Quick answer

If you paid an online seller or social-media account and suspect fraud, act immediately:

Contact the bank, e-wallet, card issuer, or payment provider at once. Report the transaction as fraudulent or disputed, ask whether the transfer can be recalled or the recipient account restricted, and obtain a reference number.
Report the seller and transaction through the platform’s official complaint or resolution system. Request a refund and preservation of the account, listing, chat, login, and transaction records.
Preserve all evidence before posts or accounts disappear.
Report the incident to the NBI Cybercrime Division, the PNP Anti-Cybercrime Group or your nearest police cybercrime unit. A formal investigation may require your personal appearance, identification, sworn statement, and original device.
For a business-to-consumer purchase, file a consumer complaint with the Department of Trade and Industry if the platform or seller does not resolve it.

Do not wait for the seller to “return the money tomorrow” before notifying the payment provider. Speed matters because transferred funds can be moved through several accounts. Reporting promptly improves the chance of preserving records or funds, but no agency, bank, or platform can guarantee recovery.

What counts as an online shopping scam?

Common examples include:

A seller accepts payment but never intended to deliver the item.
The item, tracking number, proof of shipment, identity, or business registration is fabricated.
A fake social-media page impersonates a legitimate store or person.
A “seller” sends a phishing link and uses the information entered there to access the buyer’s bank or e-wallet.
A buyer or supposed courier sends a fake payment confirmation and tricks the seller into releasing goods or money.
The victim is told to pay repeated “insurance,” “customs,” “verification,” “release,” or “refund processing” charges.
An account is taken over and used to solicit payments from friends or followers.

A late delivery, defective product, or broken promise is not automatically a crime. It may instead be a consumer or contractual dispute. Criminal fraud generally depends on proof of deception, fraudulent intent, reliance, and resulting loss. The exact offense and responsible persons must be determined from the evidence.

Possible laws include the Revised Penal Code provisions on estafa and falsification, the Cybercrime Prevention Act of 2012, and, where financial accounts, social engineering, or money-mule accounts are involved, the Anti-Financial Account Scamming Act. A complainant does not need to select the final criminal charge; accurately describe what happened and let investigators and prosecutors apply the law.

First priority: try to stop the money

Contact the payment provider through the number in its official app, website, or the back of your card—not through a number supplied by the seller.

Tell the provider:

The transaction date, time, amount, and reference number
The recipient’s account name, number, mobile number, or wallet identifier
Why you believe the transaction resulted from fraud
Whether you personally authorized the payment or an unauthorized person accessed your account
When and how you discovered the scam
Whether credentials, an OTP, PIN, card details, or identity documents were exposed

Ask the provider to:

Record a formal fraud or disputed-transaction report
Secure your account and terminate unauthorized sessions
Attempt a recall, chargeback, reversal, or recipient-account restriction, if available
Coordinate with the receiving institution
Preserve transaction and account records
Give you a case or ticket number and written instructions

Different remedies apply to card purchases, bank transfers, e-wallet transfers, cash deposits, and cash-on-delivery transactions. A transfer that the victim personally approved after being deceived may be treated differently from a transaction made after an account takeover. Report the facts honestly; do not label an authorized transfer “unauthorized.”

Under the Anti-Financial Account Scamming Act, BSP-supervised institutions may temporarily hold funds involved in a disputed transaction while verification is conducted. The statutory maximum is 30 calendar days unless a competent court extends it, but the applicable BSP rules and the facts determine whether and for how long funds may be held. A report does not automatically freeze an account or guarantee reimbursement.

If the institution does not resolve your complaint, escalate it through the BSP Consumer Assistance Mechanism. The BSP directs consumers to raise the concern first with the BSP-supervised financial institution. Escalation may be made through the BSP Online Buddy or by sending the prescribed complaint form and supporting documents to consumeraffairs@bsp.gov.ph.

Secure compromised accounts

If you clicked a suspicious link, installed an app, disclosed credentials, or lost control of an account:

Use a clean device to change the password of your email account first.
Change bank, e-wallet, marketplace, and social-media passwords.
Sign out other devices and revoke unfamiliar sessions or connected applications.
Replace reused passwords with unique ones.
Enable multi-factor authentication using the provider’s official settings.
Contact your mobile network if your SIM suddenly loses service or you suspect SIM replacement.
Lock or replace affected cards and credentials.
Review recent transactions, profile changes, forwarding rules, recovery addresses, and linked devices.
Warn contacts if the compromised account may be impersonating you.

Never give an OTP, PIN, password, card verification code, recovery code, or remote access to someone claiming they need it to process a refund.

Preserve evidence before reporting the account

Save evidence first, then block or report the scammer. Preserve:

The complete listing, advertisement, seller profile, page name, username, account ID, and profile URL
Screenshots and screen recordings showing the full page, date, time, and web address where possible
The complete conversation, including voice messages, emails, call logs, and deleted-message notices
Order confirmations, invoices, receipts, delivery records, and tracking information
Bank, card, e-wallet, cash-deposit, or remittance records
The recipient’s account name, account number, QR code, mobile number, and payment reference
Photographs or an unboxing video if the wrong, counterfeit, damaged, or empty package arrived
Copies of identification, permits, registration documents, or supposed proof of legitimacy sent by the seller
The seller’s promises, excuses, refund commitments, and requests for additional payment
Your reports to the platform and payment provider, their replies, and all case numbers
A short timeline listing each material event in chronological order

Keep original files and the device containing the messages. Do not crop, annotate, compress, or repeatedly forward the only copy. Export chats when the service permits it, and back up the evidence securely.

Under the Cybercrime Prevention Act, service providers must preserve specified traffic data and subscriber information for a minimum statutory period, while content data may be preserved after an appropriate law-enforcement order. This does not mean that every platform will retain every post or message indefinitely. Early reporting gives investigators a better opportunity to seek preservation and, when legally required, obtain a court warrant.

Report the account to the marketplace or social-media platform

Use the platform’s official in-app report, dispute, buyer-protection, or resolution process. State the remedy you want—such as cancellation, refund, return, account review, or removal of the fraudulent listing—and attach the strongest evidence.

For covered internet transactions, the Internet Transactions Act of 2023 requires digital platforms and online businesses to maintain redress mechanisms. It generally requires an aggrieved party to use that internal mechanism before filing an administrative complaint, civil action, or pursuing alternative dispute resolution. The mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing.

Keep proof of the date you submitted the platform complaint. Do not let the internal process delay an urgent report to the payment provider or law enforcement when money is moving, an account is compromised, evidence may disappear, or someone is in danger.

File a consumer complaint with the DTI

For a purchase from a business, online merchant, or e-retailer, file through the DTI’s official Consumer Complaints Assistance and Resolution System after using the seller’s or platform’s internal redress process.

Prepare:

Your name and contact details
The seller’s known name, address, contact information, and platform account
A clear statement of facts and timeline
Proof of purchase and payment
The advertisement or product description
Your communications with the seller and platform
Proof that you used the internal complaint system
The specific remedy requested, such as refund, repair, replacement, or delivery

The Internet Transactions Act gives online consumers remedies including repair, replacement, refund, and other remedies available under consumer law, depending on the violation and the condition of the goods. The online merchant or e-retailer is ordinarily the party primarily liable for the transaction. Platform liability is governed by separate statutory requirements and depends on matters such as the platform’s role, notice, diligence, and response.

The Act’s protections generally cover business-to-consumer and business-to-business internet transactions with the required Philippine connection. It expressly excludes consumer-to-consumer transactions—for example, a genuine one-off sale by one private individual to another outside the ordinary course of business. That exclusion does not legalize fraud or prevent a criminal complaint; it means the special Internet Transactions Act framework may not govern that private sale.

A claim for damages under the Internet Transactions Act must be brought before the court or the DTI within two years from the time the cause of action arose. Other claims or offenses may have different periods. Do not assume that one deadline applies to every possible case.

Report the crime to law enforcement

The Cybercrime Prevention Act identifies the NBI and PNP as the principal law-enforcement authorities for cybercrime. You may approach:

The NBI online complaint channel
The NBI Cybercrime Division or an NBI regional or district office
The PNP Anti-Cybercrime Group or a Regional Anti-Cybercrime Unit
Your nearest police station, which can record the incident and refer it to the appropriate unit

The NBI’s published procedure states that a complainant may be interviewed, complete a complaint sheet, execute a sworn statement or submit an affidavit, provide supporting documents, and allow examination of a relevant device. Filing investigative assistance with the NBI is listed as free of charge.

Bring:

At least one valid government-issued ID
Printed and electronic copies of the evidence
The original phone or device, if requested
Payment-provider and platform case numbers
A chronological account of the incident
The names and contact details of witnesses
A list of the accounts, numbers, links, and devices involved

Ask for the complaint, blotter, or reference number and the investigator’s official contact details. A report begins assessment or investigation; it does not itself establish guilt, compel an immediate refund, or guarantee that an anonymous or overseas offender can be identified.

If personal information or identity documents were misused

A scam may also involve identity theft or a data-privacy violation—for example, use of your name, photograph, ID, signature, contact list, or account credentials to impersonate you.

Preserve proof of the misuse, notify the affected platforms and institutions, and consider a complaint with the National Privacy Commission. Follow the NPC’s current complaint-affidavit form and filing instructions. A privacy complaint is separate from a request to reverse a payment or investigate a criminal offense.

If the scammer is abroad or used a foreign account

Report the matter in the Philippines if you were here when the damage occurred, your Philippine financial account was involved, or another jurisdictional connection exists. Philippine cybercrime and financial-account laws contain provisions addressing offenses with cross-border elements.

However, locating a foreign suspect, obtaining overseas platform records, freezing foreign funds, and enforcing a judgment can require formal international cooperation. Give investigators every available identifier, including country codes, foreign account details, web domains, wallet addresses, shipping documents, and time-zone information.

Common mistakes to avoid

Waiting for repeated refund promises. Report promptly while records and funds may still be traceable.
Paying a “recovery agent.” Scammers frequently return pretending to be investigators, lawyers, hackers, or bank employees who can recover the money for an advance fee.
Deleting the conversation after blocking the account.
Posting unredacted IDs, account numbers, addresses, or private conversations publicly.
Editing screenshots or submitting only isolated messages without context.
Continuing to negotiate or threatening the suspect after law enforcement becomes involved. Ask the investigator before further contact.
Misstating an authorized payment as an account takeover.
Using unofficial hotlines, social-media pages, or search advertisements. Verify .gov.ph websites and contact financial providers through their official apps or published numbers.
Assuming a DTI complaint replaces a police report. Consumer redress and criminal investigation serve different purposes.
Assuming a police report automatically produces a refund. Financial, administrative, civil, and criminal remedies have different standards and processes.

When help is urgent

Seek immediate assistance when:

Money has just been transferred and may still be in the recipient account.
Your bank, e-wallet, email, SIM, or social-media account has been taken over.
The scammer has your password, OTP, PIN, recovery code, card details, or identity documents.
The offender is threatening violence, extortion, blackmail, or publication of intimate material.
A child, senior citizen, trafficked person, or other vulnerable person is being targeted.
You are being instructed to receive or forward funds through your own account.
The loss is substantial, several victims are involved, or funds are rapidly moving across accounts.
You receive a supposed warrant, subpoena, or demand for payment from someone claiming to be an officer. Verify it independently with the named agency.

For immediate danger, contact local emergency services or go to the nearest police station. For a significant loss, a complicated business dispute, an overseas suspect, or possible liability involving your own account, consult a Philippine lawyer promptly.

Frequently asked questions

Can I report a scam if I paid voluntarily?

Yes. A payment may have been authorized but induced by deception. Tell the bank and investigators exactly how the scammer persuaded you to pay. Whether the institution must reimburse you depends on the facts, applicable rules, security controls, and evidence.

Can the bank or e-wallet freeze the recipient’s account?

A BSP-supervised institution may temporarily hold funds involved in a disputed transaction in circumstances allowed by law and BSP rules. The provider must assess the report; a complainant cannot personally order a freeze. Courts and authorized agencies may also issue appropriate orders.

Should I report to DTI or the police?

Often both, but for different purposes. DTI handles covered consumer and e-commerce disputes and remedies. The NBI and PNP investigate possible crimes. The payment provider handles account security and possible recall, reversal, or disputed-fund procedures.

What if the seller is only an individual on Facebook or another social platform?

A private consumer-to-consumer sale is generally outside the Internet Transactions Act. You should still report the account to the platform, notify the payment provider, and file a criminal complaint if the facts indicate deliberate fraud. A person who repeatedly sells as a business may not necessarily be a private, one-off seller; the actual circumstances matter.

Do I need to know the scammer’s real name?

No. Provide every identifier you have. Platforms and financial institutions may disclose protected subscriber or account information only through lawful processes, which can include subpoenas, official investigations, or court warrants.

Is a screenshot enough?

It can support a report, but a stronger submission includes complete conversations, URLs, account identifiers, original files, payment records, device data, and a coherent timeline. Investigators may need the original device to authenticate or examine digital evidence.

How long will the case take?

There is no single lawful completion time for every scam report. Timing depends on the agency, available evidence, response of platforms and financial institutions, identification of suspects, need for warrants, number of victims, and cross-border issues. Keep every reference number and follow up through official channels.

Will I definitely get my money back?

No. Recovery depends on whether funds remain available, whether a recall or chargeback applies, the provider’s investigation, the evidence, and any administrative, civil, or criminal proceedings. Anyone guaranteeing recovery in exchange for another advance payment should be treated with suspicion.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the facts, documents, payment method, platform rules, and current agency issuances. Official legal and procedural sources were checked as of 14 September 2026.