Quick answer

If you paid an online seller or social-media account and suspect a scam, act immediately:

Contact your bank, card issuer, e-wallet, or payment service. Report the transaction as fraudulent or disputed, ask whether the transfer can be stopped or recalled, request that the recipient account be investigated, and obtain a reference number. Do not wait for the seller to reply.
Secure your accounts. If you disclosed a password, OTP, PIN, card details, recovery code, or identity document, change affected credentials, sign out other devices, block or replace compromised cards, and inform the relevant financial institution.
Preserve the evidence before anything disappears. Save the advertisement, seller profile, messages, payment records, account numbers, delivery information, and platform complaint history.
Report the seller to the shopping platform or social-media service. Request a refund, preservation of account and transaction records, and action against the account.
Report the incident to law enforcement or the government anti-scam channel. You may call the Cybercrime Investigation and Coordinating Center’s 1326 hotline, use the CICC reporting page, or approach the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
For a consumer transaction, use the seller’s or platform’s internal redress process and, if unresolved, file with the Department of Trade and Industry.

These reports serve different purposes. A bank or e-wallet report may help preserve funds; a platform report may support a refund or account takedown; a DTI complaint seeks consumer relief; and a PNP or NBI complaint may lead to a criminal investigation. Filing with one does not necessarily replace the others.

First, determine what happened

An online purchase problem is not automatically a criminal scam. The correct response depends on the facts.

It may be a consumer dispute if a real seller delivered the wrong, defective, incomplete, or late item, or refuses to honor a warranty or agreed refund. Consumer remedies may include repair, replacement, refund, or other relief allowed by law.

It may be fraud or estafa if the seller used deceit to obtain payment—for example, by offering nonexistent goods, impersonating a legitimate shop, using stolen photos or identity details, sending fabricated proof, or accepting payment without any genuine intention or ability to deliver. A broken promise or unpaid debt, by itself, does not automatically prove estafa; investigators and prosecutors must examine whether legally sufficient deceit, reliance, and damage are present.

Other laws may apply where the incident involves account hacking, identity theft, altered electronic records, unauthorized card use, phishing, mule accounts, or social-engineering schemes. The exact offense and responsible parties depend on the evidence.

What to do immediately

1. Call the payment provider first

Contact the official fraud or customer-service channel of the institution you used—such as your bank, credit-card issuer, e-wallet, remittance company, or other payment provider.

Tell it:

the transaction date, time, amount, and reference number;
whether you authorized the payment but were deceived, or never authorized it at all;
the recipient’s name, account number, mobile number, bank, or e-wallet;
when and how you discovered the fraud;
whether you disclosed credentials or installed an app; and
that you want the transaction flagged, the recipient institution notified, and any available hold, recall, chargeback, or dispute process started.

Ask for a case or reference number and written confirmation. If the payment provider requires a dispute form, affidavit, police report, or supporting files, submit them promptly.

The Bangko Sentral ng Pilipinas advises consumers to report suspicious transactions immediately to the bank or e-money issuer. Under the Anti-Financial Account Scamming Act, Republic Act No. 12010, BSP-supervised institutions may temporarily hold funds involved in a qualifying disputed transaction while verification is conducted, subject to BSP rules. A report does not guarantee that funds remain available or will be returned, so speed matters. (bsp.gov.ph)

Do not assume a transaction will qualify for reversal simply because the purchase was fraudulent. The result may depend on the payment method, when the report was made, whether the funds remain in the financial system, the institution’s investigation, and the applicable rules.

2. Protect affected accounts and devices

If the scammer obtained sensitive information:

change the password of the affected account and any account using the same password;
enable multi-factor authentication;
revoke unfamiliar devices, sessions, and linked applications;
block or replace a compromised card;
ask your mobile provider about protecting the SIM if takeover is suspected;
remove remote-access or suspicious applications;
run a security scan and update the device;
monitor accounts for small test charges, new beneficiaries, loans, or password-reset attempts; and
preserve evidence before resetting or wiping the device.

Never give an OTP, PIN, password, CVV, recovery code, or screen-sharing access to someone claiming that these are needed to process a refund. Use only contact details found in the institution’s official app, statement, card, or website.

3. Preserve evidence properly

Keep the original electronic records when possible. Do not rely only on cropped screenshots.

Save:

the full seller or account profile, including username, profile URL, page ID, and visible changes of name;
the original advertisement, listing, livestream, story, or post;
the item description, price, warranty, delivery promise, and refund terms;
complete chat, email, SMS, and call logs showing dates and times;
order confirmations, invoices, receipts, tracking numbers, and delivery records;
payment confirmations, transaction IDs, QR codes, deposit slips, and recipient-account details;
the URL and screenshots of any fake website;
photos and an unedited unboxing video if an item arrived;
the seller’s identification, business name, address, telephone number, and registration information, if provided;
your reports to the platform and payment provider, including ticket numbers and replies; and
a short chronological account of what happened.

Export conversations or download account data if the service permits it. Retain the original device and files, and make a backup. Record URLs in addition to taking screenshots because investigators may need to identify the service provider or request records through lawful process.

Do not edit messages, invent details, threaten the suspected scammer, or publicly post another person’s private information. False or malicious reports can themselves create legal consequences.

Report through the shopping platform or social-media service

Use the platform’s official order-dispute, buyer-protection, impersonation, or fraud-reporting function. State the remedy you want—such as cancellation, refund, replacement, or preservation of records—and attach the strongest evidence.

If the purchase occurred through an e-marketplace, keep the transaction and communications inside the platform where possible. Payments or conversations moved outside the platform may affect buyer-protection coverage, although they do not prevent you from reporting suspected crime.

The Internet Transactions Act of 2023, Republic Act No. 11967, generally requires an aggrieved party to use the internal redress mechanism of the digital platform, e-marketplace, or e-retailer before filing a consumer complaint with a government agency, going to court, or using alternative dispute resolution. The mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing. This exhaustion rule concerns civil or administrative redress; it should not be read as a reason to delay an urgent report to a payment provider or law-enforcement authority. (lawphil.net)

The online merchant or e-retailer is ordinarily the party primarily liable to compensate the consumer. A platform may have subsidiary or solidary liability only in the circumstances specified by the Act—for example, certain failures of diligence, failure to provide required contact details for a foreign merchant, or failure after notice to act expeditiously against prohibited, imminently injurious, unsafe, or dangerous goods. Platform liability is therefore not automatic.

Report the suspected crime

CICC and Hotline 1326

For immediate guidance and referral, call the government’s 24/7 anti-scam hotline, 1326, or use the CICC online reporting page. The hotline accepts reports involving online selling scams and other cyber-enabled fraud. (pia.gov.ph)

You may also use the e-Report function in the official eGovPH platform. Keep the acknowledgment or reference number.

An initial hotline or online report may not complete a criminal complaint. You may still be asked to appear, establish your identity, submit original evidence, and execute a sworn complaint or affidavit.

PNP Anti-Cybercrime Group

You may approach the nearest police station, regional anti-cybercrime unit, or the PNP Anti-Cybercrime Group:

Email: acg@pnp.gov.ph
Telephone: (02) 3414-1560
Mobile: 0998-598-8116

These channels are listed in the BSP’s official scam-reporting directory. Verify contact details on an official government page before sending identity documents or sensitive records. (bsp.gov.ph)

NBI Cybercrime Division

You may file or seek assistance through the NBI online complaint page, the NBI Cybercrime Division, or an appropriate NBI regional office.

The BSP’s official directory lists:

Cybercrime Division email: ccd@nbi.gov.ph
Telephone: (02) 8523-8231 to 38, local 3455
Direct line: (02) 8252-6228

The NBI’s published procedure contemplates a complaint form, supporting documents, sworn statements or prepared affidavits, and examination of a relevant device when necessary. Regional Cybercrime Centers may also receive appropriate cases. (National Bureau of Investigation)

What to bring for a formal complaint

Requirements can vary with the facts and investigating office, but prepare:

a government-issued ID;
a signed chronological narrative;
printed and electronic copies of the evidence;
payment records and certification or statements from the financial institution, if available;
the seller’s identifiers and recipient-account details;
platform, bank, e-wallet, CICC, or other report numbers;
the original device, if investigators request examination; and
witnesses or their contact details, if any.

Ask the receiving officer what additional affidavit, certification, or original record is required. Obtain proof that the complaint was received.

File a consumer complaint with DTI

For a purchase from an online merchant or e-retailer, DTI may handle claims involving deceptive, unfair, or unconscionable sales practices and failures concerning the goods, warranty, refund, or other consumer obligations.

Before filing:

Send a clear written complaint to the seller and platform.
Use their internal redress mechanism.
Keep proof of the filing date and communications.
If unresolved after seven calendar days, prepare the DTI complaint.

Metro Manila complainants may use the DTI Consumer CARe System, email a completed complaint form or complaint letter to consumercare@dti.gov.ph, or file in person with the Fair Trade Enforcement Bureau. Consumers outside Metro Manila should coordinate with the appropriate DTI regional or provincial office. The portal provides online dispute-resolution functions. (consumercare.dti.gov.ph)

Include:

your complete contact details;
the seller’s and platform’s known details;
a concise statement of facts;
the amount paid;
the specific remedy requested;
proof of purchase and payment;
relevant messages, advertisements, and photos; and
proof that the internal complaint was filed and remained unresolved.

The Internet Transactions Act recognizes repair, replacement, refund, and other remedies allowed by the Consumer Act and related laws. For a replacement or refund, the merchant is generally entitled to the return of the original goods without cost to the consumer and within a reasonable period, unless the parties agree otherwise.

A claim for damages under the Internet Transactions Act must be filed with a court or DTI within two years from the time the cause of action arose. Other claims, warranties, offenses, and remedies may have different periods. Do not wait for the two-year limit: platform deadlines, chargeback periods, evidence-retention schedules, and criminal prescriptive periods are separate and may be shorter or fact-dependent. (lawphil.net)

DTI consumer proceedings and criminal investigation are distinct. If the seller appears fictitious, has disappeared, used stolen identities, or is operating a coordinated fraud, report to law enforcement even if you also pursue a refund through DTI.

If a bank or e-wallet does not resolve the complaint

First complete the institution’s own consumer-assistance or fraud process and retain its reference number and final response, if any.

If the institution is supervised by BSP and the complaint remains unresolved, escalate it through BSP Online Buddy (BOB) on the BSP website. BSP instructs consumers to complain to the financial institution first and requires the institution’s report reference number for escalation. (bsp.gov.ph)

An escalation to BSP is a regulatory consumer complaint; it is not a substitute for promptly asking the institution to hold or trace funds, nor does it replace a criminal complaint.

Special reporting situations

The scam arrived by text message

Report the sender or message through the NTC text-spam and scam reporting page. The NTC requires an image of the message showing the mobile number and proof of identity through its stated process. NTC may receive and endorse the report for blocking or other appropriate action, but a separate CICC, PNP, or NBI report may still be needed for criminal investigation. (foi.gov.ph)

Your identity or personal data was misused

Preserve proof of the unauthorized collection, disclosure, or use. Notify the organization holding the account and consider a formal complaint with the National Privacy Commission. NPC complaints have prescribed form and filing requirements. (privacy.gov.ph)

The offer was really an investment, lending, or insurance scheme

An offer presented as “online shopping” may actually involve an investment, advance-fee loan, or insurance product. Use the relevant regulator in addition to law enforcement:

investment or lending concerns: Securities and Exchange Commission;
banks, e-wallets, remittance services, and other BSP-supervised institutions: Bangko Sentral ng Pilipinas;
insurance products: Insurance Commission.

The BSP scam-reporting directory lists the appropriate official channels. (bsp.gov.ph)

What the law generally covers

Depending on the evidence, an online-shopping or social-media scam may involve:

Estafa under Article 315 of the Revised Penal Code, when its required elements are established;
Republic Act No. 10175, including computer-related fraud, computer-related identity theft, or an offense under the Revised Penal Code committed through information and communications technology;
Republic Act No. 12010, where financial accounts, mule accounts, social engineering, or other prohibited financial-account conduct is involved;
Republic Act No. 11967, for rights and obligations arising from internet transactions;
Republic Act No. 7394, for consumer-product, warranty, deceptive-sales, and related protections;
Republic Act No. 8484, where access devices such as credit cards or account credentials are fraudulently used; or
Republic Act No. 10173, where personal information is unlawfully processed or misused.

The Cybercrime Prevention Act does not make every false online promise “computer-related fraud.” That specific offense requires unauthorized input, alteration, or deletion of computer data or interference with a computer system, together with fraudulent intent and the statutory consequences. A conventional estafa allegedly carried out through online communications may instead be charged under the Revised Penal Code in relation to the applicable cybercrime provision. The final legal characterization belongs to investigators, prosecutors, and courts after reviewing the facts. (lawphil.net)

Common mistakes to avoid

Waiting several days for the scammer’s promised refund before notifying the payment provider.
Deleting the conversation after blocking the account.
Keeping only cropped screenshots that omit the username, URL, date, or transaction reference.
Continuing to send “release,” “verification,” “tax,” or “refund processing” fees.
Giving an OTP or allowing remote access to someone posing as bank support.
Reporting only to the social-media platform and assuming that this starts a police investigation.
Reporting only to police and missing a short platform or payment dispute window.
Sending original identity documents to unofficial email addresses or social-media accounts.
Publicly accusing or doxxing a person without verified evidence.
Treating a platform as automatically liable for every fraudulent seller.
Paying a supposed recovery agent who promises guaranteed tracing, arrest, or reimbursement.
Filing an exaggerated or knowingly false report to force an account freeze.

When help is urgent

Seek immediate assistance from the payment provider and law enforcement if:

money has just been transferred and may still be in the recipient account;
an unauthorized transaction is still pending;
the scammer has your OTP, PIN, password, card details, recovery code, SIM information, or remote access;
your email, social-media, bank, or e-wallet account has been taken over;
identity documents are being used to open accounts or solicit money;
the scammer is threatening violence, blackmail, or release of intimate material;
a child, older person, or otherwise vulnerable person is being targeted;
multiple victims or substantial losses are involved; or
the scam is ongoing and another payment or delivery is imminent.

For an immediate threat to life or safety, contact emergency services or the nearest police station. Do not arrange an in-person confrontation or entrapment on your own.

Frequently asked questions

Can I recover money sent by bank transfer or e-wallet?

Possibly, but recovery is not guaranteed. It depends heavily on how quickly the incident is reported, whether the funds remain traceable or available, the institutions’ verification, and the applicable dispute rules. Report to both the sending institution and law enforcement immediately.

Should I report even if the amount is small?

Yes. The report may help identify linked accounts, preserve evidence, protect other victims, or support a broader investigation. Ask the receiving agency what is required for a formal complaint.

Can I report a scammer whose real name or address is unknown?

Yes. Provide every available digital identifier: profile URL, username, mobile number, email address, recipient account, QR code, transaction reference, delivery details, and website domain. Authorities may seek subscriber or account information only through lawful processes.

Is a police blotter enough?

Usually not for a full cybercrime investigation. A blotter records the incident, but the investigating unit may require a formal complaint, sworn affidavit, identification, and supporting evidence. Ask for the next procedural step and retain proof of the report.

Must I wait seven days before reporting the crime?

No. The seven-calendar-day rule under the Internet Transactions Act concerns exhaustion of the platform’s internal redress mechanism before specified civil, administrative, or alternative-dispute action. It should not delay an urgent bank, e-wallet, CICC, PNP, or NBI report.

Can DTI order a refund?

DTI may address consumer complaints and available consumer remedies within its authority. Whether a refund is proper depends on the transaction, the evidence, the applicable law, and the proceeding. A DTI complaint is not the same as a criminal prosecution.

What if I willingly sent the payment?

Report it anyway. A transfer can be authorized by the account holder yet induced by deception. Describe the facts accurately; do not label the payment “unauthorized” if you personally approved it.

Should I continue talking to the scammer?

Preserve the conversation, but do not send more money or disclose more information. Avoid threats, impersonation, hacking, or arranging a private confrontation. Follow investigators’ instructions if they ask you to maintain contact.

Official resources

This article provides general legal information, not legal advice or a prediction of any case outcome. Procedures and legal remedies may depend on the transaction, documents, payment method, location, and agencies involved. Official sources and reporting channels were checked on September 22, 2026.