Quick answer

If you paid an online seller and believe you were scammed, act immediately:

Contact the bank, e-wallet, card issuer, or payment provider. Report the transaction as fraudulent or disputed, ask whether the transfer can be held, traced, recalled, or charged back, and obtain a reference number. Do not wait for the seller to respond if money is still moving or your account may be compromised.
Secure your accounts. Change affected passwords, revoke unknown sessions, enable multi-factor authentication, and block compromised cards or wallets. Never share an OTP, PIN, password, recovery code, or remote-access permission.
Preserve the evidence before reporting or blocking the seller. Save the listing, seller profile, messages, payment confirmation, account details, delivery records, and the page’s exact URL.
Report the account and transaction through the shopping platform or social-media service. Ask for a refund and request preservation of the seller’s account and transaction records.
Report suspected crime to the Philippine National Police, particularly the PNP Anti-Cybercrime Group, or to the National Bureau of Investigation. You may also use the Cybercrime Investigation and Coordinating Center’s official reporting service.
For a business-to-consumer sale, file a consumer complaint with the Department of Trade and Industry if the platform or merchant does not resolve it. The DTI’s online portal is the Consumer CARe System.

Reporting to one organization does not automatically report the matter to all the others. A bank report focuses on the money, a platform report on the account or listing, a DTI complaint on consumer remedies, and a police or NBI complaint on possible criminal liability.

First determine whether this is likely a scam or a consumer dispute

Warning signs of possible fraud include:

The seller used a false identity, impersonated a legitimate shop, or supplied fabricated registrations or receipts.
The item apparently never existed, and the seller disappeared immediately after receiving payment.
Several buyers were directed to send money to rotating personal accounts.
The seller demanded additional “release,” “insurance,” “customs,” or “verification” payments after the first transfer.
A parcel contained an intentionally worthless substitute instead of the advertised item.
The seller obtained your OTP, password, card details, or account access through deception.
The account, advertisement, tracking information, or proof of shipment was fabricated.

Late delivery, poor quality, a warranty disagreement, or an unresponsive seller can still violate consumer law, but these facts alone do not conclusively establish a crime. Criminal fraud generally depends on evidence of dishonest intent, deceit, and resulting loss. The seller’s intention at the time of the transaction may therefore matter.

What to do in the first hour

1. Call the payment provider immediately

Use only the telephone number or support channel shown in the provider’s official app, website, or on the back of your card.

Give the provider:

Your name and account or wallet number;
Transaction date, time, amount, and reference number;
Recipient’s name, account number, mobile number, or wallet identifier;
A short explanation of how the transaction occurred;
Whether you authorized the payment yourself or someone gained unauthorized access;
Whether you disclosed an OTP, password, PIN, card information, or identity document; and
The police, CICC, or platform reference number, if already available.

Ask specifically whether the provider can:

Block further transactions;
Temporarily restrict the receiving or affected account;
Initiate an interbank or inter-wallet fraud investigation;
Recall or trace the transfer;
Open a card dispute or chargeback, if applicable;
Preserve transaction and access logs; and
Give you a written acknowledgment and case number.

Under the Anti-Financial Account Scamming Act, BSP-supervised institutions may temporarily hold funds involved in a disputed transaction under applicable BSP rules. The statute permits a hold for the period prescribed by the BSP, not exceeding 30 calendar days unless extended by a court. It also requires coordinated verification among involved institutions and account owners.

This does not guarantee recovery. Money may already have been withdrawn or transferred, and liability depends on the circumstances. The Act provides for restitution where an institution failed to employ adequate risk controls or failed to exercise the legally required diligence; it does not make every scam loss automatically refundable.

If the provider does not adequately address your complaint, escalate it through the BSP Consumer Assistance Mechanism. BSP-CAM is generally a second-level remedy, so first lodge a formal complaint with the bank, e-wallet, or other BSP-supervised institution and keep its reply or proof that it failed to respond.

2. Secure every affected account

If you clicked a suspicious link, installed an app, shared credentials, or allowed screen access:

Disconnect the affected device from the internet if someone still has remote access.
Use a different, trusted device to change passwords.
Start with your email account because it may control password recovery for other services.
Sign out unknown devices and revoke unfamiliar sessions or connected apps.
Replace reused passwords on other accounts.
Enable multi-factor authentication using a secure method.
Block affected cards and request replacement credentials when necessary.
Tell your mobile provider promptly if your SIM stopped working unexpectedly.
Review recent transactions, beneficiaries, forwarding rules, and recovery details.

Do not pay anyone who promises to “hack back,” unlock frozen funds, or recover the money for an advance fee. Recovery scams often target people who have already reported a loss.

Preserve evidence properly

Save evidence before the seller deletes the account, changes the username, or blocks you.

Keep copies of:

The full product listing, price, description, photos, and promised condition;
The seller’s profile name, username, profile URL, account ID, phone number, email address, and stated location;
The full conversation, including dates and times—not only selected messages;
Order confirmation, invoice, receipt, and platform order number;
Payment receipt, transaction reference, recipient account details, and bank or wallet statement;
Courier booking, waybill, tracking history, parcel label, and delivery messages;
Photos or an uninterrupted video of the parcel, packaging, contents, and defects;
Links to duplicate listings or other accounts apparently operated by the same person;
The platform, payment-provider, and government complaint acknowledgments; and
A chronological account of what happened while your memory is fresh.

Screenshots are useful, but also preserve original emails, downloaded statements, files, URLs, and devices when possible. Do not crop out the username, date, time, address bar, transaction reference, or surrounding conversation. Avoid editing original files. Keep a backup in a separate secure location.

Do not obtain evidence by breaking into an account, impersonating another person, publishing private data, or threatening the suspected seller. Investigators can seek subscriber and computer data through lawful processes under the Cybercrime Prevention Act and applicable court rules.

Report the seller to the platform

Use the platform’s in-app order dispute or reporting system. Select the most accurate reason, such as item not received, counterfeit item, materially different product, impersonation, account takeover, or fraudulent payment request.

In the report:

State the order and payment references.
Give a short timeline.
Identify the exact representation that was false.
State the remedy requested—refund, replacement, cancellation, or account investigation.
Ask the platform to preserve the seller’s registration, login, listing, message, and transaction records for lawful requests from authorities.
Save the complaint number and every response.

For covered internet transactions, the Internet Transactions Act of 2023 requires e-marketplaces and relevant digital platforms to provide a responsive mechanism for reporting unlawful users or content. It also generally requires an aggrieved party seeking remedies under the Act to use the platform’s, marketplace’s, or e-retailer’s internal redress process first. That mechanism is deemed exhausted if the complaint remains unresolved after seven calendar days.

Do not interpret that seven-day rule as a reason to postpone an urgent bank fraud report, account-security action, or request for law-enforcement assistance. Those steps may be time-sensitive.

File a DTI consumer complaint when the seller was acting as a business

The Internet Transactions Act covers business-to-consumer and business-to-business internet transactions within the DTI’s mandate when a party is in the Philippines or the online business targets the Philippine market and has sufficient contacts here. It expressly excludes purely consumer-to-consumer transactions.

A person regularly selling goods through Facebook, Instagram, TikTok, an e-marketplace, or a similar service may be an online merchant even without a conventional storefront. Whether a particular account was acting in the ordinary course of business is a factual question.

After using the merchant’s or platform’s internal complaint process, submit the complaint through the DTI Consumer CARe System. Attach:

Proof of purchase and payment;
The advertisement and seller information;
Relevant messages;
Delivery or non-delivery evidence;
Your written demand and the seller’s response;
The platform complaint and result, or proof that seven calendar days passed without resolution; and
A clear statement of the remedy sought.

Online consumers may pursue repair, replacement, refund, or other remedies where goods are defective, lost without the consumer’s fault, fail to match the description or warranty, or otherwise breach the merchant’s obligations. When replacement or refund is chosen, the merchant is generally entitled to the return of the original goods without cost to the consumer, subject to the Act’s qualifications.

A claim for damages under Section 28 of the Internet Transactions Act must be brought before the court or DTI within two years from the time the cause of action arose. Other claims or offenses may have different prescriptive periods. Do not assume this two-year period applies to every possible case.

DTI is not the principal agency for a private, one-off consumer-to-consumer sale, a criminal investigation, or a dispute concerning a regulated financial service. Other civil or criminal remedies may still apply.

Report suspected crime to law enforcement

Report to one of the following:

The nearest PNP station or the PNP Anti-Cybercrime Group;
The National Bureau of Investigation, including its cybercrime investigators or an appropriate regional or district office; or
The Cybercrime Investigation and Coordinating Center through the reporting channels currently published on its official website.

Because telephone numbers, email addresses, and intake arrangements can change, verify them on the agency’s official government website instead of relying on a reposted social-media graphic.

Bring or prepare:

A government-issued ID;
A signed chronological narration;
Printed and electronic copies of the evidence;
Original devices or files if investigators ask to inspect them;
Recipient account and transaction details;
Estimated total loss;
Names of other known victims; and
Reference numbers from the bank, platform, CICC, or DTI.

Ask for an acknowledgment, blotter entry, complaint reference, or receiving copy. An initial report does not itself mean that charges have been filed. Investigators may request an affidavit and further evidence, and a prosecutor may later conduct a preliminary investigation where required.

Depending on the proven facts, the conduct may involve estafa under Article 315 of the Revised Penal Code, computer-related fraud or identity theft under the Cybercrime Prevention Act, or offenses under the Anti-Financial Account Scamming Act. The correct charge is for investigators and prosecutors to determine. A broken promise or unpaid obligation is not automatically criminal fraud.

If your identity or personal data was exposed

If you sent a selfie with an ID, identity documents, card information, or account credentials:

Notify the issuing institution and affected financial providers.
Ask whether the document or account should be replaced or specially monitored.
Watch for unauthorized loans, wallets, SIM registrations, and account-recovery attempts.
Preserve phishing messages and any evidence that your information was misused.
Report suspected identity theft to the PNP or NBI.

A complaint to the National Privacy Commission may also be appropriate when a business or personal-information controller unlawfully processed, disclosed, or failed to protect your personal data. The NPC does not replace a bank fraud report or criminal complaint.

If the seller is abroad or used a fake identity

Philippine law may still apply to an online business that targets the Philippine market and has the legally required minimum contacts, even without a local office. Enforcement and recovery can nevertheless be slower when the seller, platform, records, or funds are overseas.

If the seller’s identity is unknown, provide investigators with account numbers, usernames, profile URLs, telephone numbers, email addresses, transaction references, and timestamps. Platforms and financial institutions ordinarily cannot simply disclose protected subscriber information to a private complainant. Investigators may use subpoenas, cybercrime warrants, or other lawful processes to obtain records.

Common mistakes that can weaken a report

Waiting several days before notifying the bank or e-wallet;
Continuing to send “release” or “refund processing” payments;
Deleting the conversation after becoming upset;
Blocking the seller before preserving the profile and messages;
Submitting cropped screenshots without dates, URLs, or account identifiers;
Publicly accusing the wrong person based only on the name attached to a receiving account;
Assuming that a payment recipient is necessarily the main scammer—the account may belong to a money mule or an identity-theft victim;
Filing only with the platform and assuming police or the bank will automatically be notified;
Using unofficial “recovery agents” who demand advance payment;
Exaggerating facts or submitting altered evidence; and
Sending OTPs or passwords to someone claiming to investigate the case.

Report only what you know, distinguish facts from suspicions, and correct any material mistake promptly. AFASA separately penalizes malicious or bad-faith reporting of completely unwarranted or false information that results in a temporary hold on funds.

When help is urgent

Seek immediate assistance if:

A transfer was made recently and the funds may still be traceable;
Someone currently controls your bank, wallet, email, social-media account, or phone;
You disclosed an OTP, PIN, password, recovery code, or remote-access permission;
The scammer is threatening violence, extortion, stalking, or publication of intimate material;
A child, senior citizen, or otherwise vulnerable person is being targeted;
Your identity documents are being used to open accounts or obtain loans;
Multiple victims or large, rapidly moving transactions are involved; or
You received a demand to act secretly or send more money to recover the first payment.

For immediate danger, contact emergency services or the nearest police station. For a significant loss, disputed account liability, an overseas suspect, or a case involving several victims, consult a Philippine lawyer promptly. The Public Attorney’s Office may be an option for people who meet its eligibility and case requirements.

Frequently asked questions

Can the bank or e-wallet reverse the payment?

Possibly, but not automatically. Recovery depends on the payment method, how quickly the fraud was reported, whether funds remain available, the provider’s rules, and the investigation results. An authorized transfer induced by deception may be treated differently from a transaction made after unauthorized account access.

Should I report even if the amount is small?

Yes. The report may help identify linked accounts or other victims. Keep your expectations realistic: investigation and recovery will depend on available evidence and enforcement priorities, not only the amount lost.

Is a Facebook Marketplace sale covered by the Internet Transactions Act?

It may be covered if the seller was acting as an online merchant in the course of business. A genuinely private, one-off sale between two end-users is a consumer-to-consumer transaction and is excluded from that Act, although the Revised Penal Code, Cybercrime Prevention Act, Civil Code, and other laws may still apply.

Must I wait seven days before going to the police?

Do not delay urgent efforts to secure an account, report a financial transaction, preserve evidence, or seek protection. The seven-calendar-day rule concerns exhaustion of the online business’s internal redress mechanism for remedies under the Internet Transactions Act. A suspected crime or active account compromise may require immediate reporting.

Is non-delivery automatically estafa?

No. Non-delivery is important evidence but can also arise from breach of contract, logistics failure, or another consumer dispute. Estafa generally requires proof of the statutory form of deceit or fraudulent abuse and resulting damage. The complete circumstances and the seller’s conduct before and after payment matter.

Can I post the seller’s name and bank account online?

Use caution. A payment account may belong to a mule, an impersonated person, or another victim. Public accusations can expose personal data, interfere with an investigation, or create separate legal risk. Give identifying information to the platform, financial provider, and authorities instead.

Can I recover legal fees or damages?

That depends on the legal basis, documents, actual loss, and findings of the DTI or court. Refund rights do not automatically include every amount claimed. Keep receipts for the purchase and other directly related expenses and obtain case-specific legal advice before claiming additional damages.

What if the platform refuses to reveal the seller’s identity?

Preserve the refusal and give investigators the profile URL, account identifiers, and transaction details. Under the Internet Transactions Act, platforms may be required to provide specified merchant or subscriber information upon a competent authority’s subpoena issued in connection with a qualifying sworn complaint.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the transaction, evidence, payment method, platform, and agencies involved. Official sources and publicly available procedures were last checked on September 15, 2026.