I. Introduction

Mobile wallet transactions have become part of daily financial life in the Philippines. GCash and Maya are commonly used for remittances, online purchases, lending, bills payment, marketplace transactions, gaming deposits, business collections, and personal transfers. Their convenience, however, has also made them attractive channels for scams, unauthorized transfers, mule-account operations, online gambling fraud, fake sellers, phishing schemes, loan-app harassment, and identity theft.

When money moves from Maya to GCash, or from GCash to Maya, victims often ask: Can the transaction be traced? Can the sender or receiver be identified? Can the money be frozen or recovered? Who can legally obtain the account holder’s identity?

The short answer is that mobile wallet transactions are generally traceable at the institutional and law-enforcement level, but not fully traceable by private individuals on their own. A private complainant may have receipts, reference numbers, account names, mobile numbers, and timestamps, but the deeper information—such as verified account identity, linked device information, KYC documents, IP logs, and transaction-chain history—is usually protected by privacy, bank secrecy, cybersecurity, and financial regulations. Access normally requires proper legal process, law enforcement involvement, regulatory request, court order, or formal cooperation by the financial institution.

II. What It Means to “Trace” a Maya–GCash Transaction

Tracing may mean different things depending on the purpose.

1. Basic user-level tracing

This is what the sender or receiver can see from the app:

transaction reference number;
date and time;
amount;
sender or recipient name, sometimes partially masked;
mobile number, sometimes partially masked;
transaction status;
transfer channel;
fees;
confirmation messages;
SMS or email notifications.

This is useful for proving that a transaction occurred, but it may not be enough to identify the true person behind the wallet.

2. Platform-level tracing

Maya and GCash may internally have access to:

full registered name;
wallet number;
KYC level;
ID documents submitted;
selfie or liveness verification data;
linked email address;
linked phone number;
transaction history;
device identifiers;
login history;
IP-related metadata;
cash-in and cash-out channels;
linked bank accounts;
suspicious activity flags.

A private user cannot simply demand all this information because it involves personal data and regulated financial records.

3. Law-enforcement tracing

Police, cybercrime investigators, prosecutors, courts, and authorized regulators may seek deeper records through proper channels. This may include identifying the owner of a wallet, tracing where funds went next, finding linked accounts, and connecting digital activity to a suspect.

4. Recovery tracing

This focuses not only on identifying the account but also on locating funds quickly enough to freeze, reverse, hold, or recover them. Recovery is harder than tracing because scam funds are often moved within minutes through multiple wallets, banks, cash-out agents, crypto channels, or mule accounts.

III. Legal Nature of Maya and GCash Transactions

Maya and GCash operate as electronic money and digital financial service platforms. Transfers between them are not casual text-message exchanges; they are regulated financial transactions. They create electronic records that may be used as evidence, subject to authentication and admissibility rules.

A transaction between Maya and GCash may involve:

the sender’s wallet provider;
the recipient’s wallet provider;
payment rails or switching systems;
settlement systems;
partner banks;
cash-in and cash-out partners;
fraud monitoring systems;
compliance and anti-money laundering controls.

Because these platforms are regulated, they generally maintain transaction records and are expected to follow customer identification, anti-money laundering, cybersecurity, consumer protection, and data privacy obligations.

IV. Main Philippine Laws and Legal Concepts Involved

A. Electronic Commerce and Electronic Evidence

Digital transactions, screenshots, app receipts, SMS confirmations, emails, and electronic records may be used as evidence. However, the complainant should preserve original records and avoid altering screenshots. Courts and investigators may require proof that the electronic evidence is authentic, complete, and connected to the relevant account.

Useful evidence includes:

app transaction receipt;
reference number;
SMS notification;
email confirmation;
bank or wallet statement;
screenshots showing sender and recipient;
chat instructions telling the victim where to send money;
QR code used;
account name and mobile number;
date and time of transfer.

The best evidence is not merely a cropped screenshot but a complete set of records showing the transaction and surrounding communications.

B. Data Privacy Act

Wallet account information is personal data. A person cannot lawfully force GCash or Maya to disclose another user’s full identity merely by asking. The recipient’s full name, ID documents, address, device details, and transaction history are protected information.

This means:

customer service may confirm limited transaction information;
full account-owner details are usually withheld from private individuals;
disclosure normally requires lawful basis;
law enforcement or regulators may request information through proper procedures;
victims should not attempt doxxing, hacking, phishing, or unauthorized access.

The Data Privacy Act protects both victims and alleged wrongdoers. Even if a person appears to be a scammer, their personal data is still handled through lawful process.

C. Anti-Money Laundering Framework

Mobile wallets are vulnerable to mule-account activity. A mule account is an account used to receive and move illicit funds, sometimes by a willing participant and sometimes through a rented, borrowed, stolen, or fraudulently opened account.

Suspicious indicators include:

multiple victims sending money to the same wallet;
rapid movement of funds after receipt;
transfers to many unrelated accounts;
cash-out shortly after receipt;
use of newly verified accounts;
repeated small transfers structured to avoid detection;
accounts receiving funds from scams, illegal gambling, or phishing.

Maya and GCash have compliance obligations to monitor suspicious transactions and may freeze, restrict, or investigate accounts under applicable rules and internal risk controls. However, a victim’s report alone does not always guarantee an immediate freeze or refund.

D. Cybercrime Prevention Act

If the transaction is connected to phishing, online scam, unauthorized access, identity theft, hacking, fake marketplace listings, fake investment schemes, online gambling scams, or social media fraud, the case may involve cybercrime.

Examples:

A scammer uses Messenger to instruct the victim to send money to GCash.
A fake Maya link steals credentials and drains the wallet.
A victim is tricked into sending funds to a mule wallet.
A SIM-linked wallet is taken over.
A fake seller uses multiple e-wallets to receive payments.
A gambling platform refuses withdrawals and routes deposits through personal wallets.

Cybercrime authorities may request preservation or disclosure of electronic evidence through lawful channels.

E. Revised Penal Code: Estafa and Theft

Many wallet-related complaints involve estafa or theft, depending on the facts.

Estafa

Estafa may apply when the victim voluntarily sends money because of deceit. Examples:

fake seller;
fake investment;
online gambling withdrawal scam;
romance scam;
employment fee scam;
fake loan processing fee;
fake ticket sale;
fake rental deposit.

The victim transferred funds, but did so because of fraudulent representations.

Theft or unauthorized transfer

Theft-related theories may arise when the victim did not authorize the transfer, such as when:

the wallet was hacked;
OTPs were stolen;
credentials were compromised;
SIM was taken over;
device was stolen;
unauthorized account access occurred.

The legal theory depends on whether the victim was deceived into sending money or whether the money was taken without consent.

F. Consumer Protection and Financial Consumer Rules

Users of financial products and services have rights to fair handling, complaint resolution, transparency, and protection against unauthorized or fraudulent transactions. A complainant may file a complaint with the wallet provider and, where appropriate, escalate to financial regulators or consumer assistance channels.

Important point: a wallet provider is not automatically liable for every scam transfer. If the user voluntarily authorized the transfer to a scammer, recovery may be more difficult. If the transaction was unauthorized due to system failure, account takeover, or security breach, the analysis may be different.

V. Can a Private Person Identify the Owner of a GCash or Maya Account?

Usually, not directly.

A private complainant may see:

display name;
masked name;
mobile number;
transaction reference number;
QR code name;
confirmation receipt.

But the full legal identity, address, ID documents, and complete transaction history are not normally disclosed to another private user without legal basis.

The proper route is to:

report to the wallet provider;
request investigation and preservation of records;
file a police or cybercrime complaint;
provide the transaction reference numbers;
allow authorities to request the protected information through proper channels.

A victim should not attempt to obtain the account holder’s identity through bribery, hacking, fake support agents, phishing, social engineering, or unauthorized database access. That may create separate criminal and civil liability.

VI. Can Maya Trace a Transfer Sent to GCash?

Maya can generally identify the transaction initiated from the Maya account, including the amount, date, recipient details entered, reference number, and status. However, once the funds are received by a GCash wallet, the receiving-side details and later movement of funds are primarily within GCash’s records and the payment network’s records.

Maya may be able to:

confirm that the transaction was successful or failed;
provide reference information;
investigate whether there was a system error;
receive a fraud report;
coordinate through proper institutional channels;
preserve records;
restrict the sender account if compromised;
assist law enforcement when legally required.

Maya may not freely disclose the full identity or transaction history of the GCash recipient to the victim.

VII. Can GCash Trace a Transfer Received from Maya?

GCash can generally identify the receiving wallet, transaction reference, timestamp, account status, and subsequent movement within its own system. If the recipient quickly transferred the funds elsewhere or cashed out, GCash’s internal records may show the next steps, subject to legal process.

GCash may be able to:

receive a fraud report from the sender or victim;
flag the receiving account;
review suspicious activity;
restrict or freeze accounts under proper circumstances;
preserve records;
coordinate with Maya, law enforcement, and regulators;
provide information to authorities through lawful channels.

GCash will usually not disclose the full recipient identity to a private complainant merely upon request.

VIII. What Information Is Needed to Trace a Maya–GCash Transaction?

The complainant should collect and organize the following:

A. Transaction details

amount sent;
date and exact time;
reference number;
sender wallet number;
recipient wallet number;
displayed recipient name;
transaction status;
transaction fee;
screenshot of receipt;
SMS or email confirmation.

B. Account details

Maya account used;
GCash account received;
account names shown;
QR code used, if any;
username or merchant name;
linked social media account, if known.

C. Communication evidence

chats with the scammer;
payment instructions;
promises made;
screenshots of product listing, gambling platform, investment pitch, or service offer;
voice notes;
call logs;
emails;
links sent by the scammer.

D. Fraud context

why money was sent;
what was promised;
whether goods or services were delivered;
whether the wallet was hacked;
whether OTPs or passwords were shared;
whether there was a phishing link;
whether there were additional victims.

E. Post-transfer events

whether the recipient blocked the victim;
whether the platform disappeared;
whether more payments were demanded;
whether threats were made;
whether the same wallet is used in other complaints.

IX. Immediate Steps After a Suspicious Maya–GCash Transfer

Step 1: Do not send more money

Scammers often claim that another payment is needed to unlock a refund, release winnings, pay tax, verify identity, or reverse the transaction. These are common continuation tactics.

Step 2: Save all evidence

Take screenshots and screen recordings immediately. Save receipts, chats, usernames, links, phone numbers, and reference numbers.

Step 3: Report to the sending wallet provider

If you sent money from Maya, report to Maya immediately. If you sent money from GCash, report to GCash immediately. Provide the reference number, amount, date, recipient, and fraud explanation.

Step 4: Report to the receiving wallet provider if possible

If the recipient wallet is known, report it as a suspected scam account. The provider may not disclose details to you, but your report may help flag the account.

Step 5: Request preservation of records

Ask the provider to preserve records related to the transaction and account. This is important because logs and digital records may have retention limits.

Step 6: File with cybercrime authorities

For online scams or unauthorized transfers, file a complaint with cybercrime authorities. Bring printed and digital copies of evidence.

Step 7: Prepare a complaint-affidavit

If you know the identity of the scammer or receiving account holder, or if law enforcement can identify them, a complaint-affidavit may support criminal proceedings.

Step 8: Monitor your accounts

Change passwords, secure email, enable two-factor authentication, check linked devices, and report unauthorized access immediately.

X. When Can Funds Be Frozen?

Funds may be frozen, held, or restricted depending on the circumstances and applicable legal authority. There are several possible situations:

Internal risk hold by the wallet provider A provider may temporarily restrict an account due to suspicious activity, fraud indicators, or compliance concerns.
Law enforcement request Authorities may request preservation or action based on a complaint and investigation.
Court order or regulatory action Certain cases may require formal legal orders.
AML-related action If the transaction appears connected to money laundering or predicate crimes, special rules may apply.
Consumer dispute handling The provider may investigate and, in limited cases, reverse or adjust transactions if justified.

A freeze is more likely if the report is immediate and the funds remain in the account. If the funds have already been withdrawn or transferred onward, recovery becomes more difficult.

XI. Can a Maya-to-GCash or GCash-to-Maya Transfer Be Reversed?

A reversal is not automatic.

It depends on:

whether the transaction was unauthorized or voluntarily initiated;
how quickly the report was made;
whether the recipient account still has funds;
whether the receiving account is active and identifiable;
whether the provider finds fraud;
whether the transaction violated terms or laws;
whether there is a legal order;
whether the payment network permits reversal;
whether the recipient contests the claim.

Voluntary scam transfers

If the victim voluntarily sent money after being deceived, the provider may treat it differently from an unauthorized transaction. The scammer’s fraud may support a criminal case, but it does not always mean the wallet provider can instantly reverse the transfer.

Unauthorized transfers

If the victim did not authorize the transfer, such as in account takeover or phishing, the provider’s investigation may focus on access logs, OTP events, device use, security alerts, and whether the user’s credentials were compromised.

XII. Difference Between a Scam Transfer and an Unauthorized Transfer

This distinction is legally important.

A. Scam transfer

The victim personally sends the money, but because of deceit.

Examples:

fake seller;
fake online gambling site;
investment scam;
romance scam;
fake job fee;
fake loan release fee.

Possible case: estafa, cybercrime-related fraud, illegal gambling-related fraud, consumer complaint.

B. Unauthorized transfer

The victim did not knowingly approve the transfer.

Examples:

hacked wallet;
stolen phone;
SIM swap;
phishing link stole credentials;
malware;
OTP interception;
unauthorized linked device.

Possible case: theft, cybercrime, identity theft, unauthorized access, data breach, financial consumer complaint.

The evidence needed differs. Scam transfers focus on deception. Unauthorized transfers focus on access, consent, device control, and authentication.

XIII. Role of Reference Numbers

Reference numbers are critical. They allow providers and investigators to locate the transaction quickly.

A complaint without a reference number may still proceed, but it becomes harder. If the app receipt is gone, the complainant should check:

transaction history;
SMS inbox;
email inbox;
downloaded statements;
bank records;
screenshots;
support tickets;
linked notifications.

The reference number should be included in every report, complaint-affidavit, and follow-up.

XIV. Role of KYC in Tracing

KYC means “Know Your Customer.” Wallet providers require users to submit identifying information depending on account level and services used. In theory, KYC helps trace account holders. In practice, scammers may still use:

stolen identities;
borrowed accounts;
rented accounts;
mule accounts;
fake documents;
SIM cards registered under another person;
accounts opened by vulnerable persons for a fee;
hacked legitimate accounts.

Therefore, identifying the wallet account holder is not always the same as identifying the mastermind. Investigators may need to trace communications, devices, IP logs, cash-out locations, linked accounts, and other victims.

XV. Mule Accounts and Legal Liability

A person whose wallet received scam proceeds may claim, “I only lent my account,” “I did not know,” or “Someone used my wallet.” These claims must be investigated.

Possible liability may arise if the account holder:

knowingly allowed the wallet to receive scam funds;
rented or sold wallet access;
withdrew funds for another person;
ignored obvious suspicious activity;
repeatedly received funds from victims;
transferred funds onward to conceal their source.

Even if the account holder is not the mastermind, they may become a key respondent or witness. A mule account can be the first traceable link in the chain.

XVI. What Victims Should Ask From Maya or GCash

A victim’s report should be specific. Instead of merely saying “I was scammed,” include a clear request.

Possible requests:

investigate the transaction;
flag the recipient account;
preserve records;
check if funds remain;
restrict further suspicious movement if allowed;
provide a case or ticket number;
advise what documents are required;
coordinate with law enforcement upon request;
issue a certification or transaction record if available;
guide the complainant on dispute or fraud procedures.

The provider may not provide the other party’s private details, but it may take internal action and cooperate with authorities.

XVII. Sample Report to Wallet Provider

A clear complaint may say:

I am reporting a suspected fraudulent transaction. On [date] at approximately [time], I transferred ₱[amount] from my [Maya/GCash] account to [recipient wallet/account details shown]. The transaction reference number is [reference number].

I made the transfer because [brief explanation: fake seller, online gambling platform, investment scam, unauthorized access, etc.]. After receiving the money, the recipient [blocked me/refused delivery/demanded more money/denied withdrawal/disappeared].

I request that you investigate the transaction, flag or review the recipient account, preserve all relevant records, and advise me on the documents needed for a formal fraud complaint. I am prepared to submit screenshots, receipts, chat logs, and a police or cybercrime report.

XVIII. Filing a Cybercrime or Police Complaint

A victim should prepare both printed and digital evidence. The complaint should be chronological.

A. Basic documents

valid ID of complainant;
transaction receipts;
screenshots of wallet transaction history;
chat logs;
scammer profile screenshots;
product listing, website, gambling platform, or investment page;
proof of non-delivery or refusal;
support tickets filed with Maya or GCash;
computation of total loss.

B. Narrative

The narrative should answer:

Who contacted whom?
What was promised?
Why did the victim send money?
What wallet received the money?
What happened after payment?
Was there a demand for more money?
Was the victim blocked?
Are there other victims?
What evidence links the respondent to the wallet?

C. Request

The complainant may request investigation for estafa, cybercrime-related fraud, unauthorized access, identity theft, theft, illegal gambling-related fraud, or other applicable offenses depending on facts.

XIX. Complaint-Affidavit Structure

A complaint-affidavit may be organized as follows:

Complainant’s personal circumstances Name, age, citizenship, address, and capacity to file.
Respondent’s identity, if known Name, alias, account name, phone number, profile link, wallet number, bank account, or unknown person using specified account.
Background facts How the transaction arose.
False representations or unauthorized access Describe the deception or how the account was compromised.
Transaction details Include amounts, dates, times, wallet numbers, names shown, and reference numbers.
Post-payment conduct Blocking, refusal, disappearance, new demands, threats, or account takeover.
Damage suffered Total financial loss and related consequences.
Evidence attached List each screenshot, receipt, chat log, and support ticket.
Prayer Request investigation and filing of appropriate charges.

XX. Sample Complaint-Affidavit Paragraph

On [date], I transferred the amount of ₱[amount] from my [Maya/GCash] account to the [GCash/Maya] account identified as [name/number shown], with transaction reference number [reference number]. I made the transfer after the respondent represented that [state promise or reason]. After receiving the money, the respondent failed to comply, refused to return the amount, and eventually [blocked me/disappeared/demanded more money].

I later realized that the representations were false and were intended to induce me to send money. I respectfully request an investigation into the recipient wallet account, the persons controlling it, and any subsequent transfers or withdrawals connected to the transaction.

XXI. Evidentiary Issues in Wallet Tracing

A. Screenshots are useful but not perfect

Screenshots can be challenged as edited, incomplete, or taken out of context. Support them with:

app-generated receipts;
SMS confirmations;
emails;
full chat exports;
screen recordings;
provider certifications;
official transaction statements.

B. Account name may not be enough

A displayed account name can be incomplete, masked, fake, or based on a mule. It helps but should not be treated as conclusive proof of the real scammer’s identity.

C. Phone number may not identify the mastermind

A phone number may belong to:

a mule;
a prepaid SIM holder;
a stolen SIM;
a recycled number;
a borrowed phone;
a hacked account.

Investigators must connect the number to conduct, communications, devices, and money movement.

D. Timing matters

The faster the victim reports, the greater the chance that records are fresh and funds may still be restricted.

XXII. Common Scenarios

A. Fake seller receives payment through GCash, victim paid from Maya

The victim should report to Maya as sender, GCash as recipient platform if possible, and file a complaint for estafa if deception is clear.

B. GCash account sends funds to Maya without authorization

This may involve account takeover. The victim should immediately secure the GCash account, report unauthorized access, change credentials, preserve OTP messages, and request investigation.

C. Online gambling platform uses Maya and GCash deposits

This may involve illegal gambling, estafa, cybercrime, and money-laundering red flags. The victim should document the platform, agents, deposit channels, failed withdrawals, and fake fees.

D. Marketplace scammer uses multiple wallet accounts

Each transaction should be listed separately, with reference numbers and recipient details. Multiple accounts may show organized fraud.

E. Romance or investment scam routes funds through wallets

The complaint should include the relationship history, promises, fake profits, transfer instructions, and refusal to release funds.

F. Loan fee scam

If the victim paid “processing fees,” “insurance,” or “release fees” through a wallet but no loan was released, this may support estafa or consumer-finance complaints.

XXIII. Data Preservation Letter

A complainant or lawyer may send a preservation request to the wallet provider. This does not guarantee disclosure or freezing, but it documents urgency.

The request may ask the provider to preserve:

transaction logs;
account registration records;
KYC documents;
device and login records;
linked accounts;
cash-out records;
communications with customer support;
records of subsequent transfers.

The provider may respond that disclosure requires legal process, but preservation can still be important.

XXIV. What Not to Do

Victims should avoid:

posting unverified personal information online;
threatening the alleged account holder;
hacking or attempting account access;
bribing insiders for wallet information;
paying “recovery agents” who promise instant tracing;
sending more money to unlock refunds;
deleting chats out of embarrassment;
editing screenshots;
using fake IDs to investigate;
pretending to be law enforcement.

These actions may weaken the case or create separate liability.

XXV. “Recovery Agents” and Fake Tracing Services

Many victims are targeted again by people claiming they can recover GCash or Maya funds for a fee. These are often secondary scams.

Warning signs:

guaranteed recovery;
demand for upfront fee;
request for wallet PIN or OTP;
claim of insider access;
fake police or regulator identity;
promise to hack the recipient;
pressure to act immediately.

Legitimate recovery usually proceeds through the wallet provider, law enforcement, regulators, or courts—not private hackers.

XXVI. Legal Remedies Available

Depending on the facts, remedies may include:

fraud complaint with the wallet provider;
request for reversal or dispute review;
cybercrime complaint;
criminal complaint for estafa, theft, identity theft, or related offenses;
complaint for illegal gambling-related activity, if applicable;
consumer complaint;
data privacy complaint;
civil action for recovery of sum of money and damages;
request for preservation or production of records through legal process;
coordination with banks, e-wallets, and law enforcement.

The appropriate remedy depends on whether the case is a scam, an unauthorized transfer, a failed commercial transaction, a gambling-related fraud, or a broader organized scheme.

XXVII. Practical Timeline for Victims

Within minutes or hours

Take screenshots.
Report to wallet provider.
Change passwords.
Disable suspicious linked devices.
Request account restriction if your own wallet is compromised.
Save chats and receipts.

Within 24 hours

File formal support tickets.
Report the receiving wallet.
Prepare a timeline.
Gather evidence.
Consider police or cybercrime reporting.

Within several days

Execute complaint-affidavit.
Submit evidence to authorities.
Follow up with wallet providers.
Request preservation of records.
Check whether other victims exist.

Within the investigation period

Keep all case numbers.
Submit additional evidence.
Avoid direct confrontation with suspects.
Coordinate with authorities for legal requests to platforms.

XXVIII. Why Tracing May Fail or Stall

Tracing may become difficult when:

funds were quickly withdrawn;
account was opened using stolen identity;
wallet was rented or sold;
phone number is no longer active;
scammer used foreign platforms;
victim delayed reporting;
screenshots lack reference numbers;
transaction was routed through many accounts;
recipient used cash-out agents;
complainant cannot show deception;
provider requires legal process before disclosure.

Even when tracing identifies the first recipient wallet, identifying the mastermind may require more investigation.

XXIX. Best Practices for Businesses Receiving Wallet Payments

Businesses using Maya or GCash should maintain clean records to avoid disputes:

issue official receipts or acknowledgments;
use business accounts rather than personal wallets;
maintain transaction logs;
use consistent account names;
avoid receiving payments through employees’ personal wallets;
keep customer order records;
reconcile daily;
respond promptly to disputes;
secure devices and access credentials.

Using personal wallets for business collections can create confusion and legal exposure.

XXX. Best Practices for Consumers

Before sending money:

verify the recipient;
avoid personal wallets for large purchases from strangers;
check seller history;
avoid rush payments;
do not send OTPs;
do not click suspicious links;
confirm official merchant accounts;
screenshot the listing before paying;
avoid platforms that require additional payment to withdraw funds;
be cautious with QR codes sent by strangers;
use escrow or trusted marketplaces when possible.

After sending money:

keep the receipt;
save chats;
monitor delivery or performance;
report suspicious conduct immediately.

XXXI. Conclusion

Tracing mobile wallet transactions between Maya and GCash is legally and technically possible, but the depth of tracing depends on who is doing it and under what authority. A private user can document the transaction through receipts, reference numbers, screenshots, and communications. The wallet providers can internally trace account and transaction records. Law enforcement and regulators can seek deeper identifying information through proper legal channels.

The most important steps are speed, documentation, and lawful reporting. Victims should immediately preserve evidence, report to Maya and GCash, request investigation and record preservation, file with cybercrime authorities when fraud or unauthorized access is involved, and prepare a clear complaint-affidavit supported by transaction reference numbers.

A wallet transfer is not anonymous merely because it happened through a mobile app. But tracing must respect privacy, due process, and financial regulations. The lawful path is not hacking, public shaming, or paying recovery agents; it is organized evidence, prompt reporting, provider cooperation, and proper legal process.