Losing money to an online scam is stressful, embarrassing, and urgent all at once. The first goal is not to “build a case” yet; it is to stop further loss, preserve evidence, and give your bank, e-wallet, law enforcement, and regulators enough information to trace the money while there is still a chance it remains in the financial system. This guide explains what to do immediately after an online scam in the Philippines, which agencies handle which type of complaint, what laws may apply, what documents to prepare, and what realistic recovery options are available.

First 24 Hours: What to Do Immediately After an Online Scam

Time matters. Many scam transfers move through several accounts within minutes. Do these steps in order.

1. Secure your accounts first

Before filing reports, stop the scammer from taking more:

Change the password of the affected bank, e-wallet, email, shopping app, and social media accounts.
Turn on multi-factor authentication, preferably an authenticator app or in-app biometric method instead of SMS when available.
Log out of all devices from the app’s security settings.
Remove unfamiliar devices, linked cards, saved beneficiaries, and authorized third-party apps.
If you installed an APK, remote-access app, “investment app,” loan app, or screen-sharing app, disconnect from the internet, uninstall it, and scan the device. For large losses, use a different clean device to change passwords.
If your SIM or phone was compromised, contact your telco to block the SIM and protect your number.

Do not keep chatting with the scammer to “negotiate” unless law enforcement specifically tells you to preserve an active conversation. Scammers often use that time to move funds, demand more money, or send links that compromise more accounts.

2. Call your bank or e-wallet immediately

Report the transaction through the official hotline, app help center, or branch of the bank or e-wallet used. Ask for:

A case or ticket number
Blocking of the affected account or card
Reversal, dispute, or chargeback review if applicable
Freezing or temporary holding of funds if the recipient account is within a Philippine financial institution
A written acknowledgment or email summary of your report

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), covers financial accounts such as bank accounts, credit card accounts, transaction accounts, and e-wallets, and it specifically addresses money muling, social engineering, and misuse of financial accounts. It also requires covered institutions to have risk controls such as multi-factor authentication and fraud management systems. (Lawphil)

Under the BSP’s 2025 AFASA implementing regulations, BSP-supervised institutions may initially hold disputed funds for up to five calendar days, and temporary holding may reach up to 30 calendar days when extended under the coordinated verification process. The rules also require source account owners to provide supporting documents such as a sworn complaint, affidavit, police report, or other evidence within the initial holding period when extended holding is being assessed. (Bureau of the Treasury)

3. Save evidence before anything disappears

Do not delete the chat, account, email thread, marketplace listing, payment confirmation, or app. Save:

Full screenshots of conversations showing the scammer’s name, handle, number, profile URL, and timestamps
Payment receipts, transaction reference numbers, QR codes, account names, account numbers, wallet numbers, and bank names
Links to ads, Facebook pages, Telegram groups, websites, Shopee/Lazada listings, TikTok posts, or investment pages
Delivery details, order confirmations, fake invoices, and tracking numbers
Emails with full headers if phishing was involved
The scammer’s instructions: where to send money, what reason they gave, and what promise they made
Your own timeline: when you first saw the offer, when you paid, when they stopped responding

For court and prosecutor use, original electronic evidence matters. The Philippine Rules on Electronic Evidence recognize electronic documents and readable printouts or outputs, but you still need to preserve the source, not just cropped screenshots. (Lawphil)

4. Report scam SMS and cyber fraud channels

If the scam came through SMS, suspicious links, or cyber fraud, the Cybercrime Investigation and Coordinating Center (CICC) has promoted reporting through the eGov app’s eReport feature and the Inter-Agency Response Center hotline 1326. Reports received through the eGov app may be sent to the National Telecommunications Commission for blocking of scam numbers. (Philippine News Agency)

This is different from filing a criminal complaint. Think of it as an early reporting channel that may help flag numbers, URLs, or accounts while you prepare your formal evidence.

Which Philippine Laws May Apply to an Online Scam?

Online scams are not all charged under one law. The correct legal theory depends on how the scam happened.

Situation	Possible legal basis	Why it matters
Fake seller, fake investment, fake job, romance scam, advance-fee scam	Estafa under Article 315 of the Revised Penal Code	The core issue is deceit that induced you to part with money.
Scam committed through a computer, app, website, social media, or electronic system	Cybercrime Prevention Act of 2012, RA 10175	Crimes under the Revised Penal Code and special laws committed through ICT may carry cybercrime consequences.
Phishing, OTP theft, account takeover, fake bank/e-wallet representative	AFASA, RA 12010; RA 10175; possibly RA 8484	These involve social engineering, unauthorized account access, and misuse of financial accounts.
Credit card, ATM, account number, access code, or device-related fraud	Access Devices Regulation Act, RA 8484	“Access device” includes cards, account numbers, PINs, and other means of account access.
Ponzi scheme, fake investment platform, unregistered securities solicitation	Financial Products and Services Consumer Protection Act, RA 11765; Securities Regulation Code; SEC rules	SEC may investigate investment fraud and unauthorized investment-taking.
Misuse of your personal data, identity documents, contacts, or loan-app harassment	Data Privacy Act, RA 10173	The National Privacy Commission may handle data privacy complaints.

For estafa by deceit under Article 315(2)(a), the prosecution generally looks for false representation made before or at the time you gave the money, your reliance on that representation, and actual damage. The Supreme Court has repeatedly described these elements in estafa cases involving false pretenses and fraudulent representations. (Supreme Court E-Library)

RA 10175 covers computer-related fraud and identity theft, and its implementing rules state that crimes under the Revised Penal Code and special laws committed through information and communications technology are covered by the Cybercrime Prevention Act, with NBI and PNP cybercrime units responsible for enforcement. (Supreme Court E-Library)

AFASA is especially important for modern bank and e-wallet scams because it covers money muling, social engineering schemes, and the use of financial accounts to receive, transfer, or withdraw criminal proceeds. It also states that prosecution under AFASA is without prejudice to prosecution under the Revised Penal Code, RA 8484, the Anti-Money Laundering Act, and RA 10175. (Lawphil)

Step-by-Step Guide to Filing Reports

Step 1: File first with the bank, e-wallet, or card issuer

For bank or e-wallet losses, your first report should go to the financial institution because it is the one that can block your account, trace the transaction internally, coordinate with the receiving institution, and generate the records you will need later.

Prepare:

Your full name and account details
Date and time of transaction
Amount
Transaction reference number
Recipient account name, number, bank, wallet, or QR code
Short explanation: “I was deceived by a fake seller,” “I gave an OTP after a fake bank call,” “My account was accessed without authority,” etc.
Screenshots and receipts

Ask the bank or e-wallet to confirm whether the report is treated as a disputed transaction and whether a temporary holding or coordinated verification process is available under AFASA.

Step 2: Escalate unresolved bank or e-wallet complaints to BSP

The Bangko Sentral ng Pilipinas Consumer Assistance Mechanism is a second-level recourse for complaints involving BSP-supervised institutions. BSP instructs consumers to report first to the bank or financial institution’s Financial Consumer Protection Assistance Mechanism or customer service channel, then escalate to BSP through the BSP Online Buddy (BOB) if dissatisfied.

For escalation, prepare:

The bank/e-wallet ticket number
Copy of your complaint to the financial institution
The institution’s reply, if any
Receipts, screenshots, and timeline
Your requested resolution, such as reversal, investigation result, or written explanation

BSP also warns consumers not to share PINs, passwords, account numbers, card numbers, passport details, or other sensitive information because those are not required to process a BSP-CAM complaint.

Step 3: File a cybercrime complaint with PNP ACG or NBI Cybercrime

For criminal investigation, prepare a complaint package for the PNP Anti-Cybercrime Group or the NBI Cybercrime Division.

The NBI Citizens’ Charter for investigative assistance in computer-crime cases shows that complainants may proceed to the Cybercrime Division to file a complaint, undergo preliminary interview and initial investigation, execute sworn statements, and submit supporting documents. It lists no filing fee for this process. (National Bureau of Investigation)

Bring or prepare:

Government-issued ID or passport
Printed complaint narrative or draft affidavit
Screenshots and printed evidence
USB or cloud folder containing original digital files
Bank/e-wallet receipts and transaction records
Bank/e-wallet complaint ticket number
Scammer’s account names, numbers, links, phone numbers, usernames, and URLs
Witness statements if someone else saw the transaction or conversation
Special Power of Attorney if a representative will file for you

The DOJ cybercrime rules also require service providers to preserve traffic data and subscriber information for at least six months, and content data for six months from receipt of a preservation order from law enforcement. This is one reason early reporting matters: investigators may need to request preservation before logs are deleted. (Supreme Court E-Library)

Step 4: If it is an investment scam, report to the SEC

If the scam involved investment returns, crypto-style pooled funds, “trading bots,” “double your money,” franchise investments, lending or financing companies, or online lending apps, report to the Securities and Exchange Commission through the SEC iMessage portal. The SEC portal accepts tickets for complaints and issues, and the SEC is a financial regulator under RA 11765 for financial products and services within its jurisdiction. (Securities and Exchange Commission)

Investment scams often need a different evidence set:

Screenshots of promised returns
Names of recruiters and group admins
Proof of deposit or wallet transfer
SEC registration claims used by the scammer
Company name, address, website, and social media pages
Referral codes and commission structure
Any contract, certificate, dashboard, or “investment plan”

A company’s SEC registration as a corporation is not the same as authority to solicit investments from the public.

Step 5: If your personal data was misused, report to the National Privacy Commission

If the scammer used your ID, harvested your contacts, created accounts in your name, exposed your personal information, or an online lending app harassed your contacts, a privacy complaint may be appropriate.

The National Privacy Commission says formal complaints must be filed in a specific format, printed, filled out, notarized, and submitted in person, by courier, or by scanned email. (National Privacy Commission)

Step 6: Consider civil recovery when the scammer is identified

A criminal complaint may lead to restitution if the accused is convicted or if funds are recovered. Under the Revised Penal Code, a person criminally liable for a felony is also civilly liable, and civil liability may include restitution, reparation, and indemnification. (Lawphil)

If the scammer is clearly identified and the claim is purely for money, a civil case may also be possible. For smaller money claims, the Supreme Court’s Rules on Expedited Procedures increased the small claims threshold to ₱1,000,000, with simplified procedure in first-level courts. (Supreme Court of the Philippines)

Small claims are usually useful only when you know who to sue and where they can be served. They are less useful when the scammer used a fake name, mule account, foreign number, or stolen identity.

Where to Report: Quick Reference Table

Type of problem	Where to report first	Main purpose
Unauthorized bank transfer or e-wallet transfer	Bank/e-wallet customer service or fraud hotline	Block account, trace funds, dispute transaction, request temporary hold
Bank/e-wallet complaint unresolved	BSP Online Buddy or BSP Consumer Assistance	Escalate complaint against BSP-supervised institution
Online scam using social media, marketplace, SMS, phishing link, hacked account	PNP ACG or NBI Cybercrime Division	Criminal investigation, preservation requests, cybercrime case build-up
Scam SMS or suspicious number	eGov app eReport or CICC hotline 1326	Report scam number or cyber fraud channel
Investment scam or unauthorized solicitation	SEC iMessage portal	Regulatory action and investment-fraud review
Misuse of ID, personal data, contacts, or privacy breach	National Privacy Commission	Data privacy complaint
Known scammer and recoverable money claim	First-level court or prosecutor route depending on facts	Civil recovery or criminal case with civil liability

What a Strong Complaint Affidavit Usually Contains

A complaint affidavit is your sworn written story. It should be factual, chronological, and supported by attachments.

A practical format is:

Who you are Name, address, contact details, and how you are connected to the transaction.
How the scam started Example: “On 10 March 2026, I saw a Facebook Marketplace post offering an iPhone 15 for ₱35,000.”
What the scammer represented State the exact promise or false claim: item available, investment guaranteed, job approved, bank account at risk, OTP needed, package held by customs, etc.
Why you believed it Example: verified-looking profile, fake receipts, fake company ID, mutual friends, official-looking website, convincing phone call, or previous small successful transaction.
How and when you paid Include date, time, amount, sending account, receiving account, reference number, and screenshots.
What happened after payment Non-delivery, blocking, deletion of account, demand for more money, failed withdrawal, or unauthorized additional deductions.
Damage suffered Exact amount lost, additional fees, compromised account, or identity documents exposed.
Agencies and institutions already contacted Bank ticket number, e-wallet report number, CICC report, platform report, barangay or police blotter if any.
Attachments Label them clearly: Annex A – Facebook post; Annex B – Messenger chat; Annex C – payment receipt; Annex D – bank complaint ticket.

Avoid exaggeration. A clean, consistent affidavit is more useful than a dramatic one.

Common Mistakes That Hurt Recovery or Investigation

Waiting too long before reporting to the bank

The money may be withdrawn, converted, transferred to another institution, or sent abroad. Even under AFASA, holding works best when funds are still traceable within participating financial institutions.

Sending more money to “unlock” the refund

Scammers often ask for “tax,” “customs fee,” “verification fee,” “anti-money laundering clearance,” or “withdrawal fee.” These are usually second-stage scams.

Deleting chats out of anger or embarrassment

Deleted chats may be recoverable in some cases, but it is far better to preserve them immediately.

Posting accusations online before filing a complaint

Public posts can alert the scammer, cause them to delete evidence, or create a separate defamation issue if you name the wrong person. It is safer to preserve evidence and report through official channels first.

Filing only with Facebook, Telegram, TikTok, or the marketplace

Platform reports can remove pages but usually do not replace a bank report, law enforcement complaint, or regulator complaint.

Assuming the account name is the real scammer

Many receiving accounts are mule accounts, rented accounts, stolen accounts, or accounts opened with fake or borrowed identity documents. AFASA specifically penalizes money muling activities such as selling, lending, buying, renting, or allowing use of financial accounts for criminal proceeds. (Lawphil)

Filing false or inflated reports

AFASA regulations warn that malicious or bad-faith reports that cause unwarranted temporary holding of funds may result in criminal liability. Stick to provable facts. (Bureau of the Treasury)

Practical Notes for OFWs, Foreigners, and Victims Abroad

You can still report a Philippine-related online scam even if you are outside the Philippines, especially if the receiving account, scammer, platform activity, victim account, or financial institution is connected to the Philippines.

Common practical requirements include:

Clear scanned passport or government ID
Complaint affidavit signed abroad
Special Power of Attorney authorizing a trusted person in the Philippines to file, follow up, receive notices, and submit documents
Apostille or consular notarization/authentication, depending on where the document is executed
Philippine contact number or email for investigators and banks

For countries that are part of the Apostille system, Philippine embassies and consulates generally no longer authenticate documents originating from Apostille countries; the document needs an Apostille from the competent authority of the issuing country. Philippine foreign service posts still provide notarial services for documents such as affidavits and Special Powers of Attorney for use in the Philippines. (Apostille Services)

Foreign victims should also keep proof of currency conversion, remittance receipts, and passport entry or residence details if relevant. If the payment was made through an overseas bank or card issuer, file a dispute there as well, because Philippine authorities may not control foreign chargeback timelines.

Can You Actually Get the Money Back?

Sometimes, yes. But recovery depends on speed, evidence, and whether the funds can still be located.

You have better chances when:

You reported within minutes or hours
The receiving account is with a BSP-supervised institution
The money has not been withdrawn or transferred onward
You have complete transaction reference numbers
The recipient account is not purely fake or foreign
Your bank or e-wallet acts quickly under AFASA procedures
Law enforcement can obtain preservation or account information through proper channels

You have lower chances when:

The money was sent to crypto wallets, gift cards, foreign accounts, or unregulated platforms
The scammer used a mule account and withdrew cash immediately
You voluntarily sent several transfers over many days
Evidence is incomplete
The scammer is overseas and unidentified
The platform refuses to preserve data without formal legal process

AFASA is helpful because it gives financial institutions and BSP stronger tools, but it does not guarantee an automatic refund in every scam. It is a tracing, holding, verification, and accountability framework—not instant insurance for all losses.

Frequently Asked Questions

Can I still report an online scam if I willingly sent the money?

Yes. Many estafa and social engineering cases involve victims who voluntarily sent money because they were deceived. The legal issue is whether fraud, false pretenses, unauthorized access, or social engineering caused you to part with the money.

Should I file with the bank first or the police first?

For bank or e-wallet transfers, report to the bank or e-wallet immediately first because they can block accounts and start internal tracing. Then file with PNP ACG or NBI Cybercrime for criminal investigation. If the bank response is unsatisfactory, escalate to BSP.

How fast should I report the scam?

Immediately. The best window is within minutes or hours. AFASA temporary holding depends on whether disputed funds can still be identified and held in the transaction chain.

Is a police blotter enough?

No. A blotter may document that you reported an incident, but it is usually not the same as a full cybercrime complaint with sworn statements, evidence, and investigation request. For serious online scams, prepare a complaint affidavit and evidence packet for PNP ACG or NBI Cybercrime.

Can I file a case if I only know the scammer’s GCash number or bank account?

Yes, you can report using the wallet number, bank account, transaction reference number, and screenshots. Investigators and financial institutions may use lawful processes to trace the account owner or transaction chain. However, the named account holder may be a mule, victim of identity misuse, or intermediary, so evidence must be handled carefully.

What if the scammer is outside the Philippines?

Still report if any part of the transaction touched the Philippines, such as a Philippine bank, e-wallet, SIM, platform user, or victim. Cross-border cases take longer and may require coordination through law enforcement channels, but early preservation of digital and financial records remains important.

Can I sue the bank or e-wallet for not returning my money?

Possibly, but it depends on the facts: whether the transaction was authorized, whether the institution had adequate risk controls, how quickly you reported, whether the institution failed to act under applicable rules, and whether its failure caused further loss. AFASA recognizes institutional responsibilities and possible restitution for failure to temporarily hold funds when required under the law and BSP rules. (Bureau of the Treasury)

Can screenshots be used as evidence?

Yes, but they must be properly authenticated and supported. Keep the original device, original files, URLs, timestamps, transaction records, and full conversation threads. Do not rely only on cropped or edited screenshots.

Do I need a lawyer to report an online scam?

You can file initial reports with your bank, BSP, CICC, PNP ACG, NBI, SEC, or NPC yourself. A lawyer becomes more useful when the amount is large, the affidavit is complex, the bank denies liability, the scammer is identified, or a civil or criminal case is already moving through prosecutors or court.

Is there a filing fee for NBI cybercrime complaints?

The NBI Citizens’ Charter entry for investigative assistance to victims of computer crimes lists no fee for the complaint filing and initial investigation steps. Separate costs may arise for notarization, printing, travel, private legal assistance, or court filing fees if a civil case is later filed. (National Bureau of Investigation)

Key Takeaways

Report to your bank or e-wallet immediately and ask for a case number, account blocking, dispute review, and possible AFASA temporary holding.
Preserve complete evidence: chats, receipts, reference numbers, URLs, account names, phone numbers, and timestamps.
File cybercrime complaints with PNP ACG or NBI Cybercrime, especially for phishing, fake sellers, hacked accounts, romance scams, and account takeovers.
Escalate unresolved complaints against BSP-supervised financial institutions through BSP’s Consumer Assistance Mechanism.
Report investment scams and online lending abuses to the SEC; report data misuse or identity-related privacy violations to the National Privacy Commission.
Recovery is most realistic when you act fast, identify the transaction chain, and provide sworn and well-organized evidence.
Do not send more money, delete evidence, or publicly accuse people before preserving documents and filing proper reports.