NBI, PNP–ACG, Bank/E-Wallet Chargebacks, and Your Full Legal Toolkit

Disclaimer: This is practical legal information for the Philippine context, not formal legal advice. Timelines and internal procedures can change; when possible, confirm specifics with the relevant office or your counsel.

1) First 24 Hours: Contain the Damage

A. Freeze and secure your accounts

Change passwords on email, banking, e-wallets (GCash, Maya), marketplaces, and social media.
Enable multi-factor authentication (prefer authenticator apps over SMS).
Remotely sign out existing sessions on compromised services.

B. Document everything (before you message anyone)

Take timestamped screenshots of chats, profiles, listings, emails, transaction pages, and error messages.
Export chat threads (Messenger, WhatsApp, Telegram, Viber), transaction histories, and confirmations (InstaPay/PESONet reference numbers, card authorizations).
Save files in non-editable formats (PDF) plus the original raw exports. Keep the device; do not factory-reset.

C. Notify your bank/e-wallet immediately

Call the dispute/fraud hotline listed on your card/back of card or in the app.
Request: (i) card blocking, (ii) account freeze or limited mode, (iii) transaction dispute/chargeback filing, and (iv) recall of funds for recent InstaPay/PESONet transfers (time-sensitive).
Ask for the case number and a copy of your dispute form or ticket.

D. Report to the platform where the scam occurred

File an in-app/platform report; request takedown of listings/profiles and preservation of data.
Keep the ticket numbers and any auto-acknowledgment emails.

E. If identity data was exposed

Change recovery emails/phone numbers.
Consider SIM replacement and request a fraud flag with your telco.
Monitor for new loan/credit applications.

2) Who Can Investigate and How to File

Core agencies

PNP Anti-Cybercrime Group (PNP-ACG) – police investigations, cybercrime complaints/blotter, field operations.
NBI Cybercrime Division (NBI-CCD) – parallel investigative authority, digital forensics, case build-up.
Department of Justice – Office of Cybercrime (DOJ-OOC) – central authority for cybercrime matters, international cooperation, and prosecution support.

You can file with either PNP-ACG or NBI-CCD. In practice, choose the office that is geographically convenient or responsive; dual filing is generally unnecessary unless advised.

Filing roadmap (NBI or PNP-ACG)

Prepare a Complaint-Affidavit (see model outline below).
Attach Annexes: screenshots, bank statements, proof of payments (InstaPay/PESONet/GCash/Maya refs), chat exports, platform report receipts, copy of your ID, and any witness statements.
Bring original IDs; sign the affidavit before an administering officer (or have it notarized if filing by paper).
Request a Preservation Letter be sent to platforms/banks/telcos to retain logs beyond ordinary retention periods.
Get the reference or case number and the name/position of the receiving officer.

3) The Criminal Law Angles Often Used

Depending on facts, prosecutors may rely on:

Estafa (Swindling) – Art. 315, Revised Penal Code (RPC).
Cybercrime Prevention Act (RA 10175) – when estafa/other offenses are committed through ICT; increases penalties and enables special investigative tools.
Access Devices Regulation Act (RA 8484) – for unauthorized use of cards/one-time passwords/access devices.
E-Commerce Act (RA 8792) – legal recognition of electronic data and transactions; penal provisions for certain e-commerce offenses.
Data Privacy Act (RA 10173) – if personal data was unlawfully processed or breached.
Anti-Money Laundering Act (RA 9160, as amended) – enables monitoring, freezing, and forfeiture of scam proceeds (via AMLC and Court of Appeals).
SIM Registration Act (RA 11934) – false registration/use of SIM with fraudulent intent.

Jurisdiction & courts: Cybercrime cases are handled by designated RTC cybercrime courts; venue may hinge on where any element occurred or where the complainant resides, depending on the offense charged.

4) Evidence: Make It Court-Ready

Admissibility and preservation

Philippine Rules on Electronic Evidence (A.M. No. 01-7-01-SC) govern authenticity of e-mails, texts, screenshots, metadata, logs, and computer output.
Maintain an evidence chain: when captured, by whom, on what device, and stored where.
Keep original devices and avoid altering app data; if you must keep using the phone, make a full device backup and note dates.
For bank transactions, preserve account statements and SMS/e-mail OTP logs if available.

What helps most

Clear mapping of who, what, when, where, how much, and which accounts received the money (account names/numbers, e-wallet handles, reference IDs).
Links between suspect profiles and cash-out accounts (screenshots + bank confirmations).
Proof you acted promptly (dates of your hotline calls, dispute filings, platform takedown requests).

5) Getting Your Money Back: Banks, E-Wallets, and Chargebacks

A. Cards (credit/debit) – the chargeback track

Notify immediately and file a fraud/dispute form with your bank (issuer).
Provide: transaction date, amount, merchant, reference/ARN, and your narrative + evidence.
Your bank sends a chargeback through the card network (e.g., Visa/Mastercard).
Possible merchant responses: acceptance, representment (rebuttal), or pre-arbitration.
Time windows: Networks generally impose strict filing windows (often counted in days from posting date). Sooner is always better.

Practical tips

If you shared an OTP/PIN under social engineering, still file—facts matter; issuers assess cardholder liability on policy and network rules.
Ask your bank for: (i) your case number, (ii) the provisional credit policy, and (iii) expected milestones (e.g., representment, decision).
Keep communications in writing (e-mail acknowledgments).

B. InstaPay / PESONet transfers – the recall track

Request an urgent recall/hold of funds to the receiving bank/e-wallet; success depends on speed and whether funds are still there.
Provide reference numbers, exact amounts, timestamps, recipient account/alias, and your ID.
Ask for escalation and a written status update.

C. E-wallets (GCash, Maya, etc.)

Use the in-app Report an Issue and Fraud flows; request account freeze and trace of recipient accounts.
Submit proof of transaction and any screens of the recipient’s profile/QR.
If the e-wallet declines recovery, proceed with a formal written complaint attaching your police/NBI report.

D. Regulatory escalation

Under the Financial Products and Services Consumer Protection Act (RA 11765), start with a written complaint to your bank/e-wallet. If unresolved or denied, escalate to the Bangko Sentral ng Pilipinas (BSP) with your case chronology, bank replies, and evidence.
For data misuse or breaches, complain to the National Privacy Commission (NPC).
Where funds were layered across accounts, coordinate with investigators for AMLC assistance (possible freeze/forfeiture paths).

6) Parallel Civil Remedies

Demand Letter to the scammer (or identified account holder), demanding return of funds within a fixed period and putting them on notice of criminal/civil action.
Small Claims (no lawyers required) up to the current monetary threshold (check latest limit; it has been increased in recent years). Useful where the recipient account holder is identifiable.
Ordinary civil action for damages (if amount exceeds small-claims limit or facts are complex).
Pre-trial asset preservation: If prosecution triggers AMLC tools or if you obtain a favorable order, assets may be frozen or restrained.

7) Special Situations

Business victims: Preserve enterprise logs (SIEM, server, ERP, email gateways), issue legal hold notices internally, and coordinate with IT for forensics images.
Cross-border scammers: DOJ-OOC may request cooperation via MLAT or other channels; still file locally to start the paper trail.
Sextortion/deepfake threats: Report immediately; do not pay. Save chats, filenames, and payment instructions; ask investigators to send preservation letters to platforms.
Account-takeover (ATO): Change recovery channels first, then passwords; request device/session logs from the platform under security incident grounds.
Minors: Parents/guardians should file; consider counseling referral if distress is severe.

8) Model Documents (You Can Adapt)

A. Complaint-Affidavit (outline)

Parties and Capacity (name, age, residence, IDs).
Statement of Facts (chronology with dates/times, amounts, accounts involved).
Offenses Alleged (e.g., Estafa under RPC, as qualified by RA 10175; violations of RA 8484, etc.).
Evidence Summary (list of annexes: screenshots, statements, logs).
Reliefs Sought (investigation, prosecution, preservation of data, coordination with banks, issuance of subpoenas).
Verification and Jurat (signed and sworn).

Annexes

A – Identity documents
B – Bank/e-wallet statements & transfer/authorization references
C – Screenshots (labeled and dated)
D – Platform and bank ticket numbers/letters
E – Any witness statements

B. Bank/E-Wallet Dispute Letter (short form)

Subject: Fraud Dispute and Recall/Chargeback Request Details: Transaction date/time, amount, merchant/payee, reference number(s). Narrative: Brief facts, discovery time, and steps taken (account already blocked, police report filed). Requests: Immediate recall/chargeback; freeze of recipient funds; written updates; copy of internal findings suitable for law enforcement. Attachments: ID, statements, screenshots, police/NBI report, platform tickets. Signature & Contact: Mobile and e-mail; availability for calls.

C. Evidence Log (spreadsheet headings)

Item No. | Source (Device/App) | Description | File Name/Hash | Date/Time Captured | Relevance | Linked Annex

9) Practical Timelines & Expectations

Hotline calls & recalls: minutes to hours matter; act the same day.
Bank chargebacks: can span weeks to a few months depending on merchant response cycles.
NBI/PNP investigation: initial intake is quick; subpoenas to banks/telcos/platforms take time.
Civil recovery: small claims can be relatively fast once the defendant is served, but service of summons is the usual bottleneck.

10) Frequently Asked Questions

Q: I shared an OTP under pressure—is recovery impossible? Not necessarily. File anyway. Issuers consider context (social engineering, spoofed numbers, SIM swap). Prompt reports help.

Q: The account holder says they “only received” the money but aren’t the scammer. Receipt of stolen funds can still expose them to criminal and civil liability. Demand return and include them in the complaint if facts support knowledge/participation.

Q: Should I confront the scammer? No. You risk tip-offs that allow cash-out or evidence destruction. Let investigators send preservation/subpoenas.

Q: Do I need a lawyer? You can file pro se, but counsel helps with framing offenses, evidence, and coordinating chargebacks with criminal proceedings.

11) Quick Checklist

Change passwords; enable MFA; secure recovery channels.
Collect and export evidence; create an Evidence Log.
Call bank/e-wallet; block, dispute, and recall; get case number.
Report in-app/platform; request data preservation; save ticket.
File with PNP-ACG or NBI-CCD; submit Complaint-Affidavit + annexes.
Send Demand Letter (if recipient account holder is known).
If unresolved, escalate to BSP (finance), NPC (privacy), and coordinate with AMLC via investigators.
Consider small claims or civil suit for recovery.
Monitor identity/credit, replace SIM if needed, and keep all case updates in one folder.

Final Word

Speed, documentation, and parallel tracks (criminal + financial dispute + platform preservation) are what move the needle. Even when recovery isn’t guaranteed, building a strong, well-documented case improves your odds—of refund, reversal, or prosecution.