Online Job Scam via Telegram: How to File Estafa and Recover Your Money (Philippines)

This guide is written for victims and potential victims of “online job” schemes that recruit via Telegram (or similar apps). It explains the criminal and civil/administrative routes to pursue estafa and how to improve your chances of recovering funds. Philippine law and practice vary case-to-case; this is practical information, not legal advice.

A. What these scams look like (and why they qualify as estafa)

Common scripts

“Part-time tasks” (liking/following, “boosting” ratings, order-rebate cycles): you’re told to advance small amounts to “unlock” bigger commissions, then pressured to send more until losses pile up.
“Remote admin/assistant” roles that require a deposit, “training fee,” or buying “inventory” up front.
“Guaranteed returns” if you “top up” a trading/betting bot run via Telegram, with dashboards that fake profits.

Why this is criminal

The scheme uses deceit/false pretenses to make you part with money and you suffer damage. That’s estafa under Article 315 of the Revised Penal Code (RPC).
When deceit is carried out through computers/ICT, prosecutors usually add a charge under the Cybercrime Prevention Act (RA 10175), which qualifies the offense (higher penalties).
Depending on the facts, other laws may be engaged: Access Devices Law (RA 8484) for card/wallet misuse, E-Commerce Act (RA 8792) and the Rules on Electronic Evidence for proving chats/screenshots, Data Privacy Act (RA 10173) for doxxing/ID theft, SIM Registration Act (RA 11934) for subscriber traceability.

B. Do this immediately (first 24–72 hours)

Stop sending money and cut contact. Do not delete anything.
Preserve evidence (see Section C):
- Take full-screen screenshots of Telegram chats (with username/handle, timestamps), payment receipts, wallet/bank transaction IDs, and profile links.
- On Telegram Desktop: Settings → Advanced → Export chat history (include media and JSON/HTML if available).
Report to your bank/e-wallet right away:
- File a fraud/dispute ticket and request transaction recall/freeze on the recipient account. This can work if funds are still in the system.
- Ask for a case/reference number in writing.
Preserve your device: don’t factory-reset; keep the phone/PC untouched to protect metadata.
File a police blotter (nearest station) or go straight to:
- PNP Anti-Cybercrime Group (ACG), or
- NBI Cybercrime Division Bring IDs and evidence (see checklist below). A blotter helps banks/e-wallets action your recall/freeze.
If your provider stalls or denies relief, prepare to escalate under the Financial Products and Services Consumer Protection Act (RA 11765)—details in Section F.

C. Evidence checklist (what investigators and courts look for)

Identity & context

Your valid IDs and contact details.
The Telegram handle, profile link, group/channel links, referral trail.
Any phone numbers, emails, or payment names they used.

Transaction proof

Bank/e-wallet receipts, transaction IDs, amounts, and timestamps.
Account name/number of the recipient(s); if a “handler/money mule” was used, capture that.

Deceit trail

Screenshots/exports of promises, instructions, “top-up” demands, fake dashboards, and threats.
Any voice notes or calls (note date/time).

Preservation tips (electronic evidence)

Capture full UI (status bar/date) and file properties; avoid cropping.
Keep original files; if you must send copies, label them “For Reference,” and preserve originals on read-only media.
Maintain a simple chain-of-custody log: when/where each file/screenshot was captured and by whom.

D. Filing criminal estafa (with cybercrime qualification)

1) Where to file

City/Provincial Prosecutor’s Office where any element occurred (your location when deceived or where money was received/withdrawn) or route through PNP-ACG/NBI who will endorse to the proper prosecutor.
If you know the money mule is local, file where they reside or where their bank/wallet is based.

2) What to file

Complaint-Affidavit (notarized) stating:
- Parties (accused may be “John/Jane Doe a.k.a. @Handle, true name unknown”).
- Facts in timeline form (who said what; when you paid; how the deception worked).
- Legal basis: Estafa (Art. 315, RPC) and Use of ICT (RA 10175); add RA 8484 if cards/access devices were involved.
- Damages (total loss + consequential damages).
Annexes: All evidence in Section C, indexed and labeled.
Verification and Certificate of Non-Forum Shopping (if also filing civil claims).

3) Process overview

Filing → Subpoena to the respondent (if identifiable).
Counter-affidavit → Reply/Rejoinder (paper exchange).
Resolution (probable cause?) → Information filed in court if yes.
Arraignment & trial; you may reserve or waive civil liability here if you’re pursuing a separate civil action.

Notes

Estafa elements you must show: (a) deceit or abuse of confidence, (b) you relied and delivered money/property, (c) you suffered damage.
Penalties scale with the amount defrauded and are higher when committed through ICT (RA 10175). Courts also award civil liability (restitution, damages).
If the money mule knowingly facilitated the scam, prosecutors often include them as conspirators.

E. Civil options to get your money back (can run with or separate from the criminal case)

Option 1: Independent civil action for fraud (fast track on paper)

Under the Civil Code, fraud allows an independent civil action for damages separate from the criminal case (no need to wait for conviction).
Reliefs: restitution, actual damages, plus moral/exemplary when warranted.

Option 2: Small Claims (no lawyers; quick hearing)

Good for straightforward recovery against an identified money mule or local handler.
Jurisdictional amount: up to ₱1,000,000 (current ceiling under the latest Small Claims Rules).
File a Verified Statement of Claim with annexes; hearing is summary and lawyers cannot appear for parties (you represent yourself).
If you win, enforce via garnishment/levy (the sheriff can garnish bank/e-wallet balances).

Option 3: Demand letter + settlement

Send a formal demand (courier and email/Telegram if possible).
Set a clear deadline (e.g., 5–10 days), attach evidence, and state you’ll file estafa and civil action if unpaid.
This letter supports good-faith attempts at amicable resolution and can trigger voluntary returns.

Option 4: Preliminary attachment (to secure assets early)

If you sue civilly and can show the debt was incurred through fraud, you may apply for a WRIT OF PRELIMINARY ATTACHMENT (post a bond).
The sheriff can attach property or funds before judgment, preventing dissipation. This is technical—get counsel.

Barangay conciliation? Usually not required for criminal estafa and often not feasible when parties are in different cities or identities are unknown. For small claims against a known local mule, your court may still require certification to file action unless an exception applies.

F. Money-movement remedies with banks/e-wallets (administrative)

Transaction recall/freeze.
- For InstaPay/PESONet and e-wallet transfers, providers have internal recall and freeze processes, especially when there’s a timely fraud report and funds remain.
- Provide a blotter or case receipt, and all transaction IDs.
Escalate if unresolved.
- Use the provider’s formal complaint desk and ask for a final response (“FR”).
- If unsatisfied, escalate to the regulator under RA 11765 (Financial Consumer Protection):
  - BSP (banks, e-money issuers, payment system operators)
  - SEC (lending/investment entities)
  - IC (insurance)
- Keep a timeline of contacts and reference numbers.
AMLC & KYC trails.
- Banks/e-wallets keep KYC and transaction records (generally 5 years). Law enforcement can request these via proper process; they help identify mule accounts.

G. Telegram-specific moves

Export the chat (Desktop app) and report the account/channel.
Copy the t.me/username or user ID from profile.
Avoid joining new “replacement” groups; those are common re-funnel traps.
Do not send “verification selfies,” OTPs, or grant remote access to your phone/PC.

H. Practical timelines & expectations

Freezes/recalls work best fast—hours or a few days. Beyond that, funds are often layered (moved through multiple accounts).
Criminal cases deter and can surface identities, but recovery often comes from local mules (civil route) or voluntary returns after demand.
Cross-border masterminds are hard to haul into PH courts; focus on traceable recipients in the Philippines.

I. Step-by-step templates

1) Complaint-Affidavit (outline)

Title/parties: “People of the Philippines vs. John/Jane Doe a.k.a. @”
Your details (name, address, ID).
Material facts in dated bullet points (deceit → payments → loss).
Offenses charged: Estafa (Art. 315, RPC) in relation to RA 10175; other applicable laws.
Damages: total amount + consequential.
Prayer: file Information; issue subpoenas/warrants; order restitution.
Verification & jurat; Annexes A-Z (screens, receipts, export files).

2) Demand Letter (to mule/account holder)

Subject: Demand for Immediate Restitution – Estafa via Telegram Dear , On , ₱ was transferred to your account
as part of a scheme facilitated by you and/or your associates on Telegram (<handles data-preserve-html-node="true"/links>). This constitutes estafa under Art. 315, RPC, qualified by RA 10175. Demand is made for full restitution of ₱ within five (5) days from receipt, to . Failing which, we will file criminal and civil actions (including attachment) and report to regulators. Attached are proofs of transfer. Sincerely, <Your data-preserve-html-node="true" Name/ID>

3) Small Claims (supporting set)

Verified Statement of Claim (forms available at MTC/MeTC/MTCC clerks of court).
Annexes: proof of payment, chats, demand letter + proof of service, your ID.
Relief: ₱ + lawful interest + costs.

J. Red flags & self-defense

Any “job” that requires you to pay first.
Rush pressure, “limited spots,” guaranteed returns.
Payments only via wallet transfers with personal accounts as recipients.
“Don’t tell bank it’s investment/job—say family support.” (Classic laundering prompt.)
Fix: Use escrowed or salary-based arrangements, and verify employers outside the app.

K. FAQs

1) Can I file both criminal and civil cases? Yes. You may file an independent civil action for fraud while the criminal case runs. Coordinate to avoid double recovery.

2) Will the SIM Registration Law reveal them? It helps, but scammers often use straw registrants (“mules”). Law enforcement can request subscriber info with proper process.

3) Can I sue if I don’t know their real name? Yes—use John/Jane Doe with a specific description (handles, accounts). Identity can be developed through subpoenas to banks/wallets/telcos.

4) Are recalls guaranteed? No. Push transfers (InstaPay/PESONet/e-wallet) are generally final once claimed. Early reports and freezes improve odds.

5) Do I need a lawyer? Helpful—especially for attachment and coordinated civil/criminal strategy. Small claims are designed for self-representation.

L. Bring-to-action list (print this)

Valid IDs; police blotter (once filed).
Telegram exports/screenshots with timestamps.
All receipts/transaction IDs; recipient account names/numbers.
Chronology of events (dates, amounts).
Provider complaint/FR reference numbers.
Demand letter + proof of service (if suing civilly).
USB/drive with original files (read-only).

Final notes

Act fast, document everything, and target local recipients for recovery.
If you’d like, tell me your facts & amounts and I’ll draft a tailored Complaint-Affidavit or Small Claims packet you can take to the prosecutor or court.