Quick answer

If you suspect a scam, act immediately. Stop communicating with the suspected scammer, secure every affected account, and report any disputed payment through the 24/7 fraud-reporting channel of the bank or e-wallet from which the money came. Ask the institution to trace the transaction, temporarily hold any remaining disputed funds, begin coordinated verification, and give you a case reference number.

Then report the incident to the Philippine National Police Anti-Cybercrime Group (PNP ACG), the National Bureau of Investigation (NBI), or another appropriate enforcement agency. Report investment schemes to the Securities and Exchange Commission (SEC), and escalate unresolved complaints against a BSP-supervised financial institution to the Bangko Sentral ng Pilipinas (BSP).

Recovery is possible but never automatic. It depends on how quickly the incident is reported, whether the funds remain traceable, what the evidence shows, and whether the financial institution, recipient, platform, law-enforcement authorities, or a court can lawfully return or award the money.

What to do immediately

1. Stop further loss

Do not send another payment, even if the person claims that it is needed to release your money, pay tax, verify your account, or complete a refund.

Using a device you believe is safe:

Change the passwords of affected banking, e-wallet, email, social-media, shopping, and messaging accounts.
Use a different password for every important account.
Sign out other devices or sessions.
Enable the strongest available multifactor authentication.
Call the financial institution through the number shown in its official app, website, card, or account statement—not through a number supplied by the suspected scammer.
Ask the institution to disable compromised access, cards, online transfers, or linked devices where appropriate.
Contact your mobile provider immediately if your SIM stopped working unexpectedly or you suspect SIM takeover.
If you installed a remote-access application, disconnect the device from the internet, remove the application, and have the device checked before using it again for financial transactions.

Never disclose an OTP, PIN, CVV, password, recovery code, or screen-sharing access to someone claiming to investigate or reverse the scam. Legitimate reporting does not require paying a “recovery fee.”

2. Report the transaction to the source bank or e-wallet

Under the Anti-Financial Account Scamming Act and BSP Circular No. 1215, the account owner may initiate the disputed-transaction process through the originating financial institution’s 24/7 fraud-reporting channel. The originating institution is the bank, e-wallet, or other BSP-supervised institution holding the account from which the payment was sent.

Provide, as accurately as possible:

Your name and affected account number;
The transaction reference or identifier;
The amount, date, and exact or approximate time;
The payment method;
The recipient institution and account details, if known;
A clear explanation of how the transaction occurred and why it is disputed; and
Whether you authorized the transfer yourself because you were deceived, or whether someone accessed the account without permission.

Ask expressly for:

Immediate protection of the source account;
Tracing of the disputed funds through all recipient institutions;
Temporary holding of any funds that remain;
Coordinated verification under Republic Act No. 12010 and BSP Circular No. 1215;
Written acknowledgment and a case reference number; and
The deadline and exact documents required to support an extended hold.

Do not wait for a police report before making the first fraud report to the financial institution. A police report or sworn complaint may, however, be required promptly to support continued holding and investigation.

3. Submit supporting documents within the initial holding period

Where disputed funds can be located, the BSP rules provide for an initial hold of not more than five calendar days. The originating institution may seek an extended hold of up to 25 additional calendar days, making the total temporary-holding period no more than 30 calendar days, unless a competent court extends it.

The source-account owner is generally expected to submit supporting documents—such as a sworn complaint, affidavit, police report, or other proof—within the initial holding period, subject to exceptions allowed by the applicable industry protocol. Treat the five-day period as urgent and follow the institution’s instructions immediately.

A temporary hold:

Applies only to disputed funds that can still be found in an affected beneficiary account;
Prevents withdrawal of the amount held while verification is ongoing;
Is not a final finding that a crime occurred;
Does not by itself guarantee return of the money; and
Does not normally continue beyond 30 calendar days without a court order.

If verification reasonably concludes that the funds came from money-muling, an unlawful or illegal source, a transaction without an underlying economic purpose, or a social-engineering scheme, the BSP rules permit return of the held amount through the participating institutions. If the transaction is shown to be legitimate, or the holding period ends without a lawful basis to retain the funds, the money is generally released to the beneficiary account owner.

4. Make a law-enforcement report

A bank complaint and a criminal complaint serve different purposes. The financial institution may trace and temporarily hold money; law-enforcement authorities investigate the offender and may obtain records, warrants, or court orders. Pursue both where money, identity theft, account takeover, threats, or continuing victimization is involved.

Available official channels include:

The PNP Anti-Cybercrime Group eComplaint portal or the nearest police station;
The PNP ACG and NBI contact information listed in the BSP’s official directory of agencies handling scams and financial concerns;
An NBI office, particularly its Cybercrime Division or Anti-Fraud and Action Division; and
The Cybercrime Investigation and Coordinating Center (CICC) for assistance concerning cybercrime incidents.

Ask what form of complaint, affidavit, identification, and electronic evidence the investigating office requires. Keep the receiving officer’s name, office, date, complaint or blotter number, and copies of everything submitted.

Where else to report

Use the regulator that matches the transaction:

Investment, securities, cryptocurrency-investment, or lending solicitation: Report it to the SEC’s Enforcement and Investor Protection Department. Verify registrations and advisories through the SEC. Company registration alone does not establish authority to solicit investments.
Bank, e-wallet, remittance, payment-service, or other BSP-supervised institution: Complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism or BSP Online Buddy.
Insurance-related solicitation: Report it to the Insurance Commission.
Seller or consumer transaction involving an identifiable business: Consider the Department of Trade and Industry consumer complaint system. DTI mediation may help with a real seller or business, but it is not a substitute for a criminal report where the supposed seller is fictitious or used deception to take money.
Scam texts or misuse of telecommunications services: Report the number or message through your telecommunications provider and the National Telecommunications Commission.
Impersonation, fake profiles, or marketplace activity: Report the account, advertisement, listing, and conversation to the platform after preserving evidence.

Reporting to several proper bodies is not improper when each has a distinct role. Use consistent facts and disclose related reference numbers.

Evidence to preserve

Preserve original material before blocking accounts or asking a platform to remove content. Useful evidence may include:

Full screenshots and screen recordings showing account names, usernames, URLs, dates, and timestamps;
The original text messages, emails, chat exports, voice messages, and call logs;
Email headers and the original electronic email file, if available;
Advertisements, product listings, investment presentations, contracts, invoices, receipts, and delivery records;
Bank or e-wallet statements and official transaction confirmations;
Transaction reference numbers, QR codes, wallet addresses, recipient account names and numbers, and branch or remittance details;
The suspected scammer’s telephone numbers, email addresses, profiles, websites, and device or account identifiers;
Proof of what was promised, what representations induced the payment, and when they were made;
A chronological written account prepared while events remain fresh;
Records of every report, including reference numbers and the institution’s responses; and
Proof of consequential expenses or losses claimed.

Keep unedited originals and separate working copies. Do not crop away dates, account identifiers, URLs, or surrounding context. Back up the files in at least two secure locations. Do not publicly post another person’s private information or make unsupported public accusations; give the evidence to the proper institution or authority.

Which laws may apply

The legal classification depends on what happened and what the evidence establishes.

Estafa by deceit

Article 315(2)(a) of the Revised Penal Code may apply where a person used a false pretense or fraudulent act before or at the time of the transaction, the victim relied on it, and the victim consequently suffered damage. The Supreme Court has repeatedly treated those matters as essential elements; a broken promise or unpaid debt is not automatically estafa without the required prior or simultaneous deceit. See the Court’s discussion in Dulay v. People, G.R. No. 215132, September 13, 2021.

Cybercrime-related offenses

Where a Revised Penal Code or special-law offense is committed through information and communications technology, the Cybercrime Prevention Act of 2012 may apply. It also separately penalizes conduct such as computer-related fraud, computer-related identity theft, illegal access, and misuse of devices when their statutory elements are present.

The use of a phone, social-media account, or online transfer does not by itself prove every element of a cybercrime. Investigators must determine the actual acts, participants, intent, and electronic evidence.

Financial-account scamming and money-mule activity

The Anti-Financial Account Scamming Act, Republic Act No. 12010, addresses money-muling activities, social-engineering schemes, the purchase or sale of financial accounts, accounts opened under false identities, and related attempts or assistance.

A person should not allow another to borrow, buy, rent, control, or route money through their bank or e-wallet account. Depending on knowledge, purpose, and conduct, receiving or transferring criminal proceeds through an account may expose the account holder to criminal liability even if that person was not the original scammer.

The Act also provides that a BSP-supervised institution may be liable for restitution where it failed to employ adequate risk-management systems and controls or failed to exercise the legally required degree of diligence. Liability is fact-dependent. The law does not make every institution automatically responsible whenever a customer was deceived, and conviction of the scammer is not a prerequisite to institutional restitution where the statutory basis is established.

The detailed current framework is contained in the BSP’s official AFASA booklet, including Circular Nos. 1213, 1214, and 1215.

Paths to recovery

Return through the financial system

This is often the fastest possibility when funds remain in a BSP-supervised institution. Prompt reporting matters because scammers may rapidly withdraw, convert, or transfer the money through several accounts.

The coordinated verification process is generally to be completed within the 30-calendar-day holding period when money has been held. If no funds were held, verification should generally be completed within 30 calendar days and may, for meritorious reasons, extend to a total of no more than 60 calendar days. These periods govern the financial institutions’ process; they are not promises that the victim will be reimbursed within that time.

Reversal, refund, or platform remedy

Card issuers, remittance companies, payment providers, marketplaces, and platforms may have contractual dispute or buyer-protection procedures. Their deadlines and coverage differ. File promptly through the official channel and do not assume that a police complaint automatically starts a chargeback or platform claim.

An authorized transfer made because of deception may be treated differently from a transaction made after an account takeover. Describe exactly what occurred rather than selecting an inaccurate dispute category.

Restitution or damages in a criminal case

A conviction under Republic Act No. 12010 carries civil liability that may include restitution. Estafa and other offenses may likewise give rise to civil liability under applicable law. Under the Rules of Criminal Procedure, the civil action arising from the offense is generally deemed instituted with the criminal action unless it was waived, reserved for separate filing, or filed earlier, subject to the governing rules and exceptions.

Tell the prosecutor about the complete amount claimed and provide proof of payment and loss. A criminal complaint does not guarantee collection: recovery may still depend on conviction, the civil judgment, available assets, and enforcement.

A separate civil action

Depending on the facts, a victim may have contractual, quasi-contractual, tort, restitutionary, or other civil remedies against the recipient, seller, intermediary, or responsible institution. The proper claim, defendants, court, limitation period, and need for prior demand depend on the documents and legal relationship.

Small-claims procedure may be available for qualifying money claims within the Supreme Court’s current jurisdictional limit, but not every fraud dispute fits that procedure. Claims needing injunctions, extensive evidence, asset preservation, or complex findings may require an ordinary civil action. Obtain legal advice before choosing a remedy or signing a settlement, waiver, quitclaim, or document affecting the civil action connected with a criminal case.

Common mistakes that reduce the chance of recovery

Waiting for the scammer to keep another promise before reporting;
Reporting only to the recipient bank instead of immediately notifying the source bank or e-wallet;
Failing to request a case reference number;
Missing the institution’s deadline for an affidavit, police report, or other supporting evidence;
Deleting conversations, reinstalling the device, or closing an account before preserving records;
Editing screenshots so heavily that their context or reliability is lost;
Describing an authorized-but-deceived payment as an unauthorized transaction;
Paying private “hackers,” “agents,” or supposed officials who promise guaranteed recovery;
Warning the suspected scammer before accounts or evidence can be secured;
Posting sensitive financial information publicly;
Treating SEC registration as proof that an entity may lawfully solicit investments;
Accepting a partial refund without understanding any accompanying waiver; and
Filing knowingly false or completely unwarranted information. Malicious reporting that causes funds to be held may itself be punishable under Republic Act No. 12010.

When legal help is urgent

Speak promptly with a Philippine lawyer—or, if qualified, the Public Attorney’s Office—when:

The amount is substantial or represents essential savings;
The institution refuses to accept or act on a fraud report;
Funds have been located and a court order may be needed before the holding period ends;
The suspected offender or assets have been identified;
The case involves several victims, jurisdictions, companies, or cryptocurrency transfers;
You are being threatened, blackmailed, extorted, or pressured to destroy evidence;
Your identity, SIM, email, or financial accounts were taken over;
You are being accused of serving as a money mule;
You received a subpoena, demand letter, freeze notice, or court document;
A settlement, quitclaim, or waiver has been offered; or
A prescriptive period, platform deadline, chargeback deadline, or procedural deadline may be approaching.

If there is an immediate threat to life or physical safety, contact emergency services or the nearest police station at once.

Frequently asked questions

Can the bank freeze the scammer’s entire account?

Not automatically. Under the AFASA framework, an institution may temporarily hold the amount of disputed funds that remains traceable in affected accounts. A broader or longer restraint may require another legal basis or a court order. The Anti-Money Laundering Council and courts exercise separate powers under their governing laws.

What if I personally approved the transfer?

Report it anyway. AFASA expressly covers disputed transactions facilitated through social-engineering schemes. Authorization is relevant, but being tricked into approving a transfer does not necessarily prevent tracing, coordinated verification, criminal investigation, or every possible civil remedy.

What if the money has already been withdrawn?

The institution must still participate in coordinated verification even if the money no longer remains in the financial system. A temporary hold cannot recover money that is no longer there, but transaction records may assist investigation and other legal remedies.

Must the recipient be convicted before the bank can return held funds?

Not necessarily. The BSP rules allow return of held funds based on the coordinated verification process in specified circumstances. Republic Act No. 12010 also states that conviction is not a prerequisite to restitution from an institution where liability arises from its failure to employ adequate controls or exercise the required diligence.

Should I contact the recipient account holder?

Usually, preserve the information and let the financial institution or investigators make contact. Direct confrontation may prompt withdrawal of funds, destruction of evidence, retaliation, or further deception.

Can I recover emotional distress, lost income, or other consequential loss?

Possibly, but such damages are not presumed. The proper legal basis, causation, proof, and availability of each category depend on the facts and the action filed. Preserve receipts, medical records, employment records, and other proof, then obtain case-specific legal advice.

Is an online report enough to prosecute the case?

It can create an initial record, but investigators or prosecutors may later require a sworn complaint-affidavit, identification, authenticated records, witness statements, and personal participation. Follow up using the reference number and comply promptly with lawful requests.

How long do I have to file a case?

There is no single deadline for every scam. Prescription depends on the offense or civil cause of action, the amount and conduct involved, when the violation was discovered, and legally relevant interruptions or special rules. Do not rely on the longest possible period; report and seek advice promptly.

Official references

This article provides general legal information, not legal advice or a prediction of recovery. Procedures and remedies depend on the transaction, evidence, institutions, and documents involved. Official sources were checked as of September 14, 2026.