Scammed Online? How to File a Complaint in the Philippines

Scammed online? Start here

If money is at risk, contact your bank or e-wallet now. Use its official app or independently verified support channel. Ask it to secure the account and investigate the disputed transaction. Do not wait for a police report or a complete evidence folder.

For scam-reporting assistance, call 1326 (CICC/I-ARC). For criminal investigation, use PNP-ACG or NBI. A hotline report does not itself mean a criminal case has been filed. Recovery is not guaranteed.

Last correction: October 20, 2026. Scope: rechecked the first-hour financial-provider route, AFASA temporary-hold stages, current BSP consumer escalation, and NBI computer-crime intake; added four reader FAQs. Sources checked: Republic Act No. 12010, BSP Circular No. 1215 and its AFASA booklet/IRR, BSP consumer-assistance guidance, and the NBI Citizens Charter. Other legal analysis retains its earlier review basis. Cybercode is an independent information guide and does not receive complaints or recover funds.

What to Do in the First Hour

Stop further loss. Report to the sending bank or wallet immediately, explain what happened accurately, and ask about securing access, tracing the transfer and any available hold or dispute process. Have the amount, time and transaction reference ready; report with what you have even if some details are missing.
Secure compromised access. From a trusted device, use the official recovery process, change exposed passwords and end unfamiliar sessions. If card details were exposed, ask the issuer to block or replace the card. If your SIM stopped working unexpectedly, contact the telco and financial providers.
Keep safe evidence. Save the payment record, profile URL and relevant messages before reporting or blocking where safe. Do not delete originals, keep engaging with the scammer, or delay urgent containment to finish an export.
Stop paying. Do not send a release fee, tax or recovery charge. Unsolicited recovery agents and promises of guaranteed refunds can be another scam.
Get a reference and the next deadline. Ask whether funds were held, what supporting documents are required, where to submit them securely, and when to follow up. See the AFASA hold stages below; 30 days is not a waiting period or a guaranteed hold.

Choose the Route That Fits Your Payment

What happened?	Do now	Next route
I sent money directly to someone who deceived me	Tell the sending provider it was a scam-induced payment; ask about tracing and the available dispute process.	Bank and wallet support, then report and follow up
Money moved without my permission	Secure the account and report an unauthorised transaction; describe any exposed password, OTP or device access accurately.	Unauthorised wallet transactions or your card issuer’s dispute process
A paid marketplace order never arrived	Open the order’s in-app dispute/refund process promptly and check its deadline. A direct payment outside checkout can have different protection.	Shopping-platform support and Lazada non-delivery guide
I shared a password or OTP, but no loss is visible	Secure affected accounts and alert the provider without waiting for money to disappear.	Phishing first steps and account recovery
The bank or wallet has not resolved my complaint	Keep its complaint reference and response, and state the resolution you are requesting.	BSP consumer assistance for BSP-supervised providers

Not sure which route applies? Use the Scam or Hack Triage tool. Investment, job and romance scams may require additional reporting: investment/crypto, job/task, romance.

Complaint Evidence Pack Checklist

Keep these in one private folder. They are preparation items, not a reason to delay an urgent report:

A short dated timeline, amount lost and payment references.
Account names, profile/listing URLs and contact identifiers.
Relevant full-context screenshots, original messages and available exports.
Provider and platform case numbers, written replies and promised follow-up dates.
Relevant login alerts or original emails with headers, if available.
Identification or an affidavit only as required by the receiving authority.

Share safely: never send passwords, PINs or OTPs. Use verified submission channels, send only requested personal/account information, and keep unredacted originals privately. Do not publish evidence or send it to Cybercode. See preservation details.

Report and Follow Up

Start with the financial provider. Report the disputed payment and obtain its case number. Find the official provider route. GCash provides separate routes for scam-induced and unauthorised payments; its scam report instructions explain the in-app transaction report.
Use the relevant platform process. Report the profile or listing after safely saving identifiers. For an order paid through a marketplace, also use its refund/dispute process within the applicable deadline. An abuse report and a refund request serve different purposes.
Report suspected crime. Call 1326 for CICC/I-ARC assistance and referral. Contact NBI Cybercrime Division or PNP-ACG for investigative assistance. Use the current reporting directory and confirm the receiving office’s requirements. The financial and criminal tracks can proceed in parallel.
Act on document requests and follow up in writing. Ask the provider to confirm hold status, outstanding documents, the submission deadline, the investigation stage and the expected response date. Keep every acknowledgement. If a promised response is late, follow up using the same case reference.
Escalate an unresolved provider complaint. After raising it with a BSP-supervised bank or wallet, use BSP Online Buddy (BOB) or the official CIR route if dissatisfied with its handling. Include the earlier complaint, response if any, supporting records and requested resolution. For other regulators, use the directory’s regulator routes.

For the investigation and prosecution stages, see what happens after reporting. A report, investigation, refund request and court case are different stages; none guarantees recovery.

Key Takeaways

Contact the provider immediately and describe the facts accurately.
A temporary hold is conditional and is not an automatic reversal.
Do not wait for every document before asking for urgent help.
Preserve originals, protect sensitive information and keep case references.

More in This Guide

Governing law · Scam penalties and case summary · Offence elements · Limits and exceptions · Examples · Detailed evidence guidance · Recovery and remedies · Common mistakes · FAQs · Official sources

Governing Law and Authorities

Four statutes do most of the work in an online scam case, and they do different jobs. Two are about money. Two are about crime.

RA 12010 — the money-movement law

Republic Act No. 12010 (AFASA), Sections 7 and 8, provides for temporary holding and coordinated verification of disputed funds. Whether a transaction qualifies depends on the facts and the applicable rules; a scam-induced payment is not automatically an unauthorised transaction.

AFASA hold stages: ask about the first deadline

Under BSP Circular 1215, an initial hold is up to five calendar days. It may be extended by up to 25 days when warranted; a longer hold requires a court. Submit supporting documents within the initial period, subject to the industry protocol, and ask your provider for the actual deadline and hold status.

The hold rules cover qualifying electronic fund transfers between accounts. Erroneous transfers and ordinary credit-card transactions have different routes (the circular has an exception for credit-card-funded ACH transfers). Coordinated verification can continue even if no funds remain. Information sharing is limited to authorised verification purposes; privacy and confidentiality safeguards still matter.

RA 11765 — the complaints and escalation law

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, requires every financial service provider to establish a single consumer assistance mechanism providing free assistance to financial consumers (Section 8(f)). Section 5 identifies the enforcing regulators — the BSP, the Securities and Exchange Commission and the Insurance Commission, with the Cooperative Development Authority covering cooperatives. Section 6(f) empowers the BSP and the SEC to adjudicate purely civil claims where the relief sought is solely for payment not exceeding ten million pesos. Section 6(d)(6) allows a regulator to order accounting and disgorgement of profits obtained or losses avoided.

Start with your provider’s consumer assistance mechanism and retain its reference numbers and responses. If the issue remains unresolved, use the relevant regulator’s route. For BSP-supervised providers, the BSP publishes BOB and CIR escalation instructions. Consumer assistance and formal adjudication are different processes; ask which is appropriate for your claim.

RA 10175 and the Revised Penal Code — the criminal laws

Republic Act No. 10175, the Cybercrime Prevention Act, supplies computer-related fraud, computer-related identity theft and illegal access. Section 6 provides that crimes already defined in the Revised Penal Code, when committed through information and communications technologies, carry a penalty one degree higher. That is the cyber-estafa route: the offence charged remains estafa under Article 315 of the Revised Penal Code, but the penalty is elevated because it was committed online. The penalty brackets for estafa were reset by RA 10951, Section 85, which now scales the penalty by the amount defrauded, starting at arresto mayor in its medium and maximum periods for amounts up to forty thousand pesos.

Where card numbers, account numbers, PINs or other credentials were used, RA 8484, the Access Devices Regulation Act, may also apply. Section 3 defines an access device broadly enough to cover a card, plate, code, account number, electronic serial number or personal identification number used to obtain value or initiate a transfer of funds.

What is the punishment for scamming in the Philippines?

There is no single penalty for everything described as a scam. The offence proved, the applicable law and the facts determine the possible punishment. A bank dispute or police report is not a conviction, and a penalty range does not promise that money will be recovered.

Use this editorial comparison to organize the facts for an investigator or lawyer. It does not decide what charge should be filed.

Conduct to assess	Penalty framework	Bring these facts
Deceit inducing a payment	Article 315 estafa; RA 10951 section 85 sets amount-based brackets. ICT use can engage RA 10175 section 6.	The representation before payment, reliance, transaction dates and amount lost.
Manipulation of computer data	Computer-related fraud: RA 10175 sections 4(b)(2) and 8.	What data or system was changed without authority, fraudulent intent and resulting damage.
Deception to obtain financial credentials	AFASA social engineering: RA 12010 sections 4(b) and 16(b).	Credential request, deceptive messages, intended unauthorized account control and victim age.
Handling known criminal proceeds	AFASA money muling: RA 12010 sections 4(a) and 16(a).	Account use, transfers and evidence of knowledge; a recipient name alone does not establish guilt.

Verify the Article 315 amendments, RA 10175 sections 4, 6 and 8, and AFASA sections 4 and 16. The ICT increase is one degree, not simply one extra year. AFASA also provides separate treatment for economic sabotage; do not infer that classification merely from a large loss.

Prepare a short case summary

Timeline: what was said or done before each payment, and when you discovered the problem.
Money: each transfer, reference number, recipient account, total loss and any amount returned. Keep records supporting the figures.
Account activity: distinguish a payment you made after deception from a transfer made without your permission. Say what credentials or access were exposed.
People and proof: identify what you personally know, what records show and what remains uncertain. Keep suspected identities separate from verified account details.
Next question: ask which offence and penalty provision fit the evidence, what is still missing and which recovery route can run alongside the complaint.

Do not delay the urgent bank or wallet report while trying to calculate a sentence. Use the reporting steps with your records; avoid threatening someone with a penalty you have not verified applies.

What the Law Criminalises, Element by Element

Estafa by false pretences — Article 315(2)(a), Revised Penal Code

The prosecution must establish that the accused used a fictitious name or falsely pretended to possess power, influence, qualifications, property, credit, agency, business or imaginary transactions, or used other similar deceits; that the deceit was executed prior to or simultaneously with the commission of the fraud; that you relied on it; and that you suffered damage as a result. The timing element matters more than victims expect — a seller who genuinely intended to deliver and later failed is usually a civil breach of contract, not estafa.

Computer-related fraud — RA 10175, Section 4(b)(2)

This requires the unauthorised input, alteration or deletion of computer data or a program, or interference in the functioning of a computer system, causing damage, with fraudulent intent. Note what this actually targets: manipulation of the system itself. A scammer who simply lied to you in a chat and persuaded you to send money is more naturally charged as estafa committed through ICT than as computer-related fraud.

Illegal access — RA 10175, Section 4(a)(1)

The access to the whole or any part of a computer system without right. This fits account takeovers. It does not fit a case where you voluntarily handed over the money yourself.

Money muling and social engineering — RA 12010, Sections 4 and 5

RA 12010 distinguishes money muling under Section 4(a), social engineering under Section 4(b), and other offences under Section 5. The elements must be proved; an account’s involvement alone does not establish its owner’s guilt.

The penalties are in Section 16: money muling under 4(a), six to eight years or a fine of ₱100,000–₱500,000, or both; social engineering under 4(b), ten to twelve years or ₱500,000–₱1 million, or both, with higher penalties when the victim is a senior citizen; Section 5 offences, four to six years or ₱100,000–₱200,000, or both. Economic sabotage under 4(c) carries life imprisonment or ₱1 million–₱5 million, or both, under 16(c).

Section 4(c) applies to the prohibited acts in 4(a) or 4(b) when committed by at least three persons conspiring, against at least three persons, using a mass mailer, or through human trafficking. Multiple actors or victims do not remove the need to establish the underlying offence.

Exceptions, Boundaries and No-Jurisdiction Situations

A bad deal is not a crime. Overpriced goods, poor quality, late delivery or a seller who changed their mind are ordinarily civil matters. Criminal deceit requires misrepresentation that induced the payment.
The hold power is not a refund. RA 12010, Section 7 lets an institution freeze funds while a dispute is verified. It does not order that money back to you, and it does nothing if the balance is already zero.
Restitution under RA 12010 is fault-based. Section 6 makes an institution liable for restitution of funds where it failed to employ adequate safeguards. That is a claim against the institution’s conduct, not an automatic entitlement in every scam.
RA 11765 adjudication has limits. Section 6(f) covers claims that are purely civil, solely for payment, and not exceeding ten million pesos. A claim outside those bounds goes to the courts.
Financial regulators do not prosecute crime. The BSP and SEC supervise institutions. They will not arrest a scammer. Only the criminal track does that.
Law enforcement cannot compel a foreign platform directly. Where the scammer, the platform and the money are all offshore, an investigation depends on mutual legal assistance, which is slow and not guaranteed.
Jurisdiction still needs a Philippine anchor. RA 10175, Section 21 gives Regional Trial Courts jurisdiction over offences committed by a Filipino national regardless of the place of commission, and where any element was committed within the Philippines or using a computer system located here.

Hypothetical Scenarios

These are illustrative examples, not real cases, and not predictions of outcome.

Hypothetical 1: The marketplace seller who vanished

A buyer pays fourteen thousand pesos to a wallet number for a phone advertised on a marketplace page. The seller stops replying and deletes the listing. The deceit — a fictitious seller offering goods they never had — came before the payment, so the facts point to estafa under Article 315(2)(a), with RA 10175 Section 6 raising the penalty because it was committed online. If the buyer disputes the transfer the same day, the receiving wallet provider may be able to hold whatever balance remains under RA 12010, Section 7. If the seller cashed out within the hour, there may be nothing left to hold.

Hypothetical 2: The fake bank verification call

A caller claiming to be from a bank’s fraud team persuades an account holder to read out a one-time PIN. Money leaves the account within minutes. Obtaining sensitive identifying information through deception to gain unauthorised control of a financial account is squarely the social engineering conduct described in RA 12010, and the transfers may also raise RA 8484 issues because account credentials were used. The account holder disputes the transaction immediately and files with the NBI Cybercrime Division.

Hypothetical 3: The investment group chat

A victim sends money in three tranches to accounts named by an “investment coordinator” in a group chat, then is told to pay a “withdrawal tax” to release profits. Because several people appear to be operating together against multiple victims, the economic sabotage qualifier in RA 12010, Section 4(c) may be relevant. Because the entity may have been soliciting investments, the SEC may be the correct regulator alongside the criminal complaint. The withdrawal tax should not be paid.

Evidence and Documentation

Screenshots can be useful. Preserve their full context alongside available original records and identifiers; no single format is automatically sufficient in every case. Gather what is available without delaying urgent reporting:

Screenshots — showing the full screen including the visible date, time and the account name, not a cropped bubble.
The message export — where the platform offers a data or chat export, use it. An export carries the underlying metadata that a screenshot discards.
The profile URL — the full permanent link to the seller or scammer profile, page or shop, copied as text.
The account identifier — the username, page ID, mobile number, email address and any display name, recorded separately because display names change.
Transaction reference numbers — the sending reference, the receiving account or wallet number and the exact registered recipient name as shown on the confirmation.
Timestamps — the date and time of each message and each transfer, including the time zone shown by your device.
Email headers — if the approach came by email, save the full original message with headers, not a forwarded copy.
Device logs — login history, active session lists and device-authorisation records from the affected account’s security settings.
The institution’s written response — the dispute ticket number, every reply, and any written refusal. This is the document that makes a regulator escalation possible under RA 11765.

Preserve before you block or delete

Where safe, capture the relevant messages, export available records and copy profile or listing URLs before reporting or blocking. You do not need to keep talking to the scammer or stay exposed to threats to collect evidence. Keep originals unchanged and a dated chronology separately. See electronic evidence preservation and screenshots and authentication.

One statutory deadline matters here. RA 10175, Section 13 requires service providers to preserve traffic data and subscriber information for a minimum of six months from the date of the transaction. Delay in reporting can outlast the records an investigator would need.

Remedies and Realistic Outcomes

Platform

A social platform may remove a profile or listing and preserve records without recovering an off-platform payment. A marketplace may also offer a refund or dispute process for an eligible order paid through its checkout. For example, Shopee publishes a non-delivery refund process. Follow the specific platform’s rules and deadlines; an abuse report alone is not necessarily a refund request.

Administrative and regulatory

Under RA 11765, a regulator may adjudicate a purely civil money claim up to ten million pesos (Section 6(f)) and may order disgorgement of profits obtained or losses avoided (Section 6(d)(6)). Under RA 12010, Section 6, an institution that failed to employ adequate safeguards may be liable for restitution of funds. These routes act on the institution, not the scammer, and they require you to have exhausted the provider’s own complaints process with documentation.

Civil

You may sue the scammer for damages if you can identify and locate them. Article 20 of the Civil Code requires a person who wilfully or negligently causes damage contrary to law to indemnify the injured party, and Article 33 permits an independent civil action for fraud requiring only a preponderance of evidence. RA 12010, Section 17 also provides for restitution for the damage done in favour of the aggrieved party. A judgment is only as good as the assets behind it.

Criminal

A successful complaint can lead to an investigation, a prosecutor’s resolution and, if an information is filed, a trial. RA 10175, Section 8 sets imprisonment or a fine of at least two hundred thousand pesos for Section 4 offences. Nobody can promise you an arrest, a conviction or a recovery.

The honest position on getting your money back

Recovery depends on the payment route, available funds, evidence, provider responsibilities and the outcome of any investigation or claim. Funds can move quickly, so report promptly even if some time has passed. A hold does not guarantee repayment, and the absence of held funds does not by itself determine every possible claim. Criminal proceedings can be lengthy. Nobody can promise an arrest, conviction or refund; avoid anyone demanding an upfront recovery fee.

Common Mistakes

Blocking and deleting first, so the profile URL and thread are lost before anything is recorded.
Calling a hotline found in the scam message itself, which routes you back to the scammer.
Waiting days to contact the bank, by which time the funds have moved and the hold power is useless.
Bringing only cropped screenshots with no transaction reference number and no receiving account details.
Paying a “release fee” or hiring a “recovery agent” who found you after the scam. This is a standard second-stage fraud.
Treating the platform report as the complaint. It is not.
Failing to ask for the dispute reference in writing, which leaves nothing to escalate under RA 11765.
Assuming a small loss is not worth reporting. Amount affects the estafa penalty bracket, not your right to complain.

Access-device overlap: Scam transfers involving stolen cards, account numbers, PINs or authentication credentials may also implicate RA 8484 as amended by RA 11449.

Governing authority: For money-mule activity, disputed transfers, social engineering and temporary institutional holds, read the Anti-Financial Account Scamming Act guide to RA 12010.

Related: if the money went to someone you met on a dating app or social media, the authorised-transfer problem changes which rule helps you and the recovery window is measured in minutes. See romance scam in the Philippines: how to report it and try to get your money back.

Frequently Asked Questions

Can my bank simply reverse the transfer?

Not automatically. An AFASA hold is conditional and differs from a reversal. BSP Circular 1215 provides an initial hold of up to five calendar days and a possible extension of up to 25 days when warranted. Ask your provider whether funds were held and what documents are due; recovery is not guaranteed.

Do I need a police report before the bank will act?

Do not wait for a police report to contact your bank or wallet. A complaint can initiate the provider’s assessment. Supporting documents may then be needed within the initial holding period, subject to the applicable protocol; ask the provider what it requires and by when. Criminal reporting can proceed in parallel.

How much does it cost to file with the NBI?

The NBI’s published citizens charter for investigative assistance to victims of computer crimes lists no fees for the steps in that service.

Should I file with the NBI or the PNP?

Either can receive a cybercrime complaint. Practical considerations usually decide it: which office is accessible to you, and where your evidence and witnesses are. Do not file the same complaint with both simultaneously without saying so.

Is a screenshot enough?

Screenshots can help, but sufficiency depends on the facts and authentication. Preserve originals, context, identifiers and transaction records where available. Do not delay an urgent report because you cannot obtain a data export.

How long will a criminal case take?

There is no reliable estimate. Investigation, prosecutorial review and trial each take substantial time, and outcomes depend on whether the offender can be identified and located.

What if I voluntarily sent the money because the scammer deceived me?

Report it accurately as a scam-induced payment rather than calling it an unauthorised transfer. Contact the sending provider immediately, give the transaction reference, and ask what tracing, hold or dispute process is available. Whether funds can be held or recovered depends on the facts and available balance.

What if the money has already been withdrawn or transferred onward?

Still report promptly. BSP Circular 1215 says coordinated verification can continue even when no funds remain in the first recipient account. That does not guarantee recovery, but the provider and investigators may still need the transaction trail and your supporting records.

What details should I give my bank or e-wallet immediately?

Start with your name and affected account, the amount and time, the transaction reference, the recipient details shown on the record, and a short factual description of what happened. Ask for a case number, the hold status, any document deadline and the next follow-up date. Never send a password, PIN or OTP.

Should I pay a recovery agent who promises a refund?

No. Do not pay an unsolicited person who promises guaranteed recovery or asks for an upfront release, tax or tracing fee. Use your provider’s official channel, the proper regulator and law enforcement. A second payment can create another loss.

Official Sources

Action-route and AFASA sources rechecked 20 October 2026: BSP AFASA booklet and implementing rules, including Circular 1215; BSP consumer assistance channels; CICC scam-reporting brochure (1326); GCash scam reports; Shopee non-delivery refunds. Provider instructions can change; confirm them in the official app or current source.

Related: If the money went into an investment or trading scheme, the reporting sequence is different and the regulator is not the refund route — see investment or crypto scam: how to report it and what the SEC can do.

Related: If you were recruited for “easy online work” and then asked to deposit your own money to unlock earnings, that is a task scam — see job or task scam in the Philippines: how to report it and try to get your money back, which also explains when a fake job offer is illegal recruitment and when it is not.

Disclaimer

Sources rechecked as of: October 15, 2026 (scam-penalty classification only).

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Related: unauthorised e-wallet transactions and the refund path, for money moved out of a GCash, Maya or other wallet without your authority.

Related: when a marketplace order never arrives, for a parcel paid for through a platform rather than money sent directly to a stranger — the clocks and the forums are different.

Related: and read sending money to the wrong recipient before you report anything, if there is any chance you simply mistyped the account number. Reporting your own encoding error as a scam misroutes the case, and under RA 12010 malicious false reporting of a disputed transaction is itself an offence.