Being scammed can leave you feeling embarrassed, angry, and unsure where to begin. Do not let embarrassment delay you. In many cases, the first few hours matter because your bank or e-wallet may still be able to trace, restrict, or temporarily hold the transferred funds. Your immediate priorities are to stop further losses, preserve evidence, report the transaction through the correct channels, and prepare a clear complaint that investigators and prosecutors can act on.

What to Do Immediately After Discovering the Scam

1. Contact your bank or e-wallet at once

Use the institution’s official fraud hotline, in-app help center, branch, or verified customer-service channel. Do not rely on a phone number or link sent by the suspected scammer.

Tell the institution that:

You are reporting a fraudulent or scam-related transaction.
You want the transaction investigated immediately.
You are requesting a temporary hold or restriction under the Anti-Financial Account Scamming Act, when applicable.
You need the transaction reference number and complete receiving-account details that the institution is allowed to provide.
You want a written acknowledgment and case reference number.

Under Republic Act No. 12010, or the Anti-Financial Account Scamming Act of 2024, financial institutions may temporarily hold funds that are reasonably suspected to be connected with money muling, social engineering, or other unlawful activity. The implementing rules generally allow an initial hold of up to five calendar days and an additional hold of up to 25 calendar days when supporting documents justify an extension. A court may authorize a longer hold. (Lawphil)

Read the official Anti-Financial Account Scamming Act and the BSP’s AFASA rules and procedures.

A hold is not automatic. It may fail when:

The money has already been withdrawn.
The funds were transferred through several accounts.
The recipient used cryptocurrency, cash pickup, or an overseas account.
The report was made too late.
The institution does not have enough information to identify the transaction.

Even if the money is already gone, make the report. The transaction records may help identify the recipient, connect related accounts, or support a criminal complaint.

2. Secure every account that may have been compromised

If you disclosed a password, one-time password, personal identification number, card number, account recovery code, or identification document:

Change your passwords using a trusted device.
Log out all active sessions.
Replace compromised cards or SIM cards.
Enable two-factor authentication.
Check whether the scammer changed your recovery email or mobile number.
Review recent transactions, device logins, linked accounts, and loan applications.
Notify your contacts if the scammer may be impersonating you.

Do not give an OTP, PIN, password, or recovery code to someone claiming to be investigating the scam. Banks, police officers, and legitimate government personnel do not need your password to receive a complaint.

3. Preserve the evidence before blocking anyone

Do not immediately delete the conversation or close the fake account. Save the evidence first.

Keep copies of:

Complete chat conversations, including earlier messages.
Screenshots showing dates, times, usernames, URLs, and phone numbers.
Payment receipts and transaction confirmations.
Bank or e-wallet statements.
Emails, text messages, voice messages, and call logs.
Advertisements, product listings, investment presentations, contracts, and invoices.
The scammer’s profile pages and account links.
Delivery details, tracking numbers, and addresses.
Copies of identification documents or business permits sent to you.
Recordings that you lawfully possess.
Messages showing demands for additional payments.
Your reports to the platform, bank, or e-wallet.

Keep the original electronic files whenever possible. Do not rely only on cropped screenshots. Export the conversation, save the webpage as a PDF, and retain the phone or computer containing the original messages. Philippine courts recognize electronic documents and electronic communications when their authenticity and reliability can be properly established. (Lawphil)

The official Rules on Electronic Evidence explain how electronic records may be presented in court.

Is the Incident Legally Considered a Scam or Estafa?

The word “scam” is commonly used for many dishonest transactions, but the usual criminal charge is estafa, or swindling, under Article 315 of the Revised Penal Code.

For estafa through false pretenses, the prosecution generally must establish that:

The accused made a false representation about identity, authority, qualifications, property, credit, business, an imaginary transaction, or a similar matter.
The false representation was made before or at the time the victim gave the money or property.
The victim relied on the deception.
The victim suffered financial damage.

The Supreme Court has repeatedly explained that the deception must ordinarily exist before or at the time the victim parts with money. A person’s carelessness or gullibility does not excuse the person who deliberately used fraud. ([Lawphil][3])

A failed transaction is not automatically estafa

A seller’s failure to deliver, a borrower’s failure to pay, or a business’s refusal to refund can be a civil breach rather than a crime. The key question is whether the other party already intended to deceive you when the payment was obtained.

Indicators of possible criminal fraud include:

The seller used a fake identity or stolen photographs.
The product never existed.
The same item was sold to several victims.
The supposed office, license, investment, or business was fabricated.
Fake receipts or tracking numbers were sent.
The recipient immediately blocked you after payment.
The scammer instructed you to send funds to unrelated personal accounts.
The promised return was impossible or based on false claims.
The person continued collecting money after knowing the promise could not be fulfilled.

By contrast, delayed delivery caused by a genuine supply problem, a documented business failure, or a good-faith disagreement over contract terms may be primarily a civil or consumer matter. Investigators and prosecutors examine the entire course of conduct, not merely the fact that money was not returned.

Online estafa may carry a higher penalty

Section 6 of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, covers crimes under the Revised Penal Code and special laws when committed through information and communications technology. The law generally imposes a penalty one degree higher when the underlying crime is committed using a computer system. ([Lawphil][4])

See the official Cybercrime Prevention Act.

Other laws may also apply:

RA 12010: Social engineering, money muling, and financial-account scamming.
RA 8484: Fraudulent use of credit cards, account numbers, access codes, and other access devices.
RA 11967: Duties of online merchants and digital platforms in covered business-to-consumer transactions.
RA 8792: Certain offenses involving electronic commerce and unauthorized access.
RA 10173: Unlawful processing or misuse of personal data in appropriate cases.
RA 9160, as amended: Money laundering involving proceeds of unlawful activity.

The Access Devices Regulation Act also makes certain forms of unauthorized access-device use, account-information trafficking, and fraudulent card activity punishable. ([Lawphil][5])

Step-by-Step Guide to Reporting a Scam in the Philippines

Step 1: Prepare a one-page incident chronology

Before going to the police or prosecutor, write a clear timeline containing:

Date and time of first contact.
Name, username, phone number, and email used by the scammer.
Exact representations made.
Why you believed those representations.
Dates and amounts of every payment.
Account names, account numbers, wallet numbers, and transaction references.
Date you discovered the deception.
Refund demands and the scammer’s response.
Reports already made to banks, platforms, or government agencies.

A chronological statement is much easier to investigate than a folder containing hundreds of unexplained screenshots.

Step 2: Submit supporting documents to your financial institution

If the bank or e-wallet places an initial hold, submit supporting documents before the initial five-day period expires. Depending on the institution, these may include:

A sworn complaint or affidavit.
Police report or incident report.
Government-issued identification.
Transaction receipt.
Screenshots and chat records.
Proof of account ownership.
Written chronology.
Other documents requested by the fraud team.

The BSP rules allow a further hold of up to 25 calendar days when the source account owner provides sufficient supporting documents. Coordinated verification among institutions should generally be completed within the total 30-day hold period unless a court grants an extension. If no funds were held, verification may take longer and may be extended to 60 days for meritorious reasons. ([Bureau of Small and Medium Enterprises][6])

Ask for confirmation that your documents were received. Record the name of the officer, submission date, ticket number, and promised response date.

Step 3: Report the crime to the PNP, NBI, or CICC

For an online scam, you may report to:

The nearest Philippine National Police station.
The PNP Anti-Cybercrime Group.
The National Bureau of Investigation Cybercrime Division.
The Cybercrime Investigation and Coordinating Center.

The CICC’s 1326 hotline operates as a central reporting channel for cybercrime complaints, including phishing, online shopping scams, romance scams, and fraudulent investment schemes. ([Philippine Information Agency][7])

The NBI’s published procedure for computer-crime victims includes an initial interview, completion of a sworn complaint sheet, preparation of sworn statements, examination of available devices when needed, and submission of supporting evidence. Its published intake process is relatively short, but the actual investigation, preservation requests, identification of account holders, and case build-up can take substantially longer. ([National Bureau of Investigation][8])

Useful official channels include:

Bring printed and digital copies of your evidence. Ask for your complaint reference number, police blotter entry, or certification showing that the report was received.

Step 4: File a complaint with the Office of the Prosecutor

A police or NBI investigation does not always mean that a criminal case has already been filed in court. A formal criminal complaint is ordinarily evaluated by the Office of the City Prosecutor or Office of the Provincial Prosecutor with proper jurisdiction.

A prosecutor’s complaint package commonly includes:

An Investigation Data Form.
A notarized or sworn complaint-affidavit.
Sworn statements of witnesses.
Copies of receipts, transaction records, and communications.
Certification or police and NBI reports, when available.
Properly marked annexes.
Copies for the respondent and the prosecution office.
Filing fees, if applicable under the current schedule.

The Department of Justice provides an official checklist for filing a complaint for preliminary investigation. ([Department of Justice][9])

The complaint-affidavit should explain the facts in your own words. It should identify the specific false statements, when they were made, why you relied on them, how much you paid, where the money went, and how the deception caused your loss.

Under the DOJ-National Prosecution Service rules adopted in 2024 and subsequently upheld by the Supreme Court, prosecutors assess whether the evidence sufficiently establishes each element of the alleged offense and warrants prosecution. A well-organized affidavit supported by original records is therefore more useful than general accusations that someone is a “scammer.” ([Supreme Court of the Philippines][10])

Step 5: Report the matter to the appropriate regulator

The correct regulator depends on the type of scam.

Type of complaint	Where to report	What the agency can generally address
Unauthorized bank or e-wallet transfer	Bank or e-wallet first, then BSP	Account investigation, financial consumer complaint, compliance with fraud-handling rules
Online seller or registered business	DTI	Consumer mediation or adjudication involving covered merchants
Investment, lending, or financing scheme	SEC	Possible unauthorized solicitation, securities violations, lending or financing complaints
Online fraud or identity-based scam	PNP, NBI, or CICC	Criminal investigation and digital evidence gathering
Fake account or fraudulent advertisement	Social-media platform or marketplace	Account restriction, listing removal, preservation under platform procedures
SIM-based scam	Telecommunications provider and law enforcement	SIM restriction, subscriber-record preservation, investigation
Overseas remittance or money transfer	Remittance provider and relevant regulator	Transaction tracing, recipient information, compliance review

Complaints against banks and e-wallets

A BSP-supervised institution must maintain a Financial Consumer Protection Assistance Mechanism. You must generally complain to the institution first. If its final response is unsatisfactory, or it fails to respond properly, you may elevate the complaint through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the prescribed complaint form. Include proof that you first raised the matter with the institution.

Use the BSP’s Consumer Assistance channels.

A BSP complaint does not replace a criminal complaint against the scammer. Its primary purpose is to review the conduct of the supervised financial institution and facilitate appropriate financial-consumer handling.

Online shopping and merchant complaints

For a covered business-to-consumer online transaction, submit a complaint through the DTI Consumer CARe portal. The Internet Transactions Act applies to covered online business transactions involving the Philippine market, but generally excludes purely consumer-to-consumer transactions. A fake individual seller may therefore require criminal reporting even when the transaction occurred through an online marketplace. ([Lawphil][11])

A DTI complaint can assist with consumer redress against a legitimate or identifiable merchant. It does not by itself prosecute estafa.

Investment and lending scams

Report suspected unauthorized investment solicitation, Ponzi-style schemes, fake trading platforms, and abusive lending or financing activity through the SEC’s iMessage complaint system. The portal includes complaint categories for investment scams. ([Securities and Exchange Commission][12])

A company’s SEC registration does not automatically mean it is authorized to solicit investments from the public. Fraudsters may also use the name, registration documents, or logo of a real company without permission.

Step 6: Consider civil recovery

A criminal case aims to establish criminal responsibility, but the victim may also seek repayment or damages.

Possible civil remedies include:

Demanding the return of money through a formal written demand.
Claiming civil liability in connection with the criminal case.
Filing a separate civil action when legally appropriate.
Using the small claims process for a qualifying, straightforward money claim against an identifiable defendant.

Under the current Rules on Expedited Procedures, small claims cases may cover certain money claims not exceeding ₱1,000,000, exclusive of interest and costs. The claim must fall within the categories allowed by the rules, such as qualifying claims arising from a contract, loan, sale, or similar obligation. A fraud case requiring extensive testimony, punitive damages, or complex factual findings may need an ordinary civil action instead. ([Supreme Court of the Philippines][13])

Review the Supreme Court’s Rules on Expedited Procedures and Small Claims.

Civil recovery is difficult when the scammer is unidentified, insolvent, using a false identity, or located abroad. A favorable judgment does not automatically produce payment if the defendant has no reachable assets.

Documents to Prepare

Document	Why it matters
Government-issued ID	Establishes the complainant’s identity
Incident chronology	Gives investigators a clear sequence of events
Transaction receipts	Proves the amount, date, and destination of payment
Bank or e-wallet statement	Confirms account ownership and transaction details
Full chat export	Shows representations, instructions, and admissions
Screenshots with timestamps	Preserves visible online evidence
Profile and webpage URLs	Helps identify or preserve online accounts
Demand for refund	Shows efforts to recover the money and the respondent’s reaction
Bank complaint acknowledgment	Proves prompt reporting and provides a case reference
Police or NBI report	Supports financial-institution and prosecutor submissions
Witness affidavits	Corroborates conversations, meetings, or payments
Contracts, invoices, or advertisements	Shows what was promised
Device containing original evidence	May be needed for examination or authentication

Number your attachments consistently:

Annex “A” — Payment receipt.
Annex “B” — Bank statement.
Annex “C” series — Chat screenshots.
Annex “D” — Advertisement.
Annex “E” — Refund demand.
Annex “F” — Bank complaint acknowledgment.

Do not alter or annotate the only copy of an original file. Make a separate working copy for highlighting important portions.

What Happens After You Report the Scam?

Bank or e-wallet investigation

The source institution verifies the transaction and coordinates with the receiving institution. If funds are located and the transaction is reasonably found to be connected with unlawful activity, the institutions may process the return of the funds under the AFASA rules. If the transaction is shown to be legitimate, or the holding period expires without sufficient legal basis for continued restriction, the funds must be released. ([Bureau of Small and Medium Enterprises][6])

Financial institutions are not automatically liable for every scam loss. However, AFASA permits restitution when an institution’s failure to exercise the required degree of diligence or maintain adequate fraud controls contributed to the loss. Whether restitution is proper depends on the facts, including the authentication process, fraud alerts, transaction pattern, customer conduct, and the institution’s response after notification. (Lawphil)

Law-enforcement investigation

Investigators may seek:

Subscriber information for phone numbers.
Know-your-customer records for financial accounts.
IP address and platform information.
CCTV footage.
Device examination.
Statements from account holders or intermediaries.
Preservation of platform and telecommunications records.
Links to other complaints involving the same accounts.

The account owner receiving the money is not always the mastermind. Some accounts belong to money mules—people who sell, lend, rent out, or allow others to use their accounts. RA 12010 separately penalizes several forms of money-mule activity, including opening or using accounts under false identities and recruiting others to provide accounts. (Lawphil)

Prosecutor’s evaluation

The respondent may be directed to submit a counter-affidavit. The prosecutor then evaluates the complaint and supporting evidence. Possible outcomes include:

Dismissal for insufficient evidence.
Referral for further investigation.
Filing of an Information in court.
Filing of a different offense supported by the evidence.

A dismissal at the prosecutor level does not necessarily mean the transaction was fair or that no civil obligation exists. Criminal guilt and civil liability involve different legal requirements.

Common Mistakes That Can Hurt a Scam Complaint

Waiting several days before calling the bank

Scam proceeds can move through multiple accounts within minutes. Report immediately, even if your evidence package is incomplete. Additional documents can follow.

Sending more money to “unlock” a refund

A scammer may demand a tax, clearance fee, verification deposit, anti-money laundering fee, or account-upgrade payment. Legitimate refunds do not normally require repeated transfers to personal accounts.

Paying a supposed recovery hacker or investigator

Victims are frequently targeted a second time by people promising guaranteed recovery. They may claim to work for the NBI, PNP, BSP, Interpol, a bank, or a cryptocurrency exchange. Verify identities through the agency’s official directory and never pay into an officer’s personal account.

Deleting messages after becoming angry

Blocking the scammer may be necessary, but preserve the entire conversation first. Messages showing repeated lies, admissions, account instructions, or attempts to obtain more money can be important evidence.

Relying only on a barangay blotter

A barangay blotter records that a report was made. It does not freeze an account, begin a prosecutor’s case, or replace a police, NBI, financial-institution, or regulatory complaint.

Barangay conciliation may be relevant in certain disputes between residents of the same city or municipality, but many online scams involve unknown offenders, parties in different localities, or offenses outside the lupon’s authority. Ask the receiving police station or prosecutor whether barangay proceedings apply to your specific case.

Publicly posting all the suspect’s personal information

Public warnings can expose you to defamation, privacy, or harassment complaints, particularly when identification is uncertain. Give complete information to investigators, banks, regulators, and platform administrators. Avoid publishing identification documents, account numbers, home addresses, or unverified accusations.

Filing a complaint that contains only conclusions

Statements such as “He scammed me” or “She is a fraud” do not explain the offense. Identify the exact lie, when it was made, what evidence proves it was false, why you relied on it, and how much you lost.

Special Considerations for Foreigners and Filipinos Abroad

A foreign national can file a complaint in the Philippines. Philippine citizenship is not required to report a crime or pursue a civil claim.

RA 12010 may apply when, among other jurisdictional connections, the victim was in the Philippines, a relevant financial account was maintained by a Philippine financial institution, an element of the offense occurred in the Philippines, or Philippine information and communications technology infrastructure was used. (Lawphil)

A victim outside the Philippines should:

Report immediately to the Philippine bank, e-wallet, remittance company, or platform.
Preserve proof showing where the transaction originated and where it was received.
Contact the NBI, PNP Anti-Cybercrime Group, CICC, or the appropriate prosecutor’s office.
Ask whether remote submission is accepted.
Confirm whether the complaint-affidavit must be notarized before a Philippine consular officer, notarized locally and apostilled, or authenticated through another process.
Execute a special power of attorney if a Philippine representative must submit documents or take specific procedural steps.
Retain the original identification and transaction documents requested by the receiving office.

Authentication requirements vary depending on the country, document, agency, and intended use. Confirm the exact format with the investigator or prosecution office before paying for notarization, apostille, translation, or consular services.

When the scammer is abroad, Philippine authorities may still investigate Philippine accounts, accomplices, money mules, devices, or victims. However, obtaining foreign platform records, restraining overseas assets, serving legal process, or securing the offender’s return can take considerably longer.

Typical Timelines and Practical Expectations

Stage	Common practical timeframe
Reporting to a bank or e-wallet	Immediately; ideally within minutes or hours
Initial AFASA-related hold	Up to five calendar days
Extended administrative hold	Up to 25 additional calendar days
Total hold without court extension	Generally no more than 30 calendar days
Coordinated verification where no funds were held	Generally 30 days, potentially up to 60 days for meritorious reasons
Police or NBI complaint intake	Often completed in one visit if documents are ready
Evidence gathering and account identification	Weeks or months, depending on institutions and platforms
Prosecutor’s evaluation	Varies by office, complexity, service on respondent, and submissions
Criminal trial or ordinary civil case	Potentially months or years
Small claims case	Usually faster than an ordinary civil action, but service and court congestion still matter

These are procedural expectations, not guaranteed completion dates. Delays commonly arise from incomplete account details, false identities, uncooperative platforms, overseas records, multiple fund transfers, respondent-address problems, and large volumes of cybercrime complaints.

Frequently Asked Questions

Can I still recover my money after being scammed?

Possibly, especially if you report quickly and the money remains in a traceable Philippine bank or e-wallet account. Recovery becomes more difficult after withdrawal, cash conversion, cryptocurrency transfer, or movement through multiple accounts. A hold or investigation does not guarantee reimbursement.

Is the bank or e-wallet required to refund me?

Not automatically. The institution examines whether the transaction was authorized, how authentication occurred, whether fraud controls worked properly, and how quickly the incident was reported. Under AFASA, restitution may be required when an institution’s failure to exercise the legally required diligence contributed to the loss. (Lawphil)

Where should I report a GCash, Maya, or online banking scam?

Report first through the provider’s official fraud or customer-assistance channel. Request a case number and provide the transaction reference. If the provider’s final response is unsatisfactory, escalate to the BSP. Separately report the criminal conduct to the PNP, NBI, or CICC.

Do I need a lawyer to file a scam complaint?

A lawyer is not normally required to make an initial bank, police, NBI, CICC, DTI, SEC, or BSP report. You may also personally file a complaint-affidavit with the prosecutor. Legal assistance can be particularly useful when the amount is substantial, the facts are complex, several offenses may apply, the suspect is abroad, or civil recovery is being pursued.

Can I file a case when I only know the scammer’s username or account number?

Yes, you may report against an unidentified person or an online alias. Give investigators every available identifier, including account numbers, wallet numbers, transaction references, usernames, profile URLs, phone numbers, email addresses, IP-related information, delivery details, and photographs. Identification may later be developed through lawful requests to institutions and platforms.

Is a seller’s refusal to refund automatically estafa?

No. Refusal to refund can be a contractual or consumer dispute. Estafa generally requires proof that the seller used deception before or at the time you paid. Fake identity, nonexistent goods, fabricated tracking records, repeated victimization, and immediate disappearance after payment may support an inference of prior fraudulent intent. ([Lawphil][3])

Should I go to the barangay before filing an online scam complaint?

Usually not when the offender is unknown, lives in another city or municipality, or the alleged offense is outside barangay conciliation. A purely local dispute may be different. Ask the police or prosecutor whether a certificate to file action is required instead of assuming that every scam must begin at the barangay.

What if I voluntarily entered the OTP or approved the transfer?

Report it anyway. Social-engineering scams are specifically covered by RA 12010. Voluntary entry of an OTP does not necessarily mean the transaction was genuinely authorized when the approval was obtained through deception. However, the facts may affect the institution’s liability and the likelihood of reimbursement. (Lawphil)

Can the owner of the receiving account be charged even if someone else planned the scam?

Potentially. Liability depends on knowledge and participation. A person who knowingly sells, rents, lends, opens, or provides an account for fraudulent use may be prosecuted for money muling under RA 12010 even if that person did not personally communicate with the victim. An innocent account holder whose account was taken over presents a different situation and must be investigated accordingly. (Lawphil)

Can I file a complaint from outside the Philippines?

Yes. Begin with the financial institution and relevant Philippine cybercrime agency. Ask the receiving office about electronic submission, affidavit form, authentication, apostille or consular requirements, and whether a Philippine representative needs a special power of attorney.

Key Takeaways

Report the transaction to the bank or e-wallet immediately and request a fraud investigation, temporary hold, written acknowledgment, and reference number.
Preserve complete chats, receipts, account details, URLs, statements, and original electronic files before blocking the scammer.
Submit supporting documents within the initial five-day hold period when an AFASA-related hold is placed.
Report online fraud to the PNP, NBI, or CICC; a platform report or barangay blotter alone is usually insufficient.
File a detailed complaint-affidavit identifying the precise deception, your reliance, the payment, and the resulting loss.
Use the BSP, DTI, or SEC complaint process depending on whether the issue involves a financial institution, online merchant, or investment scheme.
A failed transaction is not automatically estafa; criminal fraud normally requires deception that existed before or when the victim parted with money.
Recovery is most realistic when reporting is immediate, the recipient account is identifiable, and the funds have not yet been withdrawn or transferred.