If you were scammed online in the Philippines, the first goal is not yet “filing a case.” It is to stop further loss, preserve evidence, and report fast enough for the bank, e-wallet, platform, or law enforcement to trace the transaction while records are still fresh. Online scams move quickly: money may pass through several bank accounts or e-wallets within minutes. This guide explains what to do immediately, what laws may apply, where to report, what documents to prepare, and what realistic remedies are available.

First: Secure Your Accounts and Preserve Evidence

Do these as soon as you realize you may have been scammed:

Stop communicating with the scammer except to preserve evidence. Do not threaten, insult, or announce that you are filing a case. Scammers often delete accounts, unsend messages, or move funds faster when warned.
Take screenshots and screen recordings immediately. Capture:
- the full chat thread;
- profile name, username, URL, phone number, email address, QR code, or account handle;
- posts, listings, advertisements, group posts, or marketplace pages;
- transaction receipts and reference numbers;
- dates and timestamps;
- delivery details, tracking numbers, or fake IDs sent to you.
Do not delete the original messages. Screenshots help, but investigators may also ask to inspect the original thread, device, email headers, or app notification history.
Change passwords and enable multi-factor authentication. Prioritize your email, banking apps, e-wallets, Facebook, Instagram, Shopee, Lazada, TikTok, Telegram, WhatsApp, and any account connected to payments.
Report unauthorized transactions to your bank or e-wallet immediately. Ask for:
- a case or ticket number;
- temporary blocking or freezing of your account if compromised;
- reversal, dispute, chargeback, or investigation;
- preservation or hold of the recipient account if possible;
- written confirmation of your report.

Under the Anti-Financial Account Scamming Act, Republic Act No. 12010, banks, non-banks, e-wallet providers, and other BSP-supervised financial institutions are now specifically covered when financial accounts are used for scams. The law recognizes social engineering schemes, money mule activities, and disputed transactions involving bank accounts and e-wallets. It also authorizes temporary holding of disputed funds for a period prescribed by the BSP, not exceeding 30 calendar days unless extended by a court. (Supreme Court E-Library)

What Counts as an Online Scam in the Philippines?

An online scam usually involves deceit that causes you to part with money, property, personal data, or account access. Common examples include:

fake online sellers who take payment but never deliver;
fake investment, crypto, forex, tasking, or “double your money” schemes;
phishing links pretending to be banks, e-wallets, delivery companies, or government offices;
romance scams and emergency-money scams;
fake job offers requiring “processing fees,” “unlocking fees,” or deposits;
identity theft using another person’s photo, business name, or fake ID;
hacked account scams, such as a “friend” messaging you to borrow money;
recovery scams where someone asks for more money to recover funds from a previous scam.

Not every failed transaction is automatically a criminal scam. A delayed delivery, defective item, or refund dispute with a real seller may start as a consumer complaint. But if the seller used a fake identity, fake proof of legitimacy, fake tracking, multiple victim accounts, or had no intention to deliver from the beginning, it may become a criminal fraud or cybercrime issue.

Main Philippine Laws That May Apply

Estafa under Article 315 of the Revised Penal Code

Most online scam complaints are framed as estafa, also called swindling, under Article 315 of the Revised Penal Code. In simple terms, estafa happens when someone uses deceit or abuse of confidence to cause another person to suffer damage.

For many online scams, the relevant mode is estafa by false pretenses or fraudulent acts under Article 315(2)(a). The usual elements are:

the scammer made a false pretense or fraudulent representation;
the false representation was made before or at the same time you paid or transferred money;
you relied on the false representation;
because of that reliance, you parted with money or property and suffered damage.

For example, a seller who pretends to own an item, sends fake shipping proof, uses a fictitious identity, and disappears after receiving payment may fit this pattern. The Supreme Court has repeatedly explained that the deceit must generally exist before or at the time the victim parts with money, not merely after a business deal goes bad. (Supreme Court E-Library)

Cybercrime Prevention Act of 2012, RA 10175

If the scam was committed through Facebook, Messenger, Instagram, email, online marketplaces, banking apps, e-wallets, SMS, fake websites, or other information and communications technology, the Cybercrime Prevention Act of 2012, Republic Act No. 10175 may apply.

RA 10175 covers computer-related offenses such as computer-related fraud, computer-related forgery, and computer-related identity theft. It also provides that crimes under the Revised Penal Code and special laws, if committed through information and communications technologies, are covered by the Cybercrime Prevention Act, with the penalty generally one degree higher. (Supreme Court E-Library)

This is why a complaint may be described as estafa in relation to RA 10175 when the fraud was committed online.

Anti-Financial Account Scamming Act, RA 12010

RA 12010 is especially important for scams involving bank accounts, e-wallets, QR payments, online transfers, and “money mule” accounts.

The law penalizes money muling, such as selling, lending, renting, buying, or allowing the use of financial accounts to receive or move scam proceeds. It also penalizes social engineering schemes, where a person obtains sensitive identifying information through deception or fraud, resulting in unauthorized access or control over another person’s financial account. (Supreme Court E-Library)

A practical point for victims: RA 12010 matters because it gives financial institutions a clearer legal basis to coordinate, verify disputed transactions, and temporarily hold suspicious funds. It also provides that institutions may be liable for restitution if they fail to employ adequate risk management systems or fail to exercise the highest degree of diligence, and conviction of the scammer is not required before restitution may be considered under the law. (Supreme Court E-Library)

Electronic Commerce Act, RA 8792

The Electronic Commerce Act, Republic Act No. 8792, helps because electronic documents and electronic data messages can have legal effect and may be used as evidence, subject to authentication and the Rules on Electronic Evidence. This includes emails, chats, screenshots, digital receipts, and transaction records, if properly preserved and presented. (Lawphil)

Securities Regulation Code, RA 8799, for Investment Scams

If the scam involved public solicitation of investments, guaranteed returns, crypto trading pools, profit-sharing, “tasking” deposits, or similar schemes, the Securities Regulation Code, Republic Act No. 8799, may apply. In Power Homes Unlimited Corporation v. SEC, the Supreme Court applied the investment contract doctrine: a scheme may be treated as a security when people invest money in a common enterprise expecting profits mainly from the efforts of others. (Supreme Court E-Library)

This matters because many online “investment” scams are not only estafa or cybercrime issues. They may also involve unauthorized sale of securities, which falls within the jurisdiction of the Securities and Exchange Commission.

Step-by-Step Guide: What to Do After an Online Scam

1. Report to your bank, e-wallet, or payment provider first

If money passed through a bank, GCash, Maya, coins wallet, remittance center, credit card, debit card, or QR payment, report it immediately.

Give the provider:

your full name and account number or wallet number;
transaction date and time;
amount;
transaction reference number;
recipient name, account number, wallet number, QR merchant name, or mobile number;
screenshots of the scam;
police report or complaint-affidavit if already available.

Use the fraud hotline, in-app help center, email support, and branch reporting if available. Do not rely only on a social media message to the provider.

For BSP-supervised institutions, the BSP’s Consumer Assistance Mechanism is generally a second-level recourse. The BSP instructs consumers to report first to the institution’s Financial Consumer Protection Assistance Mechanism or customer service channel. If unresolved or unsatisfactory, the complaint may be escalated through the BSP Online Buddy or by submitting the BSP form and supporting documents.

2. Ask for a written case number and keep following up

A phone call is useful, but a documented report is better. Ask for:

ticket number;
date and time of report;
name or ID of the agent, if provided;
summary of what action was taken;
expected response time;
whether the recipient account was flagged, frozen, or escalated.

For scams, hours matter. A follow-up within 24 to 48 hours may help confirm whether the report was escalated to the fraud or financial crime team.

3. File a cybercrime complaint with PNP-ACG or NBI Cybercrime

You may report to either:

Office	Best for	Practical notes
PNP Anti-Cybercrime Group (PNP-ACG)	Online scams, hacked accounts, identity theft, cyber-enabled estafa, phishing	You may approach the national office, regional anti-cybercrime units, or the nearest police station for guidance.
NBI Cybercrime Division (NBI-CCD)	Cybercrime investigation, digital evidence, scams involving online accounts or cross-platform activity	NBI’s citizen charter describes intake, interview, sworn statements, and supporting documents for computer crime complaints.
CICC / I-ARC Hotline 1326	Immediate reporting guidance for scams and cyber fraud	Useful for quick routing, especially when you are unsure where to start.
SEC	Investment scams, unregistered securities, crypto/forex/tasking schemes promising returns	File with the SEC complaint system or Enforcement and Investor Protection channels.
DTI	Real online seller, non-delivery, defective goods, refund refusal, deceptive sales practice	Best when the issue is a consumer transaction rather than a purely fake identity scam.

The NBI Cybercrime Division process usually involves an initial complaint, preliminary interview, sworn statements or affidavits, and submission of supporting documents. Its citizen charter lists no filing fee for the initial investigative assistance process and describes an estimated intake/interview process of about one hour and ten minutes, though actual investigation time depends on the case. (National Bureau of Investigation)

4. Prepare a complaint-affidavit

A complaint-affidavit is a sworn written statement narrating what happened. It should be factual, chronological, and supported by attachments.

Include:

your full name, address, contact number, email, and valid ID;
the scammer’s known name, alias, number, email, username, profile link, wallet, or bank details;
a timeline of events;
exactly what the scammer represented;
why you believed it;
how much you paid and how;
what happened after payment;
your attempts to recover the money;
list of attached evidence;
statement that you are filing for investigation and appropriate legal action.

If you are abroad, you may need to execute the affidavit before a Philippine Embassy or Consulate, or have documents notarized abroad and apostilled if required. For Philippine use, foreign public documents commonly need authentication through an apostille if the country is a member of the Apostille Convention, or consular authentication if not.

5. Secure a police report or incident report if your bank or e-wallet requires it

Many banks and e-wallets ask for a police report, incident report, or blotter before acting on a fraud claim. This does not replace a cybercrime complaint, but it helps prove that you formally reported the incident.

For small-value scams, victims sometimes stop here because the cost and effort of full prosecution may be higher than the amount lost. Still, reporting matters because the same account or number may be connected to many victims.

6. Report the account to the platform

Report the scammer’s account, page, group, listing, ad, or website to the platform. Use platform-specific reporting tools and choose fraud/scam/impersonation.

For evidence, report after saving screenshots, URLs, and account identifiers. If the platform removes the account before you preserve evidence, your case may become harder to prove.

7. For investment scams, report to the SEC

If the scheme involved investment returns, commissions, pooled funds, “VIP tasks,” crypto trading, forex signals, or passive income promises, report it to the Securities and Exchange Commission.

Use the SEC i-Message complaint portal and check whether the entity appears in SEC advisories. A company’s SEC registration as a corporation is not the same as authority to solicit investments from the public. A legitimate corporation may still be unauthorized to sell securities or investment contracts.

8. For consumer disputes with real sellers, report to DTI

If there is a real seller or business and the dispute is non-delivery, refund refusal, defective goods, misleading price, or deceptive online selling, DTI may be the proper first administrative route.

Prepare:

complaint letter;
proof of payment;
screenshots of listing and seller promises;
order confirmation;
delivery or tracking details;
seller’s business name and address, if known;
your demand, such as refund, replacement, or delivery.

If the seller is fake, anonymous, or using stolen identities, DTI may not be enough. You may still need PNP-ACG or NBI.

Evidence Checklist for Online Scam Complaints

Evidence	Why it matters
Screenshots of chats	Shows the promises, deceit, payment instructions, and identity used
Full profile URL or username	Helps identify the exact account, not just the display name
Transaction receipt	Proves amount, time, source, recipient, and reference number
Bank/e-wallet statement	Confirms actual debit or transfer
Links to posts, ads, listings, or websites	Helps investigators preserve or trace online content
Screen recording	Useful when messages, profiles, or comments may be deleted
Valid government ID	Required for formal complaints
Complaint-affidavit	Main sworn narration for investigation and prosecutor review
Bank/e-wallet ticket numbers	Shows prompt reporting and financial institution action
Witness affidavits	Useful if others saw the transaction or were also victimized

Can You Get Your Money Back?

Sometimes, yes — but the chances depend heavily on speed and where the money went.

Recovery is more realistic when:

you report within minutes or hours;
the recipient account still has funds;
the receiving bank or e-wallet flags the account quickly;
multiple complaints identify the same account;
the account belongs to a real, traceable person;
the financial institution failed to follow legally required safeguards.

Recovery is harder when:

you sent the money voluntarily to a scammer’s account;
the funds were immediately transferred to other accounts;
the scammer used mule accounts;
the recipient account was opened with fake or stolen identity documents;
payment was made through cryptocurrency or informal channels;
the scammer is outside the Philippines.

A criminal case may lead to restitution or civil liability, but it is usually not fast. The fastest possible route is still immediate reporting to the financial institution so suspicious funds can be held or traced.

What Happens After You File a Criminal Complaint?

The usual path is:

Intake and initial evaluation by PNP-ACG, NBI, or local police.
Collection of sworn statements and evidence.
Technical investigation, which may include requests for subscriber data, transaction records, IP logs, account details, or platform preservation.
Referral to the prosecutor if investigators find enough basis.
Preliminary investigation before the City or Provincial Prosecutor, where the respondent may be required to submit a counter-affidavit.
Filing of Information in court if the prosecutor finds probable cause.
Trial, where the complainant may need to testify.

Timelines vary widely. Initial intake may happen in a day, but cybercrime investigation can take weeks or months. Prosecutor proceedings may also take months depending on docket congestion, evidence completeness, and whether the suspect is identifiable. Court cases can take years.

Common Mistakes That Weaken Online Scam Cases

Posting the alleged scammer publicly without care

It is understandable to warn others, but public accusations can create separate problems, especially if you identify the wrong person or use insulting language. If you need to warn a group, stick to verifiable facts: transaction reference, account used, screenshots of the listing, and that a formal report has been made.

Sending more money to “recover” the first payment

Many scammers use a second scam: “Pay tax,” “Pay clearance,” “Unlock withdrawal,” “Pay anti-money laundering fee,” or “Pay attorney processing fee.” Real banks, courts, law enforcement agencies, and BSP do not recover scam funds by asking victims to send more money to random personal accounts.

Relying only on screenshots of display names

Display names can be changed. Save URLs, usernames, QR codes, mobile numbers, email addresses, transaction IDs, and account numbers.

Waiting too long

Delays allow scammers to delete accounts, move funds, dispose of SIMs, and recruit new mule accounts. Even if you are embarrassed, report quickly. Many victims delay because they feel ashamed. Scammers rely on that silence.

Filing in the wrong office only

A bank complaint, police complaint, SEC report, and DTI complaint serve different purposes. For example, reporting to your e-wallet may help freeze funds, but it does not automatically start a criminal case. Filing with PNP-ACG or NBI may start investigation, but it does not guarantee immediate refund. For investment scams, SEC reporting may help stop public solicitation, but victims may still need criminal complaints for estafa.

Special Notes for OFWs and Foreigners

If you are an OFW scammed by someone in the Philippines

You can preserve evidence abroad and authorize a trusted person in the Philippines to help file or follow up. However, for a formal criminal complaint, your sworn statement is usually important. Depending on the office handling the case, you may be asked to execute a complaint-affidavit before the Philippine Consulate or have documents properly authenticated.

If you are a foreigner scammed by a Filipino or Philippine-based account

You may report to the same agencies if the scam involved Philippine persons, accounts, platforms, or financial institutions. Prepare a copy of your passport, proof of payment, and authenticated or notarized affidavit if you are outside the Philippines. If your documents are in another language, certified English translations may be needed.

If the scammer is abroad

Philippine authorities may still investigate Philippine bank accounts, e-wallets, SIMs, or accomplices. But cross-border tracing is slower and may require coordination through law enforcement channels, platform legal processes, or mutual legal assistance. This is one reason why mule accounts in the Philippines are important: even if the mastermind is abroad, the local account holder may still be investigated.

Frequently Asked Questions

Can I file a case if I only lost a small amount?

Yes. There is no rule that small online scams are automatically ignored. The practical issue is whether the suspect can be identified and whether the evidence is complete. Even small reports matter because investigators may connect your complaint with other victims using the same account, number, or script.

Is an online scam estafa or cybercrime?

It can be both. The deceit may be estafa under Article 315 of the Revised Penal Code, while the use of online platforms, mobile phones, e-wallets, or computer systems may bring in RA 10175. If bank accounts or e-wallets were used for money muling or social engineering, RA 12010 may also be relevant.

Should I report first to the police or to my bank?

Report to your bank or e-wallet first if money was transferred. This gives the best chance of freezing or tracing funds. Then prepare your evidence and file with PNP-ACG, NBI, or the appropriate agency. Do both; they serve different purposes.

Can GCash, Maya, or a bank reverse the transfer?

They may investigate, hold funds, restrict accounts, or process disputes depending on the facts, timing, and applicable rules. Reversal is not automatic, especially if you voluntarily authorized the transfer. However, under RA 12010, disputed transactions involving social engineering or suspicious accounts have clearer procedures for coordinated verification and possible temporary holding of funds.

What if the scammer used a fake name?

That is common. Focus on identifiers that are harder to fake: account number, wallet number, transaction reference, mobile number, email address, profile URL, bank branch if visible, QR merchant name, IP-related data if available to investigators, and delivery or remittance information.

Do I need a notarized affidavit?

For a formal complaint, expect to submit a sworn complaint-affidavit. Some agencies may help prepare or administer sworn statements during intake. If you prepare it beforehand, notarization is usually needed. If you are abroad, consular notarization or apostille may be required depending on where and how the document will be used.

Can I sue in small claims court to recover the money?

Possibly, if you know the real identity and address of the person you are suing and the case fits the small claims rules. Small claims in first-level courts generally cover money claims not exceeding ₱1,000,000, exclusive of interest and costs, under the Rules on Expedited Procedures in First Level Courts. But small claims is a civil recovery remedy; it does not replace a criminal complaint for estafa or cybercrime. (Supreme Court of the Philippines)

What if the scam happened on Facebook Marketplace, Instagram, or TikTok?

Save the profile link, listing URL, screenshots, chat thread, comments, and payment details. Report the account to the platform only after preserving evidence. Then report to your bank or e-wallet and file with PNP-ACG or NBI if there was fraud.

Is a barangay blotter enough?

Usually, no. A barangay record may help document that you complained, especially if the suspect is known and in the same locality. But barangays cannot compel banks, e-wallets, telcos, or social media platforms to disclose cybercrime data. For online scams, especially anonymous or account-based scams, PNP-ACG, NBI, the bank/e-wallet, BSP, SEC, or DTI may be more relevant depending on the facts.

Can I report a scam anonymously?

You can usually send tips anonymously, but a formal criminal complaint normally requires an identified complainant, sworn statement, and evidence. If you want prosecution or recovery, you should expect to identify yourself to the proper agency.

Key Takeaways

Act fast. Report to your bank or e-wallet immediately and ask for a case number.
Preserve evidence before reporting accounts. Save chats, URLs, receipts, timestamps, and profile identifiers.
Most online scams may involve estafa, cybercrime, or both.
RA 12010 gives stronger tools against bank and e-wallet scams, including rules on money mules, social engineering, disputed transactions, and temporary holding of suspicious funds.
File with the right office: PNP-ACG or NBI for cybercrime, SEC for investment scams, DTI for real seller consumer disputes, and BSP escalation for unresolved complaints against BSP-supervised financial institutions.
A criminal case is not the fastest refund method. The fastest chance of recovery usually comes from immediate financial institution reporting before the funds move.
Do not send more money to recover lost money. “Unlocking,” “tax,” “clearance,” and “recovery” fees are common second-stage scams.