If you were scammed online and your money was sent to a Philippine bank account, e-wallet, or payment channel, speed matters. The first few hours are usually more important than the police report itself, because the money may be transferred through several accounts before investigators can trace it. In the Philippines, recovery normally involves three parallel tracks: reporting to your bank or e-wallet so disputed funds can be temporarily held, filing a police or cybercrime complaint so investigators can preserve evidence and request data, and, in serious cases, referral to the Anti-Money Laundering Council (AMLC) or court processes for a formal freeze order.
What “freezing” money means in an online scam case
People often use the phrase “freeze the account,” but Philippine law recognizes different tools with different effects.
| Remedy | Who acts | What it does | Typical use |
|---|---|---|---|
| Temporary holding of disputed funds | Bank, e-wallet, or BSP-supervised institution | Holds disputed funds in the financial system while the transaction is verified | Fast response after scam report |
| Coordinated verification | Originating bank/e-wallet and receiving bank/e-wallet | Traces the disputed transaction chain and checks whether funds remain | Bank-to-bank or e-wallet-to-bank transfers |
| AMLA freeze order | Court of Appeals, upon AMLC application | Freezes monetary instruments or property linked to unlawful activity or money laundering | Larger, organized, or money-laundering-linked scams |
| Police report / cybercrime complaint | PNP, NBI, CICC, prosecutor | Starts investigation and supports evidence preservation, warrants, subpoenas, and referrals | Needed for criminal case and formal investigation |
| Civil or criminal restitution | Prosecutor/court | Can lead to restitution, reparation, or indemnification if a case succeeds | Recovery after funds are gone |
A police report alone does not automatically freeze a bank account. It is useful because banks, prosecutors, the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, CICC, BSP, or AMLC may need a formal complaint, affidavit, or police report before taking further action.
Legal basis for online scam recovery in the Philippines
1. Estafa and cyber-enabled fraud
Many online scams are prosecuted as estafa, or swindling, under Article 315 of the Revised Penal Code. Estafa usually involves deceit or abuse of confidence that causes damage to another person. In online scam cases, the deceit may be a fake seller, fake investment manager, fake job recruiter, fake customer service agent, romance scammer, or phishing operator.
When the scam is committed through a computer system, mobile phone, online platform, messaging app, or similar technology, Republic Act No. 10175, the Cybercrime Prevention Act of 2012, may apply. Section 6 of RA 10175 covers crimes under the Revised Penal Code and special laws when committed through information and communications technology, with a higher penalty. RA 10175 also specifically recognizes computer-related fraud, computer-related forgery, and identity theft. (Supreme Court E-Library)
For practical purposes, a victim often reports the case as online estafa, cyber-estafa, computer-related fraud, identity theft, or unauthorized transaction, depending on what happened.
2. Anti-Financial Account Scamming Act
Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), signed in 2024, is now one of the most important laws for online scam recovery involving bank accounts and e-wallets. AFASA covers financial account scamming and related offenses involving banks, non-bank financial institutions, payment service providers, e-wallets, and other financial accounts. It targets schemes such as financial-account misuse, mule accounts, social engineering, and unlawful use of account credentials. (LawPhil)
AFASA is important because it gives BSP-supervised institutions a structured process to temporarily hold disputed funds and coordinate with other financial institutions to verify whether money can still be traced and recovered. The BSP’s 2025 implementing regulations explain that the rules are meant to help institutions “trace, hold, verify, and recover disputed funds.” (Bureau of the Treasury)
3. Anti-Money Laundering Act freeze orders
Some scam proceeds may also fall under the Anti-Money Laundering Act, Republic Act No. 9160, as amended. Swindling under Article 315 of the Revised Penal Code is one of the unlawful activities under the AMLA framework. (Supreme Court E-Library)
A true AMLA freeze order is issued by the Court of Appeals upon application by the AMLC, not directly by the private victim. In 2025, the Supreme Court explained that a Court of Appeals freeze order may cover related and materially linked accounts if there is probable cause and the safeguards for account holders are observed. The initial freeze is effective immediately for 20 days, with a summary hearing to determine whether to lift, modify, or extend it, but the total freeze period generally cannot exceed six months unless another lawful preservation remedy applies. (Supreme Court of the Philippines)
4. Civil liability and restitution
A criminal case is not only about imprisonment. Under the Revised Penal Code, a person criminally liable is also civilly liable. In scam cases, this can include restitution of the amount taken, reparation for damage caused, and indemnification.
Civil Code provisions may also matter. Articles 19, 20, and 21 of the Civil Code are often cited where a person acts contrary to law, abuses rights, or willfully causes loss in a manner contrary to morals or good customs. Article 2176 on quasi-delict may be relevant in some negligence-based claims, although fraud-based scam recovery is usually pursued through criminal and civil liability connected with the offense.
What to do immediately after an online scam
1. Stop communicating except to preserve evidence
Do not send more money to “unlock,” “verify,” “upgrade,” “tax clear,” or “release” funds. Many victims lose more money after the first scam because the scammer says recovery is possible only after another payment.
Preserve the conversation before the scammer deletes the account:
- Take screenshots of the full chat, including profile name, username, phone number, URL, date, and time.
- Export chats from messaging apps when possible.
- Save transaction receipts, reference numbers, QR codes, account names, account numbers, GCash/Maya/mobile wallet numbers, bank names, and timestamps.
- Save emails with full headers if the scam involved phishing.
- Do not edit screenshots. Keep originals on your phone or computer.
2. Report to your bank or e-wallet first
If money left your account, report first to the originating financial institution — the bank, e-wallet, or payment provider you used to send the money.
Ask specifically for:
- A fraud report or complaint reference number.
- Temporary holding or disputed transaction processing under AFASA, if applicable.
- Immediate coordination with the receiving financial institution.
- Written confirmation of what information or documents they need.
- The transaction reference numbers, dates, times, and receiving institution details that they are allowed to disclose.
Under BSP rules implementing AFASA, temporary holding can be triggered by a complaint from the source account owner through the institution’s 24/7 fraud reporting channel, by the institution’s fraud management system, or by a holding request from another institution. (Bureau of the Treasury)
3. Ask whether funds were successfully held
The key question is not simply “Did you report it?” The key question is:
Were the disputed funds still intact when the receiving bank or e-wallet received the holding request?
Under the BSP rules, an initial hold may be for up to five calendar days, and it may be extended by up to 25 more calendar days, for a total temporary holding period of up to 30 calendar days, unless a court of competent jurisdiction extends the period. (Bureau of the Treasury) (Bureau of the Treasury)
If the money was already withdrawn or moved to another account, the bank may still trace and coordinate, but actual recovery becomes harder. The coordinated verification process can continue even when no funds were held, but the practical goal changes from “hold and return” to “trace, identify, investigate, and prosecute.”
4. File a cybercrime complaint
For online scams, the usual agencies are:
| Agency | Best for | Notes |
|---|---|---|
| PNP Anti-Cybercrime Group (PNP-ACG) | Online estafa, phishing, marketplace scams, social media scams, hacked accounts | PNP and NBI are the law enforcement authorities under RA 10175. (Supreme Court E-Library) |
| NBI Cybercrime Division | Cyber fraud, identity theft, account takeover, digital evidence-heavy cases | The NBI has an online complaint page and Cybercrime Division contact information. (National Bureau of Investigation) |
| CICC / 1326 Hotline | Immediate reporting of cyber fraud, scam SMS, online harm | CICC and Scam Watch channels route reports and public assistance for cyber incidents. (Philippine News Agency) |
| SEC | Investment scams, Ponzi schemes, fake trading platforms, unauthorized securities solicitation | Complaints may be filed through the SEC iMessage portal. (Securities and Exchange Commission) |
| BSP Consumer Assistance Mechanism | Complaints against banks, e-wallets, or BSP-supervised institutions after first reporting to the institution | BSP-CAM is a second-level consumer recourse after reporting to the financial institution’s FCPAM/customer service channel. |
A police blotter may help document the incident, but for cybercrime investigation, a complaint-affidavit with evidence is usually stronger than a bare blotter entry.
5. Prepare a clear complaint-affidavit
A complaint-affidavit is a sworn written statement of facts. It should be direct, chronological, and supported by attachments.
Include:
- Your full name, address, contact number, and email.
- The date and time you first encountered the scammer.
- The platform used: Facebook, Messenger, Viber, Telegram, WhatsApp, Instagram, TikTok, email, website, SMS, dating app, job site, or trading app.
- The exact representations made by the scammer.
- Why you believed the scammer.
- The amount sent and every transaction reference number.
- The receiving account name, account number, mobile wallet number, QR code, or bank/e-wallet.
- What happened after payment.
- Your demand for investigation and appropriate charges.
- A list of attachments.
If you are in the Philippines, the affidavit is usually notarized before a Philippine notary public. If you are abroad, documents intended for formal Philippine proceedings may need to be signed before a Philippine Embassy/Consulate or apostilled, depending on the country and the intended use.
Required documents for police, bank, BSP, or prosecutor complaints
| Document | Why it matters | Practical tip |
|---|---|---|
| Government ID or passport | Proves identity of complainant | Use the same name as your bank/e-wallet account |
| Transaction receipts | Proves money movement | Include reference number, amount, date, time |
| Bank/e-wallet statement | Shows debit from your account | Highlight the disputed transaction |
| Screenshots of chats | Shows deceit and promises | Capture profile, username, timestamps |
| Scam profile URL or phone number | Helps investigators trace accounts | Copy links, not just display names |
| Complaint-affidavit | Main sworn narrative | Keep it factual and chronological |
| Police report or blotter | Supports bank escalation and investigation | Ask for the reference or docket number |
| Bank complaint reference | Shows you reported first to the provider | Needed for BSP-CAM escalation |
| Emails with headers | Useful for phishing | Preserve original email, not only screenshot |
| Device logs or app notifications | Supports timing and access | Do not factory reset your phone before backup |
How temporary holding under AFASA works in practice
The AFASA process is not magic, but it is the most practical legal development for scam victims because it recognizes how fast scam funds move.
Step-by-step process
Victim reports to the originating institution. This is the bank, e-wallet, or payment provider used to send the money.
Originating institution identifies the disputed transaction. It checks the transaction reference number, amount, mode of transfer, date, time, receiving institution, and involved accounts.
Initial holding request is sent. The originating institution asks the receiving institution or later receiving institutions to hold the disputed funds if still available.
Receiving institution checks whether funds remain. Funds may be fully intact, partially intact, already withdrawn, or already transferred elsewhere.
Initial hold may last up to five calendar days. This gives institutions time to prevent immediate withdrawal while they verify.
Extended hold may add up to 25 calendar days. The extension depends on reasonable grounds and supporting information, such as a sworn complaint, police report, investigation report, or fraud indicators.
Coordinated verification is completed. The institutions trace and validate the transaction chain, review documents, check fraud indicators, and communicate with account owners.
Funds are released, returned, or kept subject to lawful process. If the transaction is shown to be legitimate, the hold should be lifted. If the transaction is validated as disputed and recovery is warranted, the process may lead to return or further legal action.
The BSP rules expressly require involved account owners to cooperate by timely providing requested information and documentation. They also recognize the rights of affected beneficiary account owners to challenge the hold and show that a transaction was legitimate. (Bureau of the Treasury)
When an AMLC freeze order may become relevant
An AMLC freeze order is usually not the first remedy for an ordinary one-time online shopping scam. It becomes more relevant when facts suggest organized money laundering, large amounts, multiple victims, mule accounts, rapid layering of funds, or proceeds moving through financial institutions in a pattern.
A victim normally does not file the freeze petition directly with the Court of Appeals. The practical route is to build the record:
- Report immediately to the bank/e-wallet.
- File with PNP-ACG, NBI Cybercrime Division, CICC, or the appropriate law enforcement unit.
- Provide a sworn complaint and complete transaction documents.
- Ask the investigator to evaluate whether referral to AMLC, BSP, or prosecutors is appropriate.
- Follow up with the investigator using the complaint docket number.
A freeze order is designed to preserve property while investigation or forfeiture proceedings are pursued. It does not automatically mean the victim receives the money immediately. If several victims or unlawful activities are involved, the process may require prosecutor action, forfeiture proceedings, court orders, or distribution rules.
Police report vs. cybercrime complaint vs. prosecutor complaint
These are often confused.
| Filing | Purpose | What it usually produces |
|---|---|---|
| Police blotter / incident report | Records that an incident was reported | Blotter number or incident reference |
| PNP/NBI cybercrime complaint | Requests investigation by cybercrime authorities | Complaint docket, investigator assignment, possible requests for data |
| Complaint-affidavit for preliminary investigation | Starts prosecutor evaluation for filing charges | Prosecutor docket, counter-affidavits, resolution |
| Court case | Criminal trial and civil liability if filed | Judgment, restitution, penalties, orders |
For many victims, the strongest sequence is: bank/e-wallet fraud report first, then cybercrime complaint, then prosecutor complaint if investigators or counsel prepare the case for preliminary investigation.
Common bottlenecks in recovering scam money
The funds were moved too fast
Scammers often use mule accounts and immediately withdraw cash, convert to crypto, buy goods, or transfer through several e-wallets. A report filed days later may still help the criminal case, but it may be too late to hold the exact funds.
The account name is fake or belongs to a mule
The receiving account may belong to a real person who “rented” or lent the account, sometimes claiming ignorance. AFASA specifically addresses financial account misuse and scamming schemes, but proving knowledge and participation may require transaction patterns, communications, and identity records.
Banks cannot freely disclose account details to victims
Bank secrecy, data privacy, and internal fraud rules often prevent banks from telling you the full identity, address, or balance of the receiving account. That does not mean nothing is happening. It means the information may need to move through the AFASA coordinated verification process, BSP, law enforcement, prosecutors, or court warrants.
AFASA and the BSP rules create specific exceptions for BSP investigation and coordinated verification, but the information is still handled within authorized channels, not simply released to private complainants. (Bureau of the Treasury)
The victim only has screenshots, not transaction records
Screenshots help, but money recovery depends heavily on transaction identifiers. Always include the transfer reference number, amount, exact timestamp, sending account, receiving account, and payment channel.
The scammer is overseas
RA 10175 may still apply if elements of the offense occurred in the Philippines, a Philippine computer system was used, or damage was caused to a person in the Philippines. For foreign service providers or overseas evidence, the Rule on Cybercrime Warrants recognizes that service of warrants and court processes for persons or providers outside the Philippines is coursed through the DOJ Office of Cybercrime in line with international cooperation mechanisms.
The “recovery agent” is another scam
Be careful with people claiming they can recover money through secret AMLC contacts, hacked bank systems, or “inside” police connections. Legitimate recovery uses bank fraud channels, law enforcement, BSP, AMLC, prosecutors, and courts. Anyone asking for an advance “release fee” or “freeze certificate fee” should be treated with suspicion.
Special situations
GCash, Maya, online bank, or InstaPay transfer
Report immediately to the app or bank used to send the funds. Give the transaction reference number and request dispute handling under the institution’s fraud process. Then file with cybercrime authorities if the transfer involved fraud, phishing, impersonation, or deceit.
Fake online seller
The case may be estafa if the seller used deceit before or at the time you paid, such as using fake proof of stocks, fake courier receipts, fake identity, or a pattern of accepting payment without intent to deliver.
Investment scam or crypto trading scam
Report to cybercrime authorities and consider SEC reporting if the scheme involved investment solicitation, guaranteed returns, pooling of funds, referral commissions, securities, or an “investment contract.” SEC registration as a corporation is not the same as authority to solicit investments.
Phishing or account takeover
Change passwords, revoke logged-in sessions, disable linked devices, report unauthorized transactions, and preserve emails/SMS/app notifications. If your account was accessed without permission, RA 10175 provisions on illegal access, identity theft, or computer-related fraud may apply.
Victim is abroad
Overseas Filipinos and foreigners can still report Philippine-linked scams. The practical issue is documentation. If a sworn statement will be used formally in the Philippines, it may need notarization, consular acknowledgment, or apostille depending on where it was executed. Keep digital evidence in original form and note the time zone used in screenshots and bank records.
Practical timeline
| Time from discovery | What to prioritize |
|---|---|
| First 1–3 hours | Report to sending bank/e-wallet; request fraud hold and coordination |
| Same day | File cybercrime report or CICC/PNP/NBI complaint; preserve evidence |
| Within 1–2 days | Prepare complaint-affidavit and complete transaction packet |
| First 5 calendar days | Follow up on whether initial hold was successful |
| Within 30 calendar days | Monitor coordinated verification and submit supporting documents |
| After bank response or inaction | Escalate covered financial institution issues to BSP-CAM, after first-level complaint |
| If suspect identified or evidence is sufficient | Proceed with prosecutor complaint/preliminary investigation |
| For large or organized scams | Law enforcement may evaluate AMLC/BSP/prosecutor referrals |
Frequently Asked Questions
Can I personally ask the court to freeze the scammer’s bank account?
For an AMLA freeze order, the usual applicant is the AMLC before the Court of Appeals. A private victim normally builds the record through bank reports, law enforcement complaints, affidavits, and evidence so the proper agency can evaluate whether a freeze order or other preservation remedy is warranted.
Does a police report automatically freeze the receiving account?
No. A police report helps document the scam and supports investigation, but freezing or temporary holding depends on bank/e-wallet processes under AFASA, BSP rules, AMLC action, or court orders.
How fast should I report an online scam to my bank or e-wallet?
Immediately. Minutes and hours matter because funds can be withdrawn or moved through several accounts. Report first to the financial institution you used to send the money, then file with cybercrime authorities.
How long can a bank or e-wallet hold disputed funds?
Under BSP rules implementing AFASA, an initial hold may be up to five calendar days and may be extended by up to 25 more calendar days, for a total of up to 30 calendar days, unless extended by a court of competent jurisdiction. (Bureau of the Treasury)
What if the bank says the money is already withdrawn?
The recovery of the exact funds becomes harder, but the case is not necessarily over. Ask for written confirmation of the transaction status, continue the cybercrime complaint, and provide complete evidence so investigators can trace the account holder, mule account, cash-out point, or subsequent transfers.
Can I file both with PNP and NBI?
Yes, but avoid creating confusion by failing to disclose previous filings. If you file with more than one office, keep a list of docket numbers and tell each office where else you reported. For efficiency, many victims choose one main investigating office and use other channels for immediate reporting or referral.
Should I report to BSP?
Report first to the bank, e-wallet, or BSP-supervised institution through its customer service or Financial Consumer Protection Assistance Mechanism. BSP-CAM is generally a second-level recourse if you are dissatisfied with the institution’s handling or response.
Can the bank tell me the scammer’s full name and address?
Not always. Banks and e-wallets are restricted by bank secrecy, data privacy, and internal rules. Information may be shared through authorized channels such as coordinated verification, BSP inquiry, law enforcement, prosecutor processes, cybercrime warrants, or court orders.
What case is filed against a scammer in the Philippines?
Common charges include estafa under Article 315 of the Revised Penal Code, computer-related fraud or identity theft under RA 10175, violations of AFASA, money laundering under RA 9160 when proceeds are laundered, and securities violations for investment scams.
Can I recover my money if the scammer is arrested?
An arrest does not automatically return the money. Recovery may come from held funds, voluntary restitution, settlement documented in the proper proceeding, civil liability in the criminal case, forfeiture-related processes, or execution of a judgment. If the money was already spent or moved, recovery may take longer and may depend on identifying attachable assets.
Key Takeaways
- Report first to your bank or e-wallet, because temporary holding depends on speed.
- A police report helps, but it does not automatically freeze a scammer’s account.
- AFASA allows temporary holding and coordinated verification of disputed funds through BSP-supervised institutions.
- A true AMLA freeze order is issued by the Court of Appeals upon AMLC application.
- Keep transaction reference numbers, timestamps, account details, screenshots, and original digital evidence.
- File cybercrime complaints with the proper office: PNP-ACG, NBI Cybercrime Division, CICC, SEC for investment scams, and BSP-CAM for unresolved complaints against supervised financial institutions.
- If funds are already withdrawn, the focus shifts from immediate recovery to tracing, investigation, criminal prosecution, and civil liability.