Here’s a comprehensive, practice-oriented legal article for the Philippine setting—useful to victims, in-house counsel, banks/fintechs, and investigators.

Money Recovery After Fraud (Philippines)

Criminal, civil, regulatory, and operational routes to getting your funds back—plus preservation tactics, timelines, and templates.

1) What “fraud” covers in PH law

“Fraud” is not a single statute; it’s a cluster of crimes and civil wrongs that trigger different recovery tools:

Estafa/swindling (Revised Penal Code, Art. 315 et seq.)—by deceit, abuse of confidence, fraudulent transfers, false pretenses, online misrepresentations.
Qualified theft (Art. 310)—employee/insider takes employer funds.
B.P. 22—bounced checks (often alongside estafa).
Cybercrime-related offenses (R.A. 10175)—computer-related fraud, identity theft, illegal access; with data preservation and cyber warrants rules (A.M. No. 17-11-03-SC).
Access Devices (R.A. 8484)—card/OTP/online banking fraud; restitution, blocking, and liability rules.
Anti-Money Laundering (R.A. 9160, as amended)—freezing/forfeiture of proceeds of unlawful activities.
Financial Consumer Protection Act (R.A. 11765)—banks/e-money issuers must have redress, dispute resolution, and fair dealing; can be leveraged in unauthorized-transaction cases.
E-Commerce Act (R.A. 8792) & Rules on Electronic Evidence—admissibility of screenshots, logs, metadata.

Why this matters: Your recovery plan usually mixes criminal (to pressure and freeze), civil (to collect, attach, garnish), and regulatory (to block and reverse through institutions).

2) The 72-hour playbook (time is your best friend)

Freeze the bleeding
- Bank/e-wallet/fintech: file an urgent dispute; ask for transaction recall/hold and flag downstream recipient accounts (include amount, date/time, RRNs/trace IDs, device/IP).
- Card fraud: block the card, initiate chargeback with issuing bank; preserve merchant descriptor and receipts.
- Crypto/VASP: notify the exchange (ticket + letter from counsel), request freezing of destination wallets if in-exchange; ask for KYC/holder preservation via lawful request.
Preserve evidence
- Take full screen recordings of chats, sites, and transactions; export PDFs of statements; secure device logs.
- Keep SIM/phone intact (forensically); don’t factory-reset.
Open criminal and administrative lanes
- File a blotter and sworn complaint with PNP-ACG or NBI-CCD; request data preservation orders to platforms under the Cybercrime Law.
- Notify AMLC via your bank’s STR (suspicious transaction report) channel—this primes freeze options.
Send a legal hold/demand
- Demand letter to the fraudster (if known) and notice to payors/intermediaries (marketplace, bank, e-wallet, courier) to hold disbursements and preserve logs.

3) Three tracks to recovery (you can run them in parallel)

A) Criminal track (pressure + access to state tools)

Estafa/qualified theft/cybercrime complaints → Prosecutor → Information in court → potential warrant and arraignment.
Restitution: Courts may award civil liability in the criminal case. Even pending trial, voluntary restitution often occurs once assets are frozen and the accused seeks bail/relief.
Cyber warrants (search, seizure, disclosure, interception) can unmask beneficiaries and money mules; they support civil tracing.

Pros: Leverages state coercive powers; can trigger AMLC freeze. Cons: Timelines vary; conviction isn’t required to pursue civil recovery.

B) Civil track (sum of money, rescission, unjust enrichment, conversion)

Causes of action: breach of contract, rescission for fraud, unjust enrichment, quasi-delict, conversion.
Provisional remedies:
- Preliminary attachment (Rule 57) against a fraudster’s assets (bank accounts, vehicles, realty).
- Preliminary injunction to stop dissipation; replevin for specific chattels.
- Garnishment post-judgment.
Small Claims: for lower-value cases (no lawyers required), fast track.
Settlement leverage: early attachment is often the single most effective civil move.

Pros: Direct path to a money judgment; strong when identity is known and assets are in PH. Cons: You must serve the defendant and post bonds for provisional remedies.

C) Regulatory/Institutional track (operational reversals)

Banks/e-wallets: internal error/dispute processes; recall on interbank rails; beneficiary contact for consented return; risk holds on mule accounts.
Card networks: chargebacks under scheme rules (tight document and time deadlines).
AMLC: ex parte freeze and later forfeiture of identified proceeds of crime (coordinates across banks/e-wallets).
BSP consumer protection: escalations under R.A. 11765 when an institution fails to act fairly on unauthorized transfers.

Pros: Fastest when money is still “in the pipes.” Cons: Window to reverse is short; once funds are cashed-out, you’ll need civil/criminal recovery.

4) Tracing and freezing money

Follow the hop-chain: origin account → intermediary bank/e-wallet → mule accounts → cash-out (ATM/OTC) or crypto. Ask your bank for the next stop reference; law enforcement can compel further disclosure.
AMLC pathway**:** your bank files STR, AMLC may issue freeze (time-bound) upon finding probable cause that funds are proceeds of unlawful activity; later, forfeiture in court.
Court attachment: identify attachable assets (real property, vehicles, company shares) in the fraudster’s name; move early ex parte if allowed.
Employers: for insider fraud, hold-out on payroll/benefits pending investigation; consider set-off where lawful and documented.

5) Evidence: what you must build (admissibility ready)

Banking artifacts: transaction confirmations, RRN/trace numbers, PRN/ARN, account names/numbers, dispute tickets.
Device/comm logs: full message threads, headers, call logs, IPs, device IDs, email authentication (DKIM/SPF), delivery receipts.
Platform records: marketplace order pages, merchant profiles, payout schedules, KYC verifications (request via subpoena/LE coordination).
Provenance: sworn Affidavit of Loss/Fraud, chain of custody for devices; if imaging, note hash values.
Damages: receipts, valuations, opportunity loss (where compensable), remediation costs.

Tip: Use the Rules on Electronic Evidence formatting—printouts with hash/metadata references and certifying affidavits from custodians/IT.

6) Special fact patterns & solutions

1) Unauthorized online transfer from your bank/e-wallet

Dispute immediately; assert no-fault position absent negligence (e.g., no OTP sharing).
Demand logs: login IP, device fingerprint, geolocation, OTP delivery records.
Push for credit back or ex-gratia pending investigation; escalate under R.A. 11765 if handling seems unfair.

2) Card-not-present fraud

Issue chargeback via issuing bank; supply police report, non-receipt/non-authorization statements; ask merchant/acquirer to show 3-D Secure or equivalent proof of cardholder authentication.

3) Investment/forex/romance scams

Move funds-in-transit recall and AMLC freeze; file estafa with cybercrime involvement.
Ask platforms (social apps, exchanges) for data preservation; seek cyber warrants via investigators.

4) Payroll/insider siphoning

Forensic accounting, access logs, and segregation of duties audit.
File qualified theft/estafa; civil attachment over insider assets; notify insurer (employee dishonesty coverage, if any).

5) Crypto off-ramp to PH exchange

If funds landed at a BSP-regulated VASP, request freeze of the customer account/wallet at the exchange; seek KYC disclosure via law enforcement; consider civil attachment of fiat balances.

7) Timelines & prescription (quick guide)

Estafa/qualified theft: criminal actions generally prescribe from discovery within periods set by the RPC (longer for higher amounts).
Quasi-delict (tort): 4 years from injury.
Written contract claims: 10 years.
Small Claims: speedy; check current jurisdictional limit.
Chargebacks/bank disputes: strict internal deadlines (often days to weeks).
AMLC freeze: urgent; freeze orders are time-bound—coordinate promptly for extension/forfeiture.

Practical rule: Treat 24–72 hours as the golden window for operational reversals; treat 30 days as the typical horizon to perfect bank/card disputes; treat months for full criminal/civil trajectories.

8) Defenses you’ll face (and counters)

“You shared your OTP/was negligent.” Counter with phishing evidence, device geolocation mismatch, impossible travel, and institution’s weak controls (no behavioral flags). Invoke R.A. 11765 fairness standards.
“Funds already withdrawn/irretrievable.” Use AMLC tracing, file civil attachment on other assets, pursue co-conspirators/mules (they’re not shielded).
“It’s a civil dispute, not fraud.” For deceit at inception or false pretenses, estafa lies; show intent to defraud (pattern, fake docs, shell entities).
Jurisdiction/identity uncertainty (online actor). Push cyber warrants for subscriber/IP data; serve John Doe and amend when identity emerges.

9) Employer & insurer angles

Employers: preserve CCTV, access logs, emails; suspend access; coordinate with data protection officer on lawful processing. Consider counter-bond if employee requests release of seized items.
Insurance: check if you hold cyber, crime, social engineering, or fidelity coverage; observe notice and cooperation clauses; allow insurer subrogation to chase the fraudster.

10) Compliance & privacy guardrails

Process personal data for fraud prevention, legal claims, and law enforcement cooperation under the Data Privacy Act; limit sharing to necessary recipients; log disclosures.
Use SPAs for third-party verifiers; redact when filing public pleadings (unless court orders otherwise).

11) Practical checklists

Victim (individual or SME)

File urgent dispute with bank/e-wallet; ask recall/hold
Notify PNP-ACG/NBI; request data preservation
Send demand & preservation letters to platforms/intermediaries
Compile evidence pack (logs, screenshots, statements)
Consider civil attachment if suspect assets are known
Escalate under R.A. 11765 if financial institution response is unfair

Counsel

Sworn complaint for estafa/cybercrime; line up cyber warrants
Draft Rule 57 attachment; identify attachable property fast
Coordinate with AMLC (through reporting institutions) for freeze
Prepare electronic evidence per rules; secure custodian affidavits
Parallel chargeback or institutional reversal strategy

Banks/Fintechs (for internal teams)

Trigger fraud kill-switch; flag counterparties; file STR
Preserve full telemetry; respond within consumer-protection SLAs
Cooperate with LE (formats: CDRs, KYC, transaction logs)
Offer provisional credit where policy allows; document rationale

12) Short templates (adapt as needed)

A) Demand & Preservation to Intermediary

We are victims of fraud involving Transaction Ref. [IDs] dated [Date/Time], amount ₱[ ]. Under applicable consumer protection and cybercrime laws, kindly (1) hold any undisbursed funds, (2) preserve all logs (KYC, IPs, device IDs, timestamps, chat/transaction records), and (3) confirm your internal reference. Law enforcement requests will follow.

B) Affidavit of Fraud

I, [Name], state: on [Date] I observed [Unauthorized Transaction] totaling ₱[ ]. I did not authorize nor share OTP/credentials knowingly. Attached are [Exhibits A–F]. I request investigation, reversal/credit, and cooperation with law enforcement.

13) Bottom line

Act immediately: within hours if possible—freeze, recall, preserve.
Run criminal, civil, and institutional tracks together; each unlocks tools the others don’t (warrants, attachment, chargebacks, AMLC freeze).
Build an admissible evidence file from day one; it powers reversals, settlements, and judgments.
If the money is gone, shift to assets: attach/garnish the fraudster’s other property and pursue co-conspirators and mules.
Use R.A. 11765 to keep financial institutions honest; use AMLC to neutralize the laundering layer.

This is general information, not legal advice. For an active case, coordinate with counsel to tailor charges, provisional remedies, and institutional escalations to your exact facts and transaction trail.