A Philippine legal guide for victims, advocates, and compliance teams

1) What “Telegram game scams” look like (and why they spread fast)

“Telegram game scams” are fraud schemes marketed or operated through Telegram—often disguised as mini-games, “tap-to-earn” apps, play-to-earn (P2E) tokens, crypto airdrops, online betting, or “task games.” The scam isn’t the game mechanic itself; it’s the deceptive extraction of money, credentials, personal data, or access.

Common patterns in the Philippines include:

A. “Pay to withdraw” / “upgrade to cash out”

You’re told you’ve earned money in a Telegram mini-game, but withdrawals require:

a “verification fee,” “gas fee,” “tax,” “processing fee,” or
purchasing a “VIP level,” “booster,” “premium wallet,” or “license.”

Once you pay, the required fee keeps escalating, or you’re blocked.

B. “Tasking” and “recharge” scams (commission bait)

You’re paid small amounts early (to build trust), then asked to “recharge” larger sums to complete tasks or unlock higher commissions. Often tied to:

e-wallet transfers,
bank deposits,
crypto transfers, or
“agent-assisted” cash-in.

C. Fake airdrops, phishing bots, and wallet-drainers

A Telegram bot asks you to:

connect a crypto wallet,
sign a message/transaction,
provide seed phrases/OTP, or
click links to “claim rewards.”

Result: account takeover, wallet drained, SIM/e-wallet compromised.

D. Impersonation of brands, influencers, or “support”

Scammers pose as:

a “Telegram Support” agent,
a well-known local fintech/crypto exchange,
celebrities/influencers,
game devs/admins/mods.

E. Pyramid / investment solicitation hidden behind “gaming”

A “game” is really a recruitment-based money scheme:

“buy slots,” “buy nodes,” “buy characters,” “buy mining rigs,”
earn from referrals, not actual gameplay revenue.

F. Illegal online gambling skins

“Games” function as betting platforms or link to unlicensed gambling/payment channels—often involving money mule accounts and quick group deletions.

2) The Philippine legal framework that typically applies

2.1 Core criminal law: Estafa (Swindling) and related deceit

Most Telegram game scams are prosecuted as Estafa under the Revised Penal Code (RPC), especially where there is:

deceit (false pretenses), and
damage or prejudice (you lost money/property).

Estafa theories commonly used:

false pretenses/fraudulent acts used to induce payment;
misappropriation/abuse of confidence, if money was entrusted for a purpose and diverted.

Key practical point: Prosecutors look for a clear narrative of deception + transfer of value + loss.

2.2 Cybercrime overlay: RA 10175 (Cybercrime Prevention Act)

If the scam is executed through ICT (Telegram, links, wallets, bots), cases often invoke RA 10175, commonly as:

Computer-related fraud (fraud done through a computer system),
Computer-related identity theft (using another’s identity, accounts, SIMs),
and/or the rule that crimes committed through ICT may carry enhanced penalties (depending on charge structure and prosecutorial strategy).

Even when the underlying offense is “traditional” (like Estafa), the cyber context affects:

investigative authority (cybercrime units),
evidence handling,
warrants and preservation orders,
chain-of-custody expectations for digital evidence.

2.3 E-Commerce Act: RA 8792

RA 8792 supports recognition and admissibility of electronic data messages and electronic documents, and helps frame offenses involving electronic transactions and electronic evidence.

2.4 Data Privacy Act: RA 10173 (when personal data is misused)

If the scam involves:

harvesting IDs/selfies,
collecting contacts,
doxxing,
unauthorized processing/sharing of personal data, you may have a parallel complaint angle under RA 10173, usually raised with the National Privacy Commission (NPC) or as an ancillary criminal/civil issue.

2.5 Anti-Money Laundering Act: RA 9160 (as amended)

Victim reports and law enforcement referrals can trigger AML red flags where proceeds are laundered through:

banks,
e-wallets,
remittance centers,
crypto off-ramps,
mule accounts.

As a victim, you typically don’t “file an AMLA case” directly; rather, your report to law enforcement and to the financial institution helps enable:

rapid blocking/freezing (where possible under internal fraud protocols),
escalation to regulators/compliance,
formal requests/orders through proper legal channels.

2.6 SIM Registration Act: RA 11934

Where scammers used PH mobile numbers (for e-wallets, OTP interception, or comms), RA 11934 may assist investigators in identifying registrants—subject to lawful process. It’s not a guaranteed identity fix (fake IDs and mule registrations exist), but it can be a lead.

2.7 Civil law: recovery and damages

You may pursue:

civil action for damages (often impliedly instituted with the criminal case for Estafa unless reserved),
claims against identifiable persons/entities who received the money (including mule account owners), depending on evidence and defenses.

Reality check: civil recovery is easiest when the recipient is identifiable and funds are traceable and still reachable.

3) Where to report in the Philippines (primary channels)

A. Law enforcement (criminal complaint intake)

PNP Anti-Cybercrime Group (PNP-ACG)
NBI Cybercrime Division

These offices commonly accept complaints involving online fraud, messaging platforms, e-wallet scams, and crypto-related fraud (with appropriate supporting evidence).

B. Prosecutor / DOJ pathway

Complaints can proceed to the Office of the City/Provincial Prosecutor for preliminary investigation once you have a proper affidavit-complaint and annexes.
For cybercrime procedure and coordination, the DOJ Office of Cybercrime (OOC) may become relevant depending on case routing and operational needs.

C. Financial institution / e-wallet / bank fraud desks (urgent parallel action)

If you paid through:

bank transfer,
e-wallet (GCash/Maya/etc.),
card payment,
remittance, immediately report to the issuing bank/e-wallet and request:
fraud tagging,
recall attempt (if applicable),
recipient account review,
preservation of transaction logs.

Time matters—some internal controls work only within short windows.

D. National Privacy Commission (if identity documents were taken or exposed)

If the scam involved collection or misuse of personal information (IDs, selfies, contact list, etc.), you can file a complaint or request assistance with the NPC, especially for:

doxxing,
unauthorized processing,
breach-like incidents.

E. Platform reporting (Telegram)

Report:

the account,
group/channel,
bot,
message threads, and keep a record of your report.

Platform reporting alone rarely restores funds, but it can:

reduce further victimization,
support your narrative that you acted promptly,
corroborate account identifiers.

4) What to do immediately (victim triage checklist)

4.1 Preserve evidence properly (before scammers delete chats)

Do this first, calmly and quickly:

Telegram evidence

Screenshot key messages with timestamps and usernames/handles visible.
Capture:
- the scam pitch and promises,
- payment instructions,
- “withdrawal fee” demands,
- threats/blackmail,
- proof of being blocked/kicked.
Export chat data (best from Telegram Desktop): includes message history and often media.
Copy:
- Telegram @username,
- display name,
- user ID if visible (sometimes via bots/tools—avoid sketchy bots; don’t give credentials),
- group/channel links,
- bot usernames.

Payment evidence

Official receipts/screenshots from bank/e-wallet:
- reference numbers,
- timestamps,
- recipient name/number/account,
- amount,
- transaction type.
If crypto:
- wallet addresses,
- TXID/hash,
- chain/network,
- screenshots of wallet history,
- any “connect wallet” pages used.

Device/network context

Note device used, phone number, SIM, and email involved.
If account takeover suspected: capture login alerts.

4.2 Secure your accounts (stop the bleeding)

Change passwords (email first, then e-wallets, then social apps).
Enable MFA using authenticator apps where possible.
Revoke suspicious wallet connections and permissions (crypto).
Contact telco if SIM swap/OTP interception is suspected.
Freeze/limit cards temporarily if used.

4.3 Report to your bank/e-wallet immediately

Provide:

transaction reference,
recipient details,
description: “online fraud/scam via Telegram.” Request:
investigation case number,
attempt to block/flag recipient,
preservation of logs.

5) How to file a criminal complaint (practical steps)

5.1 Prepare an Affidavit-Complaint (with a clear, chronological story)

Your affidavit should be:

chronological,
factual,
specific about deception and reliance,
tied to exhibits.

Suggested structure

Your details (identity and contact info).
How you encountered the Telegram game.
What was promised (quote/paraphrase).
What you were instructed to do (fees, wallet, tasks).
What you paid/transferred (dates, amounts, refs).
What happened after (blocked, additional demands, no payout).
Total losses and impact.
Request for investigation/prosecution.

Attach:

screenshots (labeled),
exported chat files (if available),
transaction records,
IDs (as required),
any witness affidavits (if someone saw or helped).

5.2 Choose where to lodge the complaint

Start with PNP-ACG or NBI Cybercrime if you need investigative assistance and digital evidence handling.
If you already have a complete packet, you can also proceed to the Prosecutor’s Office for preliminary investigation.

5.3 Expect the cybercrime warrant process for deeper attribution

To identify operators, investigators may seek court-issued cybercrime warrants (under Philippine rules on cybercrime warrants), including orders to:

preserve computer data,
disclose subscriber/account data,
disclose traffic data,
search/seize devices or accounts.

Victims don’t obtain these directly; law enforcement does, based on your complaint and evidence.

6) Jurisdiction, venue, and cross-border realities

6.1 Venue (where cases may be filed)

Cyber-enabled crimes can raise questions of where the offense was committed:

where the victim received the deceptive communication,
where payment was sent,
where the victim suffered damage,
where accounts are located/used.

Philippine practice often allows filing where the victim is located or where damage occurred, but specifics depend on prosecutorial assessment and the charge framing.

6.2 Cross-border perpetrators

Telegram scam operators are frequently outside the Philippines or operating through layered identities. This affects:

speed of data access,
enforcement,
asset recovery.

Even so, filing matters because:

mule accounts and local facilitators may be in the PH,
funds often touch PH-regulated rails (banks/e-wallets/remittance),
repeat-offender patterns become provable across complaints.

7) Chances of getting money back (what is realistic)

Recovery depends on speed and traceability.

More recoverable when:

payment was a bank transfer and reported quickly,
recipient is a PH account and funds weren’t cashed out yet,
e-wallet flagged recipient early,
you have strong identifiers.

Harder when:

crypto was sent to self-custody wallets and quickly bridged/mixed,
funds routed through multiple mule accounts,
payment was cash deposit with weak KYC,
long delay before reporting.

Best practice: pursue both (1) bank/e-wallet dispute path and (2) criminal complaint.

8) Common defenses and how to inoculate your complaint

Scammers (or mule account holders) may claim:

“It was an investment and you assumed risk,”
“It’s a game; payouts aren’t guaranteed,”
“I just received money for someone else,”
“No deceit—terms were disclosed.”

How you counter (with evidence):

Show specific false promises and intentional misrepresentation.
Show patterned fee escalation tied to withdrawal.
Show you were blocked after paying.
Show that early small payouts were used to induce bigger deposits (classic fraud grooming).

9) Prevention: red flags unique to Telegram “game” scams

Treat these as near-conclusive red flags:

You must pay to withdraw winnings.
Admins claim you’ll get “guaranteed profit” or “risk-free returns.”
“Limited slots—deposit now” pressure tactics.
Verification requires seed phrase, OTP, or “remote assistance.”
You’re moved to a private “cashier” or “support” chat for payment.
Withdrawal rules change after you meet requirements.
Group is full of scripted testimonials and “proof of payout” images.
They ask for ID/selfie “to unlock rewards” without a legitimate regulated entity behind it.
Payment is routed to personal names/numbers rather than a registered business.

10) Quick reference: what to include in your report packet

Evidence bundle (minimum)

Telegram handles, group/channel links, bot usernames.
Screenshots showing the offer + instructions + your compliance + refusal/blocking.
Exported chat (if possible).
Payment receipts with reference numbers.
Total computation of losses.
Timeline (date/time per key event).

If crypto is involved

TXIDs, wallet addresses, network/chain, screenshots of transaction confirmation.
Any website/domain used (copy the exact URL you visited).
Wallet connection approvals/signature requests (screenshots).

11) A simple affidavit template outline (you can adapt)

Affiant details (name, age, address, IDs).
Discovery: where you saw the Telegram game and when.
Representations: what they promised and who said it (handles).
Inducement: why you believed it (e.g., initial small payout, group testimonials).
Transfers: each payment with date/time/amount/reference/recipient.
Breach: denial of withdrawal, fee escalation, blocking, threats.
Damage: total loss and consequences.
Prayer: request investigation/prosecution for Estafa and applicable cybercrime offenses; request assistance in tracing funds and identifying operators.
Annexes: label all exhibits (A, B, C…) and refer to them in-text.

12) Final notes (important)

Preserve evidence before confronting scammers; confrontation often triggers deletion and blocking.
Report to your financial provider immediately, even if you’re unsure you’ll pursue a case.
If minors are involved, or if there is sextortion/blackmail, treat it as urgent and prioritize safety—those cases have different urgency and reporting pathways.

If you want, paste (1) a redacted description of what happened and (2) the payment method you used (bank/e-wallet/crypto), and I’ll turn it into a clean affidavit-style narrative and an exhibit checklist you can print—without including any sensitive identifiers.