CyberCode.ph · Philippines

Investment or Crypto Scam in the Philippines: How to Report It and What the SEC Can Do

Last updated October 4, 2026 · Practical privacy, cybersecurity and technology-law guidance
Desk with a laptop and phone showing candlestick trading charts

The short answer

Report an investment or crypto scam in three places, in this order: your bank or e-wallet first, because only the payment provider can hold the money and the hold is capped at 30 calendar days; then the Securities and Exchange Commission, which can investigate the scheme, issue a cease and desist order and revoke a registration but is not a refund counter; then the NBI or PNP Anti-Cybercrime Group for the criminal case. Three bodies, three different objectives, and only one of them touches your money.

Rule, exception, evidence, timing, next step

Element What applies to an investment or crypto scam
Rule Republic Act No. 8799 requires a registration statement before securities are sold in the Philippines, and requires the seller to be registered too. Most scams fail both tests.
Exception The SEC can order a financial service provider to reimburse up to ten million pesos. It has no such power over an unregistered operator that was never its licensee.
Evidence The transfer receipts, the recipient account name and number, the solicitation messages, the platform screenshots showing your balance, and the withdrawal refusal.
Timing A disputed-transaction hold runs 5 calendar days, extendable to 25 more, 30 at the outside. Traffic data and subscriber information are preserved for six months.
Next step Call your bank or e-wallet now and use the words disputed transaction. Everything else can wait an hour; that hold cannot.

Key takeaways

  • The SEC does not get your money back. Its powers are registration, investigation, cease and desist orders and revocation. Recovery, if it happens at all, happens through the payment provider or a court.
  • The payment lane has a hard clock and the others do not. Section 7 of the Anti-Financial Account Scamming Act caps a hold of disputed funds at 30 calendar days, and the Bangko Sentral has split that into an initial 5 days plus up to 25 more.
  • There are two statutory tests you can apply yourself. Was a registration statement filed and approved for what you were sold? Was the person selling it a registered broker, dealer or salesman? Both questions come straight from the text of Republic Act No. 8799.
  • Being tricked into paying is not the same as an unauthorised transaction. If you authorised the transfer yourself, the remedies are different, and the distinction decides which guide you need. See unauthorised bank and e-wallet transactions.
  • The account that received your money may itself be a mule account. That is a separate offence under the Anti-Financial Account Scamming Act, and it is the reason a coordinated verification process exists between the two institutions.
  • Non-delivery of a promised return can be estafa. The peso brackets that set the penalty are in Republic Act No. 10951, and they are verified on the online estafa guide.
  • Selling unregistered investments is a crime and a civil wrong. On conviction, Section 73 of Republic Act No. 8799 provides a fine of fifty thousand to five million pesos, seven to twenty-one years’ imprisonment, or both; separately, the buyer may sue the seller in the Regional Trial Court to recover what was paid, within two years after the violation (Sections 57.1(a), 62.1 and 63.1).

On this page

Three lanes, three different objectives

Almost every guide to investment scams in the Philippines tells you to report to the SEC and stops there. That is the least useful of the three routes if what you want is your money. The three bodies below do different jobs, on different timetables, and you should open all three, in this order.

Lane Who runs it What it can actually achieve
Payment lane Your bank or e-wallet, supervised by the Bangko Sentral ng Pilipinas A temporary hold on the disputed funds, a coordinated verification with the receiving institution, and in the best case a return of the money to the source institution.
Regulatory lane The Securities and Exchange Commission Investigation of the scheme, a cease and desist order, revocation proceedings, and a public advisory that stops other people losing money. No refund.
Criminal lane The NBI or the PNP Anti-Cybercrime Group, then a prosecutor and a Regional Trial Court A criminal case for estafa or for a computer-related offence. Restitution is possible on conviction, but the timetable is years, not days.

The reason the order matters is that only one of the three lanes has a deadline measured in days. Read the payment lane first even if the scheme is obviously a large one, then come back to the regulator. Our online scam complaint procedure is the general parent guide for that sequence, and the hacked or scammed help directory routes other problem types.

The first hour: the payment lane comes first

Call the bank or e-wallet you paid from and say that you are reporting a disputed transaction. That phrase matters, because it is the phrase the regulation uses. Republic Act No. 12010, the Anti-Financial Account Scamming Act, provides in Section 7 that an institution may temporarily hold the funds subject of a disputed transaction within the period the Bangko Sentral prescribes, not exceeding thirty (30) calendar days. Section 8 then requires the institutions and the account owners involved to begin a coordinated verification process once a complaint is filed or a fraud management system flags the transfer.

The Bangko Sentral has filled in that period. Its 2025 circular on the temporary holding of funds, issued under Monetary Board Resolution No. 523 dated 22 May 2025, sets an initial hold of not more than 5 calendar days and an extension of not more than 25 calendar days, for a maximum of 30, which only a court order can lengthen. The grounds for a hold include a transaction that appears unusual, lacks a clear economic purpose, comes from an unknown or illegal source, or was facilitated through social engineering.

Two consequences follow, and both are practical. First, a report made on day eight has already lost the initial window. Second, the circular requires the institution to notify the beneficiary of the transaction reference, the amount, the transfer mode, the date and time, the general reasons for the hold, and how to challenge it. That means the receiving side finds out, which is why speed matters more than completeness: file the dispute with what you have, and supply documents afterwards.

The same circular carries a warning that cuts the other way. Malicious false reporting of a disputed transaction is itself an offence under the Act. Report what happened, not what you suspect.

If you paid from GCash or Maya, the provider-specific reporting flows are on our GCash scam and phishing and Maya and PayMaya scam and phishing pages. If the money left a bank account, digital payment consumer rights sets out the Bangko Sentral route.

Was it actually an investment scam? Two statutory tests

Most consumer material answers this question with behavioural red flags: guaranteed returns, pressure to recruit, a withdrawal that suddenly requires a fee. Those are useful, but they are not the test a regulator applies. The Securities Regulation Code, Republic Act No. 8799, approved on 19 July 2000, gives two questions you can answer yourself, and a scheme that fails either one is already unlawful whatever its returns look like.

Test The statutory words What to ask
Was the product registered? Section 8.1: securities “shall not be sold or offered for sale or distribution within the Philippines, without a registration statement duly filed with and approved by the Commission”. Is there a registration statement for the exact thing you bought, approved by the SEC? Not a business registration, and not a certificate of incorporation. A registration statement for the security.
Was the seller registered? Section 28: “No person shall engage in the business of buying or selling securities in the Philippines as a broker or dealer, or act as a salesman, or an associated person of any broker or dealer unless registered as such with the Commission”. Is the individual who solicited you a registered broker, dealer, salesman or associated person? A recruiter in a group chat almost never is.
Was there deception? Section 26: it is unlawful for any person, directly or indirectly, in connection with the purchase or sale of any securities “to employ any device, scheme, or artifice to defraud”. Were you told something untrue about the returns, the risk, the licence or where the money goes? This is the antifraud provision, and it stands on its own.

The first two tests are the reason the SEC publishes advisories naming specific entities: the Commission is not asserting that a scheme has failed, it is stating that the entity is not registered to sell what it is selling. That is a narrower and more provable claim, and it is the one you can check before you pay.

A point worth holding on to: a company can be validly incorporated with the SEC and still be committing an offence by selling unregistered investments. Corporate registration and securities registration are different filings. Our guides on business name versus SEC registration and the online business compliance checklist set out what a corporate registration does and does not prove.

What the SEC can and cannot do

The SEC describes its own Enforcement and Investor Protection Department as handling, among other things, investigation, the cease and desist order and revocation proceedings, alongside mandatory disclosure and anti-money-laundering compliance. That description is published in the Commission’s own contact notice and is the clearest statement of the department’s remit available from an SEC host.

Separately, Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, approved 6 May 2022, names the SEC as one of four financial regulators — with the “Bangko Sentral ng Pilipinas (BSP), Securities and Exchange Commission (SEC), Insurance Commission (IC), and the Cooperative Development Authority (CDA)”. Section 4 provides that the Act “applies to all financial products or services offered or marketed by any financial service provider”. Section 6(f) then gives the regulator a genuine money power: it may adjudicate a claim that is purely civil in nature where the relief sought is “solely for payment or reimbursement of sum of money not exceeding the amount of Ten million pesos (P10,000,000.00)”.

Question Answer
Can the SEC stop the scheme? Yes. Investigation, a cease and desist order and revocation proceedings are the department’s named functions.
Can the SEC warn the public? Yes, and it does so by publishing advisories that name the entity and state that it is not registered to solicit investments.
Can the SEC order money reimbursed? Under Republic Act No. 11765 Section 6(f), up to ten million pesos — but that power runs against a financial service provider, which is what the Act covers. It is not a route against an unregistered operator that was never a licensee.
Can the SEC prosecute? No. Criminal complaints go to a prosecutor. The SEC’s role in a criminal case is referral and evidence, not prosecution.
Can the SEC recover crypto sent abroad? No. Nothing in its published remit reaches an offshore wallet, and this guide asserts no mechanism that would.

Two further statutory powers matter for a victim, and both reach unregistered operators. First, Republic Act No. 11765 makes investment fraud unlawful for any person (Section 11), and defines it to include Ponzi schemes, boiler-room operations and “the offering or selling of investment schemes to the public without a license or permit from the SEC” (Section 3(f)). For persons found responsible, Section 16 lets the SEC impose a fine of fifty thousand to ten million pesos for each instance, plus up to ten thousand pesos a day for a continuing violation, and Section 17 lets a financial regulator bring an independent civil action on behalf of aggrieved consumers, with any civil penalty going into a fund for their benefit. Second, under Section 64 of Republic Act No. 8799 the SEC may issue a cease and desist order without a prior hearing, on its own or “upon verified complaint by any aggrieved party”, where the practice will operate as a fraud on investors. A verified complaint from you can start that process. Neither power guarantees that your own money comes back.

This is the single most important correction in this guide. The reason so many victims describe the SEC as useless is that they went to it expecting a refund. Go to it to stop the scheme and to build the record; go to the payment provider for the money. Our guide to Republic Act No. 11765 covers the consumer-protection framework in full.

The SEC complaint machinery, as the SEC publishes it

The Commission publishes a step-by-step complaint procedure, and it is worth reading even though it is written for a different kind of complaint, because it shows you what the machinery looks like from the inside. The published procedure covers registered lending and financing companies holding a Certificate of Authority; the same page states that complaints outside that scope may be endorsed to other agencies.

Stage What the SEC’s published procedure says
What you file The Commission’s complaint form, completed “completely and accurately”, with all supporting evidence and a valid government-issued identification document.
Documents named “disclosure statement, amortization schedule, receipts, promissory notes, and other relevant documents” — in an investment case, read that as the contract, the receipts and the account statements.
How it is filed By email with the attachments. The address published for the lending and financing route is cgfd_md@sec.gov.ph.
What happens next The SEC evaluates the complaint and sends a copy to the company, which has “ten (10) days from receipt to give their answer/comment”.
Possible outcomes The Commission may ask you for a reply, close the complaint, or, if warranted, issue a Formal Charge.
Stated limits The Commission says it cannot modify loan terms, void interest rates, void contracts or cancel loan obligations. The same logic applies to an investment contract: the SEC is not a civil court.

Two honest limits on this section. First, that email address and that ten-day step belong to the lending and financing route, not to an investment-scam complaint, and this guide does not claim otherwise. Second, no SEC complaint address, form or timetable for reporting an unregistered investment solicitation could be read from a government host on the date below, because every relevant page on the Commission’s site returned an error to this review. Use the contact details on the Commission’s own site at the moment you file, and do not rely on an address copied from a guide, including this one.

For the loan-app case specifically — harassment, contact scraping, threats from collectors — that lending and financing route is the right one, and the Republic Act No. 11765 framework sits behind it.

The bank and e-wallet lane, with its clocks

If you paid a bank or an e-wallet account, the institution you paid from owes you a documented complaint process, and that process has published deadlines. The Bangko Sentral’s Manual of Regulations for Banks sets them out in its appendix on consumer assistance, and the appendix states them simply in days, without saying whether banking or calendar days are meant.

Step Deadline
Acknowledge your complaint Within 2 days
Resolve a simple complaint Within 7 days
Communicate the outcome of a simple complaint Within 9 days
Resolve a complex complaint Within 45 days
Communicate the outcome of a complex complaint Within 47 days

Where a complex case will overrun, the institution must give you the reason, say that it needs an extended timeframe, and tell you when the outcome can be expected. The outcome must come to you in writing, in simple and clear language, and must set out the remedies available — including escalation to the Bangko Sentral and to court.

Escalation is a gate, not a parallel track. The Bangko Sentral’s own consumer assistance mechanism requires a complaint to go through the institution’s process first, and the Bangko Sentral describes its own process as one that “may take 55 to 65 days starting from the receipt of the complaint”. Its adjudication jurisdiction, like the SEC’s, is limited to claims solely for payment or reimbursement of a sum not exceeding ten million pesos.

One more provision is worth knowing because it decides the refund argument. Section 1002 of the Manual requires the product’s terms and conditions to state the procedures for reporting unauthorized transactions and other contingencies, and the liabilities of the parties in such a case. The honest answer to must the wallet refund me is that no single statutory rule fixes it. Section 6 of the Anti-Financial Account Scamming Act read together with your contract does: an institution that complied with the law is not liable for the loss, while a non-compliant institution is liable for restitution to account owners, and a conviction is not a prerequisite.

The criminal lane: estafa, RA 10175 and who investigates

An investment scheme that takes money on a promise it never intends to keep is, in ordinary Philippine practice, charged as estafa under Article 315 of the Revised Penal Code, with the penalty brackets set by Republic Act No. 10951. Where the scheme ran through a computer system, Section 6 of the Cybercrime Prevention Act, Republic Act No. 10175, provides that the penalty for a Revised Penal Code offence committed by, through and with the use of information and communications technology shall be one degree higher than that provided for the offence. Our online estafa guide carries the peso brackets in full and the Cybercrime Prevention Act guide covers Section 6 and the offence list.

Who actually takes the complaint matters, and it is a point on which a great deal of published advice is wrong. Section 10 of Republic Act No. 10175 makes the NBI and the PNP responsible for enforcement and requires each to organise a cybercrime unit manned by special investigators. Section 21 gives jurisdiction to the Regional Trial Court, with designated special cybercrime courts. The Cybercrime Investigation and Coordinating Center, by contrast, is a policy-coordination body: the statute gives it no complaint-intake, investigative, arrest, warrant or prosecution power at all. That is set out in detail on our CICC guide.

There is one government hotline worth knowing. A Philippine Information Agency release dated 31 December 2025 describes hotline 1326 as the government’s 24/7 central number for reporting online selling scams, dubious messages, romance scams, impersonation and investment fraud, run as an inter-agency arrangement of the CICC, the DICT, the National Privacy Commission and the NTC. That is a government news release rather than an issuance, and it is cited here as reported, with its date. For the filing routes themselves, see how to report cybercrime, the cybercrime reporting directory and the PNP Anti-Cybercrime Group complaint process.

Where the Anti-Financial Account Scamming Act helps, and where it does not

Republic Act No. 12010 is the newest and most useful instrument in this area, and it is also the one most often described too broadly. Its definitions decide whether it reaches your case.

Provision What it covers Why it matters to an investment scam
Section 3, financial account Expressly includes an e-wallet, alongside deposit, trust, investment and credit-card accounts. The Act reaches the wallet you paid from, not only a bank account.
Section 3, social engineering scheme Obtaining another person’s sensitive identifying information by deception or fraud, resulting in unauthorised access and control over their financial account. This is the limit. If you transferred the money yourself and nobody took control of your account, your case may sit outside this definition even though you were plainly deceived.
Section 4(a), money muling Obtaining, receiving, depositing, transferring or withdrawing proceeds known to derive from crimes or social engineering schemes. The collection account your money landed in is very often a mule account, and that is an offence in its own right. See money mule account liability.
Section 6, liability An institution that complied is not liable; a non-compliant institution is liable for restitution to account owners, and conviction is not a prerequisite. This is the provision that makes an institution’s own compliance the live question in a refund dispute.
Sections 7 and 8 A temporary hold not exceeding 30 calendar days, and a coordinated verification process once a complaint or a fraud-management finding arises. The only mechanism in Philippine law that can freeze the money while the facts are established.
Section 12 The Bangko Sentral may investigate and inquire into financial accounts possibly involved in a prohibited act, and bank secrecy under Republic Act No. 1405 does not apply. It removes the objection that the receiving account cannot be looked at.

The penalties are severe where the Act does bite. Under Section 16, money muling carries 6 to 8 years, a fine of one hundred thousand to five hundred thousand pesos, or both. Social engineering carries 10 to 12 years, a fine of five hundred thousand to one million pesos, or both, rising to 12 to 14 years, one million to two million pesos, or both where the victim is a senior citizen. Economic sabotage — three or more conspirators, three or more victims, a mass mailer, or human trafficking — carries life imprisonment, a fine of one million to five million pesos, or both. A large recruitment-based investment scheme with many victims is precisely the shape the economic-sabotage provision was written for. Our guide to Republic Act No. 12010 covers the Act in full.

On the effectivity date, one caution. Section 26 provides that the Act takes effect fifteen days after publication, and it was approved in 2024. This guide states no exact effectivity date, because the publication line itself was not read.

Crypto specifically, and what could not be verified

A crypto scam raises the same three lanes, with one difference that changes everything: once the asset leaves a Philippine peso rail, the payment lane closes. If you bought crypto on a local exchange and then sent it to a wallet address the scheme gave you, the transfer that a Philippine institution can still see is the peso payment into the exchange, not the on-chain transfer out. That is the transaction to dispute, and the window is the same 5 plus 25 days.

Where the scheme took pesos directly — you transferred to a bank or e-wallet account and were shown a balance on a trading dashboard — it is not really a crypto case at all. It is an unregistered investment solicitation with crypto branding, and the two tests in the section above apply unchanged.

Three honest limits, because this is the part of the subject where confident writing is cheapest:

  • No SEC rule on crypto-asset service providers is cited here. The Commission’s own memorandum-circular index lists rules for crypto-asset service providers, but every page carrying their text returned an error to this review, so this guide states no circular number, no date and no requirement from them.
  • No Bangko Sentral virtual-asset regulation is cited here. The circular that would set out virtual-asset service provider licensing is behind a robots restriction on the Bangko Sentral’s site and could not be read.
  • No Philippine case law is cited anywhere on this page. The Supreme Court’s own site answers at its root but serves no decision text to this review, so no holding is characterised. You can browse it yourself at sc.judiciary.gov.ph.

What this guide does say about crypto is limited to what the statutes actually provide: a crypto-branded scheme that sells an investment contract still needs a registration statement under Section 8.1, the person selling it still needs to be registered under Section 28, and Section 26 still catches the deception. For the technology side, see our note on crypto security and stablecoin payments.

What to preserve, and the six-month decay timer

Evidence in this kind of case decays on a schedule that is not yours. Section 13 of Republic Act No. 10175 requires service providers to preserve traffic data and subscriber information for six months from the date of the transaction, and content data for six months from receipt of a law-enforcement order, extendable once by six months. Once the material is used in evidence and the transmittal to the prosecutor is documented, preservation continues until the case is terminated. The practical reading is that the account records behind the scheme have a shelf life, and the clock started the day you paid.

Preserve these, and preserve them as files rather than as photographs of a screen where you can:

  • The transfer records. Reference numbers, exact amounts, dates and times, and the recipient account name and number exactly as your app displayed them.
  • The solicitation. The messages, group chats, calls, advertisements or livestreams that persuaded you, with the account handles and the dates, and the name of anyone who recruited you.
  • The platform itself. Screenshots of your dashboard balance, the withdrawal request, the refusal, and any demand for a fee, tax or upgrade before withdrawal. That demand is the single most probative document in the file.
  • The paper. Any contract, certificate, receipt, memorandum of agreement or profit-sharing document, however unofficial it looks.
  • The claims about licensing. Any screenshot where the scheme claimed to be SEC registered, licensed or accredited. A false statement about a licence goes to Section 26.
  • Your own identification and, if you are a joint or corporate account holder, proof of your authority, because a complaint form will ask for both.

Our online scam evidence checklist gives the bundles by recipient, and electronic evidence in the Philippines explains what makes a screenshot usable rather than merely available. Do not confront the recruiter, and do not tell them you are filing; accounts get deleted, and with them the records you need.

Your options and what to do next

These are the realistic options, what each one can achieve, where it goes and what to bring. Open the first three in parallel on the same day; the rest follow.

Option Where it goes and what it can achieve What to bring, and by when
Dispute the payment Your own bank or e-wallet. The only route that can hold the money: an initial 5 calendar days, extendable to 25 more, 30 at the outside, with a coordinated verification between the two institutions. Transfer reference, amount, date and time, recipient account name and number. File today, supply the rest later.
Formal written complaint to the institution The same bank or e-wallet, in writing, so the Manual of Regulations clocks start: acknowledgement in 2 days, a simple complaint resolved in 7 and answered in 9, a complex one in 45 and 47. The dispute reference, a short chronology, and the evidence bundle. Ask for the reference number and the name of the handling unit.
Report the scheme to the SEC The Securities and Exchange Commission. Investigation, a cease and desist order, revocation proceedings and a public advisory. Not a refund. The solicitation material, any licensing claim, the entity and individual names, and your evidence. Use the contact details published on the Commission’s own site on the day you file.
Criminal complaint The NBI Cybercrime Division or the PNP Anti-Cybercrime Group, then the prosecutor, then a Regional Trial Court under Section 21 of Republic Act No. 10175. A sworn statement, your identification, the full evidence bundle, and the mule account details. Go within the six-month preservation window.
Escalate to the Bangko Sentral The Bangko Sentral consumer assistance mechanism, but only after the institution’s own process has run. Its adjudication reaches claims solely for payment or reimbursement not exceeding ten million pesos, and it describes the process as taking 55 to 65 days. The institution’s written outcome or proof that it failed to respond, plus everything you already filed.
Civil action A court, for the money itself. Under Section 57.1(a) of Republic Act No. 8799, a person who sells a security without the required registration is liable to the buyer, who may sue to recover what was paid, with interest. Section 63.1 gives the Regional Trial Court exclusive jurisdiction over that suit. Slower and costlier, but it can order an individual to pay you. Legal advice on the amount and the cost, and the full file with the seller’s identity. Section 62.1 requires a Section 57.1(a) suit within two years after the violation.
Warn other people Report the account, page or advertisement to the platform, and tell anyone the recruiter also approached. This is the only step that reliably reduces the total loss. Nothing beyond the handles and links. Do it after you have preserved your own evidence, not before.

The first concrete action

Open your banking or e-wallet app, find the transfer, and call the provider’s official number now to report a disputed transaction, giving the reference number and the recipient account. Ask for a dispute reference and write it down. That single call starts the only clock in this whole subject that can still reach your money, and it takes ten minutes. Our scam and hack triage tool will sequence the rest for your specific situation.

Five worked scenarios

  • A group chat trading mentor, paid by GCash three days ago, dashboard shows a profit, withdrawal now needs a release fee. The release fee is the tell and the best document in your file. Dispute the GCash transfers today, inside the 5-day initial window. Report the scheme to the SEC: the mentor is almost certainly unregistered under Section 28 and the product unregistered under Section 8.1. The fee demand goes to Section 26 as a device to defraud.
  • A registered corporation sold shares in a project, with a certificate of incorporation shown as proof. Corporate registration is not securities registration. The question is whether a registration statement was filed and approved for that offering, and whether the seller is a registered salesman. Report to the SEC with the certificate, and dispute the payment separately.
  • Pesos converted to crypto on a local exchange, then sent to a wallet address the scheme provided. The on-chain transfer is gone. Dispute the peso payment into the exchange and tell the exchange the destination address was supplied by a scheme; it is also worth reporting to the exchange’s own fraud channel. Then take the criminal route, because the addresses and the platform records are what an investigator can still work with.
  • The recipient turns out to be an ordinary person who says their account was used. That is the money mule pattern, and it is an offence under Section 4(a) of the Anti-Financial Account Scamming Act whether or not they profited. Do not negotiate with them directly. Give the account details to your institution, which has a statutory coordinated verification process for exactly this, and to the investigators. See money mule account liability.
  • You recruited friends and family before it collapsed. You are a victim and, on the face of the money-muling and antifraud provisions, potentially exposed too, depending on what you knew and whether you handled other people’s funds. Preserve everything showing you were deceived, do not collect or forward any further money, and get legal advice before making a statement. Our online estafa guide sets out the victim-versus-participant distinction.

Common mistakes

  • Going to the SEC first and nowhere else. By the time a regulatory complaint is acknowledged, the 5-day payment window has closed.
  • Paying the release fee. A platform that demands a payment before it will release your own balance is not going to release it after the payment either.
  • Confronting the recruiter. It gets accounts deleted and evidence lost, and it has never once produced a refund.
  • Treating a screenshot of the dashboard as proof of the loss. It proves what you were shown, not what you paid. The transfer records are the loss; the dashboard is the deception.
  • Describing an authorised transfer as an unauthorised transaction. The two have different remedies, and the mislabelling costs you credibility at the start. Read unauthorised bank and e-wallet transactions for the distinction.
  • Reporting a suspicion as a fact. Malicious false reporting of a disputed transaction is itself an offence under the Anti-Financial Account Scamming Act.
  • Waiting to file until the file is complete. File with the transfer reference alone if that is all you have; the documents can follow.
  • Sending fresh money to recover old money. Recovery agents who ask for a fee are the second wave of the same scheme.

Every clock on one page

Clock Period Where it comes from
Initial hold on disputed funds Not more than 5 calendar days Bangko Sentral 2025 circular on temporary holding of funds
Extended hold Not more than 25 further calendar days The same circular
Absolute cap on the hold 30 calendar days, longer only by court order Republic Act No. 12010, Section 7
Acknowledgement of your complaint 2 days Manual of Regulations for Banks, consumer assistance appendix
Simple complaint resolved, then answered 7 days, then 9 The same appendix
Complex complaint resolved, then answered 45 days, then 47 The same appendix
Bangko Sentral consumer assistance process May take 55 to 65 days from receipt Bangko Sentral FAQ on its consumer assistance mechanism
Preservation of traffic data and subscriber information 6 months from the transaction Republic Act No. 10175, Section 13
Suit against an unregistered seller to recover what you paid Within 2 years after the violation Republic Act No. 8799, Sections 57.1(a) and 62.1
Actions and claims under the financial consumer protection law 5 years from the transaction or from discovery of the deceit, and never more than 10 years from the violation Republic Act No. 11765, Section 14

No deadline for reporting a scheme to the SEC, and no deadline for a criminal complaint, was read from a primary source this run. Treat the six-month preservation period as the practical outer limit for gathering evidence, and the two-year limit in Section 62.1 as the deadline to keep in view if you may sue the seller.

Frequently asked questions

Will the SEC get my money back?

No. The Commission’s published enforcement functions are investigation, the cease and desist order and revocation proceedings. It can adjudicate a purely civil money claim up to ten million pesos under Section 6(f) of Republic Act No. 11765, but that power runs against a financial service provider the Act covers, not against an unregistered operator. Money recovery, if it happens, happens through the payment provider or a court.

How quickly do I have to report to my bank or e-wallet?

Immediately. The initial hold on disputed funds is not more than 5 calendar days, with an extension of not more than 25 more and an absolute cap of 30 calendar days under Section 7 of Republic Act No. 12010. Nothing in the regulation restores a window you have already let close.

Is an investment scam a crime, or only a regulatory violation?

It can be both. Selling unregistered securities and selling without registration are violations of Republic Act No. 8799; taking money on a promise never intended to be kept is ordinarily charged as estafa; and where the scheme ran through a computer system, Section 6 of Republic Act No. 10175 raises the penalty one degree. A violation of Republic Act No. 8799 itself carries, on conviction, a fine of fifty thousand to five million pesos, seven to twenty-one years’ imprisonment, or both (Section 73).

The company showed me its SEC registration. Does that mean it was legitimate?

No. A certificate of incorporation shows that a company exists. Section 8.1 of Republic Act No. 8799 requires a separate registration statement, filed with and approved by the Commission, before securities are sold. The two filings are different, and scams routinely display the first to imply the second.

I sent crypto, not pesos. Is there anything to dispute?

Usually only the peso payment that bought the crypto. Dispute that with the institution you paid and tell the exchange the destination address came from a scheme. The on-chain transfer itself is outside the reach of the Philippine disputed-funds regime, and this guide asserts no mechanism that would recover it.

The recipient says their account was just borrowed. Does that help them?

Not on the face of the statute. Section 4(a) of Republic Act No. 12010 covers obtaining, receiving, depositing, transferring or withdrawing proceeds known to derive from crimes or social engineering schemes, and the penalty is 6 to 8 years, a fine of one hundred thousand to five hundred thousand pesos, or both. Whether they knew is a question of evidence, not a defence you should assess yourself.

Does the Anti-Financial Account Scamming Act cover me if I made the transfer myself?

Possibly not, and this is the Act’s most misunderstood limit. Its definition of a social engineering scheme requires that sensitive identifying information was obtained by deception, resulting in unauthorised access and control over the account. A victim who authorised the transfer personally may fall outside that definition while still having a disputed transaction the institution can hold under Section 7.

Should I use a recovery agent who says they can trace the money?

No. A demand for an upfront fee to recover a loss is the standard second wave of the same fraud. The only bodies with statutory power over the money are your institution, the Bangko Sentral, the regulator and a court, and none of them charges a private recovery fee.

Can I report anonymously?

You can report a scheme to a regulator or a platform without being a complainant, and that still produces a public advisory or a takedown. But a disputed-transaction hold and a criminal complaint both require you to identify yourself, because both depend on your account and your sworn account of the facts.

Verification log

What was read from a primary government source for this guide, and what was not. Where a source could not be read, no figure from it is stated anywhere above.

Claim Source and result
Republic Act No. 8799 Sections 8.1, 26 and 28, and the approval date of 19 July 2000 Read verbatim from the Senate Legislative Reference Bureau copy
Republic Act No. 8799 Sections 57.1, 62.1, 63.1, 64.1 and 73 — civil liability of an unregistered seller, the two-year limit, Regional Trial Court jurisdiction, the cease and desist power and the penalties Rechecked 4 October 2026 against the full text of the Act; the Supreme Court E-Library copy is listed under Official sources. Section 54 (administrative sanctions) is not summarised here.
Republic Act No. 11765 Sections 3(f), 11, 14, 16 and 17 — investment fraud, prescription, SEC fines and independent civil action Read 4 October 2026 from the Bangko Sentral copy of the Act
Earlier attempt (1 October 2026) to read the tail sections of Republic Act No. 8799 Not read at that time. The Senate Legislative Reference Bureau text stops at Section 40 to this review, the Senate PDF path returns an error, and the Commission’s own pages return errors. No fine, no prison term and no section number for the cease and desist power is asserted. A pending Senate bill proposing to amend and renumber the Code was the only tail-end text reachable; it is a bill, not the law, and nothing from it is used here
Republic Act No. 11765 Section 3 naming the four financial regulators, Section 4 coverage, Section 6(f) and the ten million peso ceiling, and the 6 May 2022 approval Read verbatim from the Bangko Sentral copy of the Act
The Enforcement and Investor Protection Department’s functions, including investigation, cease and desist orders and revocation proceedings Read from a Commission contact notice on a Commission host. The notice is several years old and its individual staff addresses are deliberately not published here
The Commission’s published complaint procedure, its ten-day step and its stated limits Read from the Commission’s complaints page. It is scoped to registered lending and financing companies, which the page itself states, and this guide says so
A Commission complaint address, form or timetable for an unregistered investment solicitation Not read. Every relevant page on the Commission’s site returned an error, so no such address or deadline is published here
Rules for crypto-asset service providers Not read. Listed on the Commission’s own memorandum-circular index, but every page carrying the text returned an error. No number, date or requirement is stated
Virtual-asset service provider licensing by the Bangko Sentral Not read. The circular path is robots-restricted. Nothing is asserted
Republic Act No. 12010 Sections 3, 4, 6, 7, 8, 12 and 16 Read from the Bangko Sentral booklet of the Act with its implementing rules. The exact effectivity date is not stated because the publication line was not read
The 5, 25 and 30 calendar day holding periods, and Monetary Board Resolution No. 523 of 22 May 2025 Read from the Bangko Sentral 2025 circular on the temporary holding of funds. Note that the document served carries a blank circular number, so it is cited here by title
The 2, 7, 9, 45 and 47 day complaint clocks, and Section 1002 on terms and conditions (rechecked 4 October 2026: the appendix says “days”, not banking days) Read from the Manual of Regulations for Banks, consumer protection section and consumer assistance appendix
The 55 to 65 day consumer assistance process and the ten million peso adjudication ceiling Read from the Bangko Sentral FAQ on its consumer assistance mechanism
Republic Act No. 10175 Sections 6, 10, 13 and 21 Read from the Senate Legislative Reference Bureau copy of the Act. Provisions of that Act were challenged before the Supreme Court and this guide does not state which survived, because no decision text was readable
Hotline 1326 as a 24/7 inter-agency reporting number Read from a Philippine Information Agency release dated 31 December 2025. Government news, not an issuance, and cited as reported
Philippine case law on investment scams None cited. The Supreme Court site answers at its root but serves no decision text to this review
Any figure for losses, recovery rates or the number of victims None stated. No official Philippine dataset on investment-scam losses was read, so no number is given

Official sources

Related: If what you were sold was framed as work rather than an investment — liking posts or completing tasks, with a deposit required to unlock bigger earnings — see our guide to a job or task scam in the Philippines, which separates the fraud lane from the illegal-recruitment lane and explains why that distinction decides where you file.

About this guide

Written by the Cybercode.ph Editorial Team. Cybercode.ph is an independent technology-law information resource. It is not the Securities and Exchange Commission, the Bangko Sentral ng Pilipinas, the CICC, the DICT, the NBI, the PNP or a law firm.

This page has not been reviewed by a named external legal reviewer, and Cybercode.ph does not attribute a review to anyone who has not carried one out. Instead of a reviewer claim, the verification log above records which primary sources were read for each load-bearing statement and which could not be reached. Where a source could not be read, the figure is omitted rather than filled in from memory.

If you find an error, check it against the primary source linked in the Official Sources list and tell us which source contradicts the page. Regulations in this area change without notice, and platform and agency contact details change faster than the law does.

Legal disclaimer

This guide is general legal information about Philippine law, not legal advice, and it does not create a lawyer-client relationship. Outcomes turn on facts this page cannot know. If money has been lost or a criminal complaint is in prospect, consult a Philippine lawyer or the Public Attorney’s Office about your specific situation.

Sources rechecked as of: 4 October 2026

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.