Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), creates a Philippine framework against financial-account scams involving bank, e-wallet, and other regulated accounts. It penalizes money-mule activity and social-engineering schemes and gives covered institutions defined powers and duties for investigating suspicious transactions and temporarily holding disputed funds.
Quick answer
Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), can apply to a person who knowingly sells, lends, transfers, or allows another person to control a financial account for unlawful activity; buys or uses another person’s account; recruits money mules; or uses deception to obtain confidential account information. RA 12010 complements, rather than replaces, estafa, cybercrime, access-device, anti-money-laundering, and other laws.
If you are the victim, the first move is the same whatever the scam: report the transaction at once through your bank’s or e-wallet’s own fraud-reporting channel, ask it to hold the disputed funds, and get a case reference number. Under BSP Circular No. 1215 (2025), a complaint-initiated hold starts from a report made through the institution’s 24/7 fraud-reporting channel, and the first hold lasts at most five calendar days.
Rule, qualification, evidence, timing, next step
- Rule — RA 12010 Sec. 4 penalises money muling and social engineering schemes, and Sec. 7 lets BSP-supervised institutions temporarily hold the funds behind a disputed transaction for up to thirty calendar days.
- Qualification — a hold is not a refund. Under Sec. 6, an institution the BSP finds compliant with its risk-management duties is not liable for the loss; one that failed them is liable for restitution, and a conviction is not required for that.
- Evidence — transaction reference numbers, the scam messages and sender numbers, screenshots of alerts, and the institution’s case number. A sworn complaint, affidavit or police report supports any extension of the hold.
- Timing — report immediately. The initial hold is up to 5 calendar days; it can be extended by up to 25 more, and your supporting documents are generally due within the initial period (BSP Circular No. 1215).
- Next step — report to the institution first; escalate an unresolved complaint to the BSP Consumer Assistance Mechanism through BSP Online Buddy; report the crime to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division or the CICC (hotline 1326).
For scam reporting, fraud, identity theft and complaint pathways, continue to the Philippine cybercrime hub.
On this page
- Who and what are covered
- Prohibited acts and penalties
- Temporary hold of disputed funds
- Money-mule liability
- Who investigates
- What to do if you were scammed
- Where to report and what to bring
- If your account was used or your funds were held
- Evidence checklist
- Relationship with other laws
- FAQs
- Sources
Who and what are covered?
RA 12010 Sec. 3(d) defines a financial account to include deposit, trust, investment and credit-card accounts, other transaction accounts with a bank, non-bank or financial institution, e-wallets, and any other account used to avail of financial products or services under RA 11765. “Institutions” under Sec. 3(f) are banks, non-banks, other financial institutions and payment and financial service providers under BSP jurisdiction. BSP Circular No. 1215 treats 13 August 2024 as AFASA’s effectivity date, so its hold-and-verify rules apply to disputed transactions made after that date.
Two limits matter in practice. The BSP holding rules cover electronic transfers between financial accounts. They do not apply to erroneous transfers (sending to the wrong account or the wrong amount through your own encoding error), and they do not cover credit-card transactions except where a card is used for an electronic fund transfer through an automated clearing house (Circular No. 1215).
Prohibited acts and penalties
Sec. 4 lists the core offences, Sec. 5 adds related ones, and Sec. 16 sets the penalties. Imprisonment and a fine may be imposed separately or together, at the court’s discretion.
| Offence | What it covers | Penalty (Sec. 16) |
|---|---|---|
| Money muling (Sec. 4(a)) | Using, lending, selling, buying or renting an account, or recruiting others to do so, to move proceeds known to come from crime or social engineering | 6 to 8 years, or ₱100,000 to ₱500,000, or both; the court may also order the account closed |
| Social engineering (Sec. 4(b)) | Obtaining someone’s credentials by deception, such as posing as a bank or using SMS, email or chat, resulting in unauthorised access to their account | 10 to 12 years, or ₱500,000 to ₱1,000,000, or both |
| Social engineering against a senior citizen | The same scheme where the victim is a senior citizen when the offence is committed | 12 to 14 years, or ₱1,000,000 to ₱2,000,000, or both |
| Economic sabotage (Sec. 4(c)) | Muling or social engineering by three or more people, against three or more victims, using a mass mailer, or through human trafficking | Life imprisonment, or ₱1,000,000 to ₱5,000,000, or both |
| Other offences (Sec. 5) | Aiding or attempting a Sec. 4 offence; opening an account under a fictitious or another person’s identity; buying or selling an account | 4 to 6 years, or ₱100,000 to ₱200,000, or both |
| Malicious reporting (Sec. 11) | Filing, in bad faith, a completely unwarranted or false report that results in funds being held | 1 to 5 years, or ₱50,000 to ₱200,000, or both |
A juridical person faces double the fine, capped at ₱10,000,000, and a government official or employee convicted under Secs. 4 or 5 also suffers perpetual absolute disqualification from public office (Sec. 16(h) and (i)).
Can a bank or e-wallet hold disputed funds?
Yes. RA 12010 Sec. 7 gives institutions authority to temporarily hold the funds subject of a disputed transaction for the period the BSP sets, which may not exceed thirty calendar days unless a court extends it. A transaction is “disputed” when, based on another institution’s information, a complaint, or its own fraud management system, the institution has reasonable ground to believe it is unusual, has no clear economic purpose, comes from an unknown or illegal source, or was facilitated through social engineering.
BSP Circular No. 1215 (Monetary Board Resolution No. 523, 22 May 2025) sets the mechanics:
- Initial hold — up to 5 calendar days, triggered by your complaint through the sending institution’s 24/7 fraud-reporting channel, by a fraud-system alert, or by a request from the sending institution to the receiving one.
- Case reference — the sending institution must acknowledge your complaint and give you a case reference number.
- Extended hold — up to 25 more calendar days where there are reasonable grounds to believe the funds are disputed. Submit your supporting documents (a sworn complaint, affidavit, police report or similar) within the initial holding period, unless the industry protocol provides otherwise.
- Coordinated verification — Sec. 8 requires the institutions and account owners involved to verify the transaction together. Under the Circular it must be completed within the 30-day hold, or within 30 calendar days (extendable to 60 for meritorious reasons) if no funds were held.
- Release — when the hold lapses or the recipient proves the transfer legitimate, the money goes to the recipient, unless a court extends the hold, the recipient waives the funds in writing, or verification reasonably concludes the funds came from money muling, unlawful activity or social engineering. In those cases the amount is returned to the sender’s institution.
A hold buys time; it is not a reimbursement guarantee. Separately, Sec. 6 makes an institution liable for restitution if it failed to employ adequate risk-management controls or the highest degree of diligence, and Sec. 9 makes an institution that failed to hold funds as required liable for the resulting loss. Report quickly: money already withdrawn or moved out of the system may be beyond reach.
Money-mule liability
A person should not assume that “I only lent my account” is a complete defense. The inquiry includes knowledge, intent, recruitment communications, promised compensation, control of credentials, transaction history, withdrawals, and what the account holder did after receiving alerts. Sec. 20 frees victims of trafficking in persons from criminal liability for acts committed as a direct result of being trafficked; a trafficking conviction is not required, but the circumstances must be shown by clear and convincing evidence.
Who investigates an AFASA case?
- The BSP may investigate and inquire into financial accounts that may be involved in a Sec. 4 or Sec. 5 offence, and bank-secrecy and data-privacy laws do not apply to those accounts (Sec. 12). It may also apply for cybercrime warrants under RA 10175 (Sec. 13).
- The NBI and PNP cybercrime units keep their own authority, and the BSP may ask for their help with investigations and with enforcing warrants (Sec. 13).
- The Regional Trial Court has jurisdiction over violations of the Act (Sec. 21).
- Your bank or e-wallet runs the hold and coordinated verification described above. It does not prosecute anyone, but its records are often the core evidence.
What to do if you were scammed: step by step
- Report to your own bank or e-wallet immediately through its official fraud-reporting channel (the app, or a hotline or website you look up yourself, never a number from the scam message). Give the transaction reference numbers, ask it to hold the disputed funds and start coordinated verification, and write down the case reference number.
- Contain the account. Use the in-app lock if your institution offers one, change passwords and PINs from a device you trust, and check whether the registered mobile number or email was changed.
- Preserve the evidence before anything is deleted: screenshots of messages, call logs, links, sender numbers and the transaction history.
- Within the initial 5-day hold, give the institution your supporting documents — a sworn complaint, affidavit or police report describing what happened — so an extended hold can be considered.
- Report the crime to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division, or report the scam to the CICC. A police report also counts as a supporting document for the hold.
- Escalate if the institution fails you. If your complaint is unresolved or ignored, file with the BSP Consumer Assistance Mechanism, with proof that you used the institution’s complaint channel first.
The first concrete action: open your banking or e-wallet app yourself, report the transaction as fraud now, and save the case number. Everything else builds on that record. For more detail, see Cybercode’s online-scam complaint procedure, the phishing containment guide and the electronic-evidence checklist.
Where to report and what to bring
Each route does something different. Using more than one is normal; none of them guarantees the money comes back.
| Where | What it can do | What to bring |
|---|---|---|
| Your bank or e-wallet (first level) | Hold disputed funds, run coordinated verification, give you a case number and decide your complaint | Transaction references, date and time, scam messages, and a sworn statement or police report |
| BSP Consumer Assistance Mechanism (second level) | Take up an unresolved complaint, then mediation or adjudication of purely civil money claims up to ₱10,000,000 | Proof you used the institution’s channel, its reply or case number, and your evidence |
| PNP Anti-Cybercrime Group or NBI Cybercrime Division | Investigate the offence and build a criminal case (acg@pnp.gov.ph; ccd@nbi.gov.ph) | Your sworn statement, printed screenshots, transaction records and the institution’s case number |
| CICC (hotline 1326) | Receive scam reports and coordinate with law enforcement (report@cicc.gov.ph) | The scam details, numbers and links used, and transaction references |
To escalate to the BSP, chat with BSP Online Buddy (BOB) through the webchat on the BSP website or the BSP Facebook page until you receive a reference number. If you cannot use BOB, email a completed complaint form to consumeraffairs@bsp.gov.ph with proof that you first used the institution’s complaint channel. The BSP says its consumer assistance process may take 55 to 65 days from receipt of the complaint; mediation and adjudication follow only after it. The agency contact details above are as published by the BSP in its complaint-filing notice. Our cybercrime reporting directory and CICC explainer cover each agency’s role, and for e-wallets specifically see unauthorised e-wallet transactions and the refund path.
If your account was used or your funds were held
If you are the recipient whose funds were held, Circular No. 1215 lets you challenge the hold or ask for it to be lifted at any time by giving your institution evidence that the transaction was legitimate, such as affidavits, proof of the purpose of the payment, your relationship with the sender, or the source of funds. If that is substantiated, the institution must lift the hold immediately. If someone else used your account to move scam money, stop further transfers, do not withdraw the funds, cooperate with the verification, and get legal advice before giving a statement: Secs. 4(a) and 16(a) expose account holders who knowingly let their accounts be used. See money-mule accounts and the account holder’s liability.
Evidence checklist
- Transaction receipts and reference numbers
- Full account names, numbers, wallet identifiers, and bank details
- Messages, calls, emails, links, advertisements, and impersonated profiles
- Device, login, OTP, and security-alert records
- Institutional complaint acknowledgments and investigation responses
- Evidence connecting recruiters, mule accounts, withdrawals, and beneficiaries
- Your sworn complaint, affidavit or police report, and the institution’s case reference number
Relationship with other laws
Section 19 preserves possible prosecution under other laws, including the Access Devices Regulation Act, Anti-Money Laundering Act, Cybercrime Prevention Act, and Revised Penal Code. Each offense must be matched to its own elements, and constitutional protections against duplicate punishment remain relevant.
Frequently asked questions
Is lending a bank account automatically a crime?
Liability depends on the prohibited act and required knowledge or intent. Lending an account for an unlawful scheme can create serious exposure.
Are e-wallets covered?
They may be when the account and provider fall within the Act’s definitions and BSP-supervised framework.
Does reporting guarantee recovery?
No. Rapid reporting improves the chance of tracing or holding funds but does not guarantee reimbursement.
Can a victim pursue estafa too?
Potentially. AFASA expressly operates alongside other criminal laws, but prosecutors must avoid legally impermissible duplicate punishment.
How long can a bank or e-wallet hold disputed funds?
Up to thirty calendar days under RA 12010 Sec. 7: an initial hold of up to five calendar days and an extension of up to twenty-five more under BSP Circular No. 1215. Only a court can extend it beyond thirty days.
Where do I report an AFASA scam?
Report first to your own bank or e-wallet through its fraud-reporting channel and get a case number. Escalate an unresolved complaint to the BSP Consumer Assistance Mechanism, and report the crime to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division or the CICC hotline 1326.
Sources
- Republic Act No. 12010, Anti-Financial Account Scamming Act, with BSP Circular Nos. 1213, 1214 and 1215, Series of 2025 — Bangko Sentral ng Pilipinas (RA 12010 Secs. 3–9, 11–13, 16, 19–21; Circular No. 1215 on temporary holding and coordinated verification).
- Republic Act No. 11765, Financial Products and Services Consumer Protection Act — Bangko Sentral ng Pilipinas (Sec. 6(f), BSP adjudication of money claims up to ₱10,000,000).
- BSP FAQ on Circular No. 1169 — the BSP consumer assistance mechanism, mediation and adjudication.
- BSP — How to file a complaint against a BSP-supervised institution — BSP Online Buddy, and the PNP, NBI and CICC contact details.
This article provides general legal information, not legal advice. Liability and remedies depend on the statutory elements, evidence, and current implementing rules.
Related: Investment or crypto scam: how to report it and what the SEC can do — including where this Act’s social engineering definition stops short of a transfer you made yourself.
Related: how an unauthorised e-wallet transaction dispute works in practice, including the temporary hold and coordinated verification under Secs. 7 and 8.
Sources rechecked as of: October 2, 2026