Quick answer

If you suspect fraud or estafa, immediately contact the bank, e-wallet, remittance service, marketplace, or other platform that handled the transaction and ask it to preserve records and attempt to hold, recall, or trace the funds. Then preserve your evidence and report the incident to the police, the National Bureau of Investigation, or—especially for online transactions—the PNP Anti-Cybercrime Group or NBI cybercrime investigators.

A police or NBI report starts an investigation, but the formal criminal case is generally initiated through a sworn complaint supported by affidavits and documents filed with the proper prosecutor’s office. To recover money or property, you may claim civil liability in the criminal case or pursue an appropriate separate civil remedy. Reporting the crime does not itself guarantee repayment, freeze an account, or produce an arrest.

Act quickly. Funds can be transferred within minutes, digital records may be deleted, and criminal and civil claims have prescription periods that depend on the precise offense, penalty, dates, and remedy involved.

When suspected fraud may be estafa

Article 315 of the Revised Penal Code recognizes several forms of estafa, including fraud committed through:

Unfaithfulness or abuse of confidence, such as misappropriating or converting money or property received in trust, on commission, for administration, or under an obligation to deliver or return it;
False pretenses or fraudulent representations made before or at the same time as the victim parts with money or property; and
Other fraudulent means specifically covered by law.

The prosecution generally must prove the particular statutory acts and resulting prejudice or damage. The required facts differ according to the kind of estafa alleged.

For an accusation based on false pretenses, it is usually important to show that:

The accused made a materially false representation or used a fraudulent pretense;
The representation existed before or at the time the victim surrendered money, property, or credit;
The victim relied on it; and
That reliance caused damage.

For misappropriation or conversion, the documents must show why the accused received the money or property, what obligation accompanied its receipt, and how it was later misappropriated, converted, or denied.

The governing provision is Article 315 of the Revised Penal Code, as amended. Monetary thresholds and penalties were adjusted by Republic Act No. 10951.

Not every unpaid obligation is estafa

A failed investment, unpaid debt, broken promise, delayed delivery, or breach of contract is not automatically criminal fraud. A business can fail or a debtor can default without having used deceit or misappropriated entrusted property.

The distinction often turns on evidence of the accused’s conduct and intent:

Was an important fact deliberately misrepresented before payment?
Was a fake identity, document, account, title, receipt, product, or transaction used?
Did the accused claim authority, ownership, qualifications, inventory, or financial capacity that did not exist?
Was money or property received for a defined purpose, subject to an obligation to deliver or return it, and then diverted or denied?
Do the surrounding acts show an honest commercial failure, or a scheme designed to obtain the victim’s property?

A written demand may help prove nonperformance, misappropriation, notice, or the amount claimed. It is not a universal substitute for proving every element of estafa, and its legal importance depends on the mode charged and the facts.

Other laws may also apply. For example, using information and communications technology to commit an offense under the Revised Penal Code may bring the case within Section 6 of the Cybercrime Prevention Act of 2012. A bounced check may raise a separate issue under Batas Pambansa Blg. 22, but the issuance of a dishonored check does not by itself establish every element of estafa.

What to do immediately

1. Try to stop further loss

Contact the financial institution or platform through its verified official channel. Provide the transaction reference, date, amount, destination account, and reason for reporting fraud.

Ask it to:

Flag the transaction and recipient account;
Attempt a recall or hold, if still possible;
Preserve account, login, device, IP-address, and transaction records;
Issue a case or reference number; and
Explain what affidavit, police report, or court or law-enforcement request it requires.

A bank or platform may be unable to return funds without the recipient’s consent, a legal basis, or a court or law-enforcement process. Do not delay reporting while waiting for certainty.

If account credentials, cards, SIMs, email accounts, or identity documents were compromised, change passwords from a trusted device, activate multifactor authentication, notify the relevant providers, and monitor other accounts.

2. End contact safely

Do not send “release fees,” “taxes,” “verification deposits,” or additional investments merely because the suspect promises to return the original amount. Do not meet the suspect alone or attempt an unauthorized seizure of property.

Preserve communications before blocking an account. If law enforcement is considering an entrapment or controlled transaction, follow its instructions instead of organizing one yourself.

3. Make a complete timeline

Record, while events are fresh:

When and how contact began;
Every representation or promise made;
Why you believed it;
Each payment or transfer;
The account, wallet, telephone number, email address, profile, or office used;
What was supposed to be delivered or returned;
What actually happened;
Your follow-ups and demands; and
The suspect’s explanations, admissions, threats, or attempts to obtain more money.

Separate facts you personally know from assumptions and information supplied by others.

Evidence to preserve

Keep original files whenever possible. Useful evidence may include:

Contracts, proposals, invoices, receipts, purchase orders, acknowledgments, checks, promissory notes, trust receipts, or delivery records;
Bank statements, deposit slips, transfer confirmations, e-wallet histories, QR codes, and transaction reference numbers;
Complete chat and email threads showing dates, usernames, telephone numbers, headers, and attachments;
Screenshots and screen recordings that include the profile name, URL, date, and relevant context;
Advertisements, listings, websites, social-media profiles, domain names, and marketplace order pages;
Photographs or copies of identification documents supplied by the suspect;
Audio, video, or CCTV material lawfully obtained;
Demand letters and proof of delivery;
Names and contact details of witnesses and other victims; and
The device used for the transaction, if it may contain relevant data.

Do not crop away identifying details, alter messages, annotate the only copy, or delete an account before preserving its contents. Export conversations where the application permits it. Back up the files and retain an untouched set.

Digital evidence must still be authenticated. A screenshot is more useful when supported by the original device, account records, testimony, platform information, or other evidence identifying the participants and establishing the transaction.

Where and how to report

You may report the incident to:

The local Philippine National Police station;
The PNP Anti-Cybercrime Group for online or technology-assisted incidents;
The National Bureau of Investigation, including its appropriate cybercrime unit for online schemes; or
The city or provincial prosecutor’s office having territorial authority over the offense.

Use only contact details published on official government websites. Be cautious of accounts claiming they can “recover” stolen funds for an advance payment.

A complaint should ordinarily be filed where the offense was committed or where an essential ingredient occurred. Venue can become complicated when the victim, suspect, bank, platform, and servers are in different places. Under Rule 110, the proper location depends on where the offense or an essential ingredient occurred; convenience alone does not establish criminal venue.

Bring identification, a concise chronology, the amount lost, the suspect’s available identifying information, and organized copies of the evidence. Ask for the complaint, blotter, or investigation reference number and the assigned office’s instructions.

Police report versus prosecutor’s complaint

A police blotter entry or investigative complaint documents the report and may lead to evidence-gathering. It is not the same as an Information filed in court.

Under Rules 110 and 112 of the Revised Rules of Criminal Procedure, a formal complaint is a sworn written accusation. A complaint submitted for preliminary investigation should be accompanied by the complainant’s and witnesses’ affidavits and the supporting documents needed to establish the case. The prosecutor evaluates whether the respondent should be held for trial. If the prosecutor approves the charge, the prosecutor files an Information in the proper court.

The precise procedure depends partly on the prescribed penalty and whether preliminary investigation is required. Follow the current documentary, copy, oath, filing, and service requirements of the receiving prosecutor’s office.

If the offender has just been caught

Do not assume that a warrantless arrest is lawful merely because a victim points to a suspect. Rule 113 permits warrantless arrest only in defined circumstances, including an offense committed in the arresting person’s presence or a qualifying hot-pursuit situation after an offense has just been committed. Otherwise, investigation, prosecutorial action, and judicial issuance of a warrant may be required.

What the complaint-affidavit should explain

A useful affidavit is factual, chronological, and tied to its attachments. It should identify:

The complainant and respondent, using all reliably known names and contact details;
The relationship between them;
The false representations, entrusted property, or other fraudulent acts alleged;
When, where, and through what medium each material act occurred;
Why the complainant relied on the representation or entrusted the property;
The payments or property involved;
The loss or damage;
What happened after payment or entrustment;
Any admissions, demands, repayments, or continuing acts; and
What each attached exhibit proves.

Quote a message only if the quotation is exact. Do not conceal refunds, partial performance, contractual disputes, or facts that may appear unfavorable. Material inconsistencies can damage credibility.

If the suspect’s legal name or address is unknown, provide the identifiers you have—account numbers, wallet numbers, telephone numbers, usernames, URLs, photographs, delivery details, business records, and transaction references—and explain how they are connected. Investigators may need lawful preservation requests, subpoenas, or court processes to obtain subscriber and financial records.

Seeking recovery of money or property

Civil liability in the criminal case

Under Rule 111, when a criminal action is instituted, the civil action to recover liability arising from the charged offense is generally deemed included unless the offended party:

Waives it;
Properly reserves the right to file it separately; or
Filed the civil action before the criminal action.

A reservation to file separately must generally be made before the prosecution begins presenting evidence and while the offended party has a reasonable opportunity to reserve. Actual damages should be proved through reliable records; stating an estimated loss is not the same as proving it.

The court may order restitution, reparation, or damages if legally supported, but an award is not the same as collection. Recovery may still require execution against identifiable assets.

A separate civil action

Depending on the facts, a victim may have contractual, quasi-delict, rescission, collection, or independent civil-action remedies. Article 33 of the Civil Code permits an independent civil action for fraud, which requires proof by preponderance of evidence. Rule 111 governs how civil and criminal proceedings interact, including when a separate action is suspended.

There can be no double recovery for the same injury. Filing the wrong action, making an ineffective reservation, or pursuing inconsistent remedies can create procedural problems, so obtain legal advice before choosing a route.

For a qualifying money claim within the current jurisdictional ceiling, the judiciary’s small-claims procedure may offer a simplified civil remedy. Small claims do not determine criminal guilt and are not suitable for every fraud-related remedy or defendant. Confirm the current coverage, venue, required forms, and any barangay-conciliation prerequisite through the Supreme Court’s official small-claims resources.

Preserving assets

In a proper case, counsel may assess preliminary attachment or another provisional remedy. Rule 127 permits attachment in specified circumstances connected with the civil action arising from the offense, including certain cases involving fraud or misappropriated property.

Attachment is not automatic. It generally requires a court application, proof of statutory grounds, and a bond. A victim or private person should not seize, enter, access, or dispose of the suspect’s property without lawful authority.

Settlement and repayment offers

A genuine repayment may reduce the victim’s loss, but accepting money does not automatically erase a public offense once committed. The prosecutor and court—not only the complainant—control the criminal case after it enters the public prosecution process.

Before signing a quitclaim, affidavit of desistance, settlement, novation, or acknowledgment of full payment:

Verify that funds have actually cleared;
State whether the payment is partial or complete;
Identify the obligation and remaining balance;
Avoid making false statements or promising an outcome outside your control; and
Obtain advice on the document’s effect on the civil claim and its possible evidentiary use.

An affidavit of desistance does not automatically require dismissal, although it may affect the available evidence.

Common mistakes

Waiting for repeated promises while funds and records disappear;
Reporting only to a social-media page instead of the platform, financial institution, and authorities;
Submitting screenshots without transaction records or a coherent timeline;
Treating every unpaid debt as criminal fraud;
Accusing people publicly before verifying their identity or role;
Editing, fabricating, or selectively deleting messages;
Paying an unverified “recovery agent” or someone posing as an investigator;
Filing in a location with no legally sufficient connection to the offense;
Assuming a police blotter automatically begins prosecution or freezes assets;
Signing a broad waiver after receiving only partial payment; or
Letting prescription periods run while negotiating informally.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The loss is substantial or involves several victims;
The money is still traceable or the suspect appears to be moving assets;
A bank, platform, or provider says legal process is required;
The transaction crosses cities, provinces, or countries;
The suspect’s identity is hidden behind nominees, corporations, accounts, or digital assets;
The matter involves securities, investment solicitation, land titles, forged documents, public officials, or money laundering;
You are unsure whether the case is criminal, civil, regulatory, or all three;
A prosecutor has dismissed the complaint or a review deadline may be running;
You are asked to execute a settlement, desistance, or quitclaim; or
Prescription may be an issue.

Those unable to afford private counsel may inquire with the Public Attorney’s Office about eligibility and available assistance.

Frequently asked questions

Must I send a demand letter before filing an estafa complaint?

Not in every case. A demand can be important evidence, particularly where misappropriation, refusal to return property, or the amount due is disputed, but it does not replace proof of the statutory elements. Whether demand is legally or strategically necessary depends on the particular offense and documents.

Can I file even if I know only a username or account number?

You may report the incident and provide every available identifier. A viable prosecution ultimately requires identification of the responsible person and evidence connecting that person to the acts. Banks and platforms ordinarily disclose protected records only through lawful procedures.

Can the police immediately freeze the recipient’s account?

A report alone does not guarantee a freeze. A financial institution may take protective action under its rules and applicable law, while compulsory restraint or disclosure may require action by an authorized agency or court. Immediate reporting still improves the chance of preserving funds and records.

Will filing an estafa case ensure that I get my money back?

No. Criminal liability and actual collection are separate questions. Recovery depends on proof of civil liability, the orders entered, available assets, competing claims, and successful enforcement.

Can I pursue both criminal and civil remedies?

Often yes, but Rule 111 controls whether the civil claim is deemed included, may proceed independently, must be reserved, or is suspended. Double recovery is prohibited. Choose the procedure with legal advice.

What if several victims dealt with the same person?

Each victim should preserve individual transaction records and prepare a personal account of what was represented, relied upon, paid, and lost. Coordinating reports can help investigators identify a common scheme, but one victim should not claim personal knowledge of another victim’s transaction without a proper basis.

Is an online scam automatically cybercrime?

Not every online dispute is criminal. If conduct constituting an offense under the Revised Penal Code or a special law was committed through information and communications technology, the Cybercrime Prevention Act may apply. The prosecution must still prove the underlying offense and the legally relevant use of technology.

How long do I have to file?

There is no single deadline for all fraud cases. Criminal prescription depends on the offense, applicable penalty, date of discovery or commission as legally relevant, and events that interrupt prescription. Civil claims have separate periods based on their legal source and documents. Seek case-specific advice immediately rather than calculating the deadline from an informal label such as “scam.”

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct charge, venue, procedure, deadlines, and recovery strategy depend on the evidence and documents. Sources and procedures were checked as of 21 September 2026.