Being scammed by an online task or job scheme can feel overwhelming, especially when the platform keeps demanding another “top-up,” “verification fee,” or “tax payment” before releasing your supposed earnings. The most important steps are to stop sending money, contact your bank or e-wallet immediately, preserve the evidence, secure your accounts, and report the scheme to Philippine cybercrime authorities. Fast action cannot guarantee recovery, but it can improve the chance of freezing funds, identifying the accounts used, and preventing further losses.

What Is an Online Task or Job Scam?

An online task scam usually begins with an unsolicited message offering easy work from home. The supposed job may involve:

Liking or following social media accounts
Rating hotels, restaurants, applications, or online stores
Placing “merchant orders” to increase product sales
Completing cryptocurrency or investment tasks
Encoding data or processing online transactions
Receiving and forwarding payments through your bank or e-wallet
Paying for equipment, training, permits, or account activation

The scammers may initially pay a small amount to gain your trust. After that, they ask you to deposit increasingly larger sums to unlock higher-paying tasks or withdraw your “commission.”

Common phrases include:

“Recharge your account”
“Complete the combination order”
“Your account has a negative balance”
“Upgrade to VIP level”
“Pay tax before withdrawal”
“Deposit a security bond”
“Complete one last task”
“Your withdrawal is under review”
“You made an error and must correct the transaction”

A legitimate employer does not normally require workers to deposit personal money into an account controlled by the employer simply to receive wages or commissions.

What to Do Immediately After an Online Task Scam

1. Stop sending money

Do not make another payment, even when the scammers claim that one final transfer will release everything.

Statements such as “your funds are already approved” or “the system will automatically refund you after the next task” are usually designed to exploit the victim’s hope of recovering earlier payments.

Do not borrow money, use another credit card, or ask relatives to fund the next task. The amounts demanded commonly increase until the victim can no longer pay.

2. Contact your bank, credit card issuer, or e-wallet immediately

Use the institution’s official fraud hotline, in-app support channel, or branch. Do not use a telephone number or link sent by the scammer.

Provide:

Your full name and registered mobile number
Date and time of each transaction
Amount sent
Transaction or reference number
Recipient’s bank, e-wallet, or account number
Recipient’s displayed account name
Screenshots of the conversation and payment instructions
A brief explanation that the payment was induced by an online job or task scam

Ask the institution to:

Record the transaction as a fraud or social-engineering complaint.
Coordinate with the receiving institution.
Determine whether the funds remain in the recipient account.
Apply any available temporary hold under the Anti-Financial Account Scamming Act.
Give you a complaint or case-reference number.
Tell you what sworn statement, police report, or affidavit must be submitted.

Under Republic Act No. 12010, or the Anti-Financial Account Scamming Act of 2024, covered financial institutions may temporarily hold disputed funds while they verify a transaction. The implementing rules generally allow an initial hold of up to five calendar days, with a possible extension that brings the total holding period to no more than 30 calendar days, unless a court orders otherwise. Supporting documents such as a sworn complaint, affidavit, police report, or other proof may be required during the initial period. (Bureau of Small and Medium Enterprises)

The temporary-hold process does not guarantee reimbursement. It is most useful when the money is still in the recipient account. Scammers often withdraw or transfer funds through several accounts within minutes.

The official BSP Consumer Assistance channels explain how to escalate a complaint after first using the bank or e-wallet provider’s own Financial Consumer Protection Assistance Mechanism.

3. Secure your accounts and devices

Change the passwords for any account that may have been exposed, especially:

Email
Online banking
E-wallets
Social media
Messaging applications
Cryptocurrency exchanges
Government accounts
Shopping platforms

Use a different password for each important account and enable two-factor authentication.

Immediately tell your financial institution when you disclosed any of the following:

One-time passwords
ATM or card PINs
Card security codes
Online banking passwords
Recovery codes
Answers to security questions
Copies of identification documents
Facial-verification videos or selfies
SIM registration information

Contact your mobile network when your SIM suddenly loses service or you suspect unauthorized SIM replacement.

Do not install another application sent by the scammers. Some “work platforms” and “support applications” are designed to steal passwords, read text messages, or remotely control the victim’s phone.

4. Preserve the evidence before blocking the scammers

Save the evidence first. Blocking or reporting an account may cause its profile, messages, and shared files to disappear.

Preserve:

The complete conversation, not only selected messages
Phone numbers, usernames, profile names, and profile links
Telegram, WhatsApp, Viber, Messenger, or Discord invite links
The original job advertisement
Website addresses and application download links
Email addresses and complete email headers
Bank and e-wallet account details
Deposit slips and transaction receipts
Reference numbers and timestamps
QR codes used for payment
Voice messages, videos, photographs, and documents
Contracts, identification cards, permits, or company certificates sent by the recruiter
Cryptocurrency wallet addresses and transaction hashes
Names of other victims or group-chat members
Messages showing the promises made before each payment
Messages demanding additional payment for withdrawal

Export the conversation when the application allows it. Keep the original files and make at least two backups, such as one encrypted cloud copy and one copy on a separate device.

Avoid cropping, annotating, or editing the only copy of a screenshot. You may create marked-up copies for explanation, but retain the untouched originals.

Electronic messages and digital records can be used as evidence under the Electronic Commerce Act of 2000, Republic Act No. 8792, and the Supreme Court’s Rules on Electronic Evidence. However, electronic evidence must still be authenticated—that is, someone must show that the record is what it claims to be. Keeping the original device, account, files, and surrounding conversation makes authentication easier. (Supreme Court E-Library)

5. Write a transaction timeline

Prepare a simple chronological record while the details are fresh.

Date and time	Event	Account or person involved	Amount
June 1, 9:10 a.m.	Received job offer through Telegram	Username and profile link	—
June 1, 10:30 a.m.	Completed first task and received payment	E-wallet account	₱150
June 1, 2:15 p.m.	Sent task deposit	Recipient account	₱3,000
June 2, 11:05 a.m.	Paid “negative balance”	Recipient account	₱12,000
June 2, 4:40 p.m.	Withdrawal refused unless tax was paid	Website and agent	—

Include what the scammer promised before each payment. This helps establish that you transferred the money because of false representations.

Philippine Laws That May Apply

Estafa under Article 315 of the Revised Penal Code

Most online task scams may constitute estafa, commonly called swindling, under Article 315 of the Revised Penal Code.

In a typical estafa-by-deceit case, the offender:

Makes a false statement or uses a fraudulent scheme;
Makes the deception before or at the time the victim transfers money;
Causes the victim to rely on the deception; and
Causes financial damage.

For example, a scammer falsely represents that deposits are required to complete legitimate merchant transactions and promises that the victim can withdraw the deposits plus commission. The victim transfers money because of that representation, but the supposed job and earnings are fictitious.

The amount lost can affect the applicable penalty under Article 315, as amended by Republic Act No. 10951 of 2017. The official text of the offense appears in Article 315 of the Revised Penal Code. (Lawphil)

Cybercrime Prevention Act of 2012

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers computer-related fraud, computer-related identity theft, and offenses under the Revised Penal Code or special laws committed through information and communications technology.

When estafa is committed through the internet or another computer system, Section 6 of RA 10175 may apply, and the penalty may be one degree higher than the penalty under the underlying law.

The law recognizes both the Philippine National Police and the National Bureau of Investigation as cybercrime law-enforcement authorities. It also allows the preservation and court-authorized disclosure of relevant subscriber, traffic, and content data. The official text is available in the Supreme Court E-Library copy of RA 10175. (Supreme Court E-Library)

Cybercrime cases generally fall within the jurisdiction of designated Regional Trial Courts. Philippine jurisdiction may also exist in certain cases involving Filipino offenders, Philippine computer systems, or damage connected to the Philippines. Cross-border cases can require international cooperation through the Department of Justice’s Office of Cybercrime. (Supreme Court E-Library)

Anti-Financial Account Scamming Act

RA 12010 specifically addresses financial-account scams, social-engineering schemes, and money-mule activities.

A money mule is a person whose bank, e-wallet, or other financial account is used to receive, transfer, or withdraw proceeds connected with crime or social engineering. Prohibited conduct can include:

Allowing another person to use an account;
Lending, renting, selling, or buying an account;
Opening an account under a fictitious or another person’s identity;
Recruiting people to provide accounts;
Receiving and forwarding suspicious funds for a commission.

A person who initially believed that receiving and forwarding payments was part of a legitimate job should stop immediately, preserve the instructions, and report the situation. Continuing after recognizing the suspicious nature of the transactions can create serious legal exposure. The BSP’s AFASA booklet and implementing regulations contain the law and detailed temporary-hold procedures. (Bureau of Small and Medium Enterprises)

Do not submit a fabricated or malicious fraud report. AFASA also penalizes certain false or malicious reporting.

Illegal recruitment laws

A fake job scheme may involve both estafa and illegal recruitment when someone offers or promises employment without the required authority or collects prohibited fees in connection with placement.

For local employment, relevant provisions may include Articles 13(b), 34, and 38 of the Labor Code, which address recruitment, prohibited recruitment practices, and illegal recruitment.

For overseas employment, Republic Act No. 8042, or the Migrant Workers and Overseas Filipinos Act of 1995, as amended by RA 10022 of 2010, may apply.

Before paying anything for an overseas job, verify both:

The recruitment agency through the DMW directory of licensed recruitment agencies; and
The position through the DMW list of approved job orders.

The Department of Migrant Workers advises applicants not to transact with unlicensed agencies, agencies without approved job orders, unauthorized representatives, or recruiters operating outside their registered business address. It also warns against paying placement fees without a valid employment contract and official receipt. (Department of Migrant Workers)

Where to Report an Online Task or Job Scam

Report to more than one appropriate channel. A bank complaint focuses on the movement of money, while a law-enforcement complaint focuses on identifying and prosecuting the offenders.

Office or institution	Main purpose	Useful information to submit
Your bank or e-wallet provider	Attempt to trace or temporarily hold disputed funds	Transaction references, recipient accounts, screenshots, affidavit or police report
Receiving bank or e-wallet, when identifiable	Notify it that an account may be receiving scam proceeds	Recipient details, transaction reference, originating institution’s case number
Cybercrime Investigation and Coordinating Center	Central cybercrime reporting and coordination	Scam narrative, contact details, links, accounts, payment records
PNP Anti-Cybercrime Group	Criminal investigation and cybercrime case build-up	Identification, affidavit, digital evidence, transaction records
NBI Cybercrime Division	Criminal investigation, digital tracing, and case build-up	Identification, complaint sheet, affidavit, electronic records
City or provincial prosecutor	Preliminary investigation to determine probable cause	Complaint-affidavit, witness affidavits, annexes, respondent information
Department of Migrant Workers	Overseas recruitment complaints and agency verification	Recruiter details, job offer, receipts, agency name, contract
BSP Consumer Assistance Mechanism	Escalation of unresolved complaints against BSP-supervised institutions	Institution’s complaint reference and final response, transaction documents

Reporting to the CICC

The Cybercrime Investigation and Coordinating Center operates the government’s 1326 anti-scam hotline. Reports may also be submitted through the official CICC cybercrime reporting page. (Philippine Information Agency)

A CICC report does not replace an urgent call to your bank. Do both as soon as possible.

Reporting to the PNP Anti-Cybercrime Group

You may report to the nearest PNP station, regional Anti-Cybercrime Unit, or the PNP Anti-Cybercrime Group.

Bring:

At least one valid government-issued ID
Printed copies of important screenshots
Digital copies on your phone or storage device
Bank or e-wallet statements
Transaction receipts
Your written timeline
Available information about the suspects and recipient accounts

Ask for a copy or reference number for your complaint or police record. Keep the investigator’s name and official contact details.

Reporting to the NBI Cybercrime Division

The NBI maintains an online complaint page and receives computer-crime complaints through its Cybercrime Division and regional offices.

The NBI Citizen’s Charter describes the initial computer-crime complaint intake as a no-fee service. Initial intake may be completed on the day of appearance, but this does not mean the investigation will be finished that day. Digital tracing, requests to banks or platforms, warrants, interviews, and coordination with other agencies can take much longer. (National Bureau of Investigation)

Filing a complaint with the prosecutor

After evidence has been gathered, a criminal complaint may proceed to the city or provincial prosecutor for preliminary investigation. Preliminary investigation is the process of deciding whether there is probable cause to charge the respondent in court.

The complainant commonly submits:

An investigation data form
A notarized complaint-affidavit or sworn statement
Affidavits of witnesses
Government-issued identification
Electronic evidence and printouts marked as annexes
Bank statements and transaction records
Police, NBI, or cybercrime reports
Available identifying information about the respondent
The required number of copies for the prosecutor and respondents

The prosecutor may issue a subpoena directing the respondent to submit a counter-affidavit. After reviewing the submissions, the prosecutor may dismiss the complaint or file an information in court.

Requirements and copy counts may vary by prosecutor’s office and the number of respondents. The Department of Justice publishes the basic requirements on its page for filing a complaint for preliminary investigation. (Department of Justice)

How to Prepare a Strong Complaint-Affidavit

A complaint-affidavit should tell the story clearly and chronologically. Avoid vague statements such as “I was scammed” without explaining how the deception caused each transfer.

Include:

Your identity and contact details.
How the supposed employer or recruiter contacted you.
The exact job, task, or earnings promised.
Why the offer appeared genuine.
The representation made before every payment.
The account, wallet, or cryptocurrency address used.
The date, time, and amount of every transfer.
What happened when you attempted to withdraw.
The additional demands made by the scammers.
Your total financial loss.
The steps you took to report the transactions.
A list of the attached evidence.

Refer to attachments consistently, such as:

Annex “A” — Screenshot of initial job offer
Annex “B” — Telegram profile and username
Annex “C” — First transfer receipt
Annex “D” — Message promising withdrawal
Annex “E” — Bank statement
Annex “F” — Complaint reference from the bank

State only facts you personally know unless you identify the source of other information. Do not exaggerate, guess the scammer’s identity, or name an account holder as the mastermind without evidence. The recipient account may belong to a mule, an identity-theft victim, or another participant whose exact role still requires investigation.

Can the Money Be Recovered?

Recovery depends largely on where the funds are when the complaint reaches the financial institutions.

Recovery is more possible when:

The money remains in the receiving account;
The recipient account has already been flagged;
The report is made immediately;
Complete transaction details are provided;
The receiving institution can identify subsequent transfers;
A card payment remains eligible for dispute or chargeback;
Cryptocurrency reaches an exchange that can identify and restrict the account holder;
Authorities identify assets that can be subjected to restitution or court processes.

Recovery is more difficult when:

The money was withdrawn as cash;
The funds passed through several mule accounts;
The transfer was converted into cryptocurrency;
Gift cards or prepaid credits were used;
The recipient account was opened using stolen identification;
The scam operation is located abroad;
The victim waited days or weeks before reporting;
The evidence or conversation was deleted.

An authorized transfer can still be fraudulent when the victim approved it because of deception. However, it is legally and operationally different from an unauthorized transaction caused by account hacking. A bank complaint does not automatically require the institution to reimburse every transfer the customer personally confirmed.

AFASA may impose duties relating to disputed funds and financial-account security, and liability may arise in defined circumstances when an institution fails to perform its legal obligations. Whether reimbursement is due depends on the facts, the institution’s conduct, the movement of funds, and the evidence presented. (Bureau of Small and Medium Enterprises)

Special Situations

You were asked to receive and forward money

Stop immediately. Do not transfer, withdraw, convert, or return the money based only on the supposed employer’s instructions.

Contact your bank or e-wallet provider and explain:

Who instructed you;
Why you believed it was legitimate work;
How much was received;
Whether any amount was forwarded;
Which accounts received the outgoing transfers;
What commission, if any, you retained.

Preserve all messages proving how you were recruited. Your account may have been used as a money mule, and concealing the activity can worsen your position.

You sent cryptocurrency

Contact the exchange or wallet service through its official support system. Provide:

Transaction hash
Sending and receiving wallet addresses
Date and time
Amount and cryptocurrency
Screenshots of the scam
Police, CICC, PNP, or NBI complaint reference

Blockchain transfers generally cannot be reversed like ordinary account entries. However, transaction records can sometimes be traced, particularly when funds reach a regulated exchange that has customer-identification records.

The scammer has your ID or selfie

Report the compromise to institutions where the information could be used to open accounts or bypass verification.

Watch for:

Unexpected one-time passwords
New-loan notifications
Changes to mobile or email details
Unrecognized financial accounts
SIM replacement
Messages from strangers claiming you received money
Accounts using your photograph or name

Preserve evidence of the documents you sent and the circumstances in which they were requested. Identity theft through a computer system is punishable under RA 10175. (Supreme Court E-Library)

You are a Filipino or foreign victim outside the Philippines

You may begin reporting through the financial institution, CICC, NBI online channels, or the relevant Philippine embassy or consulate.

Investigators or prosecutors may later require:

A sworn complaint-affidavit
Proper proof of identity
Original or authenticated records
An affidavit notarized abroad
Apostille or consular authentication, depending on the country and intended use
Coordination with local police in the country where you reside

Ask the receiving Philippine office about the form of authentication it requires before mailing original documents. Cross-border investigations often take longer because authorities may need foreign subscriber information, platform records, or mutual legal assistance.

The supposed job was overseas

Check whether the recruiter and job order appear in the DMW databases. Report suspected illegal recruitment to the DMW and preserve:

The recruiter’s name and address
Agency name
Social media pages
Job advertisement
Contract or offer letter
Receipts
Proof of payment
Medical, training, or processing instructions
Messages promising deployment or a visa

The DMW’s 1348 hotline may be used for migrant-worker concerns and agency verification. (Department of Migrant Workers)

Someone offers to recover your money for a fee

Be cautious of a recovery scam. The person may claim to be:

A lawyer
A hacker
A bank investigator
A government officer
A cryptocurrency recovery specialist
Another victim who knows an insider

Scammers sometimes contact victims using details taken from the original scam group. They promise guaranteed recovery but demand an advance fee, wallet activation payment, tax, or “court bond.”

Verify professionals and agencies independently. Do not send money to an account merely because the person knows details about your loss.

Common Mistakes That Can Weaken the Case

Continuing to pay after recognizing the deception
Waiting for the scammer’s promised withdrawal date before reporting
Deleting messages out of embarrassment
Saving only cropped screenshots
Losing access to the original phone or messaging account
Failing to record transaction-reference numbers
Reporting only to the social media platform and not to the bank or authorities
Sending evidence to unofficial accounts pretending to be investigators
Publicly accusing an account holder without confirming that person’s role
Threatening, harassing, or attempting to entrap suspects personally
Paying an unverified “recovery agent”
Allowing the scammer to remotely access the phone
Making a false or exaggerated police or bank report
Expecting a barangay settlement to freeze funds

Do not delay urgent financial and cybercrime reporting while attempting barangay mediation. Barangay conciliation may apply to certain disputes between residents of the same city or municipality, but many online scam cases involve unidentified offenders, different localities, serious criminal allegations, or cross-border activity. The bank, PNP, NBI, CICC, or prosecutor can determine the proper procedural route.

Typical Fees and Timelines

Step	Typical official fee	Practical timing
Bank or e-wallet fraud report	Usually none	Report immediately; acknowledgment may be same day
AFASA initial temporary hold	No separate victim filing fee	Initial period may be up to five calendar days
Possible extension of temporary hold	None	Total statutory hold generally not more than 30 calendar days without a court order
CICC report	None	Initial report can be submitted promptly; further handling varies
PNP or NBI complaint intake	None	Intake may occur the same day; investigation may take weeks or months
Notarization of private affidavit	Varies	Often completed on the same day
Prosecutor’s preliminary investigation	No filing fee for the criminal complaint itself	Commonly several weeks to months, depending on subpoenas, evidence, and workload
Cross-border tracing	Varies by process	Often substantially longer

These periods are not promises of completion. Delays commonly result from incomplete account details, multiple transfers, unidentified respondents, requests for platform data, overloaded investigators, service of subpoenas, or the need for court orders.

Frequently Asked Questions

Can I recover money sent through GCash, Maya, or online banking?

Recovery is possible but not assured. Report immediately to the sending provider and give complete transaction details. Ask it to coordinate with the receiving institution and consider the temporary-hold procedure under RA 12010. The chance of recovery drops sharply after the money has been withdrawn or moved.

Should I report to the bank first or the police?

Do both. Contact the bank or e-wallet first when every minute matters, then file with the CICC, PNP Anti-Cybercrime Group, or NBI. A police or sworn report may also be needed to support the financial institution’s investigation.

Is it still a scam if I personally approved the transfer?

Yes. A transfer may be authorized by the account holder but induced through fraud. This is common in social-engineering and online task scams. Personal confirmation of the transfer does not make the scammer’s deception lawful, although it may affect the bank’s refund analysis.

Can I file a case when I know only the bank account or phone number?

Yes. Submit all identifiers you have. Investigators can seek subscriber and account records through lawful processes. Identification may take time, and the registered account holder may not be the person who directly communicated with you.

Should I confront the person whose name appears on the receiving account?

Usually not. Preserve the name and report it. The account may belong to a mule, a recruited participant, or an identity-theft victim. Confrontation can alert offenders, cause evidence to disappear, or expose you to threats.

Is a screenshot enough to prove the scam?

A screenshot is useful but stronger when supported by the original device, complete conversation, transaction records, testimony, account identifiers, and an explanation of how it was created and preserved. Keep unedited originals.

Can I report even if the amount is small?

Yes. Small initial payments may be part of a larger organized scheme. Your report can help connect the same accounts, numbers, websites, or recruiters to other victims.

What if I borrowed the money that was lost?

You remain responsible to the lender unless the loan is separately invalid or the lender agrees to new terms. Inform legitimate creditors early, request a written restructuring when needed, and do not take another high-interest loan to satisfy the scammers.

Can the scammers be charged with both estafa and cybercrime?

Depending on the facts, estafa under Article 315 may be prosecuted in relation to Section 6 of RA 10175 when information and communications technology was used. Other charges, including computer-related fraud, identity theft, illegal recruitment, or AFASA violations, may also be considered.

Do I need a lawyer to make the first report?

No. You can personally report to your financial institution, CICC, PNP, NBI, DMW, or prosecutor. A clear timeline, complete evidence, and an accurate sworn statement are important whether or not counsel assists you.

Key Takeaways

Stop sending money immediately, regardless of promises that one final payment will unlock your earnings.
Contact your bank or e-wallet at once and ask for coordinated tracing and any available AFASA temporary hold.
Preserve complete, unedited digital evidence before blocking or reporting the scam accounts.
Report to the CICC, PNP Anti-Cybercrime Group, or NBI; report overseas recruitment schemes to the DMW.
Prepare a chronological transaction table and a detailed complaint-affidavit linking each payment to the scammer’s false promise.
Do not receive or forward funds for the supposed employer; this may involve money-mule activity.
Do not pay anyone who guarantees recovery in exchange for an advance fee.
Recovery is most likely when the report is made before the funds are withdrawn or transferred through additional accounts.