Losing money to an investment fraud is painful enough. A recovery fee scam makes the situation worse by approaching victims with a promise to recover the original investment—then demanding an “advance fee,” “tax,” “clearance charge,” “court bond,” “blockchain fee,” or “release payment.” The recovery agent may claim to be a lawyer, government investigator, bank officer, foreign regulator, cybersecurity expert, or representative of an international organization. In many cases, the promised recovery does not exist, and every additional payment becomes a new fraud loss.

The most important step is to stop paying and act quickly. A victim should immediately secure affected accounts, report the latest transfer to the bank or e-wallet provider, preserve electronic evidence, and file reports with the proper Philippine authorities. The original investment fraud and the later recovery fee scam should be documented separately but connected in one clear chronology.

What Is a Recovery Fee Scam?

A recovery fee scam usually begins after a victim has already lost money to a fake investment, cryptocurrency platform, forex scheme, online trading operation, or unlicensed investment solicitation.

The supposed recovery agent may say that:

The missing funds have already been located.
A court, bank, regulator, or cryptocurrency exchange is holding the money.
The victim must pay a tax before the funds can be released.
An “anti-money laundering certificate” or “source-of-funds clearance” is required.
A government investigator needs a processing or facilitation fee.
A cryptocurrency wallet must be “activated” or “synchronized.”
A refundable security deposit or court bond must be paid.
A percentage of the recovered amount must be paid in advance.
The victim must install remote-access software or disclose an OTP, password, seed phrase, or private key.

The scammer may know the victim’s name, original investment amount, transaction dates, and the name of the first fraudulent platform. This does not prove that the recovery is genuine. The same criminal group may be operating both scams, or the victim’s information may have been sold or shared through a fraud “lead list.”

A recovery service is not automatically fraudulent merely because it charges professional fees. The warning signs are false identities, guaranteed recovery, unexplained advance payments, pressure to act immediately, payment to personal or unrelated accounts, requests for security credentials, and unverifiable claims that money has already been seized or frozen.

Is a Recovery Fee Scam a Crime in the Philippines?

Estafa through false pretenses

The principal offense is commonly estafa, or swindling, under Article 315 of the Revised Penal Code. Article 315 covers fraud committed through false pretenses or fraudulent acts made before or at the same time the victim parts with money.

For estafa by deceit, prosecutors generally look for the following:

The accused made a false statement, representation, or fraudulent claim.
The false representation was made before or at the time the victim paid.
The victim relied on the representation.
Because of that reliance, the victim transferred money or property and suffered damage.

A person who falsely claims to be an NBI agent, lawyer, regulator, bank officer, or asset recovery specialist and induces a victim to pay a nonexistent “release fee” may therefore face estafa charges. The Supreme Court has applied these elements to fraudulent investment solicitations and other schemes in which victims surrendered money because of deliberate misrepresentations. (LawPhil)

The current text of the law may be reviewed in the Revised Penal Code on Lawphil.

Estafa committed through the internet

Most recovery scams operate through Facebook, Messenger, Telegram, WhatsApp, email, websites, online advertisements, or video calls.

Section 6 of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers crimes under the Revised Penal Code and special laws when committed through information and communications technology. When applicable, the penalty is generally one degree higher than the penalty for the underlying offense. Philippine Regional Trial Courts designated as cybercrime courts may exercise jurisdiction when an element occurred in the Philippines, a computer system involved was wholly or partly located here, or the offense caused damage to a person who was in the Philippines at the time. (Supreme Court E-Library)

The official text is available through the Supreme Court E-Library’s copy of RA 10175.

Anti-Financial Account Scamming Act

Republic Act No. 12010, the Anti-Financial Account Scamming Act or AFASA, applies to specified forms of financial account misuse. It criminalizes money-mule activities, such as knowingly allowing an account to receive, transfer, or withdraw criminal proceeds. It also penalizes certain social-engineering schemes involving the fraudulent acquisition of sensitive account information and unauthorized access or control.

This can be relevant when the recovery scam:

Uses rented, borrowed, fictitious, or purchased bank or e-wallet accounts.
Induces the victim to disclose passwords, OTPs, card details, or wallet credentials.
Takes control of the victim’s financial account.
Routes the payment through several mule accounts.
Uses another person’s identity documents to open an account.

AFASA does not mean that every fraud loss is automatically refundable. Its importance is that it gives covered financial institutions mechanisms to trace disputed electronic transfers, temporarily hold available funds, and conduct coordinated verification. (Supreme Court E-Library)

The law may be read in the official text of RA 12010.

Securities law violations

When the original scheme involved shares, investment contracts, profit-sharing arrangements, pooled funds, cryptocurrency investment packages, or similar profit-making ventures, Republic Act No. 8799, the Securities Regulation Code, may also apply.

Among other things:

Section 8 generally prohibits the public sale or offering of securities without the required SEC registration, subject to statutory exemptions.
Section 26 prohibits fraudulent schemes, material misstatements, and acts operating as fraud in connection with securities.
Section 28 generally prohibits a person from acting as a securities broker, dealer, or salesman without SEC registration.

The Supreme Court has held that an arrangement may be an “investment contract” requiring registration even when it is marketed under another label. Registration of a corporation by itself does not necessarily authorize the company to solicit investments from the public. (Supreme Court E-Library)

Large organized investment schemes may also fall under Presidential Decree No. 1689 on syndicated estafa when the legal requirements are met, including participation by a syndicate of at least five persons and defraudation involving funds solicited from the public. This classification depends heavily on the structure of the group and the evidence connecting its members. (Supreme Court E-Library)

What to Do Immediately After Paying a Fake Recovery Agent

1. Stop all further payments and communication

Do not pay another fee to “complete” the recovery. A scammer who receives one payment will often invent a second problem, such as:

Unpaid tax
Incorrect beneficiary details
Suspicious transaction clearance
Currency conversion charge
Insurance fee
Wallet activation fee
Late-payment penalty
Customs or remittance charge

Do not argue with the scammer or reveal that a criminal report is being prepared. Block access only after preserving the relevant messages, account identifiers, and profile links.

2. Secure every affected account

Change passwords using a device that the scammer has never controlled. Start with the email account linked to banking, e-wallet, social media, and cryptocurrency accounts.

Also:

Enable multi-factor authentication.
Log out all unknown devices and sessions.
Remove remote-access applications such as AnyDesk or TeamViewer if the scammer instructed you to install them.
Call the bank or e-wallet if an OTP, PIN, card number, password, seed phrase, or identification document was disclosed.
Move remaining cryptocurrency to a new wallet if the private key or seed phrase was exposed.
Ask the mobile provider about SIM replacement or account security if the scammer obtained SIM-related information.

A seed phrase or private key cannot be made safe by merely changing an app password. Once exposed, the wallet should be treated as compromised.

3. Report the transfer to the sending bank or e-wallet immediately

Use the fraud hotline found inside the official app, on the bank card, or on the institution’s verified website. Do not call a number supplied by the recovery agent.

Provide:

Transaction reference number
Sending account
Beneficiary account
Amount
Date and exact time
Transfer channel
Reason the transaction was induced by fraud
Screenshots or messages showing the false representation

Ask the institution to:

Register the matter as a fraud or disputed-transaction complaint.
Issue a written acknowledgment and case reference number.
Determine whether the funds remain in the beneficiary account.
Send a holding request to the receiving institution.
Begin coordinated verification under RA 12010 and BSP Circular No. 1215, when applicable.
Preserve transaction, login, device, and beneficiary-account records.
Inform you promptly whether additional sworn documents are needed.

Under BSP Circular No. 1215, an initial hold on available disputed funds may last up to five calendar days. When justified, it may be extended by up to 25 additional calendar days. Supporting documents such as a sworn complaint, affidavit, or police report may be needed during the initial period, which is why a victim should not wait several days before preparing them.

A hold is not guaranteed. The funds may already have been withdrawn, converted to cryptocurrency, or moved through several accounts. Even when no money is successfully held, covered institutions must conduct coordinated verification under the applicable rules. The prescribed process is generally completed within 30 calendar days, with a possible extension to 60 days in certain cases where no funds were held.

For a credit-card payment, ask the issuer about a chargeback or transaction dispute immediately. The AFASA temporary-holding rules generally do not apply to ordinary credit-card transactions unless the card was used for an electronic fund transfer through an Automated Clearing House. Card-network and issuer deadlines may apply.

4. Preserve the evidence before accounts disappear

Scammers frequently delete profiles, revoke messages, change usernames, abandon phone numbers, and replace websites. Evidence should be collected before this happens.

Keep the following:

Evidence	What to preserve
Chats	Full conversation, visible username, profile name, phone number, dates, and timestamps
Emails	Original email files and full headers, not only screenshots
Social-media profiles	Profile URL, username, page ID, advertisements, comments, and account creation details if visible
Payment records	Receipts, bank statements, transaction references, QR codes, beneficiary names, and account numbers
Cryptocurrency records	Wallet addresses, transaction hashes, exchange details, network used, and blockchain links
Websites	Full URL, screenshots, domain name, claimed office address, and downloadable documents
Calls	Call logs, phone numbers, dates, duration, lawful voicemail recordings, and notes of what was said
Documents	Fake court orders, recovery certificates, government IDs, contracts, invoices, demand letters, and tax notices
Device evidence	Remote-access app details, login alerts, malware warnings, and unfamiliar devices or sessions

Keep the original files. Avoid cropping, editing, adding annotations to, or resaving the only copy. Create a working copy for highlighting and retain an untouched copy on a separate drive or secure cloud account.

Prepare a one-page chronology showing:

Date and time
Person or account involved
Representation made
Action taken
Amount transferred
Destination account
Transaction reference
Supporting file name

This greatly reduces confusion when explaining two connected frauds involving many transactions.

5. File a criminal complaint

For online recovery scams, a victim may report to:

The NBI Cybercrime Division
A regional NBI cybercrime office
The PNP Anti-Cybercrime Group
The Cybercrime Investigation and Coordinating Center
The nearest police station, which may refer the complaint to a specialized unit

The NBI’s published process includes completion of a complaint sheet, preliminary interview, sworn statements from complainants and witnesses, submission of supporting documents, and examination of a relevant device when necessary. The NBI Citizen’s Charter states that this initial intake service has no government fee, although the investigation itself will take longer than the posted intake time. (National Bureau of Investigation)

The NBI online complaint page may be used as an initial channel, while the NBI Cybercrime Division’s complaint procedure explains the in-person requirements.

A strong complaint package ordinarily contains:

A notarized complaint-affidavit.
A chronological narrative written in numbered paragraphs.
Copies of valid identification.
Proof of each payment.
Screenshots and exported conversations.
Email headers and electronic records.
Beneficiary-account and wallet details.
A list of witnesses.
A table summarizing the original investment loss and the separate recovery-fee loss.
A request that relevant electronic and financial records be preserved.

The affidavit should state exactly what was represented, why it was false, when the victim relied on it, and how much was lost. General statements such as “I was scammed” are less useful than a transaction-by-transaction explanation.

6. Report the investment component to the SEC

If the original fraud involved an investment solicitation, securities, pooled funds, profit sharing, trading packages, or a person claiming to be an investment broker, submit a report through SEC iMessage.

Attach:

Investment contracts or subscription forms
Proof of solicitation
Advertisements and presentations
Promised returns
SEC registration numbers claimed by the promoter
Names of recruiters or uplines
Payment records
Website and social-media details
Recovery-scam communications connecting the second scam to the original scheme

SEC reporting can help identify unregistered securities offerings, unlicensed salespersons, and recurring schemes. It does not by itself guarantee reimbursement and does not replace a bank fraud report or criminal complaint. The current SEC iMessage portal accepts complaints and provides a ticket-tracking system. (imessage.sec.gov.ph)

7. Escalate unresolved bank or e-wallet complaints to the BSP

The financial institution’s own Financial Consumer Protection Assistance Mechanism is the first-level complaint channel. When the response remains unresolved or inadequate, the complaint may be elevated through the BSP Consumer Assistance Channels, including the BSP Online Buddy or the official Complaint, Inquiry and Request form.

Include:

The institution’s complaint reference number
Proof that the complaint was first raised with the institution
The institution’s written response, if any
Transaction details
A concise explanation of the requested resolution
Supporting evidence, with unnecessary sensitive credentials removed

BSP Consumer Assistance facilitates the handling of complaints against BSP-supervised institutions. Criminal investigation remains the function of law-enforcement agencies. The BSP specifically instructs fraud victims to report criminal activity to the PNP, NBI, or CICC.

Never send an OTP, PIN, password, full card credentials, or wallet seed phrase as a complaint attachment.

What Happens After a Criminal Complaint Is Filed?

An NBI or police report begins an investigation; it is not yet a criminal case in court.

Investigators may:

Interview the victim and witnesses.
Examine devices and electronic communications.
Request preservation or disclosure of account and subscriber records through the proper legal process.
Coordinate with banks, e-wallet providers, telecommunications companies, platforms, and cryptocurrency exchanges.
Identify other victims.
Trace account holders and money mules.
Refer the completed investigation to the appropriate prosecutor.

A formal complaint may also be filed with the Office of the City or Provincial Prosecutor having proper authority over the offense. The respondent is ordinarily given an opportunity to answer through a counter-affidavit. The prosecutor then determines whether the evidence meets the applicable DOJ-National Prosecution Service standard for filing an Information—the formal criminal charge—in court.

Current preliminary-investigation procedures are governed by the 2024 DOJ-NPS rules. Regular or expedited procedures may apply depending on the offense, prescribed penalty, and court jurisdiction. The Supreme Court has recognized the DOJ’s authority to issue these rules and has explained the current division between regular, summary, and expedited investigation. (Supreme Court E-Library)

In practice, resolution may take weeks or months, especially when:

The suspect uses a false identity.
Several banks or jurisdictions are involved.
Records must be obtained from foreign platforms.
Cryptocurrency must be traced.
Multiple victims and transactions must be consolidated.
Subpoenas are not immediately served.
The prosecutor’s office has a heavy caseload.

A bank’s five-day initial holding period should not be confused with the duration of the criminal investigation. The financial hold is an urgent preservation measure; the criminal process is separate and usually much longer.

Can the Victim Recover Money Through a Civil Case?

Yes, depending on the available defendants, evidence, assets, and cost of litigation.

Article 100 of the Revised Penal Code provides that a person criminally liable for a felony is also civilly liable. A criminal court may therefore order restitution or payment of proven damages when the accused is convicted. (LawPhil)

Civil Code provisions may also support recovery:

Article 19 requires persons to act with justice, honesty, and good faith.
Article 20 requires a person who causes damage contrary to law to indemnify the injured party.
Article 21 provides compensation for wilful injury contrary to morals, good customs, or public policy.
Article 22 requires the return of a benefit obtained at another person’s expense without just or legal ground. (LawPhil)

A separate civil action may be worth considering when:

The scammer or account holder has identifiable Philippine assets.
A company or responsible officer can be properly identified.
Funds are traceable to a particular recipient.
The amount justifies docket fees and litigation expenses.
Urgent provisional remedies may be legally available.
The criminal investigation is delayed but sufficient civil evidence exists.

Civil docket fees generally depend on the amount claimed. Other expenses may include notarization, certified records, service of summons, expert examination, translations, authentication of foreign documents, and professional fees.

Winning a judgment does not automatically produce payment. Recovery still depends on locating assets that can lawfully be attached or executed upon.

Common Mistakes That Reduce the Chance of Recovery

Paying to “unlock” already recovered funds

Legitimate Philippine agencies do not require a victim to transfer money to a private account, cryptocurrency wallet, or individual employee to release seized funds.

Government taxes, lawful court fees, and official charges have identifiable legal bases and formal payment channels. A screenshot of a supposed assessment, invoice, or court order is not proof that the charge is genuine.

Waiting for the scammer’s promised deadline

The scammer’s “final deadline” is artificial. The relevant deadline is the rapidly closing window before funds are withdrawn or transferred.

Report first. Organize the remaining evidence immediately afterward.

Deleting embarrassing conversations

Messages showing fear, persuasion, repeated promises, or the victim’s reliance may help prove deceit. Delete nothing simply because it feels embarrassing.

Reporting only the original investment fraud

The recovery-fee payment is a separate loss and may involve different accounts, identities, and offenses. Clearly label it as a second incident while explaining its connection to the original scheme.

Sending edited screenshots only

Investigators need context. A cropped image may omit the username, date, URL, transaction reference, or earlier representation that proves the fraud.

Publicly accusing every account holder

A beneficiary account may belong to a knowing participant, a money mule, an identity-theft victim, or a person whose account was compromised. Investigators must determine the account holder’s role.

Posting unverified accusations can also alert suspects, cause evidence to disappear, and create possible defamation issues. Public warnings should redact sensitive details and distinguish verified facts from suspicions.

Hiring a “hacker” to retrieve the money

A person offering to hack an account, exchange, or wallet is often another scammer. Unauthorized access may also constitute an offense under RA 10175. Victims should not expose themselves to a new loss or possible criminal liability through a “hack-back” arrangement.

Special Considerations for OFWs and Foreign Victims

A victim does not necessarily have to be a Filipino citizen to report a scam connected to the Philippines. Philippine jurisdiction may exist where relevant acts, computer systems, perpetrators, accounts, or damage fall within the jurisdictional rules of Philippine law. Cross-border cases are more difficult, however, because foreign subscriber records, witnesses, exchanges, and bank accounts may require international cooperation. (Supreme Court E-Library)

An overseas complainant should prepare:

A clear affidavit describing the fraud.
Passport or government identification.
Proof of residence and contact details.
Original electronic evidence.
Certified translations for documents not in English or Filipino.
A special power of attorney when a Philippine representative must submit or receive documents.
Proper authentication of documents executed abroad.

For countries participating in the Apostille Convention, a private document such as an affidavit or special power of attorney is generally notarized according to local requirements and then apostilled by the competent authority. Another option may be notarization before the appropriate Philippine Embassy or Consulate. Requirements vary by country. (Philippine Embassy)

Official information is available through the Philippine Apostille portal.

For a non-Apostille country, consular authentication or legalization requirements may apply. The receiving Philippine agency or prosecutor should also be asked whether it requires the original apostilled document, an electronic copy for initial evaluation, or personal appearance at a later stage.

Typical Timeline and Costs

Step	Practical timing	Usual direct government charge
Bank or e-wallet fraud report	Immediately, preferably within hours	Usually none
Initial AFASA holding, if applicable and funds remain	Up to 5 calendar days	None
Possible extended holding	Up to 25 additional calendar days	None
Coordinated verification	Usually within 30 days; certain no-hold cases may extend to 60 days	None
NBI or police complaint intake	Often started the same day documents are presented	None for NBI’s published intake service
SEC online report	Ticket may be submitted once evidence is organized	No private “recovery fee”
Prosecutor proceedings	Commonly weeks to months, depending on service and complexity	Usually no criminal complaint filing fee; document expenses may arise
Court proceedings	Several months to years	Criminal prosecution is by the State; separate civil claims may involve docket and litigation costs

These periods do not guarantee recovery. The best financial opportunity usually exists before the recipient withdraws or transfers the money.

Frequently Asked Questions

Can a bank reverse money I voluntarily transferred to a scammer?

Possibly, but not automatically. A transfer authorized by the account holder can still have been induced by fraud. Report it immediately and ask whether the transaction qualifies for holding and coordinated verification under RA 12010 and BSP Circular No. 1215. Recovery is more likely when funds remain identifiable within participating institutions.

The scammer says the fee is refundable. Should I pay?

No further payment should be made merely because the scammer labels it refundable. Recovery scammers routinely describe each new fee as refundable and then invent another charge.

Can the NBI freeze the scammer’s bank account immediately?

A victim’s report does not automatically freeze an account. Financial institutions may temporarily hold qualifying disputed funds under AFASA and BSP rules. Longer restraints, searches, disclosure orders, or seizure measures may require the appropriate legal authority or court process.

Should I report the scam even when the amount is small?

Yes. Smaller reports may connect an account, phone number, wallet, website, or identity to a larger operation. Multiple complaints can help investigators establish patterns and identify other victims.

What if I paid in cryptocurrency?

Preserve the wallet address, transaction hash, blockchain network, date, amount, exchange account, and screenshots. Contact the exchange immediately if the destination wallet is hosted by a known exchange. Blockchain transactions are normally irreversible, but exchanges may preserve records or restrict accounts when legally justified.

Can I recover money from the owner of the receiving account?

Potentially, but the account holder’s role must be established. The holder may be a conspirator, paid money mule, negligent participant, identity-theft victim, or compromised-account owner. Criminal and civil liability depends on knowledge, participation, benefit, and the evidence.

Is a barangay complaint required before filing estafa?

Recovery scams commonly involve unknown offenders, parties living in different cities or countries, or offenses outside the ordinary scope of barangay conciliation. Victims should not delay an urgent bank or cybercrime report while trying to locate the scammer for barangay proceedings. The appropriate prosecutor or investigating agency can determine whether any preliminary local process is legally relevant to the particular facts.

What if the recovery agent claims to be a lawyer?

Verify the lawyer’s full name independently through official professional records and contact the stated law office using information obtained from a separate, reliable source. A legitimate name may have been copied or impersonated. Do not rely on a photo of an identification card, an email signature, or a social-media profile alone.

Will filing a criminal complaint guarantee repayment?

No. A complaint can lead to investigation, prosecution, restitution, and the identification of assets, but repayment depends on whether funds or other assets can still be found and lawfully recovered.

Should the original fraud and recovery scam be filed together?

They should be clearly connected but separately itemized. Prepare distinct sections for the original investment fraud and the later recovery-fee fraud, with separate transaction tables, representations, recipients, and losses. Investigators can then determine whether the same group committed both schemes.

Key Takeaways

A person demanding advance payment to release supposedly recovered investment funds may be committing estafa and related cybercrime offenses.
Stop all payments, secure affected accounts, and preserve the complete electronic record.
Report the latest transfer to the sending bank or e-wallet immediately and obtain a case reference number.
Ask whether temporary holding and coordinated verification under RA 12010 and BSP Circular No. 1215 apply.
Submit sworn supporting documents quickly because an initial hold may last only five calendar days.
Report online fraud to the NBI, PNP Anti-Cybercrime Group, or CICC, and report investment-solicitation issues through SEC iMessage.
Escalate unresolved complaints against BSP-supervised institutions through the BSP Consumer Assistance Mechanism.
Document the original investment fraud and recovery-fee scam as separate losses linked by one chronology.
Never disclose an OTP, PIN, password, private key, or seed phrase to a recovery agent, investigator, or supposed government official.
Criminal, civil, regulatory, and financial-institution remedies can proceed on different timelines; taking one step does not replace the others.