If you lost money to an online scam in the Philippines, act quickly but carefully. The first few hours matter because banks, e-wallets, platforms, telcos, and law enforcement may still be able to trace, hold, or preserve evidence of the transaction. This guide explains what to do immediately, where to report the scam, what Philippine laws may apply, what documents to prepare, and what realistic outcomes to expect.

First Things First: Your Immediate Goals After an Online Scam

After the shock wears off, many victims instinctively message the scammer, post about them, or ask friends to “trace” the number. Those steps may feel satisfying, but they can hurt your case if they cause evidence to disappear or lead to unsafe confrontation.

Your first goals are:

Stop further loss by securing your bank, e-wallet, email, social media, and SIM.
Report the transaction immediately to the bank, e-wallet, payment platform, or marketplace.
Preserve evidence before the scammer deletes chats, changes usernames, or blocks you.
File the correct report with law enforcement or the proper regulator.
Prepare for recovery efforts through freezing, investigation, restitution, refund, civil action, or criminal prosecution.

In practice, recovering money from an online scam is difficult when funds have already been withdrawn or passed through several accounts. But fast reporting improves the chances of a temporary hold, coordinated verification, platform takedown, account tracing, and a stronger criminal complaint.

What Kind of Case Is an Online Scam in the Philippines?

“Online scam” is a practical term, not just one specific crime. Depending on how the scam happened, several Philippine laws may apply.

Estafa or Swindling Under the Revised Penal Code

Many online scams are treated as estafa, also called swindling, under Article 315 of the Revised Penal Code. Estafa generally involves defrauding another person through abuse of confidence, false pretenses, fraudulent acts, or similar deceit that causes damage. Article 315 specifically covers false pretenses such as using a fictitious name, pretending to have qualifications, business, agency, credit, property, or imaginary transactions. (Lawphil)

Common examples include:

A fake seller accepting payment for a phone, gadget, ticket, bag, or appliance and never delivering.
A person pretending to be a recruiter and asking for “processing fees.”
A fake investment promoter promising guaranteed returns.
A romance scammer inventing emergencies to induce repeated transfers.
A person using a fake identity to make you send money.

For estafa based on deceit, the important point is usually timing: the deceit must generally exist before or at the same time you parted with your money. A simple failure to pay a debt is not automatically estafa. But if the supposed transaction was fraudulent from the beginning, it may become criminal.

Cyber-Estafa Under the Cybercrime Prevention Act

If the estafa was committed through Facebook, Messenger, Instagram, TikTok, Viber, WhatsApp, SMS, email, fake websites, online banking, e-wallets, or similar technology, prosecutors may treat it as estafa committed through information and communications technology.

Under the Cybercrime Prevention Act of 2012, Republic Act No. 10175, crimes under the Revised Penal Code and special laws committed through ICT are covered by the cybercrime law, and the penalty may be one degree higher than the ordinary offense. The same implementing rules recognize the NBI and PNP as cybercrime law enforcement authorities and provide for special cybercrime courts. (Supreme Court E-Library)

This is why people often call online scam cases cyber-estafa, although the formal charge may depend on the facts and the prosecutor’s evaluation.

Computer-Related Fraud and Identity Theft

Some scams involve more than deceit. If the scammer used unauthorized access, manipulated computer data, interfered with a system, or used another person’s identifying information, the case may also involve computer-related fraud or computer-related identity theft under RA 10175. The implementing rules define computer-related fraud as unauthorized input, alteration, deletion of computer data or program, or interference in a computer system, causing damage with fraudulent intent. (Supreme Court E-Library)

Examples include:

Phishing links that capture your login credentials.
Fake bank pages that lead to unauthorized transfers.
Account takeovers of Facebook, email, bank, or e-wallet accounts.
Use of another person’s identity documents or account details.

Financial Account Scamming Under RA 12010

Republic Act No. 12010, the Anti-Financial Account Scamming Act, or AFASA, is especially important for bank and e-wallet scams. It penalizes money muling, social engineering schemes, aiding or abetting, attempts, opening accounts under fictitious names, and buying or selling financial accounts. (Supreme Court E-Library)

AFASA matters because many scams use “mule accounts” — accounts owned by someone else but used to receive, transfer, or withdraw scam proceeds. The law also allows temporary holding of disputed funds within the period set by BSP rules, not exceeding 30 calendar days unless extended by a court. (Supreme Court E-Library)

AFASA also says financial institutions must protect access to accounts using adequate risk management systems and controls, such as multi-factor authentication and fraud management systems. If an institution fails to employ adequate controls or fails to exercise the highest degree of diligence, it may be liable for restitution, and conviction of the scammer is not required before restitution may be pursued under the law. (Supreme Court E-Library)

Investment Fraud

If the scam involved “guaranteed profit,” “daily payout,” “crypto trading,” “forex signals,” “paluwagan investment,” “tasking,” “AI trading bot,” “franchise packages,” or “double your money” offers, it may also fall under investment fraud.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, defines investment fraud as deceptive solicitation of investments from the public, including Ponzi schemes and offers of investment schemes without the required SEC license or permit. (Supreme Court E-Library)

The SEC and Philippine courts use the concept of an investment contract. In SEC v. Prosperity.Com, Inc., the Supreme Court explained that an investment contract exists when a person invests money in a common enterprise and expects profits primarily from the efforts of others, following the Howey test. (Supreme Court E-Library)

Online Shopping and Marketplace Complaints

If the problem is a fake seller, non-delivery, wrong item, refusal to refund, or misleading online sale, the Department of Trade and Industry may also be relevant, especially if the seller is an online merchant or e-commerce business.

Republic Act No. 11967, the Internet Transactions Act of 2023, gives the DTI regulatory jurisdiction over e-commerce activities by e-marketplaces, online merchants, e-retailers, digital platforms, and third-party platforms. (Supreme Court E-Library)

The DTI E-Commerce FAQ says consumer complaints against online sellers may be sent to the DTI Fair-Trade Enforcement Bureau at fteb@dti.gov.ph, with eco@dti.gov.ph copied, and that DTI accommodates online and offline business complaints. (DTI ECommerce)

Step-by-Step: What to Do After Losing Money to an Online Scammer

1. Secure Your Accounts Immediately

Before preparing a complaint, stop the scam from spreading.

Do these right away:

Change passwords for your email, bank, e-wallet, social media, and shopping apps.
Turn on multi-factor authentication.
Log out unknown devices.
Block or lock compromised cards.
Call your bank or e-wallet if you gave your OTP, MPIN, card number, CVV, password, or selfie verification.
Notify contacts if your account was taken over and used to solicit money.

If your SIM, phone, or email was compromised, tell your telco, bank, and e-wallet immediately. Many financial apps use SMS, email, device binding, or one-time passwords. If the scammer controls any of those channels, they may keep draining accounts even after the first transfer.

2. Report the Transaction to the Bank, E-Wallet, or Payment Platform

Do not wait until you have a police report. Report first to the financial institution involved.

Ask for:

A case or ticket number.
A written acknowledgment by email, app message, or SMS.
A request to freeze, hold, reverse, or investigate the transaction.
Confirmation that the receiving bank or e-wallet will be notified.
Instructions for submitting proof, affidavit, or complaint form.

For fund transfers and unauthorized transactions, BSP rules treat the originating financial institution as primarily responsible for assisting its client and coordinating with the receiving financial institution. (Bangko Sentral ng Pilipinas)

Under AFASA, institutions may temporarily hold funds subject of a disputed transaction, and a transaction may be disputed if there is reasonable ground to believe it is unusual, without clear economic purpose, from an unlawful source, or facilitated through social engineering. (Supreme Court E-Library)

Practical tip: When speaking with customer service, use clear words such as:

“I am reporting a scam/fraudulent transaction. Please create a dispute ticket, notify the receiving financial institution, and request a temporary hold or preservation of funds and account records.”

3. Preserve Evidence Before It Disappears

Scam evidence is often fragile. Scammers delete posts, change usernames, unsend messages, deactivate pages, and move money quickly.

Save the following:

Evidence	What to Save
Payment proof	Bank/e-wallet receipt, reference number, date, time, amount, sender and receiver account details
Chats	Full conversation from first contact to last message, not only selected screenshots
Profile details	Username, profile URL, display name, profile photo, page link, group link
Contact details	Phone number, email address, Telegram handle, WhatsApp number, Viber number
Offer or listing	Product post, investment pitch, job offer, website, ad, livestream, invoice
Delivery details	Tracking number, courier details, fake proof of shipment, delivery address
Identity claims	IDs sent by scammer, business permits, DTI/SEC certificates, receipts, contracts
Platform records	Order number, dispute ticket, marketplace decision, seller page, report acknowledgment

Screenshots help, but they are stronger when they show:

The full screen, including date/time if possible.
The URL or username.
The sender’s number or account name.
The transaction reference number.
The sequence of messages.

Do not edit screenshots except to make backup copies. Keep the original files. If you later execute an affidavit, your statement should match the evidence exactly.

4. Report to the Platform Where the Scam Happened

Report the account, page, marketplace listing, group, or ad to the platform.

This may help:

Preserve internal platform logs.
Freeze seller wallets.
Suspend the scammer’s account.
Prevent more victims.
Generate a platform report or reference number.

For marketplace transactions, use the app’s internal dispute process first. Shopee, Lazada, Facebook Marketplace, TikTok Shop, delivery apps, and payment platforms have different time limits. Missing an in-app dispute deadline can reduce your refund chances even if you still have a criminal complaint.

5. Report to the Proper Government Office

Different agencies handle different parts of the problem. Reporting to one office does not always mean every remedy is covered.

Where to Report	Best For	What to Expect
Bank, e-wallet, or payment provider	Freezing, tracing, disputed transaction, possible refund or restitution	Ticket number, investigation, request for documents
CICC / I-ARC Hotline 1326	Initial reporting and routing of online scams	Triage and guidance; may refer to enforcement agencies
PNP Anti-Cybercrime Group	Cyber-estafa, phishing, hacked accounts, online fraud	Investigation, affidavit, possible referral to prosecutor
NBI Cybercrime Division	Cybercrime investigation, digital evidence, complex scams	Complaint sheet, interview, sworn statements
SEC	Investment scams, unauthorized investment solicitation	Complaint or report, verification of registration or license
DTI	Online seller, non-delivery, refund, misleading e-commerce transaction	Consumer complaint, mediation, referral if criminal fraud
BSP	Unresolved complaint against a BSP-supervised bank or e-wallet	BSP Consumer Assistance Mechanism after first reporting to institution

The CICC’s Inter-Agency Response Center Hotline 1326 is described by government information channels as a 24/7 central number for reporting online selling scams, suspicious texts, emails, romance scams, investment fraud, cybercrimes, and phishing. (Philippine Information Agency)

For NBI cybercrime complaints, the NBI Citizen’s Charter for Investigative Assistance for Victims of Computer Crimes identifies the CyberCrime Division process: filing a complaint or request for investigation, preliminary interview, sworn complaint sheet, sworn statements, supporting documents, and examination of relevant devices when needed. (National Bureau of Investigation)

For unresolved complaints against banks and other BSP-supervised institutions, BSP instructs consumers to first report to the institution’s Financial Consumer Protection Assistance Mechanism. If unsatisfied, the complaint may be escalated through the BSP Online Buddy or BSP Consumer Assistance Mechanism. (Bangko Sentral ng Pilipinas)

6. Prepare a Clear Written Timeline

Investigators and prosecutors need facts, not just emotion. Prepare a timeline like this:

Date and time of first contact: Who messaged whom? On what platform?
Representation made: What exactly did the scammer promise or claim?
Why you believed it: Did they show IDs, reviews, receipts, mutual friends, business documents, or fake proof?
Payment details: Amount, date, time, account number, e-wallet number, reference number.
What happened after payment: Blocked, excuses, fake tracking, additional demands, account deleted.
Loss suffered: Total amount lost, extra charges, loan interest, or other measurable damage.
Reports made: Bank ticket, platform report, hotline report, barangay blotter, police/NBI complaint.

This timeline can later become the basis of your sworn affidavit.

7. Execute a Sworn Statement or Complaint-Affidavit

For a formal criminal complaint, you will usually need a complaint-affidavit. This is your written statement under oath explaining what happened, supported by evidence.

A good complaint-affidavit should include:

Your full name, address, contact details, and ID.
The scammer’s known name, aliases, account names, numbers, links, and receiving accounts.
A chronological narration of facts.
The exact amount lost.
How the scammer deceived you.
A list of attached evidence.
A statement that you are filing for investigation and appropriate charges.

If you are abroad, your affidavit may need notarization before a Philippine consulate or apostille/authentication depending on where it is executed and how it will be used. Philippine investigators may still ask for an online interview, additional identification, or a special power of attorney if a representative in the Philippines will follow up.

8. File the Criminal Complaint and Cooperate With Investigation

After the PNP or NBI investigation, the case may be referred to the prosecutor for preliminary investigation. During preliminary investigation, the prosecutor determines whether there is probable cause, meaning enough basis to charge the respondent in court.

A typical path looks like this:

Victim files complaint with PNP-ACG, NBI-CCD, or directly with the prosecutor.
Investigator evaluates evidence and may request preservation, account information, or cyber warrants where legally proper.
Respondent may be identified through bank, e-wallet, telco, platform, or other records.
Prosecutor issues subpoena if the respondent is known.
Parties submit affidavits and counter-affidavits.
Prosecutor issues a resolution.
If probable cause is found, an Information is filed in court.

Cybercrime cases are generally within the Regional Trial Court’s cybercrime jurisdiction when RA 10175 applies. The cybercrime implementing rules also provide that venue may lie where the cybercrime or any element was committed, where any part of the computer system used is situated, or where damage took place. (Supreme Court E-Library)

Can You Still Recover the Money?

Sometimes yes, but not always.

Possible recovery routes include:

Temporary Hold or Reversal

If reported quickly, the bank or e-wallet may still locate funds in the receiving account. AFASA allows temporary holding of disputed funds within the BSP-prescribed period, not exceeding 30 calendar days unless extended by court. (Supreme Court E-Library)

This is most realistic when:

You reported within minutes or hours.
The funds are still in the receiving account.
The transaction went to a regulated bank or e-wallet.
You provided complete reference numbers.
The receiving institution acted quickly.

Restitution From the Financial Institution

AFASA provides that institutions may be liable for restitution if they failed to employ adequate risk management systems and controls or failed to exercise the highest degree of diligence in preventing loss or damage from covered offenses. Conviction is not required before restitution may be pursued. (Supreme Court E-Library)

This does not mean every victim automatically gets refunded. The institution will look at facts such as whether the transaction was authorized, whether OTP or MPIN was shared, whether fraud alerts were sent, whether suspicious patterns were detected, and whether the bank or e-wallet complied with BSP rules.

Civil Liability in the Criminal Case

When a criminal case is filed, the victim’s civil claim for restitution or damages is generally tied to the criminal action unless separately waived, reserved, or filed. This means the court may eventually order payment of the amount defrauded if the accused is convicted.

The bottleneck is collection. A judgment is useful only if the accused has reachable assets, accounts, salary, property, or other means of payment.

Small Claims or Civil Case

If you know the real identity and address of the person who received your money, a civil case may be possible. For smaller money claims, the Supreme Court’s expedited rules increased the small claims threshold to ₱1,000,000, without distinction between Metro Manila and outside Metro Manila. (Supreme Court of the Philippines)

Small claims can be useful for straightforward refund or debt-like disputes, but they may be less effective where the scammer used a fake identity, cannot be served, or where the issue is mainly criminal fraud requiring investigation.

Common Mistakes That Hurt Online Scam Cases

Waiting Too Long to Report

Many victims wait because they are embarrassed, hoping the seller will still deliver, or trying to “negotiate.” Delay gives scammers time to withdraw funds and delete evidence.

Report immediately even if you are still gathering documents.

Sending More Money to “Unlock” Funds

Recovery scammers often target scam victims again. They may claim they can hack the scammer, unfreeze funds, recover crypto, or process a refund if you pay a fee.

Do not pay anyone who promises guaranteed recovery.

Posting Accusations Without Preserving Evidence

Public posts can warn others, but they can also alert scammers to delete accounts. Worse, if you post unverified personal information of the wrong person, you may expose yourself to complaints.

Preserve first. Report first. Post carefully, if at all.

Focusing Only on the Name on the Receiving Account

The account name may belong to a money mule, identity theft victim, or recruited account owner. Under AFASA, using, borrowing, selling, lending, buying, renting, or recruiting financial accounts for scam proceeds can be punished as money muling activity. (Supreme Court E-Library)

This is why investigators look beyond the first receiving account and examine transfer chains.

Assuming Barangay Blotter Is Enough

A barangay blotter may help record that you reported an incident, but it does not replace a cybercrime complaint with PNP-ACG, NBI-CCD, or the prosecutor. Barangay conciliation is also usually ineffective if the scammer is unknown, outside the city, using a fake identity, or the matter involves a serious criminal offense.

Deleting the Chat Out of Anger or Shame

Do not delete messages, even painful or embarrassing ones. Romance scams, blackmail scams, and investment scams often require the full conversation to show how trust and deceit developed.

Special Situations

If You Are an OFW or Filipino Abroad

You can start by reporting to your bank, e-wallet, platform, and CICC channels online. For a formal Philippine complaint, you may need to coordinate with:

A relative or representative in the Philippines.
The Philippine Embassy or Consulate for notarization.
NBI or PNP cybercrime units by email or online reporting channels.
Your bank’s overseas customer service channel.

If executing documents abroad, ask the receiving Philippine office whether they require consular notarization, apostille, or a specific affidavit format.

If You Are a Foreigner Scammed by Someone in the Philippines

Foreigners can report scams in the Philippines, especially if the scammer, receiving account, platform activity, or damage has a Philippine connection. Prepare your passport, proof of payment, communications, and a clear affidavit. If you are abroad, you may need authenticated or apostilled documents and a Philippine representative for follow-up.

RA 10175’s rules allow jurisdiction where elements of the cybercrime occurred in the Philippines, where part of the computer system used is situated, or where damage occurred to a person in the Philippines. (Supreme Court E-Library)

If the Scam Involved Crypto

Crypto scams are harder because transfers may be irreversible and wallets may be offshore. Still, preserve:

Wallet addresses.
Transaction hashes.
Exchange account details.
Chat logs.
Screenshots of dashboards.
Deposit and withdrawal history.
KYC information if any exchange account was used.

Report to law enforcement, the exchange, and relevant financial regulators if a Philippine-based entity or solicitation is involved. If the scheme promised profits from others’ efforts, it may also raise SEC issues.

If the Scammer Used a Registered SIM

RA 11934, the SIM Registration Act, was intended to promote responsibility in SIM use and give law enforcement tools to address crimes involving SIMs. (Supreme Court E-Library)

However, private individuals usually cannot simply demand the registered owner’s name from a telco. Subscriber information is protected and is normally accessed through lawful processes, law enforcement requests, or court-authorized disclosure. This is another reason to file a formal report instead of relying on informal “number tracing.”

Documents to Prepare

Document	Why It Matters
Government ID or passport	Establishes complainant identity
Complaint-affidavit	Main sworn narration of facts
Transaction receipts	Proves payment, date, time, amount, reference number
Bank/e-wallet statements	Shows source and flow of funds
Screenshots of chats	Shows deceit, promises, demands, and admissions
Profile links and usernames	Helps trace online identity
Platform reports or ticket numbers	Shows you reported promptly
Bank/e-wallet ticket numbers	Supports request for hold, reversal, or investigation
IDs or documents sent by scammer	May show false identity or impersonation
Timeline of events	Helps investigator and prosecutor understand the case
Special power of attorney	Useful if someone will file or follow up for you

Realistic Timelines

Step	Typical Timeframe	Practical Reality
Bank/e-wallet initial ticket	Same day to a few days	Faster if reference numbers are complete
Temporary hold request	Urgent; ideally within hours	May fail if funds were withdrawn immediately
Platform report	Same day to several days	Results vary by platform
NBI/PNP complaint intake	Same day to a few weeks	Depends on office workload and completeness
Preliminary investigation	Several months or longer	Delays happen if respondent is hard to identify
Court case	Months to years	Recovery may depend on assets and conviction
BSP escalation	After first reporting to institution	Use when the financial institution’s response is inadequate

Frequently Asked Questions

Can I still report an online scam if I only lost a small amount?

Yes. Even small losses can be reported, especially if the scammer is victimizing many people. A small amount may still support a complaint if there is evidence of deceit, payment, and damage. For practical reasons, agencies may prioritize larger or syndicated cases, but repeated reports against the same account, number, or page can help establish a pattern.

Should I report first to the bank or to the police?

Report first to the bank, e-wallet, or payment platform immediately, then proceed with law enforcement reporting. The bank or e-wallet may still be able to flag or hold funds. Police or NBI reports are important, but waiting for a formal police document before notifying the financial institution may waste valuable time.

Is a screenshot enough evidence?

A screenshot is helpful but usually not enough by itself. Save transaction receipts, reference numbers, account details, profile links, full chat history, platform reports, and any documents the scammer sent. The stronger your evidence, the easier it is for investigators and prosecutors to understand what happened.

Can I get my money back from GCash, Maya, or my bank?

Possibly, but it depends on the facts. If the funds are still available, a hold or reversal may be possible. If the issue involved unauthorized access, weak controls, or failure to act under applicable rules, you may have grounds to pursue restitution or escalation. If you voluntarily sent money because of deception, recovery may depend on tracing the recipient, freezing funds, or obtaining restitution through legal proceedings.

What if I sent the money voluntarily?

Voluntary transfer does not automatically defeat an estafa or fraud complaint. Many scam victims willingly send money because they were deceived. The key issue is whether the scammer used false pretenses, fraudulent acts, social engineering, or misrepresentation to make you part with your money.

Can I file a case if I only know the scammer’s phone number or Facebook account?

Yes, but identification will be a major part of the investigation. Provide the phone number, profile link, username, bank or e-wallet receiving account, transaction reference, and full communication records. Law enforcement may use proper legal processes to request subscriber, platform, or financial account information.

Should I confront the scammer?

Usually, no. Confrontation may cause the scammer to delete accounts, withdraw funds, threaten you, or coach other participants. Preserve evidence, report the transaction, and let the proper channels handle tracing.

Is an online lending, crypto, or investment scam reported to the police or SEC?

Often both. If the scheme involves deception and loss of money, report to law enforcement. If it involves solicitation of investments from the public, guaranteed returns, pooled funds, securities, or investment contracts, report to the SEC as well. SEC registration as a corporation is not the same as authority to solicit investments from the public.

Do I need a lawyer to file a cybercrime complaint?

Not always. Many victims file complaints directly with the PNP, NBI, or prosecutor. A lawyer can help if the amount is large, the facts are complex, the respondent is known and contesting the claim, documents must be prepared abroad, or you are pursuing civil recovery in addition to criminal prosecution.

What if the scammer is outside the Philippines?

You can still report if the victim, money trail, account, platform activity, or damage has a Philippine connection. Cross-border cases are more difficult and may require coordination through the DOJ Office of Cybercrime, law enforcement, foreign platforms, financial institutions, or mutual legal assistance channels. Recovery is harder, but reporting is still useful for preservation, intelligence, and possible account action.

Key Takeaways

Report the scam to your bank, e-wallet, or payment provider immediately and ask for a dispute ticket, coordinated verification, and possible temporary hold.
Preserve complete evidence: chats, links, receipts, reference numbers, account details, screenshots, and platform reports.
Many online scams may be charged as estafa under Article 315 of the Revised Penal Code and, if committed through ICT, may fall under RA 10175.
Bank and e-wallet scams may also involve RA 12010, the Anti-Financial Account Scamming Act, especially where money mule accounts or social engineering are involved.
Investment scams should also be reported to the SEC; online seller and marketplace disputes may also involve DTI.
A barangay blotter is not a substitute for a cybercrime complaint with PNP-ACG, NBI-CCD, or the prosecutor.
Recovery is possible in some cases, but speed, evidence quality, and traceability of funds are critical.
Do not pay “recovery agents,” hackers, or anyone promising guaranteed refund for an upfront fee.