Being scammed can leave you embarrassed, angry, and unsure where to begin. The most important thing is to act quickly: contact the bank or e-wallet that sent the money, secure your accounts, preserve the evidence, and report the incident to the proper authorities. Even when the transfer appears completed, prompt reporting may help trace the funds, temporarily hold money still in the financial system, identify the account holder, and build a criminal or civil case.

What to Do Immediately After Discovering the Scam

1. Contact the bank or e-wallet that sent the money

Use the institution’s official 24-hour fraud-reporting channel, not a phone number or link supplied by the scammer.

Tell the bank or e-wallet that:

You are reporting a fraudulent or unauthorized transaction.
The transaction is disputed.
You want the recipient account traced and any remaining funds temporarily held.
Your account, device, card, password, PIN, or one-time password may have been compromised.
You need a written case or reference number.

Provide the transaction date, amount, reference number, recipient account details, and a concise explanation of how the scam happened.

Under the Anti-Financial Account Scamming Act or RA 12010 of 2024, banks and other financial institutions may temporarily hold funds involved in a disputed transaction while they conduct coordinated verification. BSP Circular No. 1215 allows an initial hold of up to five calendar days, subject to extension, with the total temporary hold generally limited to 30 calendar days unless a court authorizes a longer period. A hold is not an automatic refund: the money must still be available, traceable, and covered by the institution’s investigation. (Lawphil)

Report the transaction even if you voluntarily pressed “send.” A scam-induced transfer may still be disputed because consent was obtained through deception. However, recovery becomes much harder once the funds have been withdrawn, converted into cryptocurrency, transferred through several accounts, or sent abroad.

2. Secure every account that may have been compromised

Immediately change the passwords for your:

Bank and e-wallet accounts
Primary email account
Social media and messaging accounts
Online shopping accounts
Cloud storage
Mobile network account, especially if your SIM may have been taken over

Use a clean, trusted device where possible. Log out other devices, remove unfamiliar devices and applications, turn on multi-factor authentication, and ask your mobile provider to block or replace a compromised SIM.

Never give anyone another OTP, PIN, password, recovery code, screen-sharing access, or remote-control access. Legitimate banks and government investigators do not need your OTP to “reverse” a transaction.

3. Preserve the evidence before accounts or messages disappear

Do not delete the conversation, block the scammer immediately, reset your phone, or rely only on a few cropped screenshots. First preserve:

The complete chat from the first contact to the last message
The scammer’s username, account name, profile link, phone number, and email address
Advertisements, marketplace listings, websites, and product pages
Transaction receipts and reference numbers
The receiving account name, account number, QR code, or wallet identifier
Voice messages, call logs, emails, and email headers
Contracts, invoices, order confirmations, identification documents, and delivery records
Messages demanding additional “tax,” “release,” “verification,” or “recovery” fees
Your communications with the bank, platform, courier, and authorities

Take full, sequential screenshots showing timestamps and context. Export chats where the application permits it. Save the original files and make backup copies without editing them.

Electronic documents and messages can be used as evidence, but the person presenting them may need to establish their authenticity and integrity. The original device, complete conversation, metadata, transaction records, and testimony of someone who personally received the messages are generally stronger than isolated screenshots. The governing rules include the Rules on Electronic Evidence and the Electronic Commerce Act, RA 8792 of 2000. (Lawphil)

4. Report the seller or account to the platform

Report the profile, advertisement, listing, website, or message thread to the relevant marketplace, social network, messaging application, or cryptocurrency platform.

Ask the platform to:

Preserve account and transaction records
Disable the fraudulent account
Prevent deletion of the conversation
Provide a complaint reference number
Cooperate with Philippine law enforcement upon receipt of lawful process

Platforms normally will not give you another user’s private records directly. Investigators may need a subpoena, court order, or other lawful request to obtain registration information, login records, IP addresses, and linked payment details.

5. File a report with law enforcement

For an online scam, you may report to:

The NBI Cybercrime Division or an NBI Regional Cybercrime Center
The Philippine National Police Anti-Cybercrime Group
A local police station, which may record the incident and refer it to the appropriate cybercrime or investigation unit

The NBI’s published procedure requires a complainant to complete a complaint form and evaluation form and submit the available supporting evidence. The official NBI procedure for victims of computer crimes explains where cybercrime complaints are evaluated. (National Bureau of Investigation)

A police blotter is useful because it creates an official record, but it does not by itself freeze the recipient account, start a full criminal prosecution, or order repayment. Continue with the bank complaint and, when appropriate, a formal complaint-affidavit.

6. Do not send more money

Scammers often claim that the victim must pay one last amount for:

Tax
Insurance
Customs clearance
Anti-money-laundering verification
Account activation
Withdrawal approval
Lawyer’s fees
Recovery services
A supposed government certificate

This is commonly a continuation of the original scam. Victims are also targeted by “recovery agents” who claim they can retrieve the money for an advance fee. Verify any person claiming to represent a bank, government agency, law office, or investigation unit through independently obtained official contact details.

Is the Conduct Legally Considered Estafa?

The principal Philippine criminal law on fraud is Article 315 of the Revised Penal Code, commonly called estafa or swindling.

Depending on the facts, estafa may involve:

Obtaining money through a false name, false qualifications, fictitious business, imaginary transaction, or other fraudulent representation
Selling or offering something while falsely claiming ownership, authority, capacity, or ability to deliver
Misappropriating or converting money or property received in trust, on commission, for administration, or with an obligation to return or deliver it
Issuing certain unfunded checks under circumstances covered by Article 315
Using other fraudulent acts that cause measurable loss

For estafa through false pretenses, the prosecution generally must show that the false representation was made before or at the time the victim parted with the money, that the victim relied on it, and that the deception caused damage. A broken promise, unpaid loan, delayed refund, or failed business transaction is not automatically estafa. The evidence must indicate fraudulent intent or deceit, not merely later inability or refusal to perform. (Lawphil)

This distinction matters in common situations:

Situation	Possible legal character
A fake seller collects payment for an item that never existed	Possible estafa through false pretenses
A person invents an investment, license, position, or government connection	Possible estafa and violations of special laws
An agent receives money for a specific purpose and diverts it for personal use	Possible estafa by misappropriation
A real merchant delivers late because of operational problems	Usually a contractual or consumer dispute unless deceit is proven
A borrower later becomes unable to repay an ordinary loan	Generally a civil debt, not automatically estafa
A person uses stolen banking credentials or manipulates account data	Possible cybercrime, access-device, and financial-account offenses

Philippine Laws That May Apply to Scams

Several laws can apply to the same incident:

Law	When it may apply
Article 315, Revised Penal Code	Deceit, false pretenses, misappropriation, fraudulent transactions, and other forms of estafa
RA 10175, Cybercrime Prevention Act of 2012	When a Revised Penal Code or special-law offense is committed through information and communications technology; it also covers the narrower offense of computer-related fraud involving unauthorized data or system interference
RA 12010, Anti-Financial Account Scamming Act of 2024	Money-mule accounts, social-engineering schemes, trafficking or misuse of financial accounts, disputed-fund holds, and related financial-account offenses
RA 8484, as amended by RA 11449	Fraudulent use, possession, trafficking, or misuse of credit cards and other access devices
RA 11967, Internet Transactions Act of 2023	Consumer protection and responsibilities involving online merchants, e-marketplaces, digital platforms, and online transactions
Civil Code Articles 19 to 22	Recovery of money or damages for unlawful, bad-faith, abusive, or unjustly enriching conduct

An online scam is often prosecuted as Article 315 estafa in relation to Section 6 of the Cybercrime Prevention Act. Not every scam is technically “computer-related fraud” under the narrower provision of RA 10175; that offense generally concerns unauthorized manipulation or interference involving computer data or systems. (Lawphil)

RA 12010 also targets money mules—people who knowingly use, lend, rent, sell, or allow the use of financial accounts to receive or move proceeds connected with scams or social engineering. The named holder of the recipient account may therefore be an accomplice, a paid mule, or sometimes another identity-theft victim. An account name alone should not be treated as conclusive proof of who designed the scam. (Lawphil)

How to Report the Scam and Seek Recovery

1. Complete the bank or e-wallet complaint process

Send a written complaint after the initial phone or application report. Include:

Your full name and contact details
The affected account
Transaction date, time, amount, and reference number
Recipient account details
A chronological explanation of the deception
Screenshots and supporting documents
The date and reference number of your first fraud report
The result you are requesting, such as tracing, holding, investigating, and returning available funds

Keep proof that the institution received the complaint.

If the financial institution does not resolve the matter satisfactorily, first complete or substantially engage its internal Financial Consumer Protection Assistance Mechanism. You may then escalate the complaint to the Bangko Sentral ng Pilipinas through the channels listed on the BSP Consumer Assistance page, including the BSP Online Buddy or the prescribed complaint form.

The BSP generally requires proof of your prior complaint to the institution, its response if any, a summary of the dispute, supporting documents, and the resolution you seek. BSP’s published process indicates that a consumer specialist may evaluate, respond to, or refer a properly submitted complaint within seven banking days; this is not a guaranteed seven-day refund or final resolution. (Bangko Sentral ng Pilipinas)

2. Prepare a formal complaint-affidavit

A complaint-affidavit is a sworn written account describing the offense, the people involved, the evidence, and the harm suffered.

A useful complaint-affidavit normally contains:

Your identifying information
The respondent’s known name and address
A chronological statement of events
The specific representations that induced you to pay
How those representations were false
The amount lost
The recipient account and transaction references
How you identified or connected the respondent to the scheme
A numbered list of attached exhibits
The names and affidavits of witnesses, where available

Label the attachments clearly, such as “Annex A—Marketplace Listing,” “Annex B—Complete Chat,” and “Annex C—Bank Transfer Receipt.”

Under Rule 112 of the Rules of Criminal Procedure, the complaint should be supported by affidavits and documents, with enough copies for the respondents plus additional copies for the investigating office. Affidavits must be properly sworn before a prosecutor, authorized government officer, or notary public. The prosecutor conducts a preliminary investigation, meaning an evaluation of whether probable cause exists to bring the respondent to court. (Lawphil)

The rules prescribe relatively short periods for issuing subpoenas, submitting counter-affidavits, and resolving the investigation. In practice, completion may take weeks or months because of difficulty locating the respondent, failed service of subpoenas, incomplete records, requests for additional evidence, office workload, or reassignment of the investigating prosecutor.

3. Use DTI remedies for genuine online consumer transactions

A complaint to the Department of Trade and Industry is useful when the dispute involves an identifiable merchant, online seller, marketplace, defective product, non-delivery, misleading advertisement, or refusal to provide a legally required remedy.

Complaints may be initiated through DTI Consumer CARe. DTI may first facilitate mediation. If the dispute is not settled and falls within its authority, formal adjudication may require a verified complaint, supporting documents, sworn statements, the relief requested, and a certification against forum shopping. (DTI Consumer Care)

The Internet Transactions Act of 2023 provides additional rules for online merchants and e-marketplaces. However, DTI mediation is not a substitute for criminal investigation where the “seller” used a fake identity, disappeared immediately, or operated an entirely fictitious business. (Lawphil)

4. Report investment scams to the SEC

Report suspected Ponzi schemes, unlicensed investment solicitations, fake trading operations, or schemes promising unusually high or guaranteed returns to the Securities and Exchange Commission through the official SEC iMessage portal.

Submit the promoter’s name, company name, social media pages, investment presentation, contracts, payment instructions, proof of remittance, and communications concerning returns or recruitment.

An SEC report can support regulatory investigation, but you should separately notify the bank and law enforcement because regulatory action does not automatically return the money.

5. Consider a civil case or small claims case

A victim may seek restitution, reimbursement, or damages under contractual principles and Civil Code Articles 19 to 22, including the prohibition against unjust enrichment. A civil remedy can exist even when the available evidence is insufficient for a criminal conviction. (Lawphil)

A small claims case may be practical when:

The claim is purely for payment or reimbursement.
The total claim does not exceed ₱1,000,000, excluding interest and costs.
You know the defendant’s real identity and a usable address where summons can be served.
You have transaction records, contracts, messages, receipts, and other supporting evidence.

Under the Supreme Court’s Rules on Expedited Procedures in the First Level Courts, parties generally appear personally and lawyers do not represent them at the hearing unless the lawyer is personally a party. A properly authorized representative may appear in qualifying circumstances. The decision is intended to be issued within 24 hours after the hearing and is final, executory, and unappealable. (Supreme Court of the Philippines)

The rules aim to schedule the hearing within 30 calendar days from filing, or within 60 calendar days when the defendant resides outside the judicial region. Actual completion may take longer if summons cannot be served or the defendant’s address is false.

Before filing a civil case, check whether barangay conciliation is required. Disputes between individuals who actually reside in the same city or municipality generally must first pass through the Katarungang Pambarangay process unless an exception applies. If the parties live in different cities or municipalities, the dispute is ordinarily outside the Lupon’s authority, subject to limited exceptions involving adjoining barangays. (Supreme Court E-Library)

Small claims is difficult when the scammer is anonymous. The court cannot effectively proceed against a social media nickname, fake profile, or unknown “account holder” without a legally identifiable defendant and an address for service.

Evidence and Documents to Prepare

Category	Documents and information
Identity	Government-issued ID, contact details, proof of address
Transaction	Official receipt, bank statement, reference number, recipient account, QR code, amount, date, and time
Communications	Complete chats, emails, text messages, voice messages, and call logs
Online presence	Profile URL, username, advertisement, website, listing, group name, and screenshots
Representations	Claims about the product, investment, identity, authority, expected return, delivery, or refund
Loss	Amount paid, additional charges, replacement costs, and other documented damage
Reporting	Bank reference number, platform report, police blotter, NBI or PNP acknowledgment, DTI or SEC ticket
Witnesses	Names, contact details, and sworn statements of people who saw or participated in relevant events
Chronology	A one- or two-page timeline showing what happened, in date order

Bring both printed copies and securely stored electronic copies. Do not surrender your only phone or original document without obtaining a receipt or confirming how and when it will be returned.

Common Mistakes That Can Harm a Scam Case

Waiting several days before reporting

Funds can move through multiple accounts in minutes. Report first and organize the remaining paperwork immediately afterward.

Paying a second or third “release fee”

Additional payment rarely unlocks the original funds. It normally increases the loss.

Editing or selectively cropping screenshots

Edited images may create authentication problems or remove important context. Preserve the complete original.

Publicly accusing or doxxing someone

Posting names, addresses, identification documents, or unverified accusations can create defamation, harassment, or privacy issues and may alert suspects before records are preserved. Send the evidence to the bank, platform, and authorities.

Assuming the recipient account holder is necessarily the mastermind

The account may belong to a money mule or identity-theft victim. Investigators should trace account opening records, device data, withdrawals, transfers, and communications before responsibility is assigned.

Believing a police blotter guarantees reimbursement

A blotter documents the report. Recovery usually requires separate action by the financial institution, investigators, prosecutors, or courts.

Signing an informal settlement without documenting payment

A settlement should clearly identify the parties, amount, payment schedule, consequences of default, and effect on pending complaints. Do not state that the loss has been fully paid unless you have actually received cleared funds.

What If You Shared Your OTP?

Sharing an OTP can make recovery more difficult because the bank may initially treat the transaction as customer-authorized. It does not automatically end every claim.

Relevant questions include:

Was the OTP obtained through social engineering?
Did the institution’s warning clearly identify the transaction being authorized?
Was the login or transfer inconsistent with your normal activity?
Did the institution promptly act after receiving your fraud report?
Were required fraud-detection and account-protection controls used?
Does the evidence show that another person took control of your account?

RA 12010 recognizes social engineering and requires financial institutions to maintain appropriate risk controls. It also provides possible restitution where an institution fails to employ required safeguards or the legally required degree of diligence. Liability remains fact-specific, and maliciously filing a false fraud report is itself punishable. (Lawphil)

What Victims Abroad and Foreigners Should Know

A Filipino working abroad or a foreign victim may report a scam involving a Philippine account, offender, device, or harmful effect in the Philippines. RA 12010 provides cross-border coverage where a relevant element, financial account, computer system, infrastructure, or resulting damage is connected with the Philippines. (Lawphil)

For documents signed abroad:

A complaint-affidavit or special power of attorney may be signed before a Philippine embassy or consulate.
In an Apostille Convention country, a locally notarized document may generally be apostilled for use in the Philippines.
Documents from a non-Apostille country may require authentication or legalization through the appropriate diplomatic process.
A special power of attorney should specifically state whether the representative may submit complaints, receive notices, settle, obtain records, and perform court-related acts.

The DFA and Philippine foreign-service posts publish guidance on apostilles, consular notarization, and documents executed abroad. (Philippine Embassy)

A representative can handle many administrative steps, but investigators, prosecutors, or courts may still require the victim’s sworn statement, personal participation, or testimony.

Frequently Asked Questions

Can I still get my money back after sending it to a scammer?

Possibly, especially if you report immediately and the funds remain in the recipient account or can be traced to another participating institution. Recovery is not guaranteed once the money has been withdrawn, converted, or moved through several accounts.

Where should I report an online scam in the Philippines?

Report first to the sending bank or e-wallet. Then report to the platform and to the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or local police. Use DTI for identifiable online merchants and SEC for investment-related schemes.

How quickly should I report the scam?

Immediately. Do not wait to collect perfect evidence before notifying the financial institution. Make the urgent fraud report first, obtain a reference number, and submit the complete documents afterward.

Is a police blotter enough to file an estafa case?

No. A blotter is an official incident record, but a formal case normally requires a complaint-affidavit and supporting evidence for evaluation by investigators and prosecutors.

Can I file a complaint when the scammer used a fake name?

Yes. Report all available identifiers, including account numbers, wallet details, usernames, phone numbers, email addresses, profile links, and transaction references. Investigators may seek subscriber, account-opening, device, or platform records through lawful process.

Is failure to deliver an item automatically estafa?

No. It may be a consumer or contractual dispute if the seller genuinely intended to perform but later failed. Estafa generally requires proof that the seller used deceit before or when obtaining the payment, or later misappropriated property received under a legally recognized obligation.

Can I use small claims to recover money from a scammer?

Yes, when the claim is for money not exceeding ₱1,000,000 and you know the defendant’s real identity and service address. It is usually impractical against an anonymous profile until the person is identified.

Does sharing an OTP mean the bank has no responsibility?

Not automatically. It weakens the claim, but the full circumstances still matter, including how the OTP was obtained, what the warning disclosed, the institution’s controls, transaction patterns, and how promptly the fraud was reported.

Can an OFW or foreigner file a complaint without returning to the Philippines?

Many initial steps can be completed through electronic submissions, a Philippine embassy or consulate, apostilled documents, and a properly drafted special power of attorney. Personal testimony or appearance may still be required later.

Should I confront the scammer after reporting the transaction?

Avoid threats, public accusations, or revealing investigative steps. Preserve the communications and follow the instructions of the financial institution or investigator. Continued controlled communication may sometimes produce useful evidence, but do not send more money or expose additional personal information.

Key Takeaways

Report the transaction to the sending bank or e-wallet immediately and request tracing and a disputed-fund hold.
Secure your banking, email, social media, device, and SIM accounts.
Preserve complete original messages, transaction records, profile details, and metadata.
File with the NBI, PNP, or local police; a blotter alone is not a complete criminal complaint.
Use BSP escalation for unresolved financial-institution complaints, DTI for genuine consumer transactions, and SEC for investment schemes.
Estafa requires evidence of deceit or misappropriation; an unpaid debt or broken promise is not automatically a crime.
Small claims may help recover up to ₱1,000,000 when the defendant’s real identity and address are known.
Never pay additional “release,” “tax,” or “recovery” fees to the scammer or an unverified recovery agent.