What to Do After an Online Scam in the Philippines: NBI, PNP, BSP, and SEC Remedies

This guide is for general information only and doesn’t create a lawyer–client relationship. Laws and procedures change; when in doubt, consult counsel.

1) First, stabilize the situation (the “Golden Hour”)

Within minutes to hours matters most. Do these in order, fast:

Cut off the scammer’s access
- Change passwords on email, bank, e-wallet, and social media. Enable multi-factor authentication (MFA).
- If your phone may be compromised (SIM swap, malware), log out of sessions and reset the device; update OS/antivirus.
Lock the money flow
- Call your bank/e-wallet hotline to report fraud and request:
  - Transaction dispute/chargeback (for cards) or transfer recall/hold (for InstaPay/PESONet/e-wallet). Ask to flag the recipient account and to escalate as fraud.
  - Freeze or restrict your own account if necessary.
- If you sent funds to local banks/e-wallets, provide:
  - Exact timestamps, amounts, reference numbers, sender/recipient account names and numbers, screenshots, and chat logs.
- If a card was used, request card blocking and a replacement card.
Preserve evidence (don’t delete)
- Save original screenshots, PDFs of statements, email headers, website URLs, phone numbers, ads, and the product page.
- Export chat histories (Messenger/WhatsApp/Viber/Telegram), keeping metadata and timestamps.
- If you visited a phishing page, capture the URL and certificate info; don’t keep browsing it.
Tell people who can be harmed
- Notify family/colleagues if your accounts were used to solicit money.
- If work devices or accounts are involved, inform your IT/security team.

2) Know what you’re dealing with (common legal hooks)

Online scams typically fit one or more of these:

Estafa/Swindling (Revised Penal Code, Art. 315) — deception causing you to part with money.
Cybercrime (Cybercrime Prevention Act, R.A. 10175) — when the scheme uses a computer system or the internet; many offenses become qualified when committed via ICT.
Access Devices (R.A. 8484) — unauthorized use of cards/OTP/online banking credentials.
Identity Theft/Computer-related Fraud (R.A. 10175) — using your identity or manipulating data to obtain a benefit.
Financial Consumer Protection Act (FCPA, R.A. 11765) — obligations of banks/e-wallets/securities brokers to treat consumers fairly and provide redress.
Securities/Investment Fraud (Securities Regulation Code; SEC rules) — unregistered investment solicitations, Ponzi schemes.
Data Privacy (R.A. 10173) — if your personal data was compromised or misused.

3) Banking & e-wallet remedies (BSP-supervised institutions)

A. Dispute and recovery pathways

Card transactions (credit/debit): File a dispute/chargeback through your card issuer. Provide proof the transaction was unauthorized or goods/services weren’t delivered.
Fund transfers (InstaPay/PESONet/e-wallet): Request a transfer recall/hold. Recovery depends on:
- Speed (whether funds remain in the recipient account);
- Recipient bank/e-wallet cooperation; and
- The transaction’s nature (authorized vs. unauthorized).
Account takeovers: Ask the bank to investigate account compromise (phishing/OTP theft/malware). Banks may restore funds if security lapses are on the FI side; otherwise outcomes vary based on their investigation.

B. How to escalate inside the bank

File a formal complaint to the bank’s Consumer Assistance Unit. Ask for a written acknowledgment and case reference.
Track regulatory timelines (banks typically acknowledge within a few days and resolve within a set period; ask for the bank’s official timetable).
If unresolved or you disagree with the result, escalate to the BSP as regulator.

C. Elevating to the Bangko Sentral ng Pilipinas (BSP)

Who can complain: Consumers of BSP-supervised entities (banks, EMI/e-wallets, remittance companies).
What to submit: Your complaint letter, IDs, transaction proofs, your communications with the bank, and the bank’s final response (if any).
What BSP can do: Facilitate resolution under the FCPA (R.A. 11765) and BSP regulations; order corrective actions and administrative sanctions against supervised entities. BSP does not adjudicate against private, non-regulated scammers (e.g., individual sellers), but its intervention can move banks to cooperate (e.g., information sharing, placing holds, process improvements).

Tip: Always keep correspondence professional and time-stamped. Ask for the final written position of the bank if they deny your claim—this document is useful for BSP escalation and for law enforcement.

4) Securities & investments (SEC remedies)

If you sent money for “investments,” trading “packages,” guaranteed returns, or unregistered securities:

File a complaint with the SEC Enforcement and Investor Protection Department (EIPD).
Submit: proof of solicitation (posts, pitches, chats, contracts/whitepapers), receipts/wallet addresses, and identities/numbers used.
SEC powers: Investigate, issue advisories/cease-and-desist orders against entities soliciting investments without registration, freeze assets (via proper processes), and refer criminal cases to prosecutors.
If a broker/dealer or lending/financing company is involved, SEC can enforce FCPA-style consumer protection within its jurisdiction.

Note: For insurance/health plans, the regulator is the Insurance Commission (IC); for cooperatives, the CDA; for pawnshops/remittance usually BSP.

5) Criminal enforcement: NBI vs. PNP (and how they work together)

You can report to either the NBI Cybercrime Division or the PNP Anti-Cybercrime Group (PNP-ACG). In practice, choose one to lead (to avoid duplication) but you may cross-report.

A. National Bureau of Investigation (NBI)

Good for complex, cross-border, or multi-victim cases; has digital forensics capability.
File a Sworn Complaint (Affidavit) with evidence. NBI can conduct case build-up, coordinate with banks/e-wallets, and apply for preservation of data and, where available, asset freezes via proper channels (often through AMLC).

B. Philippine National Police – Anti-Cybercrime Group (PNP-ACG)

Strong on field operations, offender identification, and coordination with local police stations.
File a complaint at ACG offices/Regional cybercrime units. They can issue subpoenas duces tecum (through proper legal channels), conduct entrapments, and refer for inquest.

C. Department of Justice (DOJ) & Prosecutors

After investigation, cases are filed with prosecutors for inquest (for warrantless arrests) or preliminary investigation. Bring your Affidavit-Complaint and all annexes.

Key point: For fast freezes, prompt reporting helps. Investigators often coordinate with AMLC and regulated entities; the earlier a freeze/preserve request is routed, the better the chance funds are still parked.

6) AMLC and account freezing (how it actually plays out)

Banks/e-wallets must file Suspicious Transaction Reports (STRs) and may hold or restrict accounts per internal AML rules.
The Anti-Money Laundering Council (AMLC) may, upon proper showing, issue freeze orders (subject to confirmation by the Court of Appeals) for assets linked to unlawful activities, including cyber-enabled fraud.
You cannot “order” a freeze as a private person; your goal is to trigger the chain by speedy, well-documented reporting to the bank/NBI/PNP and by filing a formal complaint the institutions can rely on.

7) Telcos, SIMs, platforms, and privacy

SIM and number abuse: Report to your telco’s fraud/abuse channel; request number blocking and call/SMS traces where possible.
Platforms/marketplaces: Use their in-app dispute and seller verification tools; file trust & safety reports to de-list the scammer and preserve records.
Data Privacy: If your personal data was compromised, notify the National Privacy Commission (NPC). Consider identity-theft safeguards (e.g., alert your bank to enhanced verification, monitor credit if applicable).

8) Civil remedies (when to sue)

Against the scammer: File a civil action for damages, rescission, or unjust enrichment. Practical if you know the person’s identity and assets or if the platform has escrow funds.
Against regulated institutions: If you believe the bank/e-wallet/securities intermediary failed in duty of care under the FCPA or relevant regulations, discuss with counsel the viability of:
- FCPA remedies through the regulator; and/or
- A civil action (e.g., negligence, breach of contract). Note: success often hinges on forensics (e.g., IP logs, device fingerprints, OTP delivery records).

9) Jurisdiction & cross-border issues

When recipients, domains, or wallets are offshore, investigators may use mutual legal assistance and international cooperation frameworks. Expect longer timelines.
Keep transaction hashes (for crypto), blockchain explorers links, and exchange account details. If an exchange is involved, file a ticket with them and submit your police/NBI report number.

10) Typical timelines & expectations

Bank/e-wallet disputes: Acknowledgment within days; investigations often 15–45+ days depending on channel and network rules. Chargebacks can take one or more billing cycles.
Law enforcement: Initial intake is quick if documents are complete; case build-up varies from weeks to months.
Regulators (BSP/SEC): Expect structured communications and follow-ups; provide everything in PDF with labeled annexes.

You may not recover everything. The aim is to maximize preservation (freezes), strengthen your case, and prevent further harm.

11) Practical documentation kit (what to compile)

Core
- Government ID(s) (front/back)
- Proof you own the sending account/card
- Formal complaint letter (one page, clear ask)
Transactions
- Bank/e-wallet statements and reference numbers
- Screenshots of transfers and confirmations
Communications
- Chat/email threads exported with timestamps
- Call logs and voicemails
Scam artifacts
- URLs, social profiles, ads, product pages (with date/time captured)
- Photos of items received (if any), showing defects/“no delivery”

12) Where to report (by scenario)

Money moved from your bank/e-wallet:
1. Your bank/e-wallet (dispute/recall), 2) BSP escalation (if unresolved), 3) NBI or PNP-ACG (criminal).
Investment scam / guaranteed returns:
1. SEC (EIPD), 2) NBI/PNP-ACG, 3) Your bank/e-wallet (flag recipient), 4) BSP (if a BSP-supervised entity is involved), 5) AMLC via investigators.
Card-not-present fraud/phishing/OTP theft:
1. Card issuer (block/dispute), 2) NBI/PNP-ACG, 3) BSP escalation if issuer response is unacceptable.
Identity theft/data misuse:
1. Affected banks/e-wallets/platforms, 2) NPC, 3) NBI/PNP-ACG.
Undelivered goods from local online seller (non-investment):
1. Platform dispute and DTI (consumer protection), 2) Estafa complaint (if deceitful), 3) Bank/e-wallet dispute if applicable.

13) Evidence standards that actually help

Chronology table: Date–Time | Channel (Bank/App/Chat) | Action | Amount | Ref No. | Person/Account | Proof (Annex #).
Hash your files (optional): Create SHA-256 hashes of key PDFs/photos to show they weren’t altered.
Affidavits from witnesses: Delivery riders, bank officers who took your call, or colleagues who saw the solicitation.

14) Red flags to recognize next time

Pressure + secrecy (“don’t tell the bank”), guaranteed returns, “upgrade fee” requests, remote-access apps (AnyDesk/TeamViewer) for “support,” URL look-alikes, and agents refusing video calls or official IDs.

15) Templates you can reuse

A. One-page complaint to your bank/e-wallet

Subject: Urgent Fraud Dispute and Transfer Recall – [Your Name], [Account/Card No. last 4] To: Consumer Assistance / Fraud Team I report unauthorized/fraudulent transactions on [date/time]. Details: – Amounts & reference nos.: [list] – Recipient account names/numbers: [list] – Channel: [card/online banking/e-wallet/InstaPay/PESONet] I request: (1) immediate block of my account/card as needed; (2) transfer recall/hold of funds; (3) investigation under R.A. 11765 and relevant BSP rules; (4) copies of logs (IP/device/OTP delivery) for law-enforcement use; (5) a written acknowledgment and case reference. Please provide your final written position within your regulatory timeline. Annexes attached: IDs, statements, screenshots, chat exports. Signed: [Name, Date, Mobile, Email]

B. Affidavit-Complaint core body (for NBI/PNP/Prosecutor)

I, [Name], of legal age, Filipino, state:

On [date/time], I encountered [scam description] via [platform/URL/number].

Relying on false representations, I transferred the following amounts: [table].

I discovered the fraud on [date], immediately reported to [bank/e-wallet], and requested transfer recall.

The acts constitute Estafa under Art. 315 and computer-related fraud under R.A. 10175, among others.

Attached as Annexes “A” to “__” are true copies of chats, receipts, and IDs. I execute this affidavit to support criminal charges and regulatory action.

16) Quick FAQs

Can I get my money back? Possible, especially if reported quickly and the funds are still parked. Success varies by channel, cooperation, and evidence.
Do I have to choose NBI or PNP? You may file with either. Pick the one you can visit and follow through with. Cross-report as needed.
Should I still file if the amount is small? Yes—small reports reveal patterns and help de-platform scammers.
Do screenshots count? Yes, but original exports with timestamps are stronger. Keep both.

17) Action checklist (printable)

Change passwords; enable MFA; secure device.
Call bank/e-wallet; block/dispute; request recall/hold; get case reference.
Compile evidence (IDs, statements, refs, chats, URLs).
File a written complaint with the bank; demand a final written position.
Report to NBI or PNP-ACG with a sworn affidavit and annexes.
Escalate to BSP (bank/e-wallet) or SEC (investment), as applicable.
Notify NPC/DTI/telco/platform if relevant.
Monitor accounts; warn contacts; consider civil action if viable.

If you want, I can adapt the templates above to your specific facts (amounts, banks, platforms) and format your evidence into a clean annexed packet you can file the same day.