Quick answer

Act immediately. Contact the bank, e-wallet, card issuer, remittance company, or other financial institution through its official fraud channel and report the transaction as disputed. Ask it to secure your account, trace the money, initiate the temporary-hold and coordinated-verification process when applicable, and give you a case reference number.

Then secure every affected account, preserve the evidence, report the incident to the government’s 24/7 Anti-Scam Hotline 1326, and file a criminal complaint with the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Fast reporting improves the chance that funds still inside the financial system can be located, but no bank, agency, or law guarantees recovery.

If anyone is in immediate physical danger, call the nationwide Unified 911 Emergency Hotline.

What to do in the next hour

1. Call the financial institution immediately

Use only the telephone number in the institution’s official app, website, card, or account statement. Do not call a number supplied by the suspected scammer or contained in an unverified message.

Tell the institution:

Your account has been compromised or you were induced to make a fraudulent payment.
The exact amount, date, time, transaction reference number, and recipient account or wallet.
Whether you entered a password, PIN, one-time password, card number, CVV, recovery code, or other credential.
Whether the transaction was made without your permission or you personally approved it because of deception.
Whether the scammer may still have access to your phone, SIM, email, or device.

Ask the institution to:

Disable compromised access and stop further transfers or card use.
Flag the transaction formally as disputed.
Trace the funds through receiving and subsequent receiving institutions.
Initiate any available recall, reversal, chargeback, temporary hold, or coordinated verification.
Preserve transaction, login, device, IP-address, authentication, and customer-service records.
Provide a written acknowledgment and case reference number.

Under BSP Circular No. 1215, a disputed transaction can include certain unusual or apparently unlawful transactions and transactions facilitated through social engineering. Covered institutions may temporarily hold identifiable disputed funds for an initial period of up to five calendar days, extendible by up to 25 more calendar days when the regulatory conditions are met. The total administrative hold is therefore no more than 30 calendar days, unless a competent court extends it. A hold prevents movement of funds while verification occurs; it is not a final judgment that the money belongs to either party. BSP Circular No. 1215

This process can help only if funds remain traceable or intact. Money already withdrawn, converted, spent, transferred outside participating institutions, or sent through difficult-to-trace channels may not be recoverable through a hold.

2. Secure your accounts from a clean device

If you installed an app, opened an attachment, shared your screen, or allowed remote access, stop using the affected device for banking until it has been checked. On another trusted device:

Change the password of your primary email account first.
Change banking, e-wallet, shopping, social-media, and cloud-account passwords.
Sign out other sessions and remove unfamiliar devices.
Turn on multi-factor authentication.
Replace reused passwords with unique ones.
Lock affected cards and lower transaction limits where available.
Contact your mobile provider if your SIM stopped working or you suspect a SIM swap.
Review account statements and alerts for other unauthorized activity.

Never give an OTP, PIN, password, CVV, recovery phrase, or screen-sharing access to someone claiming that these are required to “reverse” the scam. A second person offering paid recovery may be another scammer.

3. Preserve evidence before blocking or deleting anything

Save evidence in its original form where possible. Take screenshots, but also retain the underlying messages, emails, files, URLs, and transaction records.

Preserve:

The scammer’s names, aliases, usernames, profile links, mobile numbers, email addresses, and wallet addresses.
Full chat and email threads, including headers if available.
Advertisements, listings, websites, QR codes, invoices, contracts, and promised returns.
Bank, card, e-wallet, remittance, or cryptocurrency receipts.
Recipient names, account numbers, wallet numbers, reference numbers, dates, times, and amounts.
Call logs, voicemail, recordings lawfully obtained, and notes of what was said.
Screenshots showing the URL, username, date, and time—not only cropped message text.
The installation file or name of any app the scammer instructed you to install.
Your communications with financial institutions and platforms, including case numbers.
A chronological account written while events are fresh.

Export chats if the platform permits it. Store copies in at least two secure places. Do not edit the original files, impersonate the scammer, threaten anyone, publish private account details, or attempt to hack an account yourself.

Where to report the scam

Different reports serve different purposes. Reporting to the bank protects the financial account; reporting to law enforcement supports a criminal investigation; reporting to a regulator addresses conduct within its jurisdiction. One report does not automatically replace the others.

Anti-Scam Hotline 1326

Call 1326 to report scams and cybercrime through the government’s inter-agency response system. DICT identifies 1326 as the national anti-scam hotline, and official government guidance describes it as available 24/7. Reports may also be made through the eGovPH app. DICT and Philippine Information Agency guidance

Have the transaction details, affected number or account, scammer’s contact information, URLs, and your financial institution’s case number ready.

NBI Cybercrime Division

You may file or request investigative assistance from the NBI Cybercrime Division or an appropriate NBI regional office. The NBI’s Citizens’ Charter states that complainants may proceed to the Cybercrime Division to complete a complaint form, with regional cybercrime centers handling regional cases. The NBI also maintains an online complaint page. NBI cybercrime assistance and NBI Online Complaint

Bring valid identification, a concise affidavit or narrative, transaction records, preserved electronic evidence, and copies of prior reports. The investigating office may ask for additional documents.

PNP Anti-Cybercrime Group

You may also report to the nearest police station or the PNP Anti-Cybercrime Group. For online cases, ask how to submit electronic evidence without altering it and obtain the complaint or blotter reference number. Hotline 1326 can help route scam reports to the proper enforcement agency.

BSP-supervised banks, e-wallets, and payment providers

First use the institution’s own Financial Consumer Protection Assistance Mechanism. If its response is unsatisfactory or it does not properly address the complaint, escalate to the BSP Consumer Assistance Mechanism through the BSP Online Buddy (BOB) on the BSP website or official Facebook page. If BOB is unavailable, submit the BSP Complaint/Inquiry/Reply form with proof that you first complained to the institution, by email to consumeraffairs@bsp.gov.ph. BSP complaint instructions

BSP escalation is a consumer-protection process. It does not replace a criminal complaint and does not guarantee reimbursement.

Online shopping disputes

For a business-to-consumer online purchase, complain to the seller and platform immediately and use the platform’s dispute or refund process. Preserve the listing before it disappears.

If unresolved, file through the DTI Consumer CARe system. The Internet Transactions Act applies to covered business-to-business and business-to-consumer internet transactions where the statutory Philippine connection exists. It generally does not cover consumer-to-consumer transactions. Republic Act No. 11967

A fake “personal seller” may still be reported to law enforcement even if the transaction falls outside DTI’s consumer-adjudication coverage.

Investment scams

Report suspected unregistered investment solicitations, fake trading platforms, Ponzi-style schemes, or misuse of a company’s identity to the SEC through its official iMessage ticketing system. Registration as a corporation alone does not necessarily authorize a company to solicit investments from the public.

Also notify the bank or payment provider and file a law-enforcement complaint; an SEC report alone does not freeze or recover your payment.

Misuse of personal data

If an organization mishandled your personal information or a personal-data breach contributed to the incident, notify that organization’s data-protection officer. A complaint against the organization may also fall within the National Privacy Commission’s jurisdiction. This is distinct from reporting the scammer’s criminal conduct.

What Philippine law may cover

The correct charge depends on the evidence, how the deception occurred, who controlled the accounts, and where the acts happened.

Fraud through false pretenses or other means may constitute estafa under Article 315 of the Revised Penal Code. Online commission may also implicate the Cybercrime Prevention Act, but the precise application and penalty must be determined from the proved acts and the charge filed. Revised Penal Code

Republic Act No. 12010, the Anti-Financial Account Scamming Act, separately penalizes specified conduct involving financial accounts, including defined money-muling activities and social-engineering schemes. It also provides mechanisms for inquiries into financial accounts, coordinated verification, and temporary holding of disputed funds. Republic Act No. 12010

Do not assume every failed purchase, unpaid debt, bad investment, or contractual disagreement is automatically criminal estafa. Criminal fraud generally requires proof of the legally required deceit or misappropriation and resulting damage. A transaction may instead—or additionally—support consumer, contractual, civil, regulatory, or administrative remedies.

Will the bank or e-wallet reimburse you?

Not automatically.

The result may depend on whether the transaction was unauthorized, whether it was induced through deception, what authentication was used, how quickly it was reported, whether funds remain intact, the institution’s security controls, and the evidence from all involved institutions.

Under the Anti-Financial Account Scamming Act, compliant institutions are not automatically liable for every scam loss. The law provides for potential restitution where an institution fails to employ the required adequate risk-management systems and controls or fails to make a required temporary hold and that failure causes loss or damage. Those questions require a factual and regulatory determination. AFASA and implementing materials

Do not accept an oral rejection as the end of the matter. Request the decision in writing, the factual basis, relevant transaction and authentication details, and the institution’s escalation procedure.

Common mistakes that reduce the chance of recovery

Waiting for the scammer’s promised refund before contacting the bank.
Reporting only to the social-media platform.
Deleting or cropping messages before saving complete copies.
Paying a “release fee,” “tax,” “verification deposit,” or “recovery charge.”
Giving another OTP after the first loss.
Using contact information supplied by the scammer.
Filing vague reports without transaction references, dates, or recipient details.
Publicly accusing an unverified person who may also be an identity-theft victim or money-mule account holder.
Assuming a police, BSP, DTI, or SEC report automatically reverses a transaction.
Making a false or exaggerated report. AFASA penalizes malicious reporting made in bad faith that causes funds to be held.

When legal help is urgent

Consult a Philippine lawyer promptly if:

The loss is substantial or involves several victims or jurisdictions.
The institution denied the dispute despite apparent account takeover or security failures.
Your identity, business account, or company systems were compromised.
You unknowingly received or transferred suspected scam proceeds.
Police, a bank, or another party treats you as a possible money mule or participant.
The scam involves threats, blackmail, intimate images, trafficking, or danger to a child.
A court order, subpoena, warrant, settlement, waiver, or demand letter has been issued.
Assets may need to be preserved through urgent court relief.
The facts could support both criminal and civil proceedings, and limitation periods must be assessed.

If you are being threatened or someone faces immediate danger, stop engaging, move to safety, and call Unified 911.

FAQ

Is it too late if I reported several hours or days later?

Report now. Delay may make tracing harder, but it does not by itself make a complaint pointless. Give the institution and investigators the exact timeline and explain the delay honestly.

Can a completed InstaPay, PESONet, e-wallet, or remittance transfer still be reversed?

Possibly, but not automatically. The institution may attempt a recall, hold identifiable disputed funds, or coordinate with receiving institutions. Success depends heavily on whether the money remains available and whether the applicable legal and operational requirements are satisfied.

What if I personally pressed “send”?

Report it anyway. A transfer authorized because of impersonation, phishing, fake investment claims, or another deceptive scheme is factually different from an ordinary authorized purchase. Describe exactly what was represented and what caused you to send the money. Do not describe the transfer as technically unauthorized if you initiated it yourself.

Should I contact the recipient?

Usually, let the institutions and investigators handle contact. Direct confrontation can cause evidence or funds to disappear and may expose you to threats. If the transfer was merely an encoding error rather than a scam, follow the bank’s erroneous-transfer procedure.

Do I need an affidavit?

The bank or hotline may accept an initial report without one, but investigators or prosecutors may require a sworn complaint-affidavit and supporting evidence. File the urgent bank report first; prepare the formal documents promptly afterward.

Can I report even if the scammer is abroad?

Yes. Preserve country codes, foreign account details, platform records, cryptocurrency transaction hashes, and all communications. Philippine jurisdiction and international cooperation depend on the facts, but AFASA expressly contemplates certain offenses and harm connected to persons or financial accounts in the Philippines.

Should I pay someone who guarantees recovery?

No legitimate person can guarantee recovery. Verify lawyers through the Supreme Court’s official lawyer-information resources and communicate with agencies through official government domains and published channels. Never provide an OTP, password, recovery phrase, or remote-device access.

This article provides general Philippine legal information, not legal advice or a prediction of recovery or case outcome. Rights and procedures depend on the documents and facts of each incident. Primary laws, BSP rules, and official reporting guidance were last checked on 27 July 2026.