Quick answer

Act immediately. Contact the bank, e-wallet, card issuer, remittance company, or cryptocurrency platform that handled the payment; secure every compromised account; preserve the evidence; and report the incident to law enforcement. Speed matters because money can move through several accounts within minutes.

Ask the financial institution to:

block further transactions and secure your account;
record the transaction as disputed or fraudulent;
trace the recipient account and send the necessary holding requests;
preserve transaction, device, login, and account records;
explain what documents it needs from you; and
give you a case or reference number.

Reporting a scam does not guarantee reimbursement. Whether money can be returned depends on facts such as whether funds remain traceable, whether you authorized the payment after being deceived, the institution’s security and fraud controls, and how quickly everyone acted.

What to do in the first few hours

1. Call the financial institution through an official channel

Use the number printed on your card, the institution’s official app or website, or a verified branch. Do not call a number supplied by the scammer or contained in the suspicious message.

Give the institution:

your name and affected account;
the transaction date, time, amount, and reference number;
the recipient’s account name and number, mobile number, wallet, or merchant details;
a short description of how the scam happened;
whether you disclosed a password, PIN, one-time password, card number, CVV, or identity document;
whether the transaction was unauthorized or you sent the money because of deception; and
whether more transactions may still be pending.

If money was transferred from one institution to another, report first to the institution from which the money left. You may also notify the receiving institution if its official fraud channel accepts reports, but do not delay the complaint to your own provider.

Under the Anti-Financial Account Scamming Act and current BSP rules, covered financial institutions may temporarily hold disputed funds and coordinate tracing through other institutions. The initial holding may last no more than five calendar days. It may be extended for up to 25 additional calendar days when the applicable grounds are present and more time is needed for verification.

For an extension, the source-account owner generally must provide supporting documents—such as a sworn complaint, affidavit, police report, or comparable evidence—within the initial holding period, subject to the applicable industry protocol. Submit these as early as possible. A hold is not a final finding that the recipient committed a crime, and it does not assure recovery. See the BSP Manual of Regulations for Payment Systems and Republic Act No. 12010.

Never make a knowingly false report. Malicious, bad-faith reporting that causes an unwarranted hold is itself punishable under Republic Act No. 12010.

2. Secure the account and the device used

From a clean, trusted device:

Change the password of the affected financial account.
Change the password of the connected email account first if it may also be compromised.
Sign out other sessions and remove unfamiliar devices.
Replace reused passwords on other accounts.
Enable multi-factor authentication using an authenticator or other secure method where available.
Lock affected cards and request replacement if card data was exposed.
Ask your mobile provider to secure or replace the SIM if you lost signal unexpectedly or suspect a SIM swap.
Remove unfamiliar payment links, beneficiaries, forwarding rules, recovery addresses, and app permissions.
Run security updates and a reputable malware scan.

If remote-access software was installed at the scammer’s direction, disconnect the device from the internet, stop using it for banking, and have it professionally checked. Preserve screenshots and installation information before removing anything relevant.

3. Stop communicating and do not pay a “recovery fee”

Do not send additional money for supposed taxes, verification, release charges, legal processing, account unlocking, or recovery services. Scammers often return pretending to be bank personnel, police officers, lawyers, regulators, or hackers who can retrieve the funds.

Do not threaten the scammer, arrange an in-person confrontation, or attempt to access the scammer’s account. Preserve the conversation, then block further contact after investigators and the financial institution have the information they need.

Preserve evidence before it disappears

Keep original files whenever possible, not only cropped screenshots. Create a simple chronological record containing:

when and how the scammer first contacted you;
every representation or promise that persuaded you to act;
the dates, times, amounts, and transaction reference numbers;
names, usernames, profile links, account numbers, wallet addresses, QR codes, telephone numbers, email addresses, and websites used;
complete chat threads, text messages, emails, voice messages, call logs, and recordings lawfully in your possession;
advertisements, product listings, contracts, receipts, invoices, deposit slips, delivery records, and demand letters;
bank or wallet statements and transaction confirmations;
the URL of each webpage and the date it was accessed;
reports made to banks, platforms, government agencies, and police, including reference numbers and replies; and
proof of your loss and any later demand for repayment.

Export chats and emails where the service permits. Save copies in at least two secure locations. Do not edit original files. Note who obtained each item and when.

This urgency has a legal reason. Under Section 13 of the Cybercrime Prevention Act, service providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months after a lawful preservation order, subject to the statutory extension and case-related rules. Victims cannot issue that order themselves, so prompt reporting can help investigators seek preservation before records are routinely lost.

Report the crime

Bring or submit a clear incident summary and copies of your evidence to a cybercrime unit of the Philippine National Police or National Bureau of Investigation, or to the police station with jurisdiction over the incident. Ask where a formal complaint-affidavit should be filed and obtain proof that your report was received.

Your account should state facts rather than legal conclusions:

who contacted you;
exactly what was represented;
why you believed it;
what action you took because of it;
where and when the payment occurred;
how much you lost;
what happened afterward; and
what records identify the accounts and persons involved.

If an investigator requests an affidavit, read it carefully and correct inaccuracies before signing. Do not identify a person as the offender unless your evidence supports that identification. An account holder may be a money mule, an identity-theft victim, or one link in a longer transaction chain.

A bank dispute, platform report, or DTI complaint is not automatically a criminal complaint. Likewise, filing a police report does not automatically reverse a transfer. Pursue the relevant tracks at the same time.

Which Philippine laws may apply?

The proper charge depends on the evidence.

Estafa by deceit

A common possibility is estafa under Article 315(2)(a) of the Revised Penal Code. The prosecution generally must prove:

a false pretense, fraudulent act, or fraudulent means;
made before or at the same time as the fraud;
reliance by the victim that caused the victim to part with money or property; and
resulting damage.

The Supreme Court has emphasized these elements in cases such as Palaoag v. People. A broken promise, failed business, unpaid debt, or disappointing purchase is not automatically criminal estafa. The timing and nature of the deception matter, and some disputes may be contractual or civil rather than criminal.

Cybercrime-related liability

When an offense defined by the Revised Penal Code or a special law is committed through information and communications technology, Section 6 of the Cybercrime Prevention Act may apply, with the statutory consequence provided there. Investigators and prosecutors must determine whether the evidence satisfies its requirements.

Financial-account scamming

Republic Act No. 12010 separately addresses conduct including money-mule activity and social-engineering schemes involving financial accounts. It covers bank and other transaction accounts, e-wallets, credit-card accounts, and other financial accounts within the Act.

The law does not punish an innocent victim merely because money passed through an account. Knowledge, purpose, participation, and the particular prohibited act must be established. It also provides a defense for trafficking victims whose acts were a direct result of being trafficked, subject to the law’s evidentiary standard.

Other laws—including the Access Devices Regulation Act—may apply when cards, account credentials, or unauthorized access devices are involved. The final characterization belongs to investigators, prosecutors, and courts.

Escalate a bank or e-wallet complaint

A BSP-supervised institution’s consumer-assistance mechanism is generally the first level of recourse. Keep the complaint, the institution’s acknowledgment, and its written response.

If the institution does not resolve the concern satisfactorily, escalate it through the BSP Consumer Assistance Mechanism. The BSP currently accepts escalation through its Online Buddy and provides alternative channels, including a complaint form sent to consumeraffairs@bsp.gov.ph.

Include:

a concise account of the incident;
the remedy requested;
the institution’s name;
your complaint and its reference number;
the institution’s reply, if any;
relevant transaction records; and
reliable contact information.

The BSP process concerns the conduct and complaint handling of institutions under its supervision. It does not replace criminal investigation or guarantee reimbursement.

Report the scam to the relevant regulator or platform

Online shopping or service complaints

Report the seller and transaction to the marketplace or platform immediately. For a consumer transaction involving a business, you may also use the DTI Consumer CARe System or follow the DTI complaint instructions.

Provide proof of transaction, your communications, the respondent’s available identity and address, a factual narration, and the remedy sought. DTI mediation or consumer enforcement is different from prosecuting deliberate fraud.

Investment solicitations

For an investment, lending, securities, or alleged “guaranteed return” scheme, preserve the offer, referral structure, payment instructions, company names, and names of promoters. Report it through the SEC i-Message system.

A company’s SEC registration, standing alone, does not establish that it is authorized to solicit investments from the public. Do not send more funds while waiting for an investigation or supposed withdrawal approval.

Misuse of personal information

If your personal information was improperly collected, disclosed, or used, you may consider a complaint to the National Privacy Commission. Follow its current form, verification, notarization, fee, and filing requirements. An NPC complaint addresses data-privacy violations; it is not a substitute for reporting theft or fraud to law enforcement and the financial institution.

Can you sue to recover the money?

Possibly, but first determine whether the defendant can be identified, located, and connected to the loss. A civil judgment may be difficult to enforce if the defendant has no reachable assets or used a false identity.

A purely monetary claim not exceeding ₱1,000,000 may qualify for the Supreme Court’s small-claims procedure, depending on the nature of the claim. The current threshold and procedure appear in the Rules on Expedited Procedures in the First Level Courts.

Small claims are not appropriate for every scam. Considerations may include:

whether there is an identifiable defendant;
whether the claim is one covered by the rule;
the proper court and venue;
whether a demand is required or useful;
whether prior barangay conciliation applies;
whether the civil claim is already included in, reserved from, or waived in a criminal case; and
whether multiple victims, assets, provisional remedies, or claims above the threshold require a different action.

Before separately suing, consult counsel about Rule 111 of the Rules of Criminal Procedure. The civil action arising from an offense is generally instituted with the criminal action unless it is waived, reserved, or previously filed. Uncoordinated filings can create procedural problems.

Important exceptions and limits

An authorized transfer is not automatically unrecoverable

If you personally entered the OTP or confirmed the transfer because the scammer deceived you, describe both facts accurately. Do not label it “unauthorized” if you technically approved it. It may still be a fraudulent or disputed transaction, but reimbursement and institutional responsibility require a fact-specific assessment.

A transfer receipt does not prove the recipient’s guilt

The receiving account is an investigative lead. The account may have been rented, sold, compromised, or opened using stolen identity information. Give the records to investigators instead of publicly accusing the named account holder.

A refund request is not the same as a chargeback right

Credit-card, debit-card, e-wallet, bank-transfer, remittance, and marketplace procedures differ. Ask for the exact dispute rule, submission deadline, required evidence, and written reason for any denial. Do not assume that rules for one payment method apply to another.

Cryptocurrency recovery is especially difficult

Report the wallet address, transaction hash, exchange, network, amount, and exact time immediately. If the assets passed through an identifiable exchange, investigators may be able to seek records or preservation through lawful process. Blockchain transactions generally cannot simply be reversed, and anyone demanding an advance recovery fee should be treated with extreme caution.

Common mistakes to avoid

Waiting for the scammer’s promised refund before reporting.
Deleting chats, blocking the account before saving evidence, or factory-resetting the device.
Sending another payment to “unlock” or recover the first one.
Giving a supposed investigator your OTP, PIN, password, seed phrase, or screen-sharing access.
Reporting only to the receiving bank and not to the institution from which the money left.
Omitting that you approved a payment after being deceived.
Posting unredacted IDs, statements, account numbers, or complaint affidavits on social media.
Publicly accusing an unverified person and risking harm to an innocent account holder.
Paying an unofficial fixer who promises arrest, account tracing, or guaranteed recovery.
Assuming that a police blotter alone completes the complaint process.
Filing inconsistent accounts with the bank, police, and regulators.
Ignoring later identity-theft risks after sending selfies, IDs, signatures, or personal records.

When legal help is urgent

Speak promptly with a Philippine lawyer or the Public Attorney’s Office, if you qualify, when:

the loss is substantial or involves several victims;
the scammer knows your home, workplace, or family and is threatening you;
intimate images, blackmail, trafficking, or threats of violence are involved;
your identity documents, SIM, email, or financial accounts have been taken over;
you are being treated as an account owner, money mule, suspect, or respondent;
police, a prosecutor, a court, or a regulator has issued a subpoena, summons, or order;
the financial institution denies the claim despite evidence of a security failure;
funds or assets may require an urgent court order;
you are considering a separate civil action; or
a filing or prescriptive deadline may be approaching.

Time limits differ according to the offense, penalty, civil cause of action, contract, payment method, and procedural history. Do not rely on a general internet deadline for a fact-specific case.

Practical incident checklist

Contact the sending institution’s official fraud channel.
Ask for tracing, a disputed-funds hold, record preservation, and a reference number.
Submit supporting documents within the institution’s stated period.
Secure email, banking, wallet, card, SIM, and device access.
Preserve complete, original evidence in two safe locations.
Prepare a dated chronology and itemized loss table.
File a law-enforcement report and ask about a formal complaint-affidavit.
Report the account, advertisement, and profile to the relevant platform.
Escalate unresolved financial-institution issues to the BSP.
Contact DTI, SEC, or NPC if the incident falls within that agency’s authority.
Watch for identity theft, new beneficiaries, password-reset messages, and follow-up scams.
Obtain legal advice before separate civil filings or signing a settlement.

Frequently asked questions

Will the bank automatically refund me?

No. A prompt report can improve the chance of tracing or holding funds, but reimbursement depends on the evidence, applicable law and regulation, the payment method, the institution’s conduct, and whether funds remain available.

Should I report even if the amount is small?

Yes. The account or contact details may connect to other victims, and early reporting can help preserve evidence. Keep the time and cost of additional proceedings proportionate to the loss.

What if I voluntarily transferred the money?

Report it honestly. A transfer induced by deception may still support a fraud complaint even though you technically authorized the payment. That does not mean the institution is automatically liable to refund it.

Can I ask the bank for the recipient’s identity?

You may provide the recipient information you already possess and ask the bank to preserve and trace records. Banks generally cannot simply disclose another customer’s protected information to you. Investigators, courts, and authorized agencies can seek information through the applicable legal process.

Is a police blotter enough?

Usually not by itself. Ask whether investigators require a complaint-affidavit, supporting affidavits, original records, identification, or additional documents. Keep the blotter or report number and the investigator’s official contact information.

Can I post the scammer’s name and account online?

Exercise caution. The displayed name may belong to a mule or identity-theft victim, and public accusations may expose personal data, prejudice an investigation, or create separate legal risk. Give identifying evidence to institutions and authorities.

Can I recover money through small claims?

Potentially, if the defendant is identifiable and the case is a covered monetary claim not exceeding ₱1,000,000. Jurisdiction, venue, barangay conciliation, and the relationship between the civil and criminal cases must still be considered.

What if the scammer is abroad?

Report locally and preserve all foreign telephone numbers, domains, platform profiles, payment processors, exchanges, and wallet information. Cross-border recovery is harder and may require cooperation between platforms and authorities, but the location of the scammer should not stop an immediate report.

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and liability depend on the documents and circumstances. Official legal and agency sources were checked as of 3 September 2026.