Quick answer

If you suspect fraud or estafa, act immediately:

Contact the sending bank, e-wallet, card issuer, or payment provider through its official fraud channel. Ask it to flag the transaction, secure your account, trace the receiving account, coordinate with the recipient institution, and temporarily hold any remaining disputed funds.
Preserve the original messages, advertisements, account details, receipts, transaction references, contracts, recordings, and other evidence. Do not delete or edit them.
Report the incident to the Philippine National Police, the NBI, or—particularly for an online incident—their cybercrime units.
Prepare a sworn complaint and supporting affidavits for the proper Office of the City or Provincial Prosecutor. The prosecutor, not the complainant, determines the appropriate charge and whether probable cause exists.
Discuss recovery with a lawyer promptly. A criminal complaint can carry a civil claim for restitution, but a separate civil case, provisional remedies, or immediate action against identifiable assets may sometimes be more effective.

Reporting does not guarantee recovery. The chances depend heavily on how quickly the money is traced, whether it remains in the financial system, whether the suspect and assets can be identified, and whether the evidence proves every element of an offense.

When suspected fraud becomes estafa

Article 315 of the Revised Penal Code covers several distinct forms of estafa. Broadly, these include fraud committed:

through unfaithfulness or abuse of confidence;
through false pretenses or fraudulent acts made before or at the same time as the victim parts with money or property; or
through specified fraudulent means, such as inducing someone by deceit to sign a document.

Common examples may include:

obtaining money through a fictitious identity, nonexistent business, false authority, or imaginary transaction;
taking money or property received in trust, on commission, for administration, or under an obligation to deliver or return it, then converting or denying receipt of it;
selling nonexistent goods or investments through material false representations; and
using a check under circumstances covered by Article 315 or, separately, the Bouncing Checks Law.

The exact mode matters. A complaint should state the facts rather than merely label the conduct “estafa.”

Deceit-based estafa

For estafa through false pretenses, the prosecution generally must show that:

the accused made a false representation or used a fraudulent act;
the deceit occurred before or at the same time as the victim transferred money, property, or value;
the victim relied on the deceit; and
the victim suffered damage.

A false promise made only after money was received ordinarily cannot be the deceit that induced the original payment. Later conduct may still help prove the person’s earlier intent, but timing and context are critical.

Misappropriation or conversion

A different form may apply when a person lawfully receives money or personal property in trust, on commission, for administration, or under another obligation to deliver or return the same property, and later misappropriates, converts, or denies receiving it to another’s prejudice.

The underlying agreement matters. Money received as a loan generally transfers ownership to the borrower, who ordinarily has an obligation to repay an equivalent amount—not to return the identical money. Nonpayment of a loan, standing alone, is therefore not automatically estafa.

A prior demand is not invariably a formal element of every misappropriation case, but a clear written demand and proof of receipt can be important evidence of conversion, refusal, default, and the amount claimed.

Not every broken promise or unpaid debt is a crime

A failed business, delayed delivery, unpaid loan, unsuccessful investment, breach of contract, or refusal to refund does not by itself prove criminal fraud. The Constitution prohibits imprisonment for debt, but it does not protect conduct that independently satisfies the elements of a criminal offense.

The central questions usually include:

What representation was made?
Was it false when made?
Did the person know it was false?
Did the victim rely on it in transferring money or property?
What obligation governed possession of the property?
What evidence shows fraudulent intent rather than later inability to perform?
What actual loss resulted?

A civil case may be the proper remedy where the evidence establishes only breach of contract or nonpayment. Filing a criminal complaint merely to pressure someone to pay can expose the complainant to legal risk, especially if material facts are knowingly misstated.

Online fraud and financial-account scams

When estafa is committed by, through, or with information and communications technology, Section 6 of the Cybercrime Prevention Act may apply, with the penalty generally one degree higher than for the corresponding Revised Penal Code offense. Other conduct may constitute computer-related fraud, computer-related identity theft, illegal access, or another cybercrime. The Cybercrime Prevention Act assigns cybercrime enforcement responsibilities to the NBI and PNP.

The Anti-Financial Account Scamming Act, or AFASA, separately addresses conduct including:

knowingly using, lending, selling, renting, or recruiting accounts as part of money-mule activity;
obtaining sensitive financial-account information through deceptive social engineering;
opening accounts under fictitious names or another person’s identity; and
buying or selling financial accounts.

AFASA authorizes covered institutions to hold funds involved in a disputed transaction under BSP rules. The statutory holding period may not exceed 30 calendar days unless extended by a competent court. It also requires coordinated verification among the institutions and account owners involved. Conviction is not necessarily required before an institution may become liable for restitution where the statutory basis for institutional liability is established.

These provisions do not mean that every voluntarily authorized transfer must be refunded. Liability depends on the facts, the institution’s duties, applicable BSP rules, and whether the transaction falls within the governing law.

What to do immediately

1. Stop further loss

Stop communicating through links or contact details supplied by the suspected fraudster.
Do not send an additional “release,” “verification,” “tax,” “recovery,” or “lawyer” fee.
Change compromised passwords using a clean device.
Sign out unknown devices and enable multifactor authentication.
If you disclosed card details, online-banking credentials, an OTP, PIN, or identity documents, tell the institution exactly what was exposed.
Ask your mobile provider to secure your number if SIM takeover is suspected.

Beware of recovery scams. A person claiming to be an investigator, bank employee, lawyer, or “hacker” who requests an OTP, remote-device access, cryptocurrency payment, or advance fee may be attempting a second fraud.

2. Contact every financial institution involved

Use only contact details shown in the institution’s official app, website, card, or account statement. Give it:

the amount, date, and exact time of each transaction;
transaction or reference numbers;
the sender’s and recipient’s account details;
the name, number, email address, username, or profile used by the suspect;
a short explanation of how the transaction was induced or accessed;
the police, NBI, or prosecutor reference number, once available; and
a request for written confirmation and a complaint or ticket number.

Ask whether the institution can:

flag the transaction as disputed or fraudulent;
place an authorized temporary hold on remaining funds;
coordinate with the recipient institution;
preserve account, device, login, and transaction records;
attempt a recall, chargeback, or reversal if the payment channel permits it; and
explain the formal escalation process.

Do this even if the recipient has already transferred the money. Prompt reporting can help investigators trace subsequent transfers and may protect other victims.

3. Make an official report

Depending on the facts, report to:

the nearest police station or the PNP Anti-Cybercrime Group for internet-enabled incidents;
the National Bureau of Investigation, including its cybercrime investigators where appropriate;
the proper City or Provincial Prosecutor’s Office for filing a criminal complaint;
the affected marketplace, social-media platform, telecommunications provider, bank, e-wallet, or payment service; and
the relevant regulator when the facts concern a regulated entity, investment solicitation, insurance product, lending activity, or financial service.

A platform report can help disable an account, but it is not a substitute for reporting to law enforcement or filing a prosecutorial complaint.

Evidence to preserve

Create a chronological folder and retain the original files whenever possible.

Communications and online material

Preserve:

complete chat and email threads, including dates, times, usernames, and headers;
SMS messages, call logs, voice messages, and lawful recordings;
profile URLs, user IDs, account handles, group names, and phone numbers;
advertisements, product listings, investment presentations, and webpages;
photographs, videos, live-stream recordings, and documents sent by the suspect;
the original URLs and the date and time each page was viewed; and
any later admission, excuse, demand, threat, refund promise, or request for further payment.

Screenshots are useful but may omit context and metadata. When possible, export the full conversation, preserve the device, and keep the original electronic files. Do not crop away dates, account names, transaction details, or surrounding messages.

Payment and ownership records

Keep:

bank or e-wallet statements;
deposit slips and official receipts;
transfer confirmations and reference numbers;
card statements and merchant details;
checks, dishonor slips, and proof of notice;
cryptocurrency wallet addresses, transaction hashes, exchange records, and timestamps;
invoices, purchase orders, delivery records, and tracking information; and
proof that the money or property belonged to you or that you were authorized to act for its owner.

Agreements and identity evidence

Keep:

contracts, acknowledgment receipts, promissory notes, trust or agency documents, and written terms;
copies of IDs or business documents received from the suspect, while treating them as potentially forged or stolen;
SEC, DTI, professional-license, property, or corporate records you independently obtained from official sources;
witness names and contact details; and
records showing how you verified—or were prevented from verifying—the representation.

Never alter a file to make it look original. Retain both the original and any annotated working copy. Back up the evidence in at least two secure locations and document who handled important devices or physical records.

Preparing the complaint

A criminal complaint is a sworn written statement. It should be factual, chronological, and supported by properly identified annexes.

Include:

Your name, address, contact information, and legal capacity to complain.
The respondent’s known name, aliases, addresses, account identifiers, employer or business, and other identifying facts. State clearly when information is uncertain.
The date, place, and method of first contact.
Each material representation or obligation, who made it, and when.
Why the representation was false or how the property was converted.
How you relied on the representation.
Every payment or transfer, with dates, amounts, recipients, and references.
The loss suffered and any partial return.
Your demands and the responses received.
A numbered list of supporting documents and witnesses.

Do not exaggerate, conceal refunds or repayments, identify an innocent account holder as the mastermind without evidence, or submit edited conversations as complete records. Statements in affidavits are made under oath.

Where the case should be filed

Venue in a criminal case is jurisdictional. Under Rule 110, Section 15 of the Revised Rules of Criminal Procedure, the action is generally instituted where the offense was committed or where any essential element occurred.

For fraud involving communications, transfers, several cities, or an overseas actor, the correct venue can require close factual analysis. The victim’s residence or the location of the bank account is not automatically sufficient in every case. Bring records showing:

where the false representation was received;
where reliance and authorization occurred;
where money or property was delivered;
where the recipient account or relevant business was maintained; and
where the resulting damage or other statutory element occurred.

Filing in the wrong place can delay or defeat a case. Obtain legal advice before filing when the relevant acts occurred in several jurisdictions.

What happens after filing

The prosecutor evaluates whether the evidence establishes probable cause—not guilt beyond reasonable doubt. Depending on the offense and its prescribed penalty, the complaint may undergo a preliminary investigation under the current DOJ-National Prosecution Service rules.

The respondent is ordinarily given the complaint and an opportunity to submit counter-affidavits and supporting evidence. The prosecutor may seek clarification and will decide whether an information should be filed in court or the complaint dismissed. Follow every subpoena and written deadline stated in the official notice; do not rely on informal assurances or older procedural summaries.

The Supreme Court has recognized the DOJ’s authority to issue its rules for preliminary investigations and deemed inconsistent portions of Rule 112 repealed upon promulgation of those rules. The governing framework is discussed in A.M. No. 24-02-09-SC.

A police blotter, cybercrime report, or bank complaint does not necessarily commence the prosecutorial case or interrupt every applicable prescriptive period. Confirm that the proper sworn complaint was filed with the legally appropriate office.

Options for seeking recovery

Civil liability in the criminal case

Under Rule 111, the civil action to recover liability arising from the charged offense is generally deemed instituted with the criminal action unless the victim:

waives it;
reserves the right to file it separately; or
filed the civil action before the criminal action.

A reservation must ordinarily be made before the prosecution starts presenting evidence and while the victim has a reasonable opportunity to reserve. The choice should be deliberate: filing separately can involve additional fees, procedure, and delay, while keeping the civil claim with the criminal case ties recovery to that proceeding.

For a prosecution under the Bouncing Checks Law, the corresponding civil action is deemed included, and reservation to file it separately is not allowed. Special filing-fee rules apply.

A separate civil action

A lawyer may consider a civil action based on contract, restitution, damages, fraud, or another applicable cause of action. Article 33 of the Civil Code also permits an independent civil action for fraud in appropriate cases. The correct theory, parties, venue, limitations period, and interaction with a criminal case depend on the documents and facts.

Civil liability may sometimes be proved by a preponderance of evidence even when criminal liability—which requires proof beyond reasonable doubt—is not established. However, dismissal or acquittal and the court’s specific findings may affect what can still be recovered.

Provisional remedies and identifiable assets

Where there is a real risk that property will be concealed or disposed of, ask a lawyer immediately about lawful provisional remedies. Attachment, injunction, garnishment, freezing, forfeiture, and preservation orders have different statutory requirements. A private complainant cannot personally freeze an account merely by making an accusation.

Do not threaten, seize, publish, or interfere with property on your own. Obtain a court order or use the authorized financial-institution and government processes.

Settlement and repayment

Restitution can be practical, but protect yourself:

put all terms in writing;
identify the total admitted obligation and payment schedule;
require payments through traceable channels;
state what happens upon default;
verify the authority of anyone settling for a company or another person; and
do not withdraw or execute a desistance affidavit before receiving legal advice.

Payment, compromise, or an affidavit of desistance does not automatically erase a public offense. The effect depends on the charge, stage of proceedings, and applicable law.

Deadlines and why delay is dangerous

There is no single filing deadline for every fraud case. Prescription depends on the precise offense, statutory penalty, date of commission or discovery, governing law, and acts that legally interrupt the period. Separate civil claims may have different limitation periods.

Delay can also cause practical losses long before prescription:

funds can be transferred or withdrawn;
online accounts can disappear;
service providers may delete or overwrite records;
witnesses may become unavailable;
memories fade; and
assets may be concealed or sold.

The Cybercrime Prevention Act requires service providers to preserve specified computer data after a valid law-enforcement order, generally for an initial six-month period, subject to the Act’s rules on extension. A victim’s private request is not necessarily equivalent to the statutory preservation order. Promptly reporting an online incident gives investigators a better chance to use the proper legal process.

Common mistakes to avoid

Waiting for the suspect’s repeated promises while funds and records disappear.
Sending more money to unlock a refund or investment withdrawal.
Treating a breach of contract as automatically criminal.
Filing in a place with no connection to an essential element of the offense.
Naming every bank-account owner, employee, relative, or company officer as a conspirator without evidence of participation.
Providing only selected screenshots instead of the complete conversation.
Losing original devices, files, envelopes, receipts, or transaction references.
Posting accusations, IDs, account details, or private communications publicly.
Conducting an amateur entrapment or confronting the suspect in a dangerous setting.
Paying an unofficial intermediary who promises arrest, account freezing, or a guaranteed outcome.
Signing a quitclaim, settlement, or affidavit of desistance without understanding its effect.
Assuming that a platform report or police blotter alone completes the legal filing process.

When legal help is urgent

Consult a Philippine lawyer promptly when:

a large amount or essential family savings is involved;
funds were transferred within the last few hours or days;
the suspect is moving assets, leaving the country, or threatening witnesses;
several victims or jurisdictions are involved;
the transaction involves cryptocurrency, investment solicitation, corporate entities, land, forged documents, or overseas accounts;
you need attachment, injunction, preservation, or another time-sensitive order;
a prosecutor, investigator, bank, or court has issued a deadline;
you are considering settlement or withdrawing a complaint;
the complaint has been dismissed; or
you may also face liability because your account was used to receive or transfer funds.

Those unable to afford private counsel may ask the Public Attorney’s Office about eligibility and available assistance. Availability and representation remain subject to its mandate, means and merit requirements, conflicts rules, and current procedures.

Frequently asked questions

Can I file estafa if the person simply failed to repay me?

Not necessarily. Mere nonpayment ordinarily creates civil liability. Estafa requires proof of the particular fraud or abuse-of-confidence elements charged. The agreement, representations, purpose of delivery, and accused’s intent are crucial.

Is a demand letter required?

It depends on the form of estafa and the facts. Demand is often valuable evidence and may be required for particular contractual or statutory consequences, but it is not a universal substitute for proving every criminal element. Preserve proof that the demand was delivered.

Can I recover money even if nobody is convicted?

Possibly. A recall, authorized hold, chargeback, institutional restitution, settlement, or properly supported civil action may provide a route to recovery. Each has separate requirements. Acquittal does not invariably extinguish every possible civil claim, although the court’s findings can be decisive.

Can a bank or e-wallet freeze the recipient’s entire account on my request?

Not simply because you demand it. Covered institutions may temporarily hold disputed funds under AFASA and BSP rules, while broader freezes or restraints may require authority from the BSP, law enforcement, the AMLC, or a court, depending on the legal basis.

What if I authorized the transfer because I was deceived?

Report it immediately. A transfer you personally confirmed can still be relevant to estafa, social engineering, or another offense, but reimbursement is not automatic. Explain exactly what representation caused you to authorize the transaction.

What if the account owner says someone else used the account?

The account trail remains important, but receipt of money alone does not conclusively prove that the account owner devised or knowingly joined the fraud. Investigators must determine knowledge, participation, control, and the movement of funds.

Can I report an anonymous or foreign scammer?

Yes. Provide every available identifier, including account numbers, usernames, phone numbers, email addresses, wallet addresses, transaction hashes, IP-related records in your possession, and platform URLs. Identification and enforcement may be harder and slower, but anonymity is not a reason to destroy evidence or abandon prompt reporting.

Should I post the suspect’s name online to warn others?

Exercise caution. Public accusations can create privacy, defamation, safety, and evidentiary problems. Report through official channels and seek legal advice before publishing identifying information.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The proper remedy depends on the evidence, governing documents, location of relevant acts, identity of the parties, and procedural history. Official sources and procedures were checked as of 19 September 2026.