Quick answer

If you suspect fraud or estafa, contact the bank, e-wallet, remittance company, or other payment provider immediately and ask it to flag the transaction, secure the account, trace the transfer, and hold any recoverable funds. Then preserve the evidence and report the incident to the Philippine National Police (PNP), National Bureau of Investigation (NBI), or the appropriate prosecutor’s office.

Reporting quickly can improve the chance of tracing funds, but neither a police report nor an estafa complaint automatically returns the money. Recovery may come through:

Reversal, recall, or temporary holding of funds by a financial institution;
Voluntary repayment or a carefully documented settlement;
Restitution or damages awarded in the criminal case; or
A separate or independent civil remedy when legally appropriate.

Whether the conduct is estafa depends on what was represented, when the deception occurred, why the victim transferred money or property, and whether the victim suffered damage. A broken promise, unpaid loan, failed investment, or unfulfilled contract is not automatically estafa.

Act immediately if money was just transferred

Minutes and hours can matter. Do the following without waiting for a complete case file:

Contact the sending institution. Use its official fraud hotline or customer-service channel. Ask for the account to be secured and the transfer to be recalled, reversed, traced, or disputed.
Contact the receiving institution if identifiable. Report the beneficiary account as connected to a fraudulent transaction. Provide the amount, date, time, reference number, and police or complaint reference when available.
Request temporary holding under the anti-scam framework. Republic Act No. 12010, the Anti-Financial Account Scamming Act, authorizes covered institutions to hold funds involved in a disputed transaction under BSP rules. The statutory period cannot exceed 30 calendar days unless extended by a court. A hold is not automatic, and it does not guarantee reimbursement.
Secure compromised accounts. Change passwords from a trusted device, sign out other sessions, replace exposed cards, reset PINs, and ask the mobile provider to investigate an unauthorized SIM replacement.
Report unauthorized access. Tell the institution whether an OTP, password, device, SIM, or account was compromised. Do not falsely describe an authorized transfer as unauthorized; explain exactly what happened.
Report to law enforcement promptly. This is especially important when funds continue to move, accounts have been taken over, identities have been stolen, or several victims are involved.

Do not send another payment for “verification,” “release,” “tax,” “insurance,” “recovery,” or “legal processing.” That is a common continuation of the scam.

When suspected fraud may amount to estafa

Article 315 of the Revised Penal Code covers several forms of swindling. Two commonly encountered categories are:

Estafa through false pretenses or fraudulent acts

This may apply when a person makes a material false representation or uses a fraudulent act before or at the time the victim parts with money or property; the victim relies on it; and that reliance causes damage.

Relevant facts may include:

A false identity, qualification, authority, business, product, property, or source of funds;
A fabricated emergency or relationship;
A claim that an investment is licensed, guaranteed, or risk-free when it is not;
False proof of ownership, shipment, payment, employment, or entitlement;
Fake documents, websites, accounts, receipts, endorsements, or transaction confirmations; or
A pattern showing that the accused obtained money through deception rather than through an ordinary transaction that later failed.

The prosecution must prove the required elements beyond reasonable doubt at trial. Suspicion, nonpayment, or an unexpectedly bad result is not enough by itself.

Estafa through misappropriation or conversion

This may apply when money, goods, or other personal property is received in trust, on commission, for administration, or under an obligation to deliver or return it, and the recipient later misappropriates, converts, or denies receiving it, causing prejudice.

The exact agreement matters. Documents should show why the property was delivered and whether there was a duty to return the same property or account for it. A simple debtor-creditor relationship does not necessarily establish this form of estafa.

A demand may be important evidence of misappropriation or failure to account, but its legal significance depends on the form of estafa and the surrounding facts. It is unsafe to assume that every case requires—or does not require—a demand letter.

Fraud is not the same as an ordinary debt or failed contract

Criminal liability generally requires more than failure to pay or perform. A business can fail, an investment can lose value, and a borrower can default without necessarily committing estafa.

Possible warning signs of criminal deception include:

The supposed goods, investment, employment, property, or transaction never existed;
Material documents or credentials were fabricated;
The accused had no authority to sell or receive the money;
The same property was sold to multiple victims;
The accused used several identities or mule accounts;
Funds entrusted for a defined purpose were diverted for personal use; or
Conduct before payment shows a plan to deceive.

Conversely, genuine partial performance, transparent disclosure of risks, an unforeseen inability to perform, or a documented commercial dispute may point toward civil rather than criminal liability. Classification should be based on admissible evidence, not labels used in messages or contracts.

Online and account-based fraud may involve additional laws

When estafa is committed through information and communications technology, Section 6 of the Cybercrime Prevention Act may apply and can raise the prescribed penalty by one degree. The law also separately addresses computer-related fraud, identity theft, illegal access, forgery, and interference with computer data or systems.

Not every online deception is “computer-related fraud” under Section 4(b)(2). That offense specifically concerns unauthorized input, alteration, or deletion of computer data or programs, or interference with a computer system, done with fraudulent intent and causing damage. An online conversation used to induce a payment may instead be prosecuted as estafa committed through ICT, depending on the evidence.

The Anti-Financial Account Scamming Act also prohibits conduct involving financial accounts used for social engineering schemes, money-mule activity, and related account scams. The investigating authority should determine the correct charge; a complainant should present the facts without forcing them into one statutory label.

Evidence to preserve

Preserve original and complete records whenever possible:

Full chat, email, SMS, and social-media conversations;
Usernames, profile URLs, account IDs, phone numbers, email addresses, and website domains;
Advertisements, listings, proposals, contracts, invoices, receipts, and demand letters;
Bank or e-wallet statements, transaction histories, deposit slips, QR codes, reference numbers, and beneficiary details;
Screenshots showing the device date, time, URL, and account identity;
Original electronic files, including documents, audio, video, and images;
Delivery records, waybills, meeting details, call logs, and witness information;
Proof of the representations made before payment;
Proof that those representations were false;
Proof of loss and efforts to recover the money; and
All ticket numbers, acknowledgments, and replies from institutions and agencies.

Export conversations where the platform permits it. Keep the original device and files; do not crop, annotate, compress, or repeatedly forward the only copy. Make a separate working copy and a backup. Record a chronological account while events are fresh.

Do not secretly access the suspect’s account, impersonate another person, hack a device, or publish sensitive information to pressure the suspect. Illegally obtained evidence can create separate legal and privacy problems.

Where to report

Bank, e-wallet, or payment provider

Report first through the institution’s official Financial Consumer Protection Assistance Mechanism or fraud channel. If the complaint remains unresolved and the institution is supervised by the BSP, escalate it through the BSP Online Buddy and Consumer Assistance Mechanism.

The BSP complaint process addresses a financial institution’s handling of a consumer concern. It is not a substitute for a criminal complaint against the scammer.

PNP or NBI

For cyber-enabled fraud, report to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or another competent PNP or NBI office. The BSP’s official fraud-reporting directory publishes current contact details for these agencies.

A blotter entry or initial incident report documents the report but may not, by itself, complete the affidavit and evidence requirements for prosecution. Ask what additional documents, interviews, forensic examination, or sworn statements are required.

Prosecutor’s office

A criminal complaint may be filed with the prosecutor’s office that has territorial authority over the offense. Venue is important: under Rule 110, a criminal action is generally instituted where the crime was committed or where an essential ingredient occurred.

The usual submission includes a properly sworn complaint-affidavit, witness affidavits, the respondent’s address if known, and organized supporting documents. Requirements and copy counts should be confirmed with the receiving office. The DOJ provides an official preliminary-investigation filing guide, its current forms, and the 2024 National Prosecution Service rules.

The prosecutor evaluates the evidence and decides whether the case should proceed. Filing a complaint does not mean the respondent is already guilty or that an arrest warrant will automatically issue.

SEC and other regulators

Report a suspected unlicensed investment solicitation or investment scam through the SEC’s official iMessage complaint system. Depending on the product or provider, the Insurance Commission, Cooperative Development Authority, BSP, or another regulator may also have authority.

A company’s SEC registration does not, by itself, mean it is authorized to solicit investments from the public.

Preparing a strong complaint-affidavit

A useful complaint-affidavit is factual, chronological, and supported by clearly labeled annexes. It should explain:

Who the complainant and respondent are;
How contact began;
The exact representations made;
When and where each material act occurred;
Why the representation was important;
What the complainant did in reliance on it;
Where and how money or property was delivered;
What later showed the representation was false or the property was converted;
The amount and nature of the loss;
What recovery efforts were made; and
How each annex supports a particular statement.

Quote only what the records actually show. Distinguish personal knowledge from information received from someone else. Identify unknown participants as unknown rather than guessing their names or roles.

Seeking recovery

Recovery through the criminal case

Under Rule 111, the civil action to recover civil liability arising from the charged offense is generally deemed included with the criminal action unless the offended party waives it, reserves the right to file it separately, or filed it before the criminal action.

This can include proven restitution or damages arising from the offense. However:

A complaint is not a lien on the accused’s property;
Conviction does not guarantee that the accused has assets available for execution;
Actual loss must be proved;
Other damages require an adequate factual and legal basis; and
Double recovery for the same injury is not allowed.

Before reserving or separately filing a civil action, obtain case-specific advice. The timing and wording of a reservation can affect available remedies.

A separate civil case

A civil action may be appropriate when the evidence establishes a contract, loan, unjust enrichment, tort, trust obligation, or another civil source of liability even if criminal intent cannot be proved beyond reasonable doubt.

Civil and criminal actions use different standards of proof, but procedural rules can require suspension or consolidation in some situations. Filing both without a coordinated strategy can cause delay, extra expense, or inconsistent pleadings.

Settlement

Settlement can produce faster recovery, but use caution:

Put the total obligation, payment schedule, default consequences, and method of payment in writing;
Verify that the person signing has authority;
Do not surrender original evidence upon a mere promise to pay;
Confirm cleared funds before acknowledging full payment;
Avoid statements that are untrue or that obstruct lawful investigation; and
Have counsel assess any affidavit of desistance, release, compromise, or reservation of rights.

Estafa is prosecuted in the name of the People of the Philippines. Repayment or an affidavit of desistance does not necessarily compel dismissal, although it may affect the evidence, civil claim, or case strategy.

Deadlines and delay

Do not postpone reporting while negotiating informally. Criminal prescription depends on the offense charged, the legally prescribed penalty, when the offense was discovered, and acts that interrupt prescription. Civil claims have their own prescriptive periods.

Online evidence may also disappear. Under the Cybercrime Prevention Act, specified subscriber information and traffic data are ordinarily preserved by service providers for at least six months from the transaction, while content data is preserved for six months from receipt of a lawful preservation order. Access or disclosure may require official process or a court warrant. A victim’s request to a platform is not a substitute for law-enforcement preservation procedures.

Obtain legal advice promptly if substantial time has passed, the suspect is leaving the country, assets are being transferred, or a filing deadline may be approaching.

Common mistakes

Treating every unpaid debt as estafa;
Waiting weeks before contacting the payment provider;
Deleting chats after taking a few screenshots;
Submitting isolated screenshots without context or account identifiers;
Omitting the representation that actually induced payment;
Exaggerating the loss or identifying an account owner as the mastermind without evidence;
Paying a supposed recovery agent who guarantees release of funds;
Publicly accusing someone before the facts are verified;
Filing in a location with no connection to an essential element of the offense;
Signing a release, quitclaim, or affidavit of desistance without understanding its effect; and
Assuming that a police report, regulator complaint, and prosecutor’s complaint are interchangeable.

When legal help is urgent

Seek prompt assistance from a Philippine lawyer, the Public Attorney’s Office if eligible, or another recognized legal-aid provider when:

The loss is substantial or involves several victims;
Real property, corporate funds, trust funds, or securities are involved;
The respondent or assets may leave the Philippines;
A bank has frozen your legitimate account because it received suspected scam proceeds;
You unknowingly received or forwarded disputed funds;
Law enforcement asks to examine or seize a device;
The suspect threatens, blackmails, or doxxes you;
You are being asked to sign a settlement, release, or affidavit of desistance;
The prosecutor has dismissed the complaint and a review deadline is running; or
You are unsure whether to pursue criminal, civil, regulatory, or parallel remedies.

If there is an immediate threat to life or safety, contact emergency services or the nearest police station.

Frequently asked questions

Can I file an estafa complaint if I do not know the scammer’s real name?

Potentially, yes. Preserve every identifier and report promptly. Rule 110 allows an accused whose true name cannot initially be ascertained to be described by a fictitious name with a statement that the true name is unknown. Investigators may seek subscriber, account, and transaction information through lawful processes.

Is a demand letter required before filing?

Not in every estafa case. Its importance depends on the statutory form charged and the evidence. In misappropriation cases, a demand and failure to account may help establish conversion, but demand should not be treated as a universal substitute for proof.

Can the bank simply reverse an authorized transfer?

Not necessarily. Authorization, payment-system rules, the location of the funds, competing claims, and applicable BSP rules all matter. Report immediately and provide truthful, complete information.

Does an account freeze mean I will get the money back?

No. A temporary hold preserves disputed funds while the matter is verified. Ownership and release may still require institutional procedures, investigation, agreement, or a court order.

Can I recover legal fees and emotional-distress damages?

Only when a legal and evidentiary basis exists. Such awards are not automatic. Keep receipts and evidence of consequential loss, but have counsel evaluate which damages can properly be claimed.

What if the scammer repays me?

Document the source and amount of every payment. Do not promise dismissal or sign a broad release without advice. Repayment may address some or all civil loss but does not automatically erase possible criminal liability.

Can several victims file together?

They may coordinate evidence and reporting, but each transaction and each victim’s reliance and loss should be documented separately. The prosecutor determines the proper respondents, charges, and case structure.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct charge, venue, deadlines, and recovery strategy depend on the documents and specific facts. Sources and official procedures were checked as of September 14, 2026.