Philippines Online Scam: How to File a Cybercrime Complaint and Recover Money

This practical legal guide is written for victims and counsel in the Philippines. It explains your options under Philippine law, how to preserve evidence, where and how to file complaints, and the realistic paths to recovering funds from banks, e-wallets, and platforms.

1) What counts as an “online scam” under Philippine law?

Online scams can violate multiple laws at once, depending on the conduct:

Cybercrime Prevention Act of 2012 (R.A. 10175) — covers offenses committed through information and communications technologies, and provides special rules on jurisdiction, venue, evidence, and cyber warrants.
Revised Penal Code (RPC) — Estafa (Art. 315) — deceit or fraudulent acts causing damage/misappropriation. Common for marketplace, investment, and “love/pig-butchering” scams.
Access Devices Regulation Act (R.A. 8484) — fraudulent use of bank cards/one-time passwords (OTP), card-not-present transactions.
E-Commerce Act (R.A. 8792) and the Rules on Electronic Evidence — authenticity, integrity, and admissibility of electronic documents and signatures.
Financial Consumer Protection Act (R.A. 11765) — duties of banks/e-wallets, internal dispute resolution (IDR), and remedies via the Bangko Sentral ng Pilipinas (BSP).
SIM Registration Act (R.A. 11934) — aids in linking numbers to identities; also provides bases for telco assistance/blocking.
Data Privacy Act (R.A. 10173) — for phishing, doxxing, and unlawful processing of personal data.
Securities Regulation Code / SEC rules — investment solicitations without registration, Ponzi schemes, unlicensed advisories, crypto “yield” scams.
Anti-Money Laundering Act (R.A. 9160, as amended) — used to trace and freeze proceeds of unlawful activities.

Key Insight: Prosecutors often charge estafa together with cybercrime qualifying circumstances; civil and administrative remedies run in parallel.

2) Immediate First Aid: 0–48 hours

Time is your best friend. The earlier you move, the higher the recovery odds.

Stop further loss.
- Change passwords/disable compromised sessions.
- Freeze cards/e-wallets; enable transaction alerts; revoke third-party app access.
Call your bank/e-wallet’s fraud hotline and file an urgent recall/chargeback/hold request.
- Provide exact timestamps, transaction references, recipient names/account numbers, device used, and narrative.
- Ask the institution to place a hold if funds are still in the recipient account and to file a recall with the beneficiary bank/e-wallet.
- Request a formal case/incident number and written acknowledgment.
Preserve evidence (see detailed checklist in §4). Don’t edit originals; make copies.
File a police blotter at the nearest station or online (if available) and prepare to lodge a complaint with:
- PNP Anti-Cybercrime Group (ACG); or
- NBI Cybercrime Division (CCD).
Notify the platform (Facebook, Instagram, Shopee/Lazada, Carousell, crypto exchange, etc.) through its abuse/fraud channel and request record preservation.
For phishing/OTP compromise: Ask your provider to lock the SIM (if hijacked), and your email provider to secure account and preserve logs.

3) Where to file: criminal, administrative, and civil tracks

You can—and often should—run multiple tracks in parallel.

A. Criminal complaint

Venue & jurisdiction. Under R.A. 10175, you may file where any element of the offense occurred, including where your device was used or where the computer system is located.

Where to go:

PNP-ACG (regional offices) — for investigation, digital forensics, entrapment, referrals to prosecutors.
NBI-CCD — similar functions; especially good for complex/economic-scale cases.
Office of the City/Provincial Prosecutor — file a sworn complaint-affidavit with annexes, then attend preliminary investigation.

Cybercrime warrants. Investigators may apply for specialized warrants under the Rules on Cybercrime Warrants (A.M. No. 17-11-03-SC):

WDCD — Warrant to Disclose Computer Data (subscriber info, traffic data, logs, KYC).
WICD — Warrant to Intercept Computer Data (prospective interception in qualifying cases).
WSSECD — Warrant to Search, Seize, and Examine Computer Data (on devices/storage/accounts).

Tip: Your affidavit should identify custodians of records (banks, e-wallets, exchanges, telcos, platforms) so law enforcement can obtain WDCDs quickly.

B. Administrative/Regulatory

BSP Financial Consumer Protection (FCPD) via your bank/e-wallet’s IDR first; if unresolved within the provider’s timeline, escalate to BSP (for banks/e-money issuers) or SEC/EIPD (for investment solicitations).
NTC for spam/SIM-related abuses; request number blocking.
National Privacy Commission (NPC) for phishing and unlawful processing; ask for Cease-and-Desist and mediation where appropriate.
SEC (Enforcement & Investor Protection Department) — report unregistered investment schemes, solicitations, and boiler rooms.

C. Civil actions (money back)

Small Claims (no lawyers required to appear): for pure money claims up to ₱1,000,000 arising from fraud or breach of contract. Fast timelines; judgment is immediately executory.
Ordinary civil action for damages, rescission, reconveyance, unjust enrichment, or conversion where amounts exceed small claims or complex relief is needed.
Attachment/garnishment once you obtain a judgment; you may also seek preliminary attachment if statutory grounds exist (e.g., fraud).

4) Evidence: what to collect and how to preserve it

Golden rules:

Make forensic-friendly copies. Save original files; export PDFs; keep metadata.
Record the chain of custody. Who collected, when, how stored.

Checklist

Full conversation threads (screenshots and raw exports) with visible timestamps, URLs/handles, and profile IDs.
Payment records: transaction IDs, reference numbers, Instapay/PESONet trace numbers, e-wallet trace IDs, bank statements, chargeback letters.
Device & login data: email headers, IP logs, unusual login alerts, authenticator app details.
Ads/listings: archived pages (PDF), seller profiles, order pages, product IDs, platform dispute case numbers.
Phone/SIM: calling/SMS screenshots, SIM serial/ICCID (if relevant), OTP messages.
Crypto: wallet addresses, TX hashes, exchange deposit/withdraw logs, screenshots of KYC’d counterparties if visible.

Formatting for court

Use the Rules on Electronic Evidence: printouts/exports should show origin and integrity (URL, date/time printed, hash if possible).
Prepare a Sworn Statement narrating events in chronological order; attach exhibits with labels (Annex “A”, “B”, …).

5) Getting your money back: realistic pathways

A. Bank and e-wallet recalls/chargebacks

Instapay: near-real-time; recalls depend on speed and whether funds remain in the recipient account. If the beneficiary account still holds funds, banks/e-wallets can freeze and seek the recipient’s consent or a lawful order.
PESONet: batch clearing; recalls may succeed before crediting or through the beneficiary bank’s return process.
Cards (Visa/Mastercard): fraud disputes under card network rules; strict time limits (often 60–120 days from statement date) and evidence standards.
E-money providers: invoke R.A. 11765 duties (fair dealing, effective redress). Keep IDR case numbers; escalate to BSP with your timeline, documents, and proof of loss.

Pro tip: Submit a formal “preservation/hold” letter to both your bank/e-wallet and the beneficiary bank/e-wallet (see template in §9) on the same day you discover the fraud.

B. Platform remedies

Marketplaces and social networks may suspend accounts, preserve data, and share KYC to law enforcement on request. Some offer buyer protection windows—file inside those windows.

C. SEC and investor scams

File with SEC EIPD to help shut down the scheme and obtain records. Recovery typically requires civil or criminal follow-through to reach assets.

D. Crypto-related funds

If routed through a centralized exchange (CEX) with PH presence or responding to MLAT/LEA requests, law enforcement can freeze balances tied to your TX hashes. Provide TXIDs and time-stamped flows. Consider private blockchain analytics to map hops.

E. Civil collection

If you know the scammer’s identity or assets, file Small Claims (≤ ₱1M) or ordinary civil action. Use subpoenas to banks/platforms (through the court) to identify recipients and asset locations.

6) What to expect procedurally

Internal Dispute Resolution (IDR) with bank/e-wallet (typically 7–15 business days to investigate; timelines vary by provider and complexity).
BSP escalation (if dissatisfied): submit the IDR outcome and evidence; BSP may mediate or issue directives.
Criminal route: After you file with PNP-ACG/NBI-CCD, investigators gather evidence and apply for cyber warrants; case is filed with the prosecutor; preliminary investigation; if probable cause, Information is filed in court.
Civil route: File, serve, attend hearings; Small Claims aims for speed; judgments can be executed against bank accounts and property.

Expectations: Recovery is not guaranteed, but early reporting, strong documentation, and parallel tracks significantly improve outcomes.

7) Common fact patterns and how they’re charged

Phishing/OTP theft → R.A. 8484 (access devices), Estafa, R.A. 10175 (as qualifying circumstance).
Investment “double your money” → Estafa; Securities law violations; R.A. 10175 if online; AMLA for proceeds.
Marketplace “paid, no delivery” → Estafa; if through platforms/e-wallets, leverage FCPA duties for redress.
Romance/pig-butchering → Estafa; possibly anti-trafficking or other offenses if syndicates are involved.
Account takeovers (social, email, e-wallet) → Illegal access, computer-related fraud, Data Privacy violations.

8) Practical drafting tips for your complaint-affidavit

Elements-first: For estafa, plead deceit, reliance, damage, and the specific acts (false pretenses, misappropriation).
Identify digital footprints: usernames, handles, phone numbers, device fingerprints, email headers/IPs, transaction IDs, TX hashes.
Name custodians and ask investigators to obtain WDCDs from:
- Banks/e-wallets (sender/recipient KYC, logs).
- Telcos (subscriber data, call/SMS logs).
- Platforms (account registration data, logins, messages).
- Exchanges (KYC, deposit/withdraw logs).
Annexes: Paginate, label, and reference in the body (e.g., “Annex ‘C-4’: Instapay Trace No. …”).

9) Ready-to-use templates

A. Bank/E-Wallet Preservation & Recall Request

[Date]

[Bank/E-Wallet Name]
[Fraud/Dispute Team Email/Office]

Re: URGENT Request to Preserve Records and Recall Funds – [Your Account No./E-Wallet ID]

I am a victim of an online scam committed on [Date/Time, Timezone]. The following unauthorized/fraudulent transfers occurred:

• Amount/Reference: ₱[amount], [Instapay/PESONet/Card Txn ID], Date/Time: [..]
• Beneficiary: [Name if visible], Account/E-Wallet: [..], Bank/Provider: [..]

Pursuant to R.A. 11765 (Financial Consumer Protection Act), R.A. 10175, R.A. 8484, and applicable BSP regulations, I request that you:

1) Immediately place a hold and initiate recall/chargeback of the above transactions;
2) Preserve and secure all relevant records (KYC, logs, IP/device fingerprints, transaction trails);
3) Provide a written acknowledgment and case reference number; and
4) Coordinate with the beneficiary institution for fund recall and with PNP-ACG/NBI-CCD upon request.

Attached are my ID, transaction proofs, and incident narrative.

Sincerely,
[Name, Contact Details]

B. Platform/Telco Preservation Letter

[Date]

[Platform/Telco]
[Trust & Safety / Law Enforcement Response]

Re: Preservation of Records – Fraudulent Account [URL/Handle/Phone No.]

Kindly preserve subscriber/account data, login IPs, timestamps, message contents, and related metadata for [90/120] days relating to:
• Account/Number: [..]
• Period: [Date/Time range]

I will facilitate an official request from PNP-ACG/NBI-CCD (WDCD). Please confirm preservation.

[Name, Contact]

C. Complaint-Affidavit Skeleton

REPUBLIC OF THE PHILIPPINES )
[City/Province]                 ) S.S.

COMPLAINT-AFFIDAVIT FOR ESTAFA (Art. 315) IN RELATION TO R.A. 10175

I, [Name], Filipino, of legal age, [address], after being sworn, depose:

1. On [Date/Time], I saw/responded to [ad/post/message] at [URL/app].
2. The respondent, [name/handle], represented that [false pretenses].
3. Relying on such representations, I transferred ₱[amount] via [bank/e-wallet], Ref. No. [..].
4. Respondent failed to [deliver/return] and has since [blocked/gone silent].
5. Damage: ₱[amount], plus other losses.

Attached as Annexes “A” to “__” are true copies of [screenshots, bank records, etc.].

PRAYER: That charges be filed and appropriate cyber warrants be issued to identify and arrest the respondent(s); and that this case proceed to trial.

[Signature]
[ID details]

SUBSCRIBED AND SWORN ... [Notary/Prosecutor]

10) Special scenarios

Money mules / “borrowed accounts.” Beneficiary accountholders may be liable (estafa, AMLA conspiracy, access device violations) if complicit. Even if not complicit, their accounts can be frozen pending investigation; civil action can target them as recipients of ill-gotten funds.
Cross-border scams. Expect slower recovery. Focus on freezing funds early (banks/e-wallets/CEX) and securing KYC via WDCD. Use MLA channels through NBI/PNP and the DOJ.
Minors or vulnerable victims. Consider counseling/psych-trauma support; include this when claiming moral damages.

11) Frequently asked questions

Q: Can I get my money back without filing a criminal case? A: Sometimes, yes—through recall/chargeback or BSP escalation—but criminal filing often compels custodians to cooperate faster and preserves evidence via warrants.

Q: Do screenshots count as evidence? A: Yes, if properly authenticated under the Rules on Electronic Evidence. Include URLs, timestamps, and, where possible, header/metadata.

Q: How long will investigation take? A: Timelines vary. Bank disputes can resolve in weeks; criminal cases can take months. Early reporting increases the chance of fund holds.

Q: I paid via cash deposit to a name I don’t know. A: Provide the deposit slip and branch/CCTV time for subpoenas. Law enforcement can trace KYC records of the recipient.

Q: Are banks/e-wallets automatically liable? A: Not automatically. Liability depends on facts (e.g., security failures, negligent handling, unfair practices). R.A. 11765 provides consumer remedies but does not guarantee reimbursement in all scenarios.

12) Action plan (one-page checklist)

Within 24 hours: Freeze/recall; preserve evidence; file blotter; send preservation letters.
Within 48 hours: File with PNP-ACG/NBI-CCD; open IDR case with your bank/e-wallet; notify platform/telco.
Within 7–15 business days: Follow up on IDR; escalate to BSP/NPC/SEC if needed; consider Small Claims if identity/assets are known.
Ongoing: Coordinate with investigators on cyber warrants; consider civil action for recovery once identities/assets surface.

13) When to hire counsel

Losses are substantial, there are cross-border elements, or you anticipate platform/bank pushback.
You need tailored strategy for asset tracing and pre-judgment remedies (e.g., attachment).
To draft robust affidavits that align with elements of the offense and maximize recovery prospects.

Final word

Online scams thrive on speed and silence. Move fast, document everything, and use parallel remedies. Even when full reimbursement isn’t immediate, early action often secures critical evidence, freezes funds, and positions you for recovery.