Quick answer

If you sent money, cryptocurrency, or e-wallet funds to a supposed investment promoted through Telegram, act immediately. Contact the bank, e-wallet, exchange, or payment provider that sent the funds and report every transfer as fraudulent. Ask it to trace the transaction, alert receiving institutions, secure your account, and determine whether the remaining funds can be temporarily held under the Anti-Financial Account Scamming Act.

Then preserve the Telegram conversations and transaction records, report the scheme to the Securities and Exchange Commission (SEC), and file a complaint with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD). A criminal complaint for estafa and related offenses may be possible. SEC violations, money-mule offenses, identity misuse, and other cybercrime charges may also apply, depending on the evidence.

Recovery is possible but not guaranteed. It becomes much harder once money has been withdrawn, moved through several accounts, converted to cryptocurrency, or transferred abroad. Do not pay any supposed “tax,” “verification,” “unlocking,” “gas,” or “recovery” fee. That is commonly another stage of the fraud.

What usually happens in a Telegram investment scam

The names and products differ, but the pattern often includes:

An unsolicited Telegram message, advertisement, or invitation to an “investment,” trading, crypto, mining, staking, or task-based income group.
Claims of guaranteed, unusually high, or risk-free returns.
Screenshots, dashboards, testimonials, or group members showing supposed profits.
Instructions to send money to personal bank or e-wallet accounts, sometimes under different names.
A small early withdrawal designed to build confidence.
Pressure to invest larger amounts or recruit other people.
A displayed balance that cannot actually be withdrawn.
Demands for additional payments described as taxes, commissions, insurance, account upgrades, anti-money-laundering clearance, or withdrawal fees.
The disappearance of administrators, deletion of messages, or removal of the victim from the group.

A displayed “profit” on a website, app, bot, or spreadsheet does not prove that an investment or trading account exists. The legally important evidence is what was represented to you, why you relied on it, where the money went, and what happened when you sought withdrawal or repayment.

Your first priority: try to stop the money

1. Call the sending institution now

Use the bank, e-wallet, remittance company, or exchange’s official 24/7 fraud-reporting channel—not a number supplied by the Telegram contact.

Provide, for each transfer:

Transaction reference number
Date and exact time
Amount
Sending account
Recipient name and account or wallet number
Receiving institution
Screenshots or receipts
A short explanation that the transfer resulted from a fraudulent investment solicitation

Ask for:

Immediate protection or temporary restriction of your account if credentials may have been compromised
Tracing of the transaction chain
Notification of the receiving institution
A temporary hold of any identifiable disputed funds, where legally available
Preservation of account and transaction records
A written acknowledgment and case reference number
The documents required for coordinated verification or a formal fraud complaint

Reporting quickly matters even if you personally approved the transfer. Explain the deception accurately. Do not simply label an authorized transfer “unauthorized” if you initiated it yourself.

2. Understand what the AFASA process can and cannot do

Under Republic Act No. 12010, the Anti-Financial Account Scamming Act, covered institutions may temporarily hold funds involved in a disputed transaction while verifying it. The law also targets money-mule activity and certain social-engineering schemes.

Under the BSP’s implementing rules in its Manual of Regulations for Payment Systems:

A complaint may be made through the sending institution’s 24/7 fraud-reporting channel.
The initial hold may last up to five calendar days.
If the required grounds exist, it may be extended by up to 25 additional calendar days.
The total administrative holding period is therefore no more than 30 calendar days; a further extension requires an order from a competent court.
The institutions conduct coordinated verification and may trace funds through receiving and subsequent receiving institutions.
The complainant must cooperate and promptly provide requested information and supporting documents.

A hold is not an automatic refund or a final finding of fraud. Whether funds can be held or returned depends on the governing rules, the verification results, whether the funds remain traceable and intact, and any court order or other legal process. Completely unwarranted or knowingly false reports may themselves create liability.

3. Escalate unresolved complaints involving BSP-supervised institutions

The bank or e-wallet’s consumer-assistance mechanism is ordinarily the first-level remedy. If its response is inadequate or the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including the institution’s case number and response.

The BSP process addresses the conduct of supervised institutions. It is not a substitute for a police, NBI, prosecutorial, or SEC complaint against the scammers.

Preserve evidence before accounts and messages disappear

Do not delete the Telegram chat, leave the group, reset the phone, or block every participant until you have preserved the evidence and secured your accounts.

Save the following in their original form where possible:

The entire Telegram conversation, not merely selected screenshots
Group and channel names, descriptions, invitation links, and public URLs
Usernames, profile names, profile photos, phone numbers, and Telegram user IDs if visible
Messages containing promises, guarantees, instructions, threats, or payment demands
Voice messages, video calls, photographs, documents, and advertisements
Dates and times, with the device’s time zone noted
Bank statements, transfer receipts, e-wallet histories, and reference numbers
Recipient account names, numbers, QR codes, wallet addresses, and exchange deposit details
The scam website’s complete URL, login page, dashboard, and withdrawal messages
Emails, SMS messages, caller numbers, and social-media advertisements
Contracts, certificates, identification cards, SEC documents, or licenses sent by the promoters
Records of every attempted withdrawal and every demand for another fee
Names and contact information of other victims or witnesses
Your initial investment amount, later payments, any amount actually returned, and net loss

Export chats or download files where the platform permits. Keep unedited copies and create backups. For screenshots, include identifying details and timestamps. Record a screen video showing the relevant account, group, username, and message sequence, but retain the underlying device and original files.

Prepare a chronological table of events. Do not alter receipts, crop away material details, impersonate the scammers, threaten them, or access an account that is not yours. Investigators can seek appropriate preservation, disclosure, and cybercrime warrants when legal requirements are met.

Criminal remedies

Estafa through false pretenses

A fraudulent investment solicitation may constitute estafa under Article 315(2)(a) of the Revised Penal Code when the evidence proves that:

The accused made a qualifying false pretense or fraudulent representation;
It was made before or at the time of the fraud;
The victim relied on it and was induced to part with money or property; and
The victim suffered damage.

These elements are reflected in Supreme Court decisions such as People v. Montano and more recent applications of Article 315. A later failure to deliver profits or repay money, by itself, does not automatically prove estafa. The prosecution must establish the required deceit and its connection to the payment.

Because Telegram and related digital systems are used to communicate and execute the scheme, Section 6 of Republic Act No. 10175 may apply when an existing offense is committed by, through, and with information and communications technology. The Supreme Court has explained that this provision makes ICT use a qualifying circumstance carrying the statutorily increased penalty. The precise charge and penalty depend on the proven acts, amount involved, applicable amendments, participation of each accused, and charging allegations.

Securities-law violations

An “investment contract” is a security when a person invests money in a common enterprise with an expectation of profits primarily from the efforts of others. The Supreme Court discussed this test in SEC v. W.J. Howey–related Philippine jurisprudence.

As a general rule, securities offered or sold to the public must be registered unless a statutory exemption applies. Brokers, dealers, associated persons, and salespersons must also have the authority required by the Securities Regulation Code, Republic Act No. 8799.

A company’s SEC registration does not by itself authorize it to solicit investments. Verify both:

Whether the entity legally exists; and
Whether the particular securities and the persons selling them have the necessary SEC registration, license, or authority.

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765 separately prohibits investment fraud and authorizes regulatory sanctions. Which regulator has jurisdiction may depend on whether the supposed product involves securities, banking, insurance, lending, virtual assets, commodities, or another regulated service.

Money mules and financial-account offenses

AFASA prohibits specified uses of financial accounts to obtain, receive, deposit, transfer, or withdraw criminal or social-engineering proceeds. It can cover selling, lending, renting, buying, or allowing the use of an account, as well as recruiting people for those purposes, when the law’s knowledge and purpose requirements are established.

The person named on a receiving account is not necessarily the mastermind. Conversely, saying “I only lent my account” does not automatically remove liability. Investigators must establish what each participant did and knew.

Syndicated or organized schemes

More serious charging provisions may be considered when the facts establish the required number of participants, conspiracy, victims, manner of operation, or other statutory circumstances. These are evidence-dependent conclusions. A victim should describe the organization and all known participants without prematurely assigning a particular offense.

Where to report

You may pursue several channels at the same time because they serve different functions.

PNP or NBI

File a complaint with the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or an appropriate regional cybercrime office. The NBI provides an online complaint page and information on investigative assistance for victims of computer crimes.

Bring:

A valid government-issued ID
A sworn, chronological account
Printed and electronic copies of the evidence
A schedule of payments and losses
Bank or e-wallet certifications and statements, if already available
The financial institution’s complaint acknowledgment
Details of suspected recipients, recruiters, administrators, and witnesses

Ask the receiving office what original devices, affidavits, certifications, or additional records it requires. Obtain and keep the complaint or reference number.

Securities and Exchange Commission

Report the offer and promoters to the SEC when the scheme involved investments, securities, profit-sharing, managed trading, pooled funds, or recruitment tied to returns. Use the SEC’s official iMessage complaint and inquiry portal.

Include the promotional materials, investment terms, identities used, payment accounts, Telegram links, and proof of loss. An SEC report can support regulatory investigation, but it does not automatically recover the victim’s money or replace a criminal complaint.

Telegram and other platforms

After preserving the evidence, report the accounts, group, channel, bot, and advertisements through Telegram’s reporting tools. Report any associated website to its hosting provider or registrar where appropriate.

Platform reporting may limit further victimization, but account removal can also make evidence harder to obtain. Preserve first and promptly give investigators the identifiers they may need.

Cryptocurrency exchanges

If funds were sent to a hosted exchange, contact the exchange’s official fraud or compliance channel immediately. Give the transaction hash, blockchain, wallet addresses, date, amount, account details, and law-enforcement reference number when available.

Blockchain transfers generally cannot be reversed merely by making a complaint. An exchange may preserve records or restrict an account only under its procedures and applicable law. Recovery usually requires identifying a custodial service or person who still controls traceable assets and obtaining appropriate cooperation or legal process.

Filing the criminal complaint

An initial report is not always the same as a formal criminal complaint. Depending on the investigation and offense, the matter may proceed to a prosecutor through a complaint-affidavit and supporting evidence.

A useful complaint-affidavit should state, in order:

How you encountered the promoter;
Every material representation made;
Why you believed and relied on those representations;
Each payment, including its recipient and reference number;
What the promoter did after receiving the money;
Your withdrawal or refund demands and the responses;
How and when you discovered the fraud;
The identities and specific acts of each respondent, so far as genuinely known; and
The loss and supporting documents.

Do not identify an account holder as the principal scammer unless the evidence supports that assertion. State what the records show and distinguish personal knowledge from information supplied by others.

The proper venue, investigating agency, prosecutor’s office, and court may depend on where essential acts occurred, where messages were sent or received, where payments or damage occurred, and the applicable cybercrime rules. Seek legal advice where respondents or transactions span several cities or countries.

Civil recovery and claims against institutions

A victim may have a civil claim against identified perpetrators or recipients based on fraud, restitution, damages, or other applicable obligations. Civil liability may also be pursued with the criminal case where permitted.

Possible remedies can include:

A demand for repayment
A civil action against properly identified defendants
Recovery of proven actual damages
Provisional court remedies, if their strict evidentiary and procedural requirements are met
Enforcement against assets after judgment

A lawyer should first determine who owns or controls the assets and whether filing costs are proportionate to the realistic recovery. A bank account name, phone number, or crypto address alone may be insufficient to establish ultimate liability.

A bank or e-wallet is not automatically required to reimburse every scam-induced transfer. Institutional liability depends on matters such as whether the transaction was authorized, whether the institution complied with applicable security and fraud-response duties, whether it received a sufficiently specific report while funds remained available, and whether its act or omission caused additional loss.

However, the BSP rules implementing AFASA provide consequences when a covered institution fails to hold funds as legally required, including potential liability for loss arising from that failure. This is fact-sensitive and should be assessed using the complaint timestamp, transaction trail, institution responses, and applicable rules.

Important deadlines

Do not wait for Telegram, the bank, or the SEC to finish its internal process before considering law-enforcement and legal action.

Different claims and offenses have different prescriptive periods, and computation may depend on:

The precise offense or civil cause of action
The legally applicable penalty
When the offense was committed or discovered
Whether the offender was known
Whether prescription was interrupted by a qualifying complaint or proceeding
Where the respondent is located
Amendments and special laws governing the claim

A support ticket, demand letter, Telegram report, or informal police entry should not be assumed to preserve every legal claim. If the loss is substantial, the scammer is identified, assets have been located, or considerable time has passed, consult Philippine counsel promptly about prescription and the filing required to interrupt it.

Common mistakes that weaken recovery

Sending more money to “unlock” the first payment
Believing that a profitable-looking dashboard proves real trading
Deleting the conversation out of embarrassment
Saving only cropped screenshots without dates or identifiers
Reporting only the final transfer instead of the complete transaction chain
Waiting several days before contacting the sending institution
Describing a transfer you made as an account takeover
Negotiating for weeks while funds are being moved
Paying an online “hacker,” “asset recovery agent,” or supposed government contact
Assuming SEC incorporation means authority to solicit investments
Publicly accusing an uninvolved person without adequate evidence
Giving a second stranger your password, seed phrase, private key, OTP, or remote access
Filing inconsistent accounts with the bank, police, SEC, and prosecutor
Surrendering the only copy of a device or document without retaining a proper copy and receipt

When legal help is urgent

Consult a Philippine lawyer promptly when:

The loss is substantial or represents essential household or business funds;
A recipient, property, or recoverable asset has been identified;
A bank refused to act despite a timely and documented report;
Funds may still be subject to a temporary hold;
You are being threatened, blackmailed, or pressured to recruit others;
Your identity, account, SIM, or credentials were used;
You unknowingly received or forwarded funds for the group;
Investigators want access to your device or ask you to sign a statement you do not understand;
The scheme involves many victims, several jurisdictions, foreign actors, or cryptocurrency;
You are approaching a possible prescriptive deadline; or
Someone has accused you of being a recruiter or money mule.

If you allowed another person to use your account or forwarded funds, obtain independent legal advice before giving a detailed statement. Preserve everything and do not fabricate an explanation.

Practical action checklist

Immediately

Stop all further payments and communication that could compromise your accounts.
Call the sending institution’s official fraud hotline.
Secure affected email, Telegram, banking, exchange, and e-wallet accounts.
Change passwords from a trusted device and enable appropriate multi-factor authentication.
Preserve chats, receipts, URLs, wallet addresses, and account identifiers.
Request tracing, record preservation, and an AFASA assessment.
Obtain a case number.

Within the next day

Prepare a transaction schedule and narrative.
Report the scheme to PNP-ACG or NBI-CCD.
Report the investment solicitation to the SEC.
Contact any relevant exchange or receiving service.
Preserve the device and make backups.
Inform other victims to report their own transactions accurately, without coordinating false or rehearsed statements.

After filing

Respond promptly to requests from financial institutions and investigators.
Keep a dated log of every call, email, visit, and response.
Submit new accounts, wallet addresses, or aliases as soon as discovered.
Ask whether investigators need original devices or certified financial records.
Evaluate civil remedies and prescription with counsel.
Be alert for impersonators claiming they can recover the money for an advance fee.

Frequently asked questions

Can my bank reverse a transfer that I approved?

Not automatically. Immediate reporting may allow remaining funds to be traced or held, but a completed authorized transfer is not guaranteed to be reversed. The result depends on the facts, the location of the funds, the AFASA verification process, and any applicable legal order.

Does Telegram have to reveal the scammer’s identity to me?

Ordinarily, a private complainant cannot compel disclosure merely by asking. Investigators may seek preservation or disclosure through applicable legal processes. Save exact usernames, links, dates, and other identifiers before the account changes or disappears.

Is a Telegram username enough to file a complaint?

You may report the incident even if the true identity is unknown. Provide every available identifier and the complete transaction trail. A formal case against a particular person will require evidence connecting that person to the deceit, accounts, communications, or proceeds.

What if the investment company is SEC-registered?

Corporate registration alone does not authorize public investment solicitation. The particular security or investment product and the persons selling it may require separate registration or authority. Ask the SEC to verify both.

What if I received a small profit before losing money?

Disclose it. Early payouts may have been used to induce larger payments. Calculate the net loss accurately and give investigators the complete record.

Can I recover cryptocurrency?

Sometimes, but recovery is difficult. It is more realistic when assets remain at a cooperative custodial exchange or can be connected to an identifiable person. A transaction hash helps trace movement but does not itself reverse a blockchain transfer.

Should I confront the recipient account holder?

Usually not. The holder may be a participant, a money mule, another deceived person, or a stolen-identity victim. Confrontation may prompt movement of funds or destruction of evidence. Give the information to the sending institution and investigators.

Can several victims file together?

Victims may coordinate in identifying the scheme and informing investigators, but each should prepare a truthful personal account and proof of individual payments. Whether complaints are consolidated depends on the evidence, respondents, offenses, and authorities handling the matter.

Do I need a lawyer to make the initial report?

No. You may immediately report to your financial institution, the SEC, PNP, or NBI yourself. A lawyer becomes particularly useful for a complaint-affidavit, disputed venue, substantial loss, asset-preservation strategy, civil action, or possible liability as a recruiter or account intermediary.

Will filing a complaint guarantee repayment?

No. Criminal prosecution, regulatory enforcement, and financial-institution complaints have different purposes. Repayment ultimately depends on locating assets or intact funds, proving the claim, and obtaining a lawful return, settlement, or enforceable judgment.

Official legal and reporting resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the documents, payment route, parties, dates, and applicable regulator. Official sources were checked as of 3 September 2026.