.
Future-proof yourself and your organization with scam literacy, vendor/licensing checks, and zero-tolerance policies for “guaranteed” returns.