Losing money to an online scam is frightening because time matters: the scammer may move the funds through several bank or e-wallet accounts within minutes. In the Philippines, the best response is to preserve evidence, report to your bank or e-wallet immediately, ask for a temporary hold or tracing of the funds, and file a cybercrime report with the proper authorities. This guide explains what to do first, which Philippine laws may apply, where to report, what documents to prepare, and what recovery realistically looks like.

What to Do Immediately After an Online Scam

1. Stop communicating with the scammer

Do not send more money, IDs, OTPs, selfie videos, or “verification” payments. Many victims lose more because the scammer later claims that a refund, prize, delivery, account release, or investment withdrawal requires another fee.

Block the scammer only after you have preserved the conversation. If possible, keep the chat thread open and take screenshots before the account disappears.

2. Secure your accounts

Change passwords and enable multi-factor authentication on:

Online banking apps
E-wallets
Email accounts
Facebook, Instagram, TikTok, Telegram, WhatsApp, Viber, or other messaging apps
Shopping platform accounts
Crypto exchange accounts, if involved

If you gave your OTP, card details, PIN, password, or ID, treat the incident as possible identity theft or account takeover.

3. Save evidence before anything is deleted

Create a folder with:

Screenshots of chats from start to finish
Sender name, username, profile link, phone number, email address, QR code, or account number
Proof of payment, transfer confirmation, reference number, receipt, or bank statement
Product listing, investment offer, fake job post, or website link
Screenshots showing promises, delivery details, refund promises, or threats
Date and time of each transaction
Your own short timeline of what happened

Screenshots are useful, but investigators often need more than pictures. Save the actual links, profile URLs, usernames, reference numbers, and transaction IDs because names and display photos can be changed easily.

4. Report to your bank or e-wallet immediately

Contact the sending bank, e-wallet, credit card issuer, or payment app through its official hotline, in-app help center, branch, or fraud channel. Ask for a case or ticket number.

Use clear words:

“I am reporting a fraudulent transaction. Please tag this as a disputed transaction, preserve logs, coordinate with the receiving institution, and determine whether the funds may be temporarily held under the Anti-Financial Account Scamming Act.”

Under Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA), BSP-supervised institutions may temporarily hold funds subject of a disputed transaction for a period prescribed by the BSP, not exceeding 30 calendar days unless extended by a court. The law also requires coordinated verification among institutions and provides possible restitution where an institution failed to use adequate risk controls or failed to exercise the required diligence. (Lawphil)

5. Report to cybercrime authorities

For online scams, the main law enforcement agencies are the National Bureau of Investigation Cybercrime Division (NBI-CCD) and the Philippine National Police Anti-Cybercrime Group (PNP-ACG). Republic Act No. 10175 expressly makes the NBI and PNP responsible for cybercrime law enforcement and requires them to organize cybercrime units. (Supreme Court E-Library)

You may also report through the government’s anti-scam channels. The Cybercrime Investigation and Coordinating Center has promoted the 1326 anti-scam hotline for scam reports and assistance, including coordination with PNP and NBI. (Philippine News Agency)

Is an Online Scam a Crime in the Philippines?

Yes. Depending on the facts, an online scam may fall under several Philippine laws.

Estafa under Article 315 of the Revised Penal Code

Many online scams are prosecuted as estafa, also called swindling. Article 315 of the Revised Penal Code punishes a person who defrauds another through listed means, including false pretenses, fictitious names, imaginary transactions, or other similar deceit. (Supreme Court E-Library)

Common examples:

A fake seller accepts payment but never intends to deliver.
A person pretends to be a recruiter and asks for “processing fees.”
Someone claims to have investment access, crypto trading expertise, or inside information but the offer is fake.
A scammer uses a fake identity to make the victim send money.

For estafa, the key issue is usually whether there was deceit before or at the time the money was sent. A simple unpaid debt is not automatically estafa, but a transaction may become criminal when the evidence shows that the offender used fraud from the beginning.

Cybercrime under Republic Act No. 10175

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers computer-related fraud, computer-related identity theft, and crimes under the Revised Penal Code or special laws committed through information and communications technology. Computer-related fraud includes unauthorized input, alteration, deletion of computer data or interference in a computer system causing damage with fraudulent intent. The law also covers identity theft involving another person’s identifying information. (Supreme Court E-Library)

This matters because an ordinary estafa may become a cybercrime-related case when the deceit is committed through online messaging, fake websites, hacked accounts, phishing links, or other digital systems.

Anti-Financial Account Scamming Act

AFASA directly targets financial account scams. It penalizes money muling and social engineering schemes involving bank accounts, e-wallets, credit cards, payment accounts, and similar financial accounts. It also recognizes that scammers often use other people’s accounts to receive and move stolen funds. (Lawphil)

Important AFASA points for victims:

Banks, e-wallets, and other BSP-supervised institutions must have adequate risk management systems, including multi-factor authentication and fraud management systems.
A disputed transaction may trigger temporary holding of funds and coordinated verification.
Conviction of the scammer is not always required before restitution may be considered where the institution failed in duties covered by the law. (Lawphil)

Financial consumer protection

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, protects financial consumers’ rights to fair treatment, disclosure, protection against fraud and misuse, data privacy, and timely complaint handling. It also defines investment fraud as deceptive solicitation of investments from the public, including Ponzi schemes and unlicensed investment schemes. (Supreme Court E-Library)

For purely civil money claims against covered financial service providers, the BSP and SEC have adjudicatory authority for payment or reimbursement claims not exceeding ₱10 million, subject to the limits and procedures in RA 11765. (Supreme Court E-Library)

Step-by-Step Guide to Reporting and Recovering Money

Step 1: Make a one-page incident summary

Write a simple timeline:

How you met or found the scammer
What the scammer promised
Why you believed the scammer
When and how you sent money
Where the money was sent
What happened after payment
What steps you already took with the bank, e-wallet, platform, or police

This helps banks, investigators, prosecutors, and regulators understand the case quickly.

Step 2: Report the transaction to the financial institution

Report to:

The bank or e-wallet you used to send money
The receiving bank or e-wallet, if you know it
Your credit card issuer, if the payment was by card
The payment platform, marketplace, or remittance provider

Ask for:

A fraud ticket or reference number
Written acknowledgment
Investigation status
Whether the funds were successfully held, recalled, blocked, or traced
Whether the case was referred to the receiving institution

The BSP’s Consumer Assistance Mechanism is generally a second-level recourse, meaning you should first report to the bank or BSP-supervised institution’s own Financial Consumer Protection Assistance Mechanism or customer service channel. If unresolved or unsatisfactory, you may escalate to BSP through the BSP Online Buddy or other BSP consumer assistance channels.

Step 3: File with NBI Cybercrime Division or PNP Anti-Cybercrime Group

For formal investigation, prepare to give a sworn statement. The NBI Cybercrime Division’s citizen charter states that the general public may request investigative assistance, with no filing fee for the listed CCD process, and includes complaint filing, preliminary interview, sworn statements, and submission of supporting documents. (National Bureau of Investigation)

Bring or prepare:

Valid government ID
Printed and digital copies of evidence
Transaction receipts and account details
Screenshots and URLs
Your written timeline
Phone or device used, if relevant
Bank or e-wallet ticket numbers

In practice, online reports are useful for triage, but many cases still require a personal appearance or sworn complaint-affidavit, especially if the case will move to formal investigation or prosecution.

Step 4: Report the account, profile, phone number, or listing

Report the scammer’s account to the platform involved:

Facebook Marketplace or Meta
TikTok Shop
Shopee, Lazada, Carousell, or other marketplace
Telegram, Viber, WhatsApp, or Instagram
The domain registrar or hosting provider, if a fake website was used

Also report the phone number to the telco if SMS or calls were used. The SIM Registration Act requires SIM registration as a condition for activation, but victims do not personally receive subscriber information just because a number was used in a scam. Access to subscriber or traffic information is usually handled through lawful processes by investigators, courts, or authorized agencies.

Step 5: Escalate to the correct regulator

Use the regulator that matches the scam.

Scam type	Where to report or escalate	Why it matters
Bank, e-wallet, credit card, or payment transfer fraud	Bank/e-wallet first, then BSP Consumer Assistance Mechanism	BSP handles complaints involving BSP-supervised institutions and financial consumer protection concerns. (Bureau of the Treasury)
Fake investment, Ponzi, crypto-style investment solicitation, unregistered securities	Securities and Exchange Commission	The SEC accepts complaints and tickets through its official iMessage system. (Securities and Exchange Commission)
Online purchase from a known seller or platform	DTI Consumer CARe System	DTI’s online consumer system allows electronic filing and online dispute resolution for consumer complaints. (DTI Consumer Care)
Identity theft, misuse of IDs, doxxing, unauthorized use of personal data	National Privacy Commission	NPC formal complaints require a specific form and may be submitted in person, by courier, or by scanned email after notarization. (National Privacy Commission)
Cybercrime investigation	NBI-CCD, PNP-ACG, CICC/1326	These channels handle or coordinate cybercrime reporting, investigation, and referral. (Supreme Court E-Library)

Required Documents and Practical Timelines

Item	Why it is needed	Practical note
Valid ID	Confirms your identity as complainant	Foreigners should bring passport, ACR I-Card if available, or other official ID.
Proof of payment	Shows the loss and transaction trail	Include reference number, date, time, amount, sender and receiver details.
Screenshots of chats and posts	Shows deceit, promises, instructions, and identity clues	Capture full screen where possible, including usernames and timestamps.
URLs and profile links	Helps investigators identify the actual digital account	A display name alone is weak evidence because it can be changed.
Written timeline	Makes the complaint easier to evaluate	Keep it factual and chronological.
Sworn statement or complaint-affidavit	Required for formal investigation or prosecution	Some offices assist with sworn statements; notarization may be required depending on where filed.
Bank or e-wallet ticket number	Shows you already reported the fraud	BSP generally expects prior reporting to the financial institution before escalation.
Device used in the transaction	May help in forensic review	Do not factory-reset the device before preserving evidence.

For urgent fund recovery, the most important timeline is the first few hours. Once funds are withdrawn in cash, converted to crypto, or passed through multiple mule accounts, recovery becomes much harder.

For formal investigation, expect longer timelines. Initial complaint intake may be quick, but subpoenas, cybercrime warrants, account tracing, coordination with banks or platforms, prosecutor review, and court proceedings can take weeks, months, or longer depending on the complexity of the case and whether the scammer can be identified.

Can You Get the Money Back?

Sometimes, but not always.

Recovery is more likely when:

You report within minutes or hours.
The funds are still in the receiving account.
The receiving bank or e-wallet can temporarily hold the disputed funds.
The scammer used a traceable account under a real identity.
The financial institution failed to follow required security, fraud monitoring, or complaint-handling obligations.
The scam is part of a larger operation already under investigation.

Recovery is harder when:

The funds were withdrawn immediately.
The scammer used multiple mule accounts.
The money was converted to crypto or gift cards.
The scammer is outside the Philippines.
The account holder is only a mule with no remaining funds.
The evidence consists only of cropped screenshots without transaction details.

AFASA improves the victim’s position because it gives financial institutions authority and responsibilities relating to disputed funds, coordinated verification, and temporary holding. But it does not guarantee automatic reimbursement in every case. The facts, timing, bank records, fraud controls, and available funds still matter.

What Happens After You File a Cybercrime Complaint?

A typical path looks like this:

Complaint intake. You submit your narrative and evidence.
Initial interview. The investigator checks whether the facts show estafa, cybercrime, financial account scamming, identity theft, or another offense.
Evidence preservation. You may be asked for more screenshots, links, receipts, or device access.
Requests to platforms or financial institutions. Investigators may coordinate with banks, e-wallets, telcos, or online platforms.
Cybercrime warrants or court orders. For certain digital evidence, law enforcement may need court-issued warrants.
Referral for preliminary investigation. If suspects are identified and evidence is sufficient, the case may be referred to the prosecutor.
Court case. If the prosecutor finds probable cause, an information may be filed in court.

The Supreme Court’s Rule on Cybercrime Warrants covers preservation, disclosure, interception, search, seizure, examination, custody, and destruction of computer data. It also provides rules on where cybercrime actions and warrant applications may be filed, including designated cybercrime courts where the offense, system, or damage occurred.

Special Situations

If the scammer used a real person’s bank or e-wallet account

That person may be:

The main scammer
A money mule
A recruited account holder
A hacked account owner
Someone whose ID was misused

Do not assume the account name alone proves who planned the scam. Still, the receiving account is a critical lead and should be reported immediately.

AFASA specifically penalizes buying, selling, lending, renting, using, or allowing the use of financial accounts for money muling activities connected to criminal proceeds or social engineering schemes. (Lawphil)

If you were scammed by a fake online seller

If the seller is identifiable and the issue looks like a consumer transaction, DTI may help with mediation or consumer complaint processing. If the seller used a fake identity, fake tracking number, fake courier receipt, or never intended to deliver, it may also be estafa or cybercrime.

A barangay blotter may help document what happened, but it is usually not enough for fund tracing or cybercrime investigation. For unknown online scammers, NBI, PNP-ACG, CICC, the financial institution, and the relevant platform are more practical.

If the scam involved fake investment or crypto profits

Report to the SEC if the offer involved pooled money, guaranteed returns, trading profits, “staking,” “tasking,” referral commissions, or investment packages. RA 11765 recognizes investment fraud, including Ponzi schemes and unlicensed public investment solicitations. (Supreme Court E-Library)

Also file with cybercrime authorities if money was transferred through bank, e-wallet, crypto exchange, or online platforms.

If your identity documents were used

If you sent a passport, driver’s license, UMID, national ID, selfie, signature, or bank details, monitor for:

New loan apps or lending accounts
SIMs or e-wallets opened in your name
Unauthorized credit card or bank activity
Fake social media profiles
Threats using your personal information

A data privacy complaint may be appropriate if personal information was misused or processed unlawfully. NPC’s complaint process requires a formal complaint in the required format, notarization, and submission through its accepted channels. (National Privacy Commission)

If you are overseas or a foreigner

Filipinos abroad and foreigners may still report scams connected to Philippine accounts, Philippine victims, Philippine-based offenders, or financial institutions operating in the Philippines. Practical issues are usually evidence, notarization, and personal appearance.

If you cannot appear in the Philippines, ask the receiving agency what format it accepts for a sworn complaint. Some documents executed abroad may need consular acknowledgment or apostille, especially if they will be used formally in Philippine proceedings. The Philippine apostille system authenticates public documents for cross-border use, and foreign-issued documents intended for use in the Philippines may need apostille or equivalent authentication depending on the issuing country and document type. (Apostille Services)

Common Mistakes That Hurt Online Scam Cases

Waiting too long before reporting

The best chance of recovery is usually before the money leaves the receiving account. Report immediately even if you feel embarrassed or unsure.

Deleting the conversation

Victims sometimes delete chats because they feel ashamed. Do not delete anything. The embarrassing parts may be exactly what proves deceit.

Posting accusations online before filing

Public posts can warn the scammer, cause deletion of accounts, or create separate legal risks. Preserve evidence and report first.

Sending more money to “recover” the first payment

Recovery scams are common. Anyone asking for “clearance fees,” “unlocking fees,” “anti-money laundering fees,” “tax,” or “refund processing fees” after a scam is likely trying to take more money.

Sharing OTPs or passwords with people claiming to help

The BSP warns consumers not to share PINs, passwords, account numbers, card numbers, passports, or other identification cards when filing BSP-CAM complaints because these are not required for BSP complaint processing.

Filing only with the platform

A Facebook, Telegram, TikTok, or marketplace report may remove the account, but it does not automatically create a criminal case or trace the funds. Report to the financial institution and cybercrime authorities too.

Frequently Asked Questions

Can I still report an online scam if I only lost a small amount?

Yes. Small-value scams can still be criminal, especially if the same account victimized many people. Report it because your evidence may connect to a larger pattern.

Should I go to the barangay first?

For unknown online scammers, a barangay complaint is usually not the most effective first step. Banks, e-wallets, NBI, PNP-ACG, CICC, DTI, SEC, BSP, or NPC may be more appropriate depending on the scam. A barangay record may help document the incident, but it usually cannot trace bank accounts or compel platforms to preserve digital evidence.

Can the police trace a GCash, Maya, bank, or phone number?

They may be able to request information through proper legal processes, but victims normally cannot demand subscriber or account data directly from banks, telcos, or platforms. Privacy, bank secrecy, cybercrime rules, and financial regulations affect how information is obtained.

Is it estafa if the seller promised delivery but never shipped the item?

It depends on intent and evidence. If the seller was real but merely delayed, it may be a civil or consumer dispute. If the seller used fake identity, fake proof, repeated false promises, or never intended to deliver from the start, it may support estafa or cybercrime.

Can my bank or e-wallet refuse to refund me?

It can dispute liability depending on the facts. However, financial institutions have duties under RA 11765, AFASA, BSP rules, and their own fraud controls. Ask for a written explanation, preserve the ticket history, and escalate to BSP if the institution’s response is unsatisfactory and it is within BSP’s coverage.

What if I voluntarily sent the money?

Voluntary transfer does not automatically defeat the case. Many scams work because the victim was deceived into authorizing the payment. The legal question is whether there was fraud, false pretenses, social engineering, identity theft, or another unlawful act.

What if the scammer is abroad?

You can still report in the Philippines if Philippine accounts, victims, platforms, or institutions are involved. Cross-border cases are slower because investigators may need platform cooperation, mutual legal assistance, or coordination with foreign authorities.

Do I need a lawyer to file a cybercrime complaint?

For many reports, you can file directly with the bank, e-wallet, NBI, PNP, CICC, DTI, SEC, BSP, or NPC. Legal assistance becomes more useful when the amount is large, the bank denies liability, a prosecutor requires a more detailed complaint-affidavit, or a civil recovery case is being considered.

Can I sue the scammer civilly to recover money?

Yes, if the scammer or responsible party can be identified and there are assets to recover from. Civil recovery may be based on damages under the Civil Code, including provisions requiring compensation for damage caused contrary to law or through willful injury. (Lawphil)

How long does an online scam case take?

Fund-hold requests are urgent and should be made immediately. Bank or e-wallet investigations may take days to weeks. Cybercrime investigations can take weeks or months, especially if warrants, platform data, or multiple financial institutions are involved. Court cases can take much longer.

Key Takeaways

Report to your bank or e-wallet immediately and ask for fraud tagging, coordinated verification, and possible temporary holding of disputed funds.
Preserve screenshots, links, transaction IDs, receipts, account numbers, and your written timeline before blocking or deleting anything.
Online scams may involve estafa, cybercrime, financial account scamming, identity theft, access device fraud, investment fraud, or consumer protection violations.
NBI-CCD, PNP-ACG, CICC/1326, BSP, SEC, DTI, and NPC handle different parts of the problem.
Recovery is most realistic when the report is made quickly and the funds remain traceable or temporarily held.
Do not send more money, share OTPs, or trust “recovery agents” who demand fees after the scam.