Last materially reviewed: September 21, 2026
Direct answer
Yes. Under Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), a person who uses, lends, sells or rents a bank or e-wallet account, or lets someone else use it, to receive, move or withdraw money known to come from a crime or scam is a money mule (Sec. 4(a)). The penalty is 6 to 8 years’ imprisonment, a fine of ₱100,000 to ₱500,000, or both (Sec. 16(a)). Selling or buying an account is also a separate offence (Sec. 5(d)).
Liability turns on what you knew, what you did and what you were paid. A holder whose credentials were stolen is a victim, not a mule. If you already lent or sold your account: take back control of it, stop every transfer, keep the recruiter’s messages, report it to your bank or e-wallet through its official channel, and get advice from a lawyer or the Public Attorney’s Office (PAO) before you sign a sworn statement. If you lost money to a scam instead, start with the RA 12010 victim guide.
Rule, qualification, evidence, timing, next step
| Question | Answer for the account holder |
|---|---|
| Rule | RA 12010 Sec. 4(a) treats using, lending, selling, buying or renting an account to handle known crime or scam proceeds as money muling. |
| Qualification | Knowledge of the criminal source is part of Sec. 4(a). Stolen credentials, account takeover and trafficking (Sec. 20) change the answer. |
| Risk and evidence | Recruiter chats, commissions, transfer patterns and withdrawals show what you knew. Preserve them; never delete or edit them. |
| Timing | Disputed funds can be held for up to 30 calendar days unless a court extends it (Sec. 7). No reporting deadline for account holders was verified. |
| Next step | Secure the account, stop transfers, report through the bank’s or e-wallet’s official channel, and get legal advice before any sworn statement. |
What RA 12010 says about money mules
Under RA 12010 Sec. 4(a), a person is a money mule if, to obtain, receive, deposit, transfer or withdraw proceeds known to be derived from crimes, offenses or social engineering schemes, they do any of these:
- use, borrow or allow the use of a financial account;
- open an account under a fictitious name or with someone else’s identity or ID documents;
- buy or rent an account;
- sell or lend an account; or
- recruit, hire or induce anyone to do items 1 to 4.
A “financial account” covers deposit, trust, investment and credit-card accounts, other accounts with banks and non-banks, and e-wallets (Sec. 3(d)). Sec. 5 adds separate offences: wilfully aiding or attempting a Sec. 4 offence, opening an account under a fictitious or another person’s identity, and buying or selling an account. Unlike Sec. 4(a), the text of Sec. 5(d) on buying or selling does not mention knowledge of criminal proceeds. Lending is not listed in Sec. 5(d).
Muling becomes economic sabotage (Sec. 4(c)) when it is committed by three or more people conspiring together, against three or more victims, with a mass mailer, or through human trafficking.
The penalties in Sec. 16 are below. In each case the court may impose imprisonment, a fine, or both.
| Offence | Penalty | Extra consequence |
|---|---|---|
| Money muling, Sec. 4(a) | 6 to 8 years, or ₱100,000 to ₱500,000, or both (Sec. 16(a)) | For items 1 to 4, the court orders the account closed and forfeiture under Art. 45, Revised Penal Code |
| Other offences, Sec. 5 | 4 to 6 years, or ₱100,000 to ₱200,000, or both (Sec. 16(d)) | Account closure where the act is opening an account under a false identity or buying or selling one |
| Economic sabotage, Sec. 4(c) | Life imprisonment, or ₱1,000,000 to ₱5,000,000, or both (Sec. 16(c)) | Not applicable |
| Government official or employee | The penalty for the offence committed | Perpetual absolute disqualification from public office (Sec. 16(i)) |
A conviction also carries civil liability, which may include restitution to the victim (Sec. 17), and prosecution under RA 12010 does not prevent charges under the Revised Penal Code, the Access Devices Regulation Act, the Anti-Money Laundering Act or the Cybercrime Prevention Act (Sec. 19). The Regional Trial Court hears RA 12010 cases (Sec. 21).
Situations that change the answer
The same transfer history can mean very different things. This table matches common situations to the provision that fits.
| Situation | How RA 12010 treats it | What helps show the facts |
|---|---|---|
| Sold the account for a fee | Sec. 5(d) offence; also Sec. 4(a)(4) muling if you knew it would carry crime or scam proceeds | The buyer’s messages, the payment received, when you handed over access |
| Lent the account to a friend or “employer” | Sec. 4(a)(4) muling only if you knew the money came from a crime or scam | What you were told, what you were paid, whether you saw warnings |
| Received and forwarded money for a commission | Sec. 4(a)(1) muling if you knew the source; the recruiter faces Sec. 4(a)(5) | The job ad, chats, transfer instructions and your commission records |
| Credentials stolen or account taken over | You are the victim; the taker may have committed social engineering under Sec. 4(b) | Login alerts, OTP messages, device changes, your prompt report |
| Forced or trafficked into it | Trafficking victims are free from criminal liability for acts that directly result from being trafficked (Sec. 20) | Clear and convincing evidence of the trafficking circumstances; a trafficking conviction is not required |
How investigators and courts infer knowledge is a question of evidence, not a statutory checklist. In practice, being paid a commission to forward strangers’ money, being told to withdraw cash quickly, and ignoring bank warnings all weaken a claim that you did not know (editorial explanation).
If you already lent or sold your account: what to do now
- Take back control. Change the password and MPIN, log out other devices, and check that the registered mobile number and email are still yours. If you cannot get in, call the institution through the number in its official app or website and ask it to lock the account. Use the in-app lock if your institution offers one.
- Stop every transfer. Do not withdraw, forward or “return” money on the recruiter’s instructions. Under BSP Circular No. 1215, funds that verification links to money muling are deducted and returned to the sender’s institution. Moving them yourself adds to the record against you.
- Report it to the bank or e-wallet. Use its official complaint channel. State that another person used the account, give the dates, ask it to restrict or close the account and preserve its records, and write down the reference number.
- Preserve the evidence listed below before anything is deleted. Do not edit chats or invent a story for the bank.
- Get legal advice before any sworn statement or interview. Your account of events will also describe your own role. Consult a private lawyer, or the PAO if you qualify for free legal aid.
- Report the recruiter, with your lawyer’s guidance, to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division or the CICC (hotline 1326).
- If you were coerced or trafficked, tell your lawyer and the investigators at once, because Sec. 20 may apply.
First concrete action: open the app yourself, change your password and MPIN, then report the misuse through the institution’s official channel and save the reference number.
If your funds were held or your account was frozen
A bank or e-wallet may temporarily hold funds from a disputed transaction for the period the BSP sets. That period may not exceed 30 calendar days unless a court extends it (RA 12010 Sec. 7). Under BSP Circular No. 1215, the initial hold lasts up to 5 calendar days. Your institution must notify you of the hold and tell you how to challenge it.
- Challenge the hold at any time by giving your institution evidence that the transfer was legitimate: affidavits, sworn statements, police reports, or proof of the transaction’s purpose, your relationship with the sender, or the source of the funds. If that is substantiated, the institution must lift the hold immediately.
- If verification concludes that the funds came from money muling, unlawful activity or social engineering, or if you sign a written waiver, the amount is deducted from your account and returned to the sender’s institution.
- If the hold runs past the allowed period or was improper, the institution faces BSP administrative action (Sec. 10). Complain to the institution first, then escalate to the BSP Consumer Assistance Mechanism.
- A hold or restriction is not a conviction. Criminal liability is decided in court. Separately, the BSP may investigate and inquire into accounts involved in a Sec. 4 or 5 offence, and bank-secrecy and data-privacy laws do not apply to those accounts (Sec. 12).
Where to go and what to bring
Each route does a different job. Start with the institution, and get advice before you report to law enforcement.
| Where | Why go there | What to bring |
|---|---|---|
| Your bank or e-wallet | First-level complaint route: it can restrict the account, preserve records and run the hold and verification process | Valid ID, account details, a dated timeline and the recruiter’s messages |
| BSP Consumer Assistance Mechanism | Second-level route if the institution ignores you or holds funds improperly; file through BSP Online Buddy | The institution’s reference number, its reply and your evidence |
| Private lawyer or PAO | Assess your exposure and whether Sec. 20 applies before you sign a statement | Everything above, plus any notice from the bank or investigators |
| PNP-ACG, NBI or CICC | Investigate the recruiter and the scheme (acg@pnp.gov.ph; ccd@nbi.gov.ph; CICC hotline 1326) | Timeline, chats, transaction references and the institution’s reference number |
The BSP escalation steps and the agency contacts above are as published in the BSP’s complaint-filing notice. Deadlines: no fixed period for an account holder to report misuse was verified, and the prescriptive period for RA 12010 offences was not verified this run. The 30-day cap on holds is the practical clock, so act the same day. The cybercrime reporting directory covers each agency’s role.
Evidence to preserve
Preserve evidence that shows both account activity and the account holder’s state of knowledge. The online scam evidence checklist explains how to capture it.
- Recruitment chats, job ads, voice messages and promises of commission.
- Account opening, device, login, beneficiary and transaction records you can download.
- Proof of identity theft, lost devices, unauthorised password resets or account-recovery attempts.
- Withdrawal slips, cash-out locations and any proof of who received cash from you.
- Bank notices, hold notifications, reference numbers and reports to authorities.
Common mistakes
- Calling the arrangement harmless because the account holder kept only a small fee.
- Deleting messages after the bank freezes the account.
- Sending suspicious funds back to instructions supplied by the same recruiter.
- Assuming lack of contact with the victim means there can be no liability.
- Giving a sworn statement to the bank or police before getting advice.
Frequently asked questions
Can I be liable if I did not know the money came from a scam?
Money muling under RA 12010 Sec. 4(a) covers proceeds known to come from a crime, offence or social-engineering scheme, so knowledge matters. Genuine lack of knowledge is significant, but commissions, repeated unusual transfers and ignored warnings can be used to show you knew. Selling or buying an account is a separate offence under Sec. 5(d).
Is lending my account to a friend or relative a crime?
Lending an account is money muling under Sec. 4(a)(4) when it is done to receive or move proceeds known to come from a crime or scam. Lending is not listed among the Sec. 5(d) offences, which cover buying and selling. Your bank’s or e-wallet’s terms of use may separately prohibit letting someone else use your account.
What if I was forced or trafficked into it?
RA 12010 Sec. 20 frees victims of trafficking in persons from criminal liability for acts committed as a direct result of being trafficked. A trafficking conviction is not required, but the circumstances must be shown by clear and convincing evidence. Tell your lawyer and the investigators early.
Can the bank freeze the account?
A bank or e-wallet may hold funds from a disputed transaction for up to 30 calendar days unless a court extends the hold (Sec. 7). You can challenge the hold at any time with evidence that the transfer was legitimate. If that is substantiated, the hold must be lifted.
What should I do first if I already lent my account?
Change your password and MPIN, stop all transfers, and report the misuse through your bank’s or e-wallet’s official channel. Keep every message from the recruiter, and get advice from a lawyer or the PAO before you give a sworn statement.
Related Cybercode guides
Related: Collection accounts in investment and crypto schemes are very often mule accounts — see investment or crypto scam: how to report it and what the SEC can do.
Related: Being “hired” as a payment processor and told to receive and forward transfers for a cut is the classic recruitment route into a mule account — see job or task scam in the Philippines.
Related: unauthorised e-wallet transactions, for the victim side of the same transfer.
Official sources
- Republic Act No. 12010, Anti-Financial Account Scamming Act, with BSP Circular Nos. 1213, 1214 and 1215, Series of 2025 — Bangko Sentral ng Pilipinas (RA 12010 Secs. 3–5, 7, 10, 12, 16, 17, 19–21; Circular No. 1215 on holding, challenge and release of disputed funds).
- BSP — How to file a complaint against a BSP-supervised institution — BSP Online Buddy, and the PNP, NBI and CICC contact details.
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.
Related: if you were the sender and the account you paid may be a mule account rather than an innocent stranger’s, start with sending money to the wrong recipient. It explains why an ordinary encoding error gets no statutory hold, and why a suspected mule account changes which team inside your bank should be handling it.
Sources rechecked as of: October 3, 2026