Quick answer

If you suspect fraud or estafa, act immediately: stop further payments, contact every bank or e-wallet involved through its official fraud channel, secure your accounts, preserve the complete transaction trail, and report the incident to law enforcement. To pursue criminal charges, you will ordinarily need a sworn complaint-affidavit and evidence establishing the particular offense and identifying the responsible person. To recover money, promptly request tracing or temporary holding of funds and consider restitution through the criminal case, a separate civil action, or an appropriate small-claims case.

A report does not guarantee recovery. Whether conduct is estafa depends on how the money or property was obtained or handled—not simply on a failure to pay a debt, deliver an item, or keep a promise. Speed matters because transferred funds can be withdrawn or moved through several accounts, electronic records may be lost, and both criminal and civil claims have prescriptive periods.

What legally counts as estafa?

Article 315 of the Revised Penal Code punishes several distinct forms of swindling. Common forms include:

Obtaining money or property through a fictitious name, false authority, imaginary transaction, or another false representation made before or at the time the victim parted with it.
Receiving money or personal property in trust, on commission, for administration, or under an obligation to deliver or return it, and then misappropriating, converting, denying receipt of, or refusing to account for it.
Taking undue advantage of a signature obtained in blank.
Inducing someone through deceit to sign a document.
Certain fraudulent uses of checks and other practices specifically covered by Article 315.

The applicable provision, required proof, possible penalty, court jurisdiction, and procedure depend on the precise method used and, in many cases, the amount involved. The present monetary brackets under Article 315 were introduced by Republic Act No. 10951.

For estafa by false pretenses, prosecutors generally look for evidence showing:

A false representation or fraudulent act;
Made before or simultaneously with the victim’s delivery of money or property;
Reliance by the victim on that deceit;
Delivery because of that reliance; and
Resulting damage capable of proof.

For estafa through misappropriation or conversion, the important questions include:

Whether the accused received money or personal property in trust, on commission, for administration, or under an obligation to deliver or return the same thing;
Whether the accused misappropriated, converted, denied receiving, or failed to account for it;
Whether another person suffered prejudice; and
Where legally relevant, whether a demand was made.

The exact elements must match the specific paragraph charged. A prosecutor cannot substitute a general accusation of dishonesty for evidence of every legal element.

A broken promise or unpaid debt is not automatically estafa

Nonpayment, delay, breach of contract, business failure, or failure to deliver does not by itself prove criminal fraud. For estafa by false pretenses, the deceit must generally exist before or at the time the victim gives up the money or property. A later failure to perform is ordinarily a civil matter unless surrounding evidence shows that the promise or representation was fraudulent from the beginning.

Useful indicators may include fabricated documents, a false identity or address, pretending to own property that did not exist, claiming nonexistent authority, taking payment for an imaginary transaction, using the same scheme against several people, immediately diverting funds contrary to the stated purpose, or disappearing after receipt. No single indicator automatically proves guilt.

For property received in trust or for a specific duty to return or deliver, the distinction between ownership, a loan, agency, deposit, commission, and administration can determine whether Article 315 applies. The written agreement and the parties’ actual arrangement are therefore critical.

Online scams and financial-account schemes

Estafa committed through information and communications technology may also fall under Section 6 of the Cybercrime Prevention Act of 2012, which generally provides a penalty one degree higher when a Revised Penal Code offense is committed by, through, and with the use of ICT. Other conduct may constitute computer-related fraud, computer-related forgery, identity theft, illegal access, or another cybercrime. The correct charge depends on what the offender actually did; the fact that people merely communicated online does not resolve the classification by itself.

The Anti-Financial Account Scamming Act, Republic Act No. 12010, separately addresses money-mule activities and social-engineering schemes involving bank, e-wallet, and other covered financial accounts. Among other safeguards, it authorizes covered institutions, subject to Bangko Sentral ng Pilipinas rules, to temporarily hold funds involved in a disputed transaction. The statutory holding period may not exceed 30 calendar days unless extended by a competent court.

Republic Act No. 12010 also provides for coordinated verification among affected institutions and account owners. In specified circumstances, an institution may be liable to restore funds when it failed to employ adequate risk-management controls or the legally required degree of diligence; a criminal conviction is not a prerequisite to that form of restitution. This does not create an automatic refund for every scam. Liability depends on the law, BSP rules, the institution’s safeguards, the transaction, and the account owner’s conduct.

What to do in the first hours

1. Stop communicating through the scammer’s links or numbers

Do not send a “release fee,” “tax,” “verification deposit,” or additional amount to recover the first payment. Do not install software or share an OTP, PIN, password, recovery code, screen-sharing access, or remote-control permission.

Contact the bank, e-wallet, marketplace, or payment provider using the number or channel displayed in its official app, website, card, or statement—not details supplied by the suspected scammer.

2. Report the transaction to the sending institution

Tell the institution that the transaction is disputed and suspected to be fraudulent. Ask it to:

Lock or secure affected access;
Open a formal fraud case;
Attempt a recall or reversal where available;
Notify the receiving institution;
Initiate coordinated verification under applicable law and BSP rules;
Preserve transaction, authentication, device, IP, and account records; and
Give you a reference number and written acknowledgment.

State the exact amount, date and time, transaction reference, recipient account, and circumstances. A request can still be made if you authorized the transfer while deceived, although the institution will evaluate authorized and unauthorized transactions differently.

3. Notify the receiving institution if identifiable

Provide the destination account or wallet number and transaction reference. Ask that the report be escalated to its fraud team and that any remaining proceeds be preserved or temporarily held as allowed by law. The institution may be unable to disclose account-holder information directly because disclosure normally requires legal authority.

4. Secure every potentially exposed account

Change passwords using a clean device, revoke unknown sessions, enable strong multi-factor authentication, lock compromised cards, change vulnerable PINs, and alert your mobile provider if SIM takeover is possible. Check email rules, linked devices, recovery addresses, loan applications, and recent account changes.

If identity documents were exposed, notify the issuing agency and affected financial institutions. Monitor accounts and retain all security alerts.

5. Make a law-enforcement report promptly

For an online or technology-enabled incident, you may approach the cybercrime unit of the Philippine National Police or the National Bureau of Investigation. The Cybercrime Investigation and Coordinating Center also publishes government cybercrime reporting and assistance information.

For an offline incident, you may initially report to the local police or NBI. Ask what office will investigate and what additional documents are required. Obtain the investigator’s name, docket or reference number, and a copy or acknowledgment of your report.

A police, NBI, CICC, platform, or bank report is not necessarily the same as filing a criminal complaint with the proper prosecutor’s office. Confirm which steps remain.

Evidence to preserve

Keep originals and make at least two secure backups. Preserve the evidence in its native form where possible rather than relying only on cropped screenshots.

Identity and contact evidence

Profile URLs, usernames, telephone numbers, email addresses, display names, and account IDs;
Photographs, identification documents, business registrations, calling cards, or supposed authority documents sent by the person;
Marketplace listing URLs and seller or store identifiers;
Delivery addresses, meeting locations, vehicle details, and names of witnesses.

Communications

Complete message threads showing dates, times, sender details, and surrounding context;
Emails with full headers;
Voice messages, lawful recordings, call logs, SMS messages, and video-call details;
Advertisements, proposals, representations, guarantees, and instructions;
Messages showing follow-up demands, excuses, admissions, blocking, or disappearance.

Do not edit the originals. Export chats when the platform permits it, record the URL and date of access, and retain the device on which the messages were received.

Payment and transaction records

Official receipts, deposit slips, statements, and transaction confirmations;
Bank or wallet names, account numbers, account names as displayed, QR codes, reference numbers, dates, times, and amounts;
Card records, remittance documents, cryptocurrency wallet addresses and transaction hashes;
Fraud-case reference numbers and communications with institutions;
A clear schedule of every payment and the total actual loss.

Agreements and proof of deceit or entrusted property

Contracts, purchase orders, invoices, acknowledgments, delivery records, and powers of attorney;
Proof of what the suspect represented before payment;
Evidence contradicting those representations;
Proof of the purpose for which property was entrusted and the duty to return or deliver it;
Written demands and proof of receipt;
Statements from witnesses with personal knowledge.

Prepare a chronological account separating what you personally saw or heard from information supplied by somebody else. Identify who can authenticate each document or electronic record.

Preparing a criminal complaint

A complaint-affidavit should be factual, chronological, and tied to the elements of the suspected offense. It ordinarily identifies the complainant and respondent, explains each material representation or act, states when and where it occurred, describes why it was false or wrongful, connects it to each payment or delivery, calculates the loss, identifies witnesses, and authenticates the attachments.

Do not exaggerate, conceal unfavorable facts, or identify someone solely because their name appeared on a receiving account. The account owner may be the offender, a knowing money mule, an identity-theft victim, or another person whose role requires investigation.

Under the current DOJ-National Prosecution Service framework, prosecutors apply the standard of prima facie evidence with reasonable certainty of conviction. The evidence must appear admissible, credible, preservable, and sufficient—if left uncontroverted—to establish every element and the identity of the responsible person. The Supreme Court upheld this DOJ standard in Meking v. Remulla, G.R. No. 280455, November 11, 2025.

The procedure depends on the prescribed penalty:

Regular preliminary investigation generally covers offenses carrying at least six years and one day of imprisonment.
Other offenses may undergo summary investigation or expedited preliminary investigation under the applicable DOJ rules.
Cases within the original jurisdiction of the Regional Trial Court may require regular preliminary investigation even where a different track might otherwise appear applicable.

Filing arrangements, accepted electronic channels, oath requirements, copies, and local documentary requirements can change. Confirm them directly with the prosecutor’s office that has territorial authority before filing. Do not send sensitive evidence to an unofficial email address or social-media account.

Where should the complaint be filed?

Venue is jurisdictional in criminal cases. The case generally belongs where the offense, or an essential ingredient of it, occurred. Relevant places may include where the deceit was communicated or acted upon, where money or property was delivered or received, or where conversion occurred. Online transactions, multiple transfers, overseas actors, and victims in different locations can make venue complicated.

Do not select an office only because it is convenient. Give the investigator or lawyer all relevant locations, including where you were when you relied on the representation and initiated the transfer.

Barangay conciliation may also be a precondition in cases within the Lupon’s authority—for example, when the parties are actual residents of the same city or municipality and no statutory exception applies. Exceptions include disputes outside the Lupon’s authority and situations requiring urgent legal action. Because the applicable penalty and residence facts matter, verify this before filing rather than assuming that a barangay certificate is always required or never required.

How recovery can be pursued

Immediate tracing, recall, or temporary holding

This is often the best chance of preserving money that remains within the financial system. A bank or wallet complaint should be made immediately, but a temporary hold is not a final award to the victim. Verification, release, restitution, or court processes may still be necessary.

Civil liability in the criminal case

As a general rule, the civil action to recover civil liability arising from the offense is deemed instituted with the criminal action unless the offended party waives it, reserves the right to bring it separately, or has already filed it. Restitution or damages may be ordered if liability is established.

Tell the prosecutor about every payment, partial return, expense, and other claimed loss. Keep proof. Avoid collecting the same loss twice through overlapping proceedings.

A separate civil action

A civil case may be appropriate when the evidence principally supports breach of contract, collection of a sum of money, rescission, restitution, damages, or another civil remedy rather than estafa. A criminal complaint should not be used merely to force payment of an ordinary debt.

Claims within the current small-claims coverage—generally money claims not exceeding ₱1,000,000, exclusive of interest and costs—may qualify for the streamlined small-claims procedure if they fall within the categories allowed by the Supreme Court’s rules. Criminal liability and non-monetary remedies are not decided in a small-claims case. Check the Supreme Court small-claims resources and the proper first-level court for current forms and filing requirements.

Claims against a financial institution

Complain first through the institution’s official consumer-assistance mechanism and preserve its final response. Matters involving a BSP-supervised institution may be elevated through the BSP consumer-assistance channels.

Whether the institution must reimburse you depends on the transaction, applicable consumer-protection and payment rules, security controls, warnings, authentication, and the institution’s diligence. Sharing an OTP or authorizing a transfer may affect the assessment, but it does not make a report pointless or automatically resolve every issue against the account owner.

Demands and settlement

A written demand can document the amount claimed, basis of the obligation, requested action, deadline, and receipt by the other party. Demand is legally significant in some forms of estafa and civil claims, but it is not a universal substitute for proof of deceit or conversion.

Settlement may produce faster recovery, but use caution:

Put all terms, dates, payment methods, defaults, and releases in writing.
Verify the identity and authority of the person signing.
Do not withdraw or execute a broad waiver merely because a postdated check or first installment was offered.
State how partial payments will be credited.
Have counsel review quitclaims, affidavits of desistance, confidentiality clauses, or transfers of property.

An affidavit of desistance does not automatically terminate a public criminal prosecution. The prosecutor or court determines its legal effect. Never accept money intended to influence testimony, conceal evidence, or make a false statement.

Deadlines and prescription

Do not delay while negotiating informally. Criminal prescription depends on the offense legally established and the penalty prescribed by law. Articles 90 and 91 of the Revised Penal Code govern prescription for Revised Penal Code offenses, including when the period begins, is interrupted, and resumes. Special laws may use different rules.

Civil deadlines also vary. Under the Civil Code, actions upon a written contract generally have a different prescriptive period from actions upon an oral contract, injury to rights, fraud, or obligations created by law. The governing period can also depend on accrual, discovery, demand, interruption, and the remedy chosen.

Because an incorrect classification can produce an incorrect deadline, have a lawyer calculate prescription from the documents and exact dates. Do not assume that a bank report, police blotter, demand letter, barangay proceeding, or informal negotiation necessarily interrupts every applicable prescriptive period.

Electronic evidence creates an additional practical deadline. Under Section 13 of the Cybercrime Prevention Act, specified traffic data and subscriber information are ordinarily preserved by service providers for a minimum of six months from the transaction, while content data are preserved for six months from receipt of a lawful preservation order; law enforcement may order one extension under the statute. Victims cannot compel disclosure merely by asking the platform. Early reporting gives investigators more time to seek lawful preservation and disclosure.

Common mistakes that weaken a case

Continuing to send money in the hope of unlocking a refund or investment;
Deleting, blocking, resetting, or surrendering a device before preserving evidence;
Submitting cropped screenshots that omit the sender, date, URL, or context;
Relying only on a police blotter and assuming a prosecutor’s complaint has been filed;
Naming the receiving-account owner as the mastermind without evidence of knowledge or participation;
Treating every unpaid loan or failed business as estafa;
Failing to explain which statement was false and why it caused the payment;
Omitting partial refunds or facts favorable to the respondent;
Posting accusations, personal data, or identification documents publicly;
Paying an unofficial “recovery agent,” hacker, fixer, or investigator;
Missing a subpoena, prosecutor’s filing date, court notice, or bank-response deadline;
Signing a broad release before cleared funds or agreed property are actually received;
Filing in the wrong territorial venue;
Waiting for a demand to expire before alerting banks and investigators.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A large amount or essential family or business funds are involved;
Funds are still traceable or a bank hold may expire;
The suspect is moving assets, leaving the country, threatening witnesses, or destroying records;
The transaction involves real property, securities, cryptocurrency, corporate accounts, public funds, several victims, or overseas actors;
You signed a waiver, settlement, investment agreement, acknowledgment, or affidavit;
Police or prosecutors declined the complaint and a review period may be running;
You received a subpoena, counter-complaint, demand, or court summons;
The claim may be close to prescription;
The victim is a child, senior citizen, person with disability, or person under coercion;
Your identity, SIM, email, or financial accounts remain compromised.

People who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its legal requirements and conflict rules. Victims may also ask the prosecutor’s office or local IBP chapter about available legal-assistance services.

Frequently asked questions

Can I file estafa if I voluntarily transferred the money?

Possibly. Voluntary transfer does not defeat estafa when deceit caused the transfer. You must still prove the applicable form of fraud and each required element.

Is the owner of the recipient account automatically criminally liable?

No. The account is an important lead, but criminal liability is personal. Evidence must establish the owner’s participation, knowledge, intent, or other basis for liability. Money-mule activity may be separately punishable under Republic Act No. 12010 when its statutory elements are present.

Can the bank reverse the transfer?

Sometimes, particularly if the report is immediate and the funds remain available, but reversal is not guaranteed. Ask for recall, coordinated verification, and any temporary hold permitted by law and BSP rules.

Do I need the scammer’s complete address before reporting?

Do not postpone an urgent bank or law-enforcement report solely because the identity is incomplete. Provide every available identifier. A prosecutor’s complaint must sufficiently identify and locate the respondent for service or explain the available identifying facts; investigators may need lawful process to obtain subscriber or account information.

Is a demand letter required?

It depends on the form of estafa and the surrounding facts. Demand can help prove conversion, refusal to account, notice, or default, but it does not create fraud where the elements are absent. Do not delay an urgent financial or cybercrime report while preparing one.

Can I file both criminal and civil cases?

Potentially, but Rule 111 governs whether civil liability arising from the offense is included, reserved, waived, or pursued separately. Independent or contract-based civil claims may follow different rules. Coordinating the remedies avoids procedural problems and double recovery.

What if several victims were deceived by the same person?

Each victim should preserve an individual transaction record and sworn account. Tell investigators about the apparent pattern and provide contact details with the other victims’ consent. Whether transactions constitute separate offenses, a complex crime, syndicated estafa, economic sabotage, or another offense is a legal determination that depends on proof.

Will an affidavit of desistance end the case after repayment?

Not necessarily. Estafa is prosecuted in the name of the People of the Philippines. Repayment and desistance may affect civil liability or the evidence, but they do not automatically require dismissal.

Should I confront or publicly expose the suspected scammer?

Usually not before securing accounts and evidence. Confrontation can prompt flight, asset transfers, evidence deletion, or threats. Public accusations can also create privacy, defamation, and safety risks. Give the evidence to the proper institution and authorities.

Official legal and reporting resources

This article provides general legal information, not legal advice or a prediction of any case outcome. The proper offense, venue, remedy, evidence, and deadline depend on the complete facts and documents. Sources and procedures were checked as of 15 September 2026.