The first few hours after an online scam can determine whether the money is still recoverable. Your immediate priorities are to stop further losses, notify the bank or e-wallet before the funds are withdrawn or transferred again, preserve evidence, and create an official record of the incident. Reporting the scam to the police is important, but a police report by itself does not reverse a bank transfer. Money recovery usually depends on how you paid, how quickly you reported, whether the funds can still be traced, and whether the bank, platform, merchant, or scammer can legally be made to return them.

What to Do Immediately After an Online Scam

1. Stop communicating and secure your accounts

Do not send another payment, even if the scammer claims it is needed for a refund, account verification, tax clearance, customs release, loan approval, investment withdrawal, or police settlement.

Immediately:

Change the passwords of affected email, banking, e-wallet, shopping, and social media accounts.
Log out other devices and revoke unfamiliar sessions.
Change compromised PINs and security questions.
Disable or lock affected cards through the banking app.
Contact your mobile network if your SIM stopped working unexpectedly, which may indicate SIM takeover.
Tell your bank if you disclosed an OTP, card number, CVV, password, recovery code, or remote-access permission.
Remove remote-access applications such as AnyDesk or TeamViewer if the scammer instructed you to install them.
Run a security scan, but do not factory-reset the device until important evidence has been preserved.

When calling the bank or e-wallet, clearly distinguish between:

An unauthorized transaction, meaning you did not approve it; and
An authorized transfer induced by fraud, meaning you personally sent the money because the scammer deceived you.

Both should be reported, but they may be investigated differently.

2. Report the transaction to your bank or e-wallet immediately

Use the institution’s official 24/7 fraud hotline, in-app reporting feature, or verified website. Do not rely on a social media comment or a message to an unofficial customer-service account.

State that you are reporting a disputed transaction caused by an online scam or social engineering. Ask the institution to:

Record the transaction as fraudulent or disputed.
Trace the destination account.
Send a hold request to the receiving bank or e-wallet.
Preserve transaction and account records.
Restrict your compromised account if necessary.
Give you a complaint or case reference number.
Tell you what documents are required to continue or extend the hold.

Provide, at minimum:

Transaction date and exact time
Amount
Reference or trace number
Sending account details
Receiving bank or e-wallet
Recipient’s name, account number, mobile number, or QR information
Brief description of how the scam occurred

Under the Anti-Financial Account Scamming Act or AFASA, Republic Act No. 12010, banks and other regulated financial institutions may temporarily hold funds involved in disputed transactions while they conduct coordinated verification. The BSP implementing rules for AFASA provide for an initial hold of up to five calendar days, with a possible extension so that the total temporary hold does not exceed 30 calendar days, unless a court issues a further order. (Supreme Court E-Library)

A hold is not the same as a guaranteed refund. It only works to the extent that traceable funds remain in the receiving account or connected accounts. Scammers often move money through several “mule” accounts within minutes.

3. Prepare supporting documents during the initial hold period

A bank or e-wallet may ask for a sworn complaint, affidavit, police report, or similar document before extending an initial hold. Do not assume that the first phone call is enough.

Prepare:

A chronological affidavit describing what happened
Screenshots and exported copies of conversations
Transaction receipts and account statements
The advertisement, listing, website, profile, or investment presentation
Copies of identification documents
The bank or e-wallet complaint reference number
Any police, CICC, NBI, or platform report
Proof of the scammer’s representations and your reliance on them

If the bank gives you a deadline, submit the documents within that period and keep proof of submission.

4. Preserve evidence before accounts or messages disappear

Scammers frequently delete profiles, unsend messages, change usernames, or block victims after payment.

Preserve both screenshots and original electronic records:

Export the full chat when the application allows it.
Save emails with headers, not only screenshots of the message body.
Copy the exact website address and profile links.
Record usernames, display names, phone numbers, email addresses, account numbers, wallet addresses, and QR codes.
Save call logs and voicemails.
Download invoices, order confirmations, contracts, and payment receipts.
Record the date and time when each representation was made.
Preserve cryptocurrency transaction hashes and wallet addresses.
Keep the original files. Do not crop, annotate, or overwrite the only copy.

Electronic records may be used as evidence under Philippine rules governing electronic documents, but their reliability is easier to establish when the originals, metadata, source links, and surrounding conversation have been preserved.

5. Report the scam through official government channels

For centralized scam reporting, the Department of Information and Communications Technology and the Cybercrime Investigation and Coordinating Center operate the 1326 National Anti-Scam Hotline. Reports may also be made through the reporting functions available in the eGovPH system. (Dictionary of the Filipino Language)

You may also file through the NBI online complaint portal or approach the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or the nearest police station. The investigator may require a personal interview, sworn statement, identification, and supporting documents. (National Bureau of Investigation)

A government report serves several purposes:

It creates an official record.
It supports requests to extend a financial-account hold.
It allows investigators to request subscriber, account, and transaction information through proper legal processes.
It helps connect complaints involving the same scammer, account, website, or money-mule network.
It may support a criminal complaint before the prosecutor.

Do not delay the bank report while waiting to complete the police or NBI process. Report to the financial institution first, then complete the law-enforcement documentation as quickly as possible.

Can Money Sent to an Online Scammer Be Recovered?

Recovery depends heavily on the payment method.

Payment method	Immediate recovery step	Practical recovery outlook
Bank transfer or InstaPay/PESONet transfer	Report to the sending bank and request tracing and an AFASA hold	Best chance when reported before the funds leave the receiving account
E-wallet transfer	Report through the e-wallet’s fraud channel and request restriction of the recipient account	Possible if a balance remains, but scammers often cash out quickly
Credit card	Lock the card and file a transaction dispute or chargeback	Stronger for unauthorized use or nondelivery; deadlines vary by issuer and card network
Debit card	Block the card and dispute the transaction immediately	Recovery depends on whether the transaction was unauthorized and whether settlement can still be stopped
Marketplace payment	Open a platform dispute before confirming receipt or releasing escrow	Often one of the fastest remedies when payment remained inside the platform
Remittance or cash pickup	Contact the remittance company with the reference number	Payment may sometimes be stopped before collection
Cash deposit	Report to the receiving bank and law enforcement	Difficult once withdrawn, but deposit records may help identify the recipient
Cryptocurrency	Notify the exchange, preserve wallet addresses and transaction hashes, and report to cybercrime authorities	Blockchain transfers cannot normally be reversed; recovery depends on tracing funds to a cooperating exchange or seizure
Gift cards or prepaid codes	Contact the issuer immediately	Usually difficult once the code has been redeemed

When a bank or e-wallet may have to reimburse the victim

RA 12010 requires regulated institutions to use adequate risk-management systems and exercise the high degree of diligence expected of financial institutions. When an institution’s failure to employ required safeguards or diligence causes the loss, the institution may be liable for damages, including restitution of the lost funds. A criminal conviction of the scammer is not necessarily required before that institutional liability can arise. (Supreme Court E-Library)

This does not mean every scam loss must automatically be refunded. Important questions include:

Was the transaction properly authenticated?
Did the institution detect unusual transaction behavior?
Did it respond promptly after receiving the fraud report?
Did it follow required holding and verification procedures?
Was there a systems or security failure?
Did the victim ignore repeated security warnings or voluntarily disclose credentials?
Were the funds still available when the report was received?

Even when the victim approved the transfer, AFASA may still be relevant if the payment resulted from social engineering, such as impersonation, phishing, fake investment instructions, fraudulent customer support, or manipulation into transferring money.

Philippine Laws Commonly Applied to Online Scams

Estafa under the Revised Penal Code

Many online scams amount to estafa, commonly called swindling, under Article 315 of the Revised Penal Code.

In a typical false-pretense case, the prosecution must establish that:

The accused made a false representation or used deceit.
The deceit occurred before or at the time the victim gave the money or property.
The victim relied on the representation.
The victim suffered financial damage.

Examples include:

Selling a nonexistent item
Pretending to be a legitimate merchant or government officer
Offering a fake investment
Using a false identity to obtain money
Collecting payment with no intention of delivering
Falsely claiming that a fee is required to release a loan, prize, parcel, or refund

Penalties for estafa depend partly on the amount involved, as adjusted by Republic Act No. 10951. (Lawphil)

A failed transaction is not automatically estafa. A genuine seller who encountered a delivery delay or contractual dispute is different from a person who used deceit from the beginning. Evidence of fake identities, multiple victims, fabricated documents, immediate blocking, or withdrawal of funds can help show fraudulent intent.

Cybercrime Prevention Act

Under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, offenses under the Revised Penal Code and special laws committed through information and communications technology may be treated as cybercrime-related offenses. Section 6 generally imposes a penalty one degree higher when an existing crime is committed through ICT. (Lawphil)

The law also provides investigative tools for obtaining computer data, subscriber information, traffic data, and other electronic evidence, subject to applicable legal requirements.

Anti-Financial Account Scamming Act

RA 12010 specifically addresses:

Social engineering schemes
Money-mule activity
Selling, renting, or lending financial accounts
Receiving or transferring proceeds of scams
Using another person’s identity or account to facilitate fraud
Coordinated holding and verification of disputed funds

A person who knowingly allows an account, e-wallet, SIM-linked financial account, or credentials to be used for fraudulent transfers may face liability as a money mule even if that person was not the main scammer.

Financial consumer protection laws

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, recognizes financial consumers’ rights to fair treatment, protection of assets against fraud and misuse, data privacy, disclosure, and timely complaint handling and redress. (Supreme Court E-Library)

These rights support complaints against banks, e-wallet providers, lending platforms, insurers, and other BSP-supervised financial service providers.

Internet Transactions Act

The Internet Transactions Act of 2023, Republic Act No. 11967, establishes protections and responsibilities for online merchants, e-marketplaces, digital platforms, and consumers.

It is particularly useful in cases involving:

Nondelivery
Defective or misrepresented goods
Refusal to provide required merchant information
Marketplace sellers who violate consumer obligations
Platforms that fail to follow applicable complaint-handling duties

Consumer complaints may be filed through the DTI Consumer Care system. (Lawphil)

DTI mediation is most appropriate when there is an identifiable merchant or platform dispute. It does not replace a criminal complaint against a fake seller who disappeared after receiving payment.

Where to Report an Online Scam in the Philippines

Office or institution	When to report	What it can do
Sending bank or e-wallet	Immediately after discovering the scam	Trace the transaction, secure the source account, request a hold, investigate liability
Receiving bank or e-wallet	As soon as the destination institution is known	Flag the recipient account and coordinate with the sending institution
BSP Consumer Assistance Mechanism	After first complaining to a BSP-supervised institution and receiving no satisfactory resolution	Refer and facilitate complaints involving banks, e-wallets, and other supervised institutions
CICC or 1326 hotline	For phishing, social engineering, account takeovers, fake websites, and other cyber-enabled scams	Centralize reporting and coordinate with relevant agencies
NBI Cybercrime Division	For investigation and preparation of a criminal complaint	Investigate, preserve evidence, identify suspects, and refer cases for prosecution
PNP Anti-Cybercrime Group or local police	For immediate police reporting and criminal investigation	Receive complaints, prepare reports, investigate, and coordinate with cybercrime units
DTI	For online shopping, merchant, refund, warranty, and marketplace disputes	Mediation, consumer enforcement, and referral under consumer and e-commerce laws
SEC	For fake investments, unauthorized solicitation, Ponzi schemes, and entities misusing registration claims	Investigate securities violations and verify whether an entity may solicit investments
National Privacy Commission	When personal data, IDs, account information, or identity documents were unlawfully collected or misused	Investigate possible Data Privacy Act violations

Escalating a bank or e-wallet complaint to the BSP

The BSP generally requires the consumer to complain first through the institution’s Financial Consumer Protection Assistance Mechanism.

If the response is delayed or unsatisfactory, the complaint may be escalated through the BSP Online Buddy or Consumer Assistance channels. Supporting documents should include:

Your complaint to the institution
The institution’s response, if any
Transaction records
Identification
Relevant screenshots and correspondence
The institution’s case reference number

The BSP states that complaints submitted through BOB receive a reference number immediately, while complaints submitted through email or post are evaluated or referred within the agency’s stated processing period. (Bangko Sentral ng Pilipinas)

The BSP does not act as the criminal prosecutor of the scammer. Its role concerns the conduct and regulatory obligations of the supervised financial institution.

How to Prepare a Strong Criminal Complaint

A criminal complaint should tell a clear, evidence-supported story rather than simply stating, “I was scammed.”

1. Write a chronological account

Include:

How and when you first encountered the scammer
The identity or role the scammer claimed
Each important promise or representation
Why you believed the representation
When and how payment was made
What happened after payment
Attempts to obtain delivery or a refund
When you discovered the deception
Steps taken to report and secure the funds
The exact amount of your loss

2. Connect each statement to evidence

Label attachments clearly, for example:

Annex A — Online advertisement
Annex B — Messenger conversation
Annex C — Proof of transfer
Annex D — Recipient account details
Annex E — Bank fraud complaint
Annex F — Marketplace report
Annex G — Demand for refund
Annex H — Scammer’s deleted or changed profile

Bring originals or access to the original device when investigators request verification.

3. Identify all possible participants

The person who chatted with you may not be the account holder who received the money. Include information about:

The seller or recruiter
The holder of the receiving account
Persons who called or sent payment instructions
Delivery riders or supposed agents
Other accounts where the money was transferred
Websites, pages, groups, and phone numbers involved

An account holder is not automatically the mastermind, but the account may have been knowingly rented, sold, or used as a mule account.

4. Obtain the appropriate sworn documents

Law-enforcement officers or prosecutors may require:

Complaint-affidavit
Witness affidavits
Certification or records from the bank or platform
Screenshots authenticated by the person who captured them
Copies of identification
A special power of attorney when a representative is permitted to handle particular steps

A prosecutor evaluates whether there is sufficient basis to believe that a crime was committed and that the respondent probably committed it. If probable cause is found, the corresponding criminal information may be filed in court.

Money Recovery Through Civil or Administrative Remedies

Return of funds under AFASA procedures

When traceable funds are held and coordinated verification shows that they came from social engineering, money-mule activity, or another covered disputed transaction, the institutions may return the held amount through the originating institution under BSP rules. The parties should be notified of the result.

The verification process is generally designed to be completed within the statutory holding period when funds are held. More complex tracing may take longer when no funds remain available, multiple institutions are involved, or law-enforcement processes are required. (Bangko Sentral ng Pilipinas)

Chargeback or card dispute

A cardholder may dispute:

Transactions never authorized
Duplicate charges
Goods not received
Goods materially different from what was promised
Transactions processed after cancellation

A chargeback is governed by the issuer’s procedures and card-network rules. Submit the dispute promptly because contractual deadlines may be much shorter than the period for filing a court case.

Marketplace refund or DTI mediation

Where payment remained in platform escrow, use the marketplace dispute process before pressing “order received” or otherwise releasing payment.

If the merchant is identifiable but refuses a legitimate refund, DTI mediation may resolve the matter without a court case. Prepare the order details, proof of payment, seller correspondence, platform decision, and proof that the product or service was not delivered as promised.

Civil liability in the criminal case

The civil action to recover the loss is generally deemed included in the criminal case unless it is waived, reserved, or separately filed under the Rules of Criminal Procedure.

A court may order the accused to pay:

The amount fraudulently obtained
Proven consequential losses
Interest where legally proper
Other damages supported by evidence

A favorable judgment does not guarantee immediate collection. Recovery still depends on finding assets, income, accounts, or property that can lawfully be subjected to execution.

Small claims or a separate civil case

When the defendant’s real identity and address are known, a contractual money claim may qualify for the small claims procedure if it falls within the covered cases and does not exceed the current ₱1 million ceiling.

Small claims can be useful for:

Refunds arising from a sale
Unpaid obligations
Money lent
Payment for undelivered services
Other covered contractual money claims

A victim generally needs the defendant’s correct name and address so the court can serve summons. Small claims are usually not practical against an anonymous social media account or a person whose location is unknown.

For larger or more complex claims, an ordinary civil action may be necessary. Depending on the parties’ residences and the nature of the dispute, prior barangay conciliation may be required under the Katarungang Pambarangay system. The DILG Katarungang Pambarangay Handbook explains the general coverage and exceptions. (DILG Region 5)

Common Mistakes That Reduce the Chance of Recovery

Waiting for the scammer to promise a refund

A scammer may delay the victim until the money has been withdrawn or transferred through several accounts. Report first. Negotiations can continue later without sacrificing the chance to hold funds.

Reporting only on social media

Public warnings can help others, but a Facebook post does not initiate a bank hold, preserve official records, or begin a criminal investigation.

Assuming a police blotter automatically freezes an account

A police report supports the complaint, but it does not by itself freeze a bank or e-wallet account. Financial institutions follow AFASA procedures, while longer restraints may require lawful orders or other authorized processes.

Deleting conversations out of embarrassment

Victims sometimes delete messages because they feel ashamed. The conversations may contain the strongest evidence of deceit, identity, payment instructions, and coordination among participants.

Paying an online “recovery agent”

A common second scam involves a person claiming to be a hacker, lawyer, police officer, bank insider, or international recovery specialist. The person asks for an advance fee, cryptocurrency payment, “unlocking charge,” or tax before the stolen money can supposedly be released.

Legitimate government agencies do not require payment to an anonymous personal account to recover scam proceeds.

Treating SEC registration as proof that an investment is legitimate

Company registration does not automatically authorize an entity to solicit investments from the public. Investment-taking activities may require separate registration and authority. Verify both the entity and its authority to offer the specific investment.

Continuing to use a compromised device

A scammer who gained remote access may still be able to read OTPs, intercept messages, or access banking applications. Use a clean device when changing credentials and coordinating with financial institutions.

Special Situations

The victim voluntarily sent the money

Voluntary authorization does not automatically mean there was no scam. Fake investment managers, impersonators, romance scammers, fraudulent sellers, and fake bank officers often manipulate victims into initiating the transfer themselves.

Tell the institution that the transaction was authorized under deception or social engineering, rather than describing it inaccurately as a completely unauthorized debit.

The scammer used another person’s bank or e-wallet account

That account may be a money-mule account. Report every recipient account, even when the account name differs from the scammer’s displayed identity.

The account holder may claim that the account was borrowed, rented, hacked, or used without permission. Investigators and financial institutions must determine whether the holder knowingly participated, was negligent, or was also a victim.

The victim is outside the Philippines

An overseas Filipino or foreign national may still report a scam involving a Philippine financial account, Philippine-based suspect, or harm connected to the Philippines. Online complaints may be initiated through the financial institution, CICC, or NBI, although investigators or prosecutors may later require a sworn affidavit or personal participation.

Documents signed abroad may need:

Notarization under the law of the country where signed
An apostille if the issuing country participates in the Apostille Convention
Consular authentication where the apostille process does not apply
A certified English translation for documents written in another language

The receiving Philippine office should be asked about its exact documentary requirements before authentication expenses are incurred.

Personal data or identity documents were stolen

Report the incident to the affected bank, e-wallet, marketplace, mobile network, and government agency that issued the identification document.

Where the scam involved unlawful collection, disclosure, or misuse of personal data, a complaint may also be filed with the National Privacy Commission. (National Privacy Commission)

Monitor financial accounts and be alert for accounts, loans, SIM registrations, or transactions opened under your identity.

Practical Timeline After Reporting

Period	What normally matters most
First minutes to several hours	Lock accounts, call the financial institution, request tracing and a hold, preserve evidence
First five calendar days	Submit the sworn complaint, affidavit, police report, or other documents requested to support an extended hold
Within the possible 30-day hold period	Banks and e-wallets conduct coordinated verification and determine whether held funds may be returned
Following weeks or months	BSP, DTI, NBI, PNP, SEC, or NPC complaints may be evaluated, mediated, investigated, or referred
Several months or longer	Prosecutor proceedings, court cases, asset recovery, and execution of judgments may continue

Criminal investigations and court cases do not have a guaranteed completion date. Delays may result from anonymous accounts, incomplete subscriber information, multiple financial institutions, overseas platforms, congested dockets, difficulty serving respondents, or the need for warrants and international assistance.

Frequently Asked Questions

Can a bank reverse an online scam transfer?

A bank cannot always unilaterally reverse a completed transfer. It may trace the transaction, send a hold request, and coordinate with the receiving institution. Recovery is more likely when money remains in a traceable account and the report was made quickly.

What should I do if I was scammed through an e-wallet?

Report through the e-wallet’s official fraud channel immediately. Provide the recipient’s mobile number or account details, amount, time, and reference number. Ask for a case number and submit any affidavit or police report required to extend the hold.

Can I recover money if I gave the scammer my OTP?

Giving an OTP can make the dispute more difficult, but it does not automatically end the investigation. Explain exactly how the OTP was obtained, including impersonation, phishing, remote access, fake customer support, or coercive instructions. The institution’s security controls and response must still be examined.

Is a police blotter enough to get a refund?

No. A police blotter records the incident but does not automatically reverse the transaction or compel a refund. It is supporting evidence for the bank, e-wallet, investigators, prosecutor, and possible court case.

Can I file a complaint even if the amount is small?

Yes. A low amount does not make the conduct lawful. Reporting may also help authorities connect your case to a larger pattern involving many victims. The practical choice of remedy should consider the amount, available evidence, identity of the scammer, and likely recovery cost.

What if the scammer already blocked me or deleted the account?

Preserve all remaining records, including profile links, usernames, notifications, email messages, payment instructions, and transaction details. Platforms, telecommunications companies, and financial institutions may retain records even after an account is deleted, although access usually requires proper legal or regulatory processes.

How long does it take to recover money from an online scam?

A successful bank or e-wallet hold may produce results within days or weeks. Complaints requiring investigation, prosecution, or court enforcement can take months or years. Speed of reporting, remaining account balance, number of intermediary accounts, and availability of the scammer’s assets are major factors.

Can I sue the owner of the receiving account?

Possibly, but receipt of money alone does not always prove that the account holder knowingly participated. Evidence may show that the person was a money mule, accomplice, negligent account owner, or another victim. A civil case also requires a legally supportable cause of action, correct identity, address for service, and evidence of liability.

What if the scammer is abroad?

Report locally when Philippine accounts, victims, or transactions are involved. Philippine investigators may coordinate with foreign platforms and authorities, but international requests can take time. Preserve complete account, transaction, domain, phone, email, and cryptocurrency information.

Can I get in trouble for lending my account to someone who used it in a scam?

Yes. Knowingly lending, selling, renting, or allowing the use of a financial account for fraudulent activity may constitute money-mule activity under RA 12010. A person who discovers that an account has been misused should stop further transactions, notify the institution, preserve communications, and cooperate with investigators.

Key Takeaways

Report the scam to the bank or e-wallet immediately; the first hours are critical.
Ask for transaction tracing, an AFASA hold, and a written case reference number.
Submit any required affidavit, sworn complaint, or police report within the institution’s deadline.
Preserve original chats, emails, transaction records, URLs, account details, and device evidence.
Report cyber-enabled scams through CICC’s 1326 hotline, NBI, PNP, or the appropriate specialized agency.
A police report supports recovery but does not automatically freeze funds or produce a refund.
Authorized transfers induced by deception may still qualify as social-engineering disputes.
Recovery may come through an AFASA return of held funds, bank reimbursement, chargeback, platform refund, DTI mediation, civil liability in the criminal case, small claims, or a separate civil action.
Do not pay unverified “recovery agents” or send additional money to the scammer.
The sooner the transaction is reported and properly documented, the greater the practical chance of tracing and recovering the funds.