Quick answer

If money was released through a genuine marketplace escrow because of fraud—or paid to a fake “escrow” account—you may still pursue recovery in the Philippines. Act immediately: report the transaction to the marketplace and the bank or e-wallet, ask the financial institution to trace and temporarily hold the disputed funds, preserve all digital evidence, and file a complaint with the PNP or NBI cybercrime unit.

Possible remedies include:

reversal, refund, or buyer protection under the platform’s rules;
temporary holding and coordinated tracing of funds under the Anti-Financial Account Scamming Act;
a criminal complaint for estafa, computer-related fraud, identity theft, money-muling activity, or another applicable offense;
a DTI consumer complaint when the transaction is covered by the Internet Transactions Act; and
a civil or small-claims case to recover money and provable damages.

Recovery is not automatic. The result depends on whether funds remain traceable, whether the supposed escrow was genuine, what the parties represented, whether the platform received notice, and what the records prove.

First determine what kind of “escrow fraud” occurred

The word escrow is used loosely online. Identifying the actual arrangement determines whom you should pursue.

Fake escrow service

The buyer or seller is directed to a website, account, QR code, or payment link presented as an independent escrow service. The service is fictitious, controlled by the scammer, or impersonates a legitimate company. Money is transferred directly to the fraudster or a mule account.

In this situation, the legitimate marketplace may argue that the payment occurred outside its system. Your strongest immediate avenues are usually the sending and receiving financial institutions and a criminal investigation.

Fraud within a real marketplace

Payment enters the platform’s genuine escrow or wallet, but the scammer causes its release by using false delivery proof, an empty parcel, counterfeit goods, a substituted item, a compromised account, or deceptive instructions to mark the order as received.

Here, the seller or merchant remains the primary target. Depending on the facts, the platform may also have contractual or statutory responsibility.

Impersonation of marketplace staff

A scammer claims to be customer support and asks for an OTP, password, card details, remote-access installation, or payment of a “release,” “verification,” “insurance,” or “tax” fee. This may involve social engineering and unauthorized control of a financial account.

Collusion involving a seller, buyer, courier, or account holder

False delivery events, fabricated returns, mule accounts, or coordinated withdrawals may involve several participants. Do not publicly accuse a person based only on an account name; an account may be stolen, rented, or used by another person. Give the identifiers to the platform, financial institution, and investigators.

What to do immediately

Speed matters because fraud proceeds can be transferred through several accounts or withdrawn within minutes.

1. Contact the bank, card issuer, or e-wallet now

Use the institution’s official fraud or consumer-assistance channel—not a number or link sent by the supposed seller or escrow agent. State clearly that:

the transaction is disputed and connected to suspected fraud;
you want the funds traced and, if still available, temporarily held;
you request coordination with the receiving and any subsequent financial institutions;
compromised access, cards, tokens, or devices should be blocked; and
you need a complaint or case reference number.

Provide the transaction reference, date and time, amount, source and recipient details, payment channel, and a short explanation of the deception. If the payment was by credit or debit card, ask whether a chargeback or card-network dispute is available and observe the issuer’s documentary deadlines. A chargeback is governed by the applicable card and issuer rules and is not guaranteed.

Under Republic Act No. 12010, institutions supervised by the Bangko Sentral ng Pilipinas may temporarily hold funds involved in a disputed transaction and conduct coordinated verification. BSP rules provide for an initial hold of not more than five calendar days and allow the overall temporary holding period to reach—but not exceed—30 calendar days unless extended by a competent court. A hold preserves available funds; it does not itself decide ownership or guarantee reimbursement. See the BSP’s AFASA law and implementing issuances.

2. Secure affected accounts

If credentials may have been exposed:

change passwords using a clean device;
sign out other sessions;
replace compromised cards or payment credentials;
remove unfamiliar linked devices and recovery details;
preserve security alerts before deleting anything;
tell your mobile provider if your SIM stopped working unexpectedly; and
check for other unauthorized transactions.

Never give an OTP, PIN, password, recovery code, or remote control of your device to someone claiming that it is required for a refund.

3. Open a formal marketplace dispute

Use the platform’s in-app or official website process. Identify the specific remedy requested—such as stopping escrow release, refunding the payment, preserving account and transaction data, reviewing delivery evidence, or disabling a fraudulent listing.

Do not rely only on a chat with the seller. Save the ticket number, timestamps, automated replies, and final decision. Under the Internet Transactions Act, an aggrieved party generally must first use the platform’s internal redress mechanism before filing a complaint with a court or government agency. That mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing. The full statute is available in Republic Act No. 11967.

Because financial tracing is time-sensitive, this seven-day rule should not be treated as a reason to delay reporting suspected crime or disputed funds to a bank, e-wallet, PNP, or NBI.

4. Report the suspected crime

Report promptly to the PNP Anti-Cybercrime Group, an appropriate police cybercrime unit, or the NBI Cybercrime Division. A formal investigation may be needed to identify the account user and obtain subscriber, traffic, platform, or financial information through lawful process.

The Cybercrime Prevention Act designates the PNP and NBI as cybercrime law-enforcement authorities. Computer data may be preserved, while disclosure of protected subscriber or computer data generally requires the procedures prescribed by law and the Supreme Court’s cybercrime-warrant rules. See Republic Act No. 10175 and the Rule on Cybercrime Warrants.

Bring or attach:

a chronological incident narrative;
valid identification;
proof of payment;
marketplace and financial-institution case numbers;
the listing, profile, URLs, usernames, phone numbers, email addresses, and account details;
conversations and notices;
delivery, tracking, unboxing, or return evidence; and
the device containing the original records if investigators request it.

A police report documents the incident, but prosecution ordinarily requires a properly supported criminal complaint and evaluation by the prosecutor.

Possible criminal cases

The correct charge is determined by prosecutors from the evidence. One incident may fit more than one law, but overlapping statutes do not justify assuming that every online scam is automatically every cybercrime.

Estafa by deceit

Article 315(2)(a) of the Revised Penal Code may apply when a person uses a false pretense or fraudulent representation before or at the time of the transaction; the victim relies on it; the reliance causes the victim to part with money or property; and damage results.

The Supreme Court has repeatedly treated prior or simultaneous deceit, reliance, and resulting damage as essential elements. A broken promise, delayed delivery, or ordinary contractual breach is not automatically estafa. Evidence that the seller never possessed the item, used a fictitious escrow, fabricated documents, or made material lies to obtain payment may support fraudulent intent, but the entire transaction must be assessed. See the Supreme Court’s discussion in Dulay v. People.

When an offense under the Revised Penal Code is committed through information and communications technology, Section 6 of Republic Act No. 10175 may apply. Charging and penalty issues should be left to the prosecutor and court because they depend on the proved conduct, the amount involved, and controlling jurisprudence.

Computer-related fraud or identity theft

Computer-related fraud under Republic Act No. 10175 concerns unauthorized input, alteration, or deletion of computer data, or interference with a computer system, causing damage with fraudulent intent. It does not necessarily cover every lie communicated online; there must be conduct fitting the statutory computer-related elements.

Computer-related identity theft may apply to the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of another person’s identifying information. This may be relevant when a scammer impersonates a legitimate escrow company, marketplace representative, seller, or account owner.

Financial-account scamming

Republic Act No. 12010, the Anti-Financial Account Scamming Act, penalizes specified money-muling activities and social-engineering schemes.

Money-muling provisions may apply when a person knowingly uses, lends, sells, rents, opens, or recruits the use of a financial account to receive or move proceeds derived from crimes or social-engineering schemes. Merely being the registered account holder does not, by itself, prove every required element; knowledge and purpose must be established where the statute requires them.

The Act’s social-engineering offense addresses deceptive acquisition of sensitive identifying information that results in unauthorized access and control over another person’s financial account. A voluntarily authorized payment induced by a false sales representation may instead require analysis under estafa or other laws unless the distinct AFASA elements are present.

A conviction under AFASA carries civil liability that may include restitution. The Act also provides that prosecution under it does not prevent prosecution under other applicable laws.

Who may be required to pay

The scammer or merchant

Under the Internet Transactions Act, an e-retailer or online merchant is primarily liable to indemnify an online consumer in civil actions or administrative complaints arising from the internet transaction. The merchant may also be liable under the contract, the Civil Code, the Consumer Act, or criminal law.

The marketplace or digital platform

A platform is not automatically liable for every fraudulent seller.

Under Republic Act No. 11967, a marketplace or digital platform that facilitated the transaction may be subsidiarily liable for direct damages when, among other statutory circumstances:

it failed to exercise ordinary diligence in performing its legal obligations, causing the consumer’s loss;
after notice, it failed to act expeditiously on infringing goods or services or a government takedown order; or
a foreign merchant lacked a Philippine legal presence and the platform failed, despite notice, to provide its contact details.

The statute provides a good-faith defense where the platform proves reasonable efforts in relying on merchant representations or registration documents.

The platform may be solidarily liable with the merchant if, after notice, it fails to act expeditiously to remove or disable access to goods or services that are prohibited by law or are imminently injurious, unsafe, or dangerous. This special rule does not automatically make a platform solidarily liable for an ordinary non-delivery or every escrow dispute. The platform is treated as the same entity as the merchant when the evidence establishes that they are the same entity.

A bank, e-wallet, or payment provider

A financial institution is not automatically liable merely because a scammer used an account it maintained. Liability may arise, however, from its own violation of financial-consumer laws or AFASA duties.

Republic Act No. 12010 provides that an institution required to hold disputed funds may be liable for loss or damage arising from failure to do so, including restitution. It also addresses failures to maintain required safeguards and exercise the applicable standard of diligence. Whether this applies requires examination of when the report was received, whether funds were still present, the institution’s role, and its compliance with BSP rules.

If the institution’s internal complaint process does not resolve the matter, escalate it through the BSP’s Consumer Assistance Mechanism. BSP requires the consumer to complain first to the BSP-supervised institution and submit that complaint, its response if any, and supporting documents when escalating.

The registered recipient-account owner

The account owner may be the perpetrator, a knowing mule, an identity-theft victim, or an innocent person whose account was compromised. Civil or criminal liability cannot safely be inferred from the displayed account name alone. Investigators and financial institutions must trace control and use of the account.

Consumer remedies through the DTI

Republic Act No. 11967 applies principally to business-to-business and business-to-consumer internet transactions when one party is situated in the Philippines. It excludes consumer-to-consumer transactions—transactions between end-users for personal, family, or household purposes and outside the ordinary course of business.

This distinction matters. A one-off purchase from a private individual on a classifieds page may fall outside the Internet Transactions Act even though contractual, civil, and criminal remedies remain available. A person regularly selling online may qualify as an online merchant regardless of the label placed on the account.

For a covered transaction:

File through the merchant’s or platform’s internal redress mechanism.
Keep proof of the filing date.
If unresolved after seven calendar days, pursue the appropriate DTI, court, or alternative-dispute-resolution remedy.
File any claim for damages under Section 28 of the Act within two years from the time the cause of action arose.

A consumer may electronically initiate a complaint through the DTI’s Consumer Complaints Assistance and Resolution System. Attach the order record, invoice or receipt, proof of payment, platform dispute, communications, delivery evidence, and the resolution sought.

DTI proceedings may address consumer-law violations and administrative relief. DTI does not replace criminal investigation, and an administrative fine imposed on a business is not automatically paid to the victim as compensation.

Civil recovery and small claims

A victim may seek return of the payment and other damages allowed by contract or law. Actual damages must be proved; screenshots of an estimated loss are not a substitute for receipts, transaction records, or other competent evidence.

The Rules on Expedited Procedures permit qualifying money claims not exceeding ₱1,000,000, exclusive of interest and costs, to be filed as small claims in the proper first-level court. Covered claims include certain money claims arising from contracts of sale and other specified arrangements. Lawyers may advise the parties, but attorneys may not appear for them at the small-claims hearing. Review the SupSupreme Court’s Rules on Expedited Procedures and current court forms before filing.

Small claims may be impractical when:

the defendant’s real identity or address is unknown;
several foreign or corporate defendants are involved;
the legal theory requires complex evidence;
the amount exceeds the threshold; or
relief other than a qualifying money judgment is essential.

Depending on the parties’ residences and the applicable exceptions, barangay conciliation may be a prerequisite before a civil case is filed. Confirm venue and pre-filing requirements with the court or counsel.

A criminal case normally carries the civil action for recovery arising from the offense unless the civil action is waived, reserved, or previously filed under the Rules of Criminal Procedure. Coordinate separate DTI, civil, small-claims, and criminal filings to avoid inconsistent allegations or double recovery.

Evidence to preserve

Keep evidence in its original form wherever possible. Preserve:

the full listing, seller profile, store page, reviews, and URL;
the marketplace order number and escrow status;
all chats, emails, SMS messages, voice messages, and call logs;
payment confirmations, statements, QR codes, account names, account numbers, and transaction references;
the fake escrow website address, certificates, payment instructions, and error pages;
platform rules and buyer-protection terms displayed when the transaction occurred;
notices sent to the seller, platform, bank, and e-wallet;
delivery tracking, parcel labels, weight records, courier messages, and proof of delivery;
continuous unboxing or return videos, where available;
photographs of the parcel and contents;
login alerts, device notices, IP or session information visible in the account;
complaint numbers, names of representatives, dates, and responses; and
proof of consequential expenses or other claimed damages.

Export chats if the platform permits it. Retain the device and original files; do not rely only on cropped screenshots. Screenshots can be useful, but electronic evidence must be authenticated. Record how and when each item was obtained, avoid editing originals, and make secure backups.

Ask the platform and financial institutions in writing to preserve relevant records. Under Republic Act No. 10175, service providers must preserve traffic data and subscriber information for at least six months from the transaction, while content data is preserved for six months from a lawful preservation order, subject to extension and case-related rules. This does not mean a private complainant can compel disclosure directly; protected data generally requires lawful investigative or court process.

Common mistakes that weaken recovery

Waiting for the scammer’s promised refund while funds are being moved.
Reporting only to the marketplace and not to the financial institution.
Marking the transaction “received” because the seller promised a later refund.
Paying an additional “unlock,” “verification,” or “recovery” fee.
Using contact information supplied by the scammer instead of official channels.
Deleting chats, discarding packaging, or editing original files.
Posting the recipient’s personal information publicly instead of giving it to investigators.
Assuming that a DTI complaint alone will identify an anonymous offender.
Treating every failed sale as criminal estafa without proof of prior deceit.
Filing inconsistent factual narratives with the platform, bank, police, and court.
Paying a supposed recovery agent who guarantees a freeze, arrest, or refund.
Missing the platform’s dispute period or the Internet Transactions Act’s two-year damages period.

When legal help is urgent

Consult a Philippine lawyer promptly when:

the loss is substantial or involves several victims;
the platform or institution denies a claim despite timely notice;
funds, accounts, or property may need a court-ordered freeze or preservation measure;
the offender is abroad or used foreign platforms or payment providers;
the real defendant must be identified through subpoenas or cybercrime warrants;
you are considering simultaneous criminal, DTI, and civil proceedings;
you have been named as the recipient-account owner or accused of being a money mule;
the transaction involved a business, high-value goods, regulated products, or forged documents; or
a prosecutor, court, bank, or platform has given you a deadline.

The Public Attorney’s Office may assist qualified indigent persons, subject to its governing rules and evaluation.

Frequently asked questions

Can the bank simply reverse a transfer that I authorized?

Not necessarily. An authorized transfer induced by fraud is different from an unauthorized account takeover. The bank cannot always debit the recipient conclusively based only on the sender’s allegation. It may, however, trace and temporarily hold available disputed funds and conduct coordinated verification under AFASA and BSP rules. Prompt reporting greatly improves the chance that funds remain within the financial system.

Does clicking “order received” end all legal rights?

Not automatically. It may trigger contractual escrow release and make a platform refund harder, but it does not legalize fraud or conclusively waive statutory rights. The reason for clicking, the platform’s disclosures, any deception, and the transaction records remain relevant.

Is the marketplace liable because it verified the seller?

Verification alone does not guarantee liability. The platform’s legal responsibility depends on its statutory duties, diligence, notice, response, role in the transaction, representations, and any applicable good-faith defense.

Can I demand the recipient’s identity from the bank or platform?

You may request preservation and lawful cooperation, but privacy and bank-confidentiality rules generally prevent direct disclosure merely on private demand. Investigators, prosecutors, the BSP in authorized AFASA inquiries, or courts may obtain information through the applicable legal process.

Can I file both a criminal complaint and a claim for a refund?

Yes, potentially. Criminal liability and civil recovery serve different purposes. However, the civil liability arising from the alleged offense may already be included in the criminal action. Obtain advice before filing a separate civil case or signing a waiver, quitclaim, or settlement.

Does the two-year Internet Transactions Act deadline apply to every case?

No. It governs a consumer’s claim for damages under Section 28 of that Act. Different prescriptive periods may govern criminal offenses, contractual claims, other civil causes of action, platform disputes, or financial-institution procedures. Do not wait for the longest possible period.

What if the sale was between two private individuals?

A genuine consumer-to-consumer transaction is excluded from Republic Act No. 11967. You may still have remedies under the Civil Code, the Revised Penal Code, Republic Act No. 10175, AFASA, platform rules, and applicable court procedures.

Can a police report guarantee recovery?

No. A report can begin investigation and support requests for lawful data or financial tracing, but recovery depends on available funds or assets, identification of responsible persons, admissible evidence, and the outcome of the relevant proceedings.

Official legal and complaint resources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and available remedies depend on the transaction documents, platform rules, payment method, parties, and evidence. Official sources were checked as of September 7, 2026.