Quick answer

Act immediately. Contact the bank, e-wallet, card issuer, remittance company, or other financial institution from which the money left. Ask it to secure your account, record the transaction as disputed or fraudulent, trace the funds, and request a temporary hold through the receiving institutions. Then preserve your evidence and report the scam to law enforcement.

A report does not guarantee a refund. Recovery depends on matters such as whether the funds remain traceable, whether they can still be held, how the transaction was authorized, what security information was disclosed, and what the institutions’ investigation establishes. Even if the money has already been withdrawn, report the case: the records may help identify the recipient, connect related complaints, and support criminal or civil proceedings.

What to do immediately

1. Call the financial institution using an official channel

Use the number printed on your card, shown inside the official app, or published on the institution’s verified website. Do not call a number supplied by the scammer.

Tell the institution:

You are reporting an online scam or fraudulent transaction.
The exact amount, date, time, and transaction reference number.
The source and recipient account, wallet, card, or mobile number, if known.
Whether you personally sent the payment, were deceived into approving it, disclosed an OTP or PIN, installed an app, or lost control of your account.
Whether other transactions may still be pending.

Ask it to:

Block or restrict the affected account, card, online-banking access, or transfer function where appropriate.
Record a formal fraud or disputed-transaction report.
Trace the transaction chain and contact every receiving institution.
Initiate the temporary-holding and coordinated-verification process if the transaction qualifies.
Give you a case or reference number and written instructions for any affidavit, police report, identification, or supporting documents.
Confirm what happened to scheduled transfers, linked cards, loans, or credit facilities.

Under the Anti-Financial Account Scamming Act or Republic Act No. 12010 and BSP Circular No. 1215, BSP-supervised institutions have procedures for tracing disputed transactions, temporarily holding identifiable disputed funds, and conducting coordinated verification.

The initial hold may last not more than five calendar days. If the originating institution finds an extension warranted, the hold may be extended by not more than 25 additional calendar days. These are maximum holding periods—not waiting periods for victims and not promises that money will be recovered. A hold can operate only on funds that are found within the covered financial system and are capable of being held.

Report immediately because scam proceeds may be withdrawn, converted, or transferred through several accounts within minutes.

2. Secure your accounts and devices

From a device you reasonably believe is safe:

Change the passwords of the affected financial account, primary email, social-media accounts, shopping accounts, and cloud storage.
Use new, unique passwords and enable multifactor authentication.
Sign out other devices and revoke unfamiliar sessions or connected apps.
Change compromised PINs and request card replacement where needed.
Contact your mobile provider if your SIM stopped working unexpectedly or you suspect SIM swapping.
Remove remote-access or screen-sharing applications used during the incident—but first preserve their names, installation records, messages, and relevant screenshots.
Check whether the scammer changed recovery emails, phone numbers, transfer limits, beneficiaries, or notification settings.
Review recent transactions across all linked accounts.

If the scammer obtained an OTP, PIN, password, card security code, recovery code, selfie, signature, or identification document, disclose that fact accurately to the institution. Concealing it can impede the investigation.

3. Do not send more money

Do not pay supposed “release fees,” “taxes,” “verification deposits,” “legal charges,” or “recovery fees.” A scammer may claim that one final payment will unlock a refund or investment withdrawal. Another person may later pose as a hacker, government officer, lawyer, bank employee, or asset-recovery agent.

Do not confront the suspected scammer in person, attempt an unauthorized account takeover, or publish unverified personal information. Preserve the interaction and let investigators decide how to proceed.

Preserve evidence before it disappears

Keep both readable copies and original electronic files where possible. Relevant evidence may include:

Complete chat, SMS, and email conversations—not only selected screenshots.
The account name, username, profile URL, page URL, email address, and mobile number used.
Advertisements, listings, livestreams, websites, job offers, contracts, invoices, and promises made.
Payment receipts, bank or e-wallet statements, QR codes, transaction references, and recipient details.
Call logs, voice messages, recordings lawfully obtained, and meeting details.
Courier records, tracking numbers, packaging, and the item received.
Copies of identification or documents the scammer sent.
Password-reset, login, device, and security-alert emails.
The name of any remote-access app and the time it was used.
Your reports to the platform and financial institution, including reference numbers and replies.
Names and contact information of witnesses or other victims.

Create a chronological account while events are fresh: what was represented, when you relied on it, what action you took, how much you lost, and what happened afterward.

For websites and social-media accounts, capture the full URL, date, time, profile information, and surrounding context. Export chats if the platform permits it. Keep the original phone or computer and avoid editing original files. Back up the evidence securely, but do not continue using an infected device for banking.

Electronic material is not automatically accepted merely because it is printed or shown in a screenshot. Its authenticity, integrity, reliability, source, and context may need to be established under the Supreme Court’s Rules on Electronic Evidence and the Revised Rules on Evidence. Preserving originals and documenting how the records were obtained can therefore matter.

Report the crime

You may seek investigative assistance from one or more of the following:

Cybercrime Investigation and Coordinating Center: Call the National Anti-Scam Hotline at 1326, use the reporting feature available through the eGovPH app, or consult the DICT/CICC information page.
National Bureau of Investigation: File or request investigative assistance from the NBI Cybercrime Division. The NBI publishes its computer-crime assistance procedure and an online complaint page.
Philippine National Police: Approach the PNP Anti-Cybercrime Group or the nearest police station for referral and documentation.
Office of the prosecutor: A criminal complaint may ultimately be filed with the proper city or provincial prosecution office, supported by sworn statements and evidence. Current prosecutorial procedure is governed by the DOJ’s 2024 National Prosecution Service Rules, together with other applicable rules.

Bring a government-issued ID, your timeline, transaction records, original evidence or faithful copies, the financial institution’s reference number, and available information identifying the suspected offender. Ask what additional affidavits, copies, certifications, or device examination may be required.

A police blotter or online report can document the incident, but it is not necessarily the same as completing the sworn complaint and supporting submissions required for investigation or prosecution. Follow the receiving agency’s instructions and keep proof of every filing.

What offenses may apply?

The correct offense depends on the scam’s actual method and evidence.

Estafa through deceit

Many online scams may fall under Article 315 of the Revised Penal Code when a false pretense or fraudulent representation was made before or at the time the victim parted with money or property, the victim relied on it, and damage resulted. A failed sale or unpaid obligation is not automatically estafa; a mere breach of contract may be civil if the required prior or simultaneous deceit cannot be proved.

Cybercrime-related liability

Section 6 of the Cybercrime Prevention Act of 2012 covers crimes already punished by the Revised Penal Code or special laws when committed through information and communications technology. Other cybercrime provisions may apply when the conduct involves illegal access, computer-related fraud, identity theft, or other specifically prohibited acts.

The Cybercrime Prevention Act also requires service providers to preserve specified computer data for statutory periods, with possible extensions following a proper law-enforcement order. Victims generally should not assume that a platform will retain deleted material indefinitely; prompt reporting gives investigators a better opportunity to pursue lawful preservation and disclosure processes.

Financial-account scamming

Republic Act No. 12010 penalizes defined conduct involving money-mule accounts, social-engineering schemes, and other misuse of financial accounts. It also permits authorized institutions and competent authorities to trace disputed funds and access account information through the law’s procedures.

The victim ordinarily cannot compel a bank to reveal another customer’s confidential account information directly. Investigators and regulators must use the lawful inquiry and disclosure mechanisms.

Other laws may apply to access-device fraud, illegal investment solicitation, unlawful lending practices, identity misuse, threats, extortion, trafficking, or exploitation. Let the investigating authority assess the complete facts rather than forcing every incident into a single legal label.

Complain to the appropriate regulator or agency

An administrative or consumer complaint can supplement—but does not replace—a criminal report.

Bank, e-wallet, card, or payment-service complaint

First use the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service process. If its response is absent or unsatisfactory, escalate the matter through the BSP’s second-level Consumer Assistance Mechanism.

The BSP accepts escalations through the BSP Online Buddy on its website and, if the chatbot is inaccessible, through the prescribed form sent to consumeraffairs@bsp.gov.ph. Include proof that you first complained to the institution. See the BSP’s current complaint instructions and consumer-assistance channels.

BSP consumer assistance addresses the conduct and complaint handling of BSP-supervised institutions. It does not replace the police, NBI, CICC, or prosecutor’s criminal investigation.

Online purchase or service dispute

For a transaction involving a legitimate business or online seller and a consumer-law issue—such as nondelivery, defective goods, misleading representations, or refusal to honor applicable remedies—consider the DTI Consumer CARe system.

DTI proceedings may help with a consumer dispute, but DTI is not a substitute for reporting an impersonator, fictitious seller, stolen account, or organized fraud to law enforcement and the payment institution.

Investment, lending, or securities-related scheme

Report suspected unauthorized investment solicitation or investment fraud through the SEC’s official iMessage system. Registration of a corporation or business name does not, by itself, prove that an investment offer is authorized or legitimate.

Can you recover the money?

Possible routes include:

Reversal, chargeback, or other contractual card remedy, where available.
Recovery through the financial institutions’ disputed-transaction verification process.
Restitution or civil liability pursued with the criminal case.
A separate civil action based on the applicable facts and documents.
A settlement that is properly documented and does not require you to surrender evidence or make another unsafe payment.

Whether a card charge, wallet transfer, InstaPay or PESONet transaction, cryptocurrency transfer, cash remittance, or direct deposit can be reversed is product- and fact-specific. An “authorized” payment induced by deception may be treated differently from an account takeover, but neither label alone decides criminal liability or guarantees reimbursement.

Do not sign a quitclaim, affidavit of desistance, settlement, assignment, or acknowledgment prepared by the other side without understanding its effect. Payment or a private settlement does not automatically erase every possible public offense.

Common mistakes to avoid

Waiting for the scammer’s promised refund before contacting the bank.
Reporting only to the social-media platform.
Deleting chats, blocking the account before saving evidence, or factory-resetting the device.
Sending cropped screenshots that omit usernames, URLs, dates, or context.
Giving investigators estimates when exact statements and transaction records are available.
Exaggerating facts or concealing that an OTP, password, or approval was voluntarily provided.
Paying a “recovery agent” who promises guaranteed results.
Assuming a verified badge, SEC registration, DTI business name, SIM registration, or displayed ID proves legitimacy.
Publicly accusing an unverified person whose identity may also have been stolen.
Expecting the recipient account holder’s name to prove who designed or controlled the scam.
Treating a bank complaint, police blotter, platform report, and prosecutor’s complaint as interchangeable.
Missing follow-up requests or failing to keep complaint reference numbers.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The amount is substantial or involves business, family, trust, or pooled funds.
Several victims, multiple accounts, cryptocurrency, foreign recipients, or shell companies are involved.
You need to pursue attachment, injunction, a civil claim, or another time-sensitive remedy.
The institution rejects the dispute and the facts involve account takeover, disputed authentication, or possible security failures.
You signed contracts, loan documents, quitclaims, or settlement papers.
Your identity documents are being used to borrow money, open accounts, or impersonate you.
The scam involves threats, blackmail, intimate images, stalking, physical danger, or a child.
Law enforcement asks you to participate in an entrapment operation.
You receive a subpoena, demand, or accusation arising from funds that passed through your own account.

If there is immediate danger, contact emergency services or the nearest police station. Do not meet the suspected offender or conduct your own entrapment operation.

People who cannot afford private counsel may ask the Public Attorney’s Office whether they qualify for assistance. Law-school legal-aid clinics and the Integrated Bar of the Philippines may also have referral or assistance programs, subject to their requirements and capacity.

FAQ

I personally approved the transfer. Can I still report it?

Yes. Approval does not prevent you from reporting that consent was obtained through deception, impersonation, coercion, or account manipulation. Tell the institution exactly how the approval occurred. Whether the payment is refundable and what offense was committed require a factual investigation.

I gave the scammer my OTP. Is the case hopeless?

No. Report it truthfully and immediately. OTP disclosure may affect the institution’s assessment of authorization, security, and liability, but it does not legalize fraud or eliminate the need to trace funds and investigate the scammer.

Can the bank freeze the recipient’s entire account?

The AFASA process concerns identifiable disputed funds and is subject to statutory safeguards, verification, notice, and time limits. It is not an unrestricted power for a complainant to freeze another person’s entire account indefinitely. Longer restraints may require another legal basis or an order from the proper authority.

Does a five-day hold mean I will receive the money after five days?

No. The five-day period is the maximum initial temporary hold. Institutions must still trace the funds and verify the transaction. Funds may already be gone, may be only partly intact, may be subject to competing claims, or may be released if the complaint is not substantiated.

Should I report the recipient account even if its owner says the account was only borrowed?

Yes. Republic Act No. 12010 specifically addresses money-mule activity and the lending, sale, or transfer of financial-account access under defined circumstances. Investigators must determine the account holder’s knowledge, participation, and liability.

Can screenshots alone prove the scam?

Sometimes screenshots are useful, but they may not be sufficient by themselves. Preserve the original conversation, device, account details, URLs, transaction records, and other evidence that can authenticate the material and connect it to the people and events involved.

What if the scammer is abroad?

Report locally without delay. Cross-border investigation and recovery can be harder and may require cooperation with platforms, financial institutions, and foreign authorities. Provide country indicators, foreign numbers, wallet addresses, domains, and remittance details, but do not assume that the displayed location is genuine.

Is filing a platform report enough?

No. A platform report may remove or preserve an account, but it does not automatically start a Philippine criminal case, place a hold on bank funds, or create a BSP consumer complaint. Report separately to the payment institution and an appropriate law-enforcement body.

Is there a fixed deadline for reporting every online scam?

No single deadline covers every scam. Prescription depends on the offense, penalty, date of commission or discovery, and applicable law, while banking and platform remedies may have separate contractual periods. Because evidence and funds can disappear quickly, report immediately and obtain legal advice instead of waiting for the outer legal deadline.

Official sources

This article provides general legal information, not legal advice for a particular case. Outcomes depend on the transaction, communications, account records, contracts, and other evidence. Official sources and procedures were checked as of 27 July 2026.