Being scammed by several people can feel harder to report because each person may have played a different role: one made the sales pitch, another collected the payment, another controlled the group chat, and someone else supplied the bank or e-wallet account. Philippine law allows authorities to investigate them as participants in one coordinated scheme, but a strong case must show what each person did, how the deception caused you to release money, and how the participants were connected. The most urgent priorities are to preserve the evidence, report the transfer to the financial institutions, identify every participant and victim, and file a properly organized criminal complaint.

What to Do Immediately After Discovering the Scam

1. Stop further losses and secure your accounts

Do not send additional money for supposed taxes, withdrawal fees, verification charges, legal processing, account activation, or “fund recovery.” Scammers often demand one final payment after the victim begins asking for a refund.

Immediately:

Change the passwords of affected email, banking, e-wallet, social media, and messaging accounts.
Log out unknown devices and revoke suspicious app permissions.
Contact your mobile provider if your SIM may have been compromised.
Block compromised cards or online banking access.
Warn family members if the scammers obtained your contacts or identification documents.
Do not delete the conversations or reset the device until the evidence has been backed up.

2. Report the transaction to the bank or e-wallet immediately

Contact the fraud or customer-protection department of the institution from which the money was sent. If you know the recipient’s bank or e-wallet, report the beneficiary account there as well.

Provide:

Transaction date and time
Amount
Transaction reference number
Source and recipient account details
Name or alias used by the scammer
A concise explanation of the deception
Screenshots of the payment instructions and conversation

Ask for:

A written complaint or fraud reference number
A recall or recovery request
Preservation of transaction and account records
Temporary holding and coordinated verification under the Anti-Financial Account Scamming Act
Written confirmation of the action taken

Republic Act No. 12010, the Anti-Financial Account Scamming Act of 2024 or AFASA, permits covered financial institutions to temporarily hold funds involved in a disputed transaction for up to 30 calendar days, unless a competent court extends the period. The institutions must simultaneously conduct coordinated verification. A complaint does not guarantee that the money will be frozen or returned, particularly if it has already been withdrawn or moved through several accounts, but immediate reporting materially improves the chance of tracing it. (Lawphil)

The bank or e-wallet’s Financial Consumer Protection Assistance Mechanism is the first level of recourse. If the institution’s response is inadequate, the complaint may be escalated through the BSP Consumer Assistance Mechanism. The BSP generally requires proof that the complaint was first raised with the financial institution.

3. Preserve the original electronic evidence

Screenshots are useful, but screenshots alone may be challenged if they do not show where the content came from or whether it was altered. Philippine courts recognize electronic documents, but the party presenting them must establish authenticity and reliability under the Rules on Electronic Evidence. (Lawphil)

Preserve the following:

Full chat exports, not only selected screenshots
Original emails, including headers
Profile URLs, usernames, account numbers and telephone numbers
Voice messages, photographs, videos and documents sent by the scammers
Screen recordings showing the account, conversation and URL
Advertisements, websites and landing pages
Contracts, invoices, receipts and certificates
Bank statements and official transaction confirmations
Call logs and text messages
Delivery records or courier receipts
The original phone, computer or storage device, when practical

Keep an untouched copy. Do not add annotations to the only copy, rename every file without keeping the original filename, or crop out dates, account names and URLs. Create a separate working copy for highlighting important portions.

Secretly recording a private conversation may raise issues under Republic Act No. 4200, the Anti-Wiretapping Act. Preserve recordings already lawfully obtained, but do not assume that every covert recording is admissible. (Lawphil)

4. Write a chronological incident report while events are fresh

Prepare a simple timeline:

Date and time	Person involved	Representation made	What you did because of it	Amount or property lost	Supporting evidence
5 March, 10:15 a.m.	“Agent Mark”	Claimed the investment was SEC-registered	Joined the group and submitted ID	None yet	Chat export, profile URL
6 March, 2:40 p.m.	“Finance Officer Ana”	Promised guaranteed return within seven days	Transferred ₱100,000	₱100,000	Bank receipt, messages
13 March, 9:00 a.m.	“Manager Leo”	Required a withdrawal tax	Sent another ₱25,000	₱25,000	E-wallet receipt

This timeline helps investigators distinguish the original deception from later excuses and identify each participant’s role.

What Criminal Charges May Apply

Estafa under Article 315 of the Revised Penal Code

Many coordinated scams fall under estafa, commonly called swindling, under Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951.

For estafa by false pretenses, the prosecution generally must establish that:

The accused made a false representation concerning matters such as identity, qualifications, authority, business, property, credit or an imaginary transaction.
The representation was made before or at the same time the victim parted with money or property.
The victim relied on the representation.
The victim suffered damage as a result.

The Supreme Court has repeatedly explained that the central wrong in estafa is the use of fraud or deceit that causes damage to another. (Lawphil)

Estafa may also arise from misappropriation or conversion when money or property was received in trust, on commission, for administration, or under an obligation to return or deliver it, but was later used or withheld contrary to that obligation.

A mere unpaid debt, failed business or broken promise is not automatically estafa. The evidence must show criminal deceit at the required time or fraudulent misappropriation—not simply inability to perform a contract.

Conspiracy when several people worked together

Article 8 of the Revised Penal Code recognizes conspiracy when two or more persons agree to commit a felony and decide to carry it out. Once conspiracy is established, the act of one conspirator in furtherance of the agreed plan may be treated as the act of all.

Conspiracy is commonly shown through coordinated acts rather than a written agreement. Examples include:

One participant recruits victims while another receives payments.
Several people use the same script or fabricated documents.
One person answers questions and another pressures the victim to pay.
Funds are immediately transferred among accounts controlled by connected participants.
Different participants take over the conversation at different stages.
Group administrators delete complaints and direct victims to private payment channels.

Mere friendship, employment, presence in a group chat or ownership of a receiving account does not automatically prove conspiracy. The complaint should identify the overt act connecting each respondent to the fraud. (Lawphil)

Syndicated estafa is not automatic merely because there are several scammers

Presidential Decree No. 1689 imposes heavier liability for syndicated estafa, but its requirements are specific. It generally requires:

A syndicate consisting of at least five persons;
The group to have been formed with the intention of carrying out the unlawful scheme; and
The fraud to involve money contributed by stockholders or members of specified organizations, or funds solicited from the general public by a corporation or association.

Therefore, five people committing an ordinary private scam do not automatically commit syndicated estafa. The nature of the organization, the solicitation of funds and the purpose for which the group was formed must be proven. (Lawphil)

Even when the technical requirements of syndicated estafa are absent, the participants may still be prosecuted for ordinary estafa as conspirators.

Online estafa under the Cybercrime Prevention Act

When estafa is committed by, through or with the use of information and communications technology, Section 6 of Republic Act No. 10175 may apply. The law treats the use of ICT as a qualifying circumstance and generally imposes a penalty one degree higher than the underlying offense. (Supreme Court E-Library)

This may cover schemes conducted through:

Facebook, Instagram, TikTok or online marketplaces
Messenger, Viber, Telegram, WhatsApp or email
Fake trading websites or mobile applications
Online job or investment platforms
Digital wallets and online banking
Impersonated business or government accounts

Cybercrime jurisdiction may exist when an element occurred in the Philippines, a computer system used was wholly or partly situated here, or the offense caused damage to a person who was in the Philippines at the time. (Lawphil)

Money mules, account takeovers and social engineering under AFASA

AFASA specifically penalizes certain financial-account scams.

A money mule may include a person who knowingly uses, lends, sells, rents or allows the use of a financial account to receive, transfer or withdraw proceeds known to come from crimes or social-engineering schemes. The law also covers those who recruit other people to supply accounts.

A social-engineering scheme under AFASA involves obtaining sensitive account information through deception or fraudulent electronic communications, resulting in unauthorized access or control over a financial account.

Under AFASA, money-muling or social-engineering offenses may constitute economic sabotage when committed:

By three or more persons conspiring together;
Against three or more victims;
Through a mass mailer; or
Through human trafficking.

This is different from syndicated estafa under PD 1689. AFASA uses a three-person or three-victim threshold for its own economic-sabotage provision, while PD 1689 has separate five-person and public-fund requirements. (Lawphil)

The registered owner of the recipient account should not automatically be accused of knowingly joining the scam. AFASA’s money-muling provision generally requires knowledge that the funds came from a crime or social-engineering scheme. The account may also have been stolen or opened through identity theft.

Other laws that may apply

Type of scam	Possible additional law or agency
Stolen card details, unauthorized access devices or fraudulent card use	Republic Act No. 8484, the Access Devices Regulation Act
Unregistered investment solicitation, fake securities or manipulated trading platform	Republic Act No. 8799, the Securities Regulation Code; Securities and Exchange Commission
Fake overseas employment or collection of prohibited recruitment fees	Labor Code provisions on recruitment; Republic Act No. 8042, as amended; Department of Migrant Workers
Identity theft, illegal access or computer-related forgery	Republic Act No. 10175
Laundering or movement of criminal proceeds	Republic Act No. 9160, the Anti-Money Laundering Act, as amended

The final charges depend on the exact acts and evidence. One scheme may produce several lawful charges, but the same conduct cannot simply be relabeled without proving the elements of each offense.

How to Build a Strong Case Against Multiple Scammers

1. Prepare a participant-role matrix

Create one row for every known person, alias, account or business:

Person or identifier	Claimed role	Actual acts observed	Account or contact used	Evidence linking the person
“Mark D.”	Investment agent	Recruited victim and promised guaranteed returns	Telegram @markprofits	Chat export, voice note
Ana Santos	Cashier	Sent bank instructions and confirmed receipt	Bank account ending 1234	Transfer slip, messages
“Admin Leo”	Group administrator	Deleted complaints and demanded withdrawal fee	Facebook profile URL	Screen recording, witness affidavit
Unknown account owner	Recipient	Received ₱75,000	E-wallet number	Official transaction record

Do not describe everyone merely as “part of the group.” Explain the specific act showing participation.

2. Prepare a transaction schedule

List every payment separately, including:

Date and time
Amount
Sending institution
Recipient institution
Recipient name and account
Transaction reference
Reason given for the payment
Person who instructed the payment
Evidence of receipt or acknowledgment

Each independent transaction may become a separate count of estafa, although the prosecutor will determine whether the facts support one continuing offense or several counts.

3. Obtain a separate affidavit from every victim and material witness

When there are multiple victims, each person should execute an affidavit covering facts personally known to that person. One victim generally should not narrate another victim’s payment based only on what was heard in a group chat.

A coordinated filing may include:

A common complaint describing the overall operation
Separate victim affidavits
A consolidated list of respondents
A combined transaction spreadsheet
Common exhibits showing the shared scheme
Individual annexes proving each victim’s loss

Consistency is important, but the affidavits should not be copied word for word if the victims had different experiences.

4. Show how the participants were connected

Useful links may include:

Shared telephone numbers, email addresses or devices
Common bank and e-wallet accounts
Identical fabricated contracts or certificates
Repeated scripts and payment instructions
Transfer chains between participant accounts
Corporate records connecting officers and agents
Social media posts showing joint promotion
Testimony from former employees or insiders
IP, subscriber or device information obtained through lawful investigation

Victims usually cannot obtain protected bank, telecommunications or platform records directly. The NBI, PNP, prosecutor, BSP or court may use the applicable legal process to obtain or preserve them.

Where to Report and File the Case

Reporting to one office does not always replace filing with another. A bank complaint attempts to trace or hold the funds. Law-enforcement agencies investigate. The prosecutor determines whether criminal charges should be filed in court.

Office	Main purpose
Bank or e-wallet customer-protection unit	Transaction recall, temporary hold, verification and account preservation
BSP Consumer Assistance Mechanism	Second-level complaint concerning a BSP-supervised institution
PNP Anti-Cybercrime Group	Investigation of online scams and cyber-related offenses
NBI Cybercrime Division or Fraud and Financial Crimes Division	Case build-up, digital investigation and sworn statements
CICC / Inter-Agency Response Center Hotline 1326	Central reporting and referral for scams and cybercrime
City or Provincial Prosecutor’s Office	Filing and evaluation of the criminal complaint
Securities and Exchange Commission	Unregistered investment solicitation or securities violations
Department of Migrant Workers	Illegal overseas recruitment and recruitment-fee complaints

The government’s Hotline 1326 receives reports of online selling, impersonation, investment, phishing, romance and other cyber scams. The NBI also accepts online complaints and provides investigative assistance through its cybercrime and fraud units. (Philippine Information Agency)

Filing with the prosecutor

A prosecutor complaint normally includes:

Investigation Data Form
Complaint-affidavit
Affidavits of witnesses and other victims
Government-issued identification
Known addresses or identifying details of respondents
Documentary and electronic evidence
Transaction schedule and proof of loss
Police, NBI or bank reports, if available
Properly marked annexes or exhibits
Additional copies required for the prosecution office and each respondent

Affidavits must generally be sworn before a prosecutor, another authorized officer or a notary public. The DOJ provides National Prosecution Service forms and publishes filing requirements for complaints. (Department of Justice)

Current DOJ procedures distinguish among:

Regular preliminary investigation for offenses carrying a prescribed penalty of at least six years and one day;
Expedited preliminary investigation for certain offenses punishable by more than one year up to six years and falling within first-level court jurisdiction; and
Summary investigation for offenses generally punishable by up to one year, a fine, or both.

The classification depends on the charge, prescribed penalty and court jurisdiction—not merely the amount lost. The DOJ’s 2024 rules also permit electronic filing and virtual proceedings when authorized by the investigating prosecutor and supported by the prosecution office’s facilities. (Lawphil)

Choosing the correct place to file

Venue in criminal cases is important because it affects the court’s jurisdiction. Relevant places may include:

Where the false representation was made;
Where the victim relied on it;
Where the victim transferred or delivered the money;
Where the money was received or misappropriated;
Where a relevant computer system was located; or
Where legally recognized damage occurred.

Online communications do not mean the complaint may be filed anywhere. The facts should identify a specific connection to the city or province where the prosecutor complaint is filed.

Is barangay conciliation required?

A barangay blotter is not the same as filing a criminal complaint, and it does not by itself start a prosecution.

Barangay conciliation generally does not cover offenses whose maximum penalty exceeds one year of imprisonment or a fine exceeding ₱5,000. It may also be inapplicable when the parties do not actually reside in the same city or municipality, subject to statutory exceptions. Most serious estafa, cybercrime and AFASA cases therefore proceed directly to law enforcement or the prosecutor, although a low-penalty related offense may require separate analysis. (Lawphil)

Documents and Evidence Checklist

Item	Why it matters
Complaint-affidavit	Provides the sworn narrative and identifies the offense
Detailed timeline	Shows when deceit occurred and how it caused payment
Participant-role matrix	Connects each respondent to a specific act
Transaction schedule	Establishes the amount and route of the loss
Certified or official bank records	Stronger proof than screenshots alone
Full chat and email exports	Shows context, identity indicators and continuity
URLs, usernames and telephone numbers	Helps investigators preserve and trace accounts
Contracts, advertisements and certificates	Proves the representations made
Victim and witness affidavits	Establishes personal knowledge and pattern
Bank fraud-reference numbers	Shows prompt reporting and allows follow-up
Police, NBI or CICC report	Documents the investigative referral
Original device or forensic copy	May be needed to authenticate electronic evidence
Proof of address	Helps establish venue
Proof of actual financial loss	Supports criminal and civil liability

Notarization does not make a false or incomplete statement true. Every affiant should review the dates, amounts, names and attachments before signing.

Recovering the Money

A criminal complaint seeks prosecution and punishment, but it can also carry civil liability for restitution and damages. Under Rule 111 of the Rules of Criminal Procedure, the civil action arising from the offense is generally deemed instituted with the criminal case unless it is waived, reserved for separate filing, or filed earlier.

Article 33 of the Civil Code also permits an independent civil action for damages arising from fraud. It proceeds under the civil standard of preponderance of evidence, which is lower than proof beyond reasonable doubt. Double recovery for the same loss is not allowed. (Supreme Court E-Library)

Possible recovery routes include:

Release of funds held after bank verification
Restitution ordered in the criminal judgment
Civil liability included in the criminal case
An independent civil action based on fraud
A contractual collection or rescission case, when supported by the facts
Preliminary attachment in a proper civil action when statutory grounds exist and the required bond is posted
Forfeiture proceedings involving criminal proceeds or instrumentalities

A conviction is not always required before a financial institution may be liable for restitution under AFASA. The law provides that a covered institution may be liable when it failed to employ adequate risk controls, failed to exercise the required degree of diligence, or failed to hold disputed funds as required by law and BSP regulations. Liability remains fact-specific and is not established merely because a scammer used an account with that institution. (Lawphil)

A partial repayment, settlement or affidavit of desistance should clearly state:

Amount received
Remaining balance
Payment schedule
Whether civil claims are being compromised
Treatment of interest, costs and damages
Consequences of default
Whether the document is a full release or only a partial acknowledgment

Criminal liability is prosecuted in the name of the People of the Philippines. A private settlement does not automatically require the prosecutor or court to dismiss the criminal case.

Practical Timelines and Common Delays

Stage	Practical expectation
Bank or e-wallet reporting	Same day; the likelihood of recovery decreases as funds move or are withdrawn
Temporary holding under AFASA	Up to 30 calendar days, unless extended by a competent court
NBI or PNP intake	Often completed during the initial visit, followed by case evaluation and evidence gathering
Digital or financial tracing	May take weeks or months, especially when several institutions or platforms are involved
Prosecutor proceedings	Commonly several months, depending on service of subpoenas, number of respondents and completeness of evidence
Filing and arrest	Delayed when respondents use false addresses, aliases or foreign locations
Court proceedings	Often longer when there are multiple accused, numerous witnesses or digital-forensic issues
Recovery	May occur early if funds are held, but otherwise may depend on settlement, attachment or final judgment

Common bottlenecks include incomplete account details, poor-quality screenshots, unavailable original devices, respondents who cannot be located, conflicting victim affidavits, delayed bank replies and funds transferred through several mule accounts.

Special Considerations for Foreigners and Filipinos Abroad

A foreign national may file a criminal complaint in the Philippines and seek recovery of money lost through a Philippine-based scam. Philippine nationality is not required to be an offended party.

A complainant who is abroad may need:

A sworn complaint-affidavit executed before a Philippine embassy or consulate; or
A locally notarized affidavit apostilled by the competent authority of an Apostille Convention country; or
Consular authentication when the document comes from a non-Apostille country;
A special power of attorney for a Philippine representative to submit documents and receive communications; and
Certified English translations of documents written in another language.

Documents carrying a valid foreign Apostille generally no longer need authentication by the Philippine embassy in that country. A document may also be notarized directly before a Philippine consular officer where that service is available. (Philippine Embassy in New Delhi)

An authorized representative can handle many filing and follow-up tasks, but cannot replace the complainant’s personal knowledge. The victim may still be required to participate in a virtual hearing, execute a clarificatory affidavit or testify at trial.

When the scammers, servers or financial accounts are abroad, Philippine authorities may use international cooperation mechanisms under the Cybercrime Prevention Act, applicable treaties, mutual legal assistance arrangements and reciprocal laws. Cross-border requests usually take longer because they require coordination with foreign institutions and authorities. (Supreme Court E-Library)

Common Mistakes That Weaken Multi-Person Scam Cases

Waiting until every scammer’s real name is known. Known participants can be identified while investigators work to trace aliases and account holders.
Accusing every account owner without evidence of knowledge. An account holder may be a knowing mule, an identity-theft victim or an innocent person whose account was compromised.
Submitting hundreds of unsorted screenshots. Investigators need a timeline, exhibit index and explanation of why each document matters.
Deleting messages after blocking the scammers. Blocking is sensible; deleting the evidence is not.
Treating a failed investment as automatically criminal. Evidence must show fraud, not merely poor performance or business failure.
Using one affidavit for all victims. Each victim should prove personal communications, reliance, payment and loss.
Posting unverified identities publicly. Public accusations may create defamation, privacy or safety issues and may alert suspects before records are preserved.
Paying an unverified “recovery agent.” Recovery scams frequently target people who have already reported an initial fraud.
Accepting oral repayment promises. Any settlement should be written, specific and supported by verifiable payment arrangements.
Assuming a police blotter completes the case. A blotter documents a report; prosecution normally requires a sworn complaint and supporting evidence.

Frequently Asked Questions

Can several victims file one complaint against the same scammers?

Yes. Related complaints may be coordinated or consolidated when they involve the same participants and scheme. Each victim should still execute a separate affidavit and prove their own payment, reliance and loss.

Can I include all the scammers in one complaint?

Yes, when the facts show that they participated in the same plan. The complaint should state the specific act of every respondent. Different charges or separate counts may be recommended depending on each person’s role.

Is it syndicated estafa whenever five or more people are involved?

No. PD 1689 also requires proof concerning the formation of the syndicate and the type of funds or public solicitation involved. Five ordinary conspirators may instead face ordinary estafa and other applicable charges.

Can a bank reverse an InstaPay, PESONet or e-wallet transfer?

Sometimes, but reversal is not automatic. Recovery is more likely when the fraud is reported before the recipient withdraws or transfers the funds. Request an immediate hold, recall and coordinated verification, and obtain a written case-reference number.

What if I know only aliases and account numbers?

Report all available identifiers, including usernames, profile URLs, telephone numbers, emails, account names, account numbers and transaction references. Investigators may seek subscriber, platform or financial records through lawful process.

Do I need to send a demand letter before filing estafa?

Not in every estafa case. A demand may help show failure to return or account for property in misappropriation cases, but estafa by deceit focuses on the fraudulent representation that induced the victim to part with money. Sending a demand should not delay urgent reporting to the bank or authorities.

Can I file even if part of the money was returned?

Yes. Partial repayment does not necessarily erase an offense that was already completed, although it affects the remaining civil loss and may be considered in the proceedings.

Can I recover money without a criminal conviction?

Potentially. Recovery may come from an early bank hold, settlement, civil action, attachment or an AFASA-based restitution claim against a financial institution when the legal requirements are proven. Article 33 also allows an independent civil action based on fraud.

Can an OFW or foreigner file without returning immediately to the Philippines?

Many initial steps can be completed through an authenticated or apostilled affidavit, an authorized representative, electronic filing and virtual proceedings where permitted. Personal participation may still be required later for clarification or testimony.

How long do I have to file?

The prescriptive period depends on the specific offense, amount, penalty and applicable law. Filing should not be delayed. Electronic evidence can disappear, financial records may become harder to trace, and scammers may move funds or leave the country. Current Supreme Court doctrine recognizes that filing a criminal complaint with the prosecution office can interrupt prescription in circumstances governed by the applicable rules. (Supreme Court E-Library)

Key Takeaways

Report the transfer to the bank or e-wallet immediately and request a temporary hold, recall and coordinated verification.
Preserve complete electronic records, original files, transaction references and devices.
Identify the specific role and overt act of every participant.
Prepare separate affidavits and loss records for each victim.
Multiple offenders may be liable as conspirators, but syndicated estafa has additional legal requirements.
Online schemes may involve estafa in relation to RA 10175, AFASA, the Access Devices Regulation Act or securities and recruitment laws.
A police or barangay blotter does not replace a properly supported prosecutor complaint.
Criminal prosecution and civil recovery are related but distinct; a conviction does not automatically mean the money is still available.
Foreigners and overseas Filipinos may use consularized or apostilled documents and authorized Philippine representatives.
Speed, organization and reliable evidence are usually more important than the number of pages submitted.