Discovering that you have sent money to a fake seller, investment scheme, impersonator, phishing site, or compromised account can be overwhelming. The most important steps are to act immediately, preserve evidence, notify the bank or e-wallet, and report the incident to the proper Philippine authorities. Fast reporting may help stop further transfers, identify the receiving accounts, preserve digital records, and improve the chances of recovering funds.

What counts as an online scam in the Philippines?

An online scam generally involves deception carried out through Facebook, Messenger, email, text messages, online marketplaces, dating apps, websites, banking apps, cryptocurrency platforms, or other digital channels.

Common examples include:

A Facebook Marketplace seller receives payment but never intended to deliver the item.
A scammer impersonates a relative, employer, bank employee, government officer, or company representative.
A fake investment platform promises guaranteed or unusually high returns.
A phishing page collects a victim’s username, password, card details, or one-time password.
A scammer takes control of a social media account and asks the owner’s contacts for money.
A fake online lending company demands advance “processing,” “insurance,” or “release” fees.
A romance scammer builds an online relationship before requesting money.
A fraudulent job recruiter collects placement, equipment, training, or registration fees.
A person knowingly allows a bank or e-wallet account to be used to receive and transfer scam proceeds.

Not every failed online transaction is automatically a crime. A delayed delivery, defective product, refund dispute, or unpaid obligation may be a consumer or civil matter when there is no proof that the other party intended to deceive the victim from the beginning.

For estafa by false pretenses under Article 315 of the Revised Penal Code, prosecutors ordinarily look for proof that:

The accused made a false representation or used a fraudulent act.
The deception occurred before or at the same time the victim parted with money or property.
The victim relied on the deception.
The victim suffered financial loss or damage.

The central issue is not merely whether money remains unpaid. It is whether the victim was induced to pay through fraud that already existed when the transaction was made.

Philippine laws that may apply to an online scam

Several laws may apply to the same incident. The final charges depend on what the scammer did, how the money was transferred, what information was stolen, and the available evidence.

Law	When it may apply
Article 315, Revised Penal Code	Estafa involving false representations, fraudulent schemes, fictitious transactions, or other forms of deceit that cause financial damage
Republic Act No. 10175, Cybercrime Prevention Act of 2012	Crimes under the Revised Penal Code or special laws committed through information and communications technology; Section 6 may increase the applicable penalty by one degree
Republic Act No. 12010, Anti-Financial Account Scamming Act of 2024	Money-mule activities, social engineering schemes, and misuse of bank, e-wallet, or other financial accounts
Republic Act No. 8484, as amended by RA 11449	Fraudulent use of access devices, including cards, account credentials, online banking access, skimming, and unauthorized access
Republic Act No. 10173, Data Privacy Act of 2012	Unauthorized collection, processing, disclosure, or misuse of personal information
Republic Act No. 11967, Internet Transactions Act of 2023	Consumer transactions involving online merchants, e-marketplaces, digital platforms, and online sellers
Republic Act No. 8792, Electronic Commerce Act of 2000	Legal recognition and evidentiary use of electronic documents, messages, and transactions
Republic Act No. 11765, Financial Products and Services Consumer Protection Act	Consumer complaints involving banks, e-wallets, payment providers, and other BSP-supervised financial institutions

Under the Cybercrime Prevention Act of 2012, an offense already punishable under the Revised Penal Code or another special law may be treated more seriously when committed through a computer system or other information and communications technology.

The Anti-Financial Account Scamming Act, or AFASA, specifically addresses modern financial scams. It prohibits certain money-mule activities and social engineering schemes, such as obtaining sensitive information through deception to gain unauthorized access to a victim’s financial account. It also requires regulated financial institutions to adopt fraud-management systems and stronger account-security controls.

What to do immediately after an online scam

1. Contact the bank or e-wallet immediately

Call the official fraud hotline or use the in-app help channel of the bank, e-wallet, payment provider, cryptocurrency exchange, or remittance service involved.

State clearly that the transaction resulted from a scam and ask the institution to:

Create a formal fraud or disputed-transaction report.
Record the exact date and time of your report.
Give you a complaint or reference number.
Secure or temporarily restrict your account if it may be compromised.
Trace the transfer to the receiving institution.
Send a holding request to the receiving bank or e-wallet.
Apply the temporary-hold and verification procedures under AFASA, when applicable.
Preserve transaction logs, account-access records, device information, and related data.

Do not simply ask whether the transfer can be “cancelled.” Use direct terms such as fraud report, disputed transaction, temporary hold, fund tracing, and AFASA investigation.

Under the BSP’s AFASA rules, an institution that receives a valid report may initiate an initial temporary hold of up to five calendar days while the transaction is examined and downstream institutions are notified. Coordinated verification generally takes place within a 30-calendar-day temporary holding period, subject to the rules and any court-authorized extension. These procedures do not guarantee recovery because the money may already have been withdrawn, converted, or transferred through several accounts.

AFASA procedures generally cover electronic fund transfers from one financial account to another. They do not ordinarily apply to a simple mistaken transfer, and some credit-card transactions are handled under different dispute and chargeback procedures.

2. Secure all affected accounts

Immediately change the passwords of the affected email, banking, e-wallet, social media, and shopping accounts.

Also:

Sign out of all active sessions.
Enable multi-factor authentication.
Remove unknown devices and recovery addresses.
Contact your mobile provider if your SIM may have been compromised.
Lock or replace affected cards.
Check whether the scammer changed your account-recovery details.
Review recent transactions for smaller test charges or unauthorized transfers.
Warn trusted contacts if your social media or messaging account was taken over.

Never give anyone your one-time password, PIN, card verification value, recovery code, or screen-sharing access. A legitimate investigator or bank representative should not require your OTP to “reverse” a transaction.

3. Preserve evidence before blocking or reporting the account

Save the evidence before the scammer deletes the profile, removes the listing, changes usernames, or clears the conversation.

Preserve:

The complete chat or email thread.
The seller’s or scammer’s profile URL, username, user ID, telephone number, and email address.
The original advertisement, listing, website, or social media post.
Transaction receipts and reference numbers.
Bank or e-wallet account names and numbers.
Cryptocurrency wallet addresses and transaction hashes.
Voice messages, call logs, recordings, and video-call details.
Delivery promises, invoices, identification cards sent by the scammer, and tracking details.
Your requests for a refund and the scammer’s responses.
The bank’s fraud-report reference number.
Reports submitted to the platform and the platform’s acknowledgment.

Take screenshots showing the full screen, date, time, account name, URL, and surrounding conversation. Also export the chat where the application permits it. A screen recording that opens the profile and scrolls through the conversation can help establish where the screenshots came from.

Do not rely exclusively on cropped screenshots. Philippine courts may admit text messages and other electronic communications, but the evidence must still be authenticated—meaning someone must establish that it is genuine and accurately represents the communication. Unauthenticated or heavily edited screenshots may be given little weight or excluded. The Rules on Electronic Evidence and the Electronic Commerce Act recognize electronic records, but they do not remove the need to prove authenticity.

Keep the original device and original files whenever possible. Make backup copies, but do not alter the originals by adding annotations, highlighting, cropping, or changing file names.

4. Report the account to the platform

After preserving the evidence, report the fraudulent account, advertisement, website, page, or listing to the platform.

This may help:

Prevent additional victims.
Preserve internal platform records.
Trigger account restrictions or takedown.
Create a report number that can be attached to your complaint.
Support a later request from law enforcement for subscriber or access information.

A platform report is useful, but it does not replace a report to the bank, police, NBI, CICC, or prosecutor.

5. Stop communicating when continued contact creates more risk

You may send one clear written demand for delivery or refund when the transaction could still be a genuine dispute. However, do not continue sending “verification,” “tax,” “release,” “insurance,” “lawyer,” or “recovery” fees.

Scammers frequently claim that the victim must pay one more amount before funds can be returned. A second scam may also come from a supposed hacker, investigator, foreign recovery agency, or government employee who promises guaranteed recovery for an advance fee.

Where to report an online scam in the Philippines

Different agencies perform different functions. Reporting to more than one office may be appropriate.

Office or channel	What it can do	When to use it
Your bank, e-wallet, or payment provider	May secure the account, trace the transfer, notify the receiving institution, investigate the transaction, and apply AFASA procedures	Report here first whenever money or account access is involved
Cybercrime Investigation and Coordinating Center	Receives and coordinates cybercrime and scam reports	For phishing, account takeovers, online fraud, fraudulent websites, and other cyber-enabled scams
PNP Anti-Cybercrime Group	Conducts criminal investigation, evidence gathering, account identification, and case referral	When you want a criminal investigation or the suspect’s identity is unknown
NBI Cybercrime Division	Investigates computer-related crimes and may assist with sworn statements and digital evidence	For complex, organized, cross-regional, or technically sophisticated scams
Bangko Sentral ng Pilipinas	Provides second-level consumer assistance involving BSP-supervised institutions	After first complaining to the bank, e-wallet, or other regulated financial institution
Department of Trade and Industry	Handles online consumer disputes involving merchants, sellers, products, services, refunds, and delivery	When the issue concerns a genuine merchant or online seller and consumer rights
Securities and Exchange Commission	Receives reports concerning investment solicitation, unregistered investment schemes, lending, financing, and online lending companies	For fake investments, Ponzi-type schemes, unauthorized securities, or lending-company complaints
National Privacy Commission	Handles qualifying complaints involving misuse, unauthorized disclosure, or unlawful processing of personal data	When personal information or identity documents were stolen or misused
National Telecommunications Commission or telecom provider	Receives reports involving scam texts, spoofed messages, SIM-related abuse, and telecommunications concerns	For fraudulent SMS messages, suspicious sender IDs, or telecom abuse

CICC 1326 anti-scam reporting

The Cybercrime Investigation and Coordinating Center operates the 1326 anti-scam hotline. Reports may also be submitted through the CICC online reporting page or through the contact channels published by the Department of Information and Communications Technology.

A CICC report can help with intake, referral, and inter-agency coordination. However, investigators may still require a personal interview, sworn complaint, original evidence, or access to the affected device.

PNP Anti-Cybercrime Group

A complaint may be filed with the PNP Anti-Cybercrime Group or an appropriate cybercrime office. Bring your valid identification, written chronology, transaction records, electronic evidence, and information about the recipient accounts.

When giving your statement, identify:

Where you were when you received and relied on the fraudulent representations.
Where and how the payment was initiated.
Which account received the funds.
What the scammer promised.
Why the promise or representation was false.
What happened after payment.

These details are important because estafa may be prosecuted in a place where an essential part of the offense occurred, but the records must support the claimed venue.

NBI Cybercrime Division

The NBI Cybercrime Division receives requests for investigative assistance involving computer crimes. The NBI’s published procedure contemplates the execution of sworn statements and the submission or examination of relevant devices and records. The service itself is generally listed without a government filing fee, although victims may still incur costs for notarization, printing, certification, transportation, courier services, or legal assistance.

Information is available through the NBI Cybercrime complaint-assistance page and the NBI online complaint portal.

BSP consumer complaint

For complaints against a bank, e-wallet, payment provider, or other BSP-supervised financial institution, first use the institution’s own Financial Consumer Protection Assistance Mechanism.

If the institution does not respond adequately, escalate the complaint through the BSP Consumer Assistance Mechanism.

Include:

Your complaint to the institution.
The institution’s response, if any.
Your account and transaction details.
The fraud-report reference number.
A concise explanation of the remedy you requested.
Supporting documents.

The BSP process is a consumer-assistance and regulatory channel. It is not a replacement for a criminal complaint, and the BSP does not personally prosecute the scammer.

DTI, SEC, and National Privacy Commission

Use DTI Consumer CARe when the respondent is an identifiable online merchant and the dispute concerns delivery, product quality, warranties, refunds, deceptive sales practices, or another consumer issue.

Report suspicious investments, unregistered securities solicitation, lending companies, financing companies, and online lending applications through SEC iMessage.

A formal privacy complaint may be filed through the National Privacy Commission’s complaint procedure when the incident involves identity theft, unlawful disclosure, or misuse of personal information. The NPC’s formal process generally requires the prescribed complaint form, supporting records, and notarization.

How to file a formal criminal complaint

1. Prepare a detailed chronology

Write the events in date-and-time order. Avoid general statements such as “I was scammed.”

Explain:

How you encountered the scammer.
What identity, authority, product, opportunity, or investment the scammer presented.
The exact representations that caused you to trust the scammer.
When and how you sent money or disclosed account information.
The recipient account and transaction reference.
What happened after payment.
Why you concluded that the representation was false.
What steps you took to request delivery, performance, or refund.
The exact amount of your loss.

Separate what you personally observed from what another person told you.

2. Prepare a complaint-affidavit

A complaint-affidavit is a sworn written statement describing the offense and identifying the supporting evidence.

It should contain:

Your full name, address, citizenship, and contact details.
The respondent’s name, if known, and all available identifiers.
A clear factual narrative.
The legal acts you are complaining about.
A list of attachments.
An explanation of how each attachment supports your account.
A statement that the allegations are true based on your personal knowledge or authentic records.

The affidavit may be executed before the proper prosecutor, investigator, notary public, or another officer authorized to administer oaths, depending on where and how it is filed.

3. Submit complete and properly labeled attachments

Label the documents in order, such as:

Annex “A” — advertisement or listing.
Annex “B” — complete chat conversation.
Annex “C” — payment receipt.
Annex “D” — bank statement.
Annex “E” — demand for refund.
Annex “F” — bank fraud-report acknowledgment.
Annex “G” — platform-report acknowledgment.

Whenever possible, attach both printed copies and an organized digital copy.

4. Allow investigators to identify unknown participants

The name shown on a receiving bank or e-wallet account is not necessarily the mastermind. The account may belong to:

A knowing money mule.
A person who sold or rented the account.
An identity-theft victim.
A compromised account holder.
A person recruited to withdraw or forward funds.
A legitimate account holder who is also part of the scheme.

Law enforcement may need lawful requests, subpoenas, warrants, preservation orders, or coordination with banks, telecom providers, platforms, and payment services to identify the participants.

Under RA 10175, law-enforcement authorities may require service providers to preserve specified computer data for the period provided by law. Victims should therefore report promptly so investigators can consider preservation measures before records are deleted under ordinary retention policies.

5. Prosecutor review

After investigation, a complaint may be filed with the appropriate prosecution office. Current National Prosecution Service rules require prosecutors to determine whether the evidence establishes a prima facie case with reasonable certainty of conviction. In practical terms, the evidence should support every essential element of the proposed offense and not merely create suspicion.

The Supreme Court upheld this prosecution standard in Meking v. Remulla, emphasizing the prosecutor’s gatekeeping duty before a person is put through a criminal trial.

This is why a clear affidavit, authentic electronic evidence, bank records, and proof of the original deception are critical.

Documents and evidence checklist

Document or evidence	Why it matters
Government-issued ID	Establishes the complainant’s identity
Detailed written chronology	Helps investigators understand the sequence and identify the elements of the offense
Complaint-affidavit	Serves as the sworn factual basis of the complaint
Complete chat or email export	Shows the actual representations, promises, and responses
Unedited screenshots	Visually records the profile, messages, listing, date, time, and URL
Transaction receipt and reference number	Identifies the transfer and allows financial tracing
Bank or e-wallet statement	Confirms that funds left the victim’s account
Recipient account details	Helps identify the destination institution and account
Original phone, computer, or storage device	May be needed to authenticate or examine digital evidence
Advertisement, order page, invoice, or contract	Shows what was offered and on what terms
Refund demands and responses	May show evasion, contradictory explanations, or refusal
Bank, platform, CICC, PNP, or NBI report number	Establishes that the incident was promptly reported
Witness affidavit	Supports conversations or events personally observed by another person
Translation of foreign-language records	Allows Philippine investigators and prosecutors to evaluate the evidence

Do not surrender the only copy of your evidence without retaining a backup and obtaining an acknowledgment or inventory.

Expected timelines and common bottlenecks

There is no single guaranteed timeline for an online scam case.

Typical stages include:

Bank or e-wallet report: Immediate intake is possible, but tracing depends on how quickly the funds moved and how many institutions are involved.
AFASA temporary hold: An initial hold may last up to five calendar days, with coordinated verification generally conducted within the applicable 30-day period.
Law-enforcement intake: A complete complaint may be received on the day of filing, but investigation may take weeks or months.
Requests for records: Banks, platforms, telecom providers, foreign companies, and cryptocurrency services may have different legal and technical requirements.
Prosecutor proceedings: Preliminary evaluation may take several months, especially when respondents must be located and served or additional evidence is required.
Court proceedings: A contested criminal case can take years.

Frequent causes of delay include:

Late reporting after the money has passed through several accounts.
Incomplete screenshots or missing original messages.
Failure to identify the exact fraudulent representation.
Use of fake, stolen, or foreign identities.
Multiple money-mule accounts.
Incorrect respondent names or addresses.
Cross-border platform or cryptocurrency records.
Victims filing only a brief incident report without a sworn narrative.
Confusion between a consumer complaint and a criminal complaint.
Failure to respond when investigators request additional documents.

Common mistakes to avoid

Waiting for the scammer’s promised refund

A short written demand may be reasonable, but repeated promises should not delay reporting. Financial tracing becomes more difficult as funds are withdrawn or layered through multiple accounts.

Deleting the conversation after blocking the account

Preserve the complete conversation and account details first. Blocking may make the profile or messages harder to access.

Posting accusations and personal information online

Publicly posting names, addresses, identification cards, telephone numbers, or account details may create privacy, defamation, harassment, or mistaken-identity issues. Give the complete information to the investigating authorities and financial institutions instead.

Assuming a barangay blotter is enough

A barangay record may document that you reported an incident, but it does not by itself trigger bank tracing, cybercrime investigation, digital-data preservation, or prosecutor review. Online fraud should ordinarily be reported directly to the relevant financial institution and cybercrime authorities.

Treating every failed sale as estafa

If the seller is a real merchant experiencing a delivery, warranty, or refund dispute, DTI consumer remedies may be more appropriate. Criminal estafa requires evidence of deceit—not merely poor service, delay, breach of contract, or inability to pay.

Filing a false or exaggerated complaint

Report only facts you can honestly support. AFASA penalizes malicious or false reports intended to cause an improper hold on another person’s financial account.

Reporting from abroad or as a foreigner

A foreign national or a Filipino living overseas may report a scam connected to the Philippines. Relevant connections may include a Philippine receiving account, a suspect located in the Philippines, a Philippine telephone number, or deceptive acts directed at the victim from the Philippines.

Authorities may require:

A sworn complaint-affidavit.
A copy of the complainant’s passport or identification.
Proof of the international transfer.
Original electronic records.
An interview by video conference or other approved means.
A representative in the Philippines for certain administrative steps.
Eventual testimony if a criminal case proceeds to trial.

An affidavit executed abroad may be notarized before a Philippine Embassy or Consulate. Another possible route is local notarization followed by an apostille when the document comes from a country participating in the Apostille Convention. Documents from non-participating countries may require authentication or legalization under the receiving office’s rules. Current country and procedure information is available through the DFA Apostille portal.

A special power of attorney may allow a representative to submit or follow up documents, but it does not necessarily eliminate the need for the victim’s own sworn affidavit, interview, original evidence, or testimony.

Frequently Asked Questions

Can a GCash, Maya, or bank transfer be reversed after a scam?

Possibly, but recovery is not automatic. Report the transaction immediately and ask for a formal fraud investigation, fund tracing, and an AFASA temporary hold where applicable. Recovery depends heavily on whether funds remain in a traceable account.

Where should I report a Facebook Marketplace scam?

Preserve the listing and complete conversation, report the account to Facebook, notify your bank or e-wallet, and file a report with CICC, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division. A genuine merchant dispute may also be reported to DTI.

Can I report an online scam if I do not know the scammer’s real name?

Yes. Provide all available identifiers, including usernames, profile URLs, telephone numbers, email addresses, account numbers, wallet addresses, transaction references, and device or platform information. Investigators may seek additional records through lawful processes.

Are screenshots enough to file a complaint?

They may support a complaint, but screenshots alone are not always sufficient. Preserve the original device, full conversation, exported messages, profile URL, transaction records, and surrounding context so the electronic evidence can be authenticated.

Do I need a lawyer to report an online scam?

A lawyer is not ordinarily required to make an initial report to the bank, CICC, PNP, NBI, DTI, SEC, NPC, or BSP. Legal assistance may become useful when preparing a complex complaint-affidavit, dealing with substantial losses, responding to a prosecutor, pursuing civil recovery, or handling a court case.

Is a small online scam worth reporting?

Yes. Small transactions may form part of a larger scheme involving many victims. A report can help connect accounts, telephone numbers, websites, and identities to other complaints. However, the time and cost of pursuing recovery should be considered realistically.

Can the owner of the receiving account be charged as a money mule?

Potentially. Liability depends on proof that the person knowingly used, lent, sold, rented, transferred, or controlled the account for unlawful proceeds or participated in prohibited conduct under AFASA. The mere appearance of a person’s name on an account does not automatically prove that the person organized the scam.

Can I recover money through a criminal case?

A criminal court may address civil liability arising from the offense, but actual recovery depends on locating the offender, proving the loss, identifying assets, and enforcing the judgment. Immediate financial-institution reporting remains important because criminal proceedings may take much longer.

Should I pay a recovery agent who promises to hack the scammer’s account?

No. Claims of guaranteed recovery through hacking, private tracing, foreign agents, or advance “release fees” are common follow-up scams. Do not disclose more credentials or send additional money.

Can I file the complaint while outside the Philippines?

Yes, although the exact process depends on the receiving agency and the evidence. You may need an authenticated or apostilled affidavit, a Philippine representative, remote coordination with investigators, and eventual personal testimony.

Key Takeaways

Report the transaction to the bank or e-wallet immediately and request fraud tracing and applicable AFASA procedures.
Secure affected accounts, change passwords, revoke unknown sessions, and never disclose an OTP or recovery code.
Preserve complete, unedited electronic evidence before blocking or reporting the scammer’s account.
Use CICC 1326, the PNP Anti-Cybercrime Group, or the NBI Cybercrime Division for cybercrime and criminal investigation.
Escalate unresolved complaints against BSP-supervised institutions through the BSP Consumer Assistance Mechanism.
Use DTI for genuine online consumer disputes, SEC for investment or lending schemes, and NPC for personal-data misuse.
A failed transaction is not automatically estafa; the evidence must show deception that induced the payment.
Fast reporting improves the possibility of preserving records and tracing funds, but no agency can guarantee recovery.