Last materially reviewed: September 3, 2026
Sources rechecked as of: September 30, 2026
Direct Answer
After an online scam, save the evidence before you block anyone, delete anything or report the account: blocking and reporting can make the scammer’s profile, messages or listing disappear from your view. Capture the full conversation, the account’s profile link, every phone number and account number used, and your own payment records, then write a dated timeline. If you sent money in the last few hours, call your bank or e-wallet first (see step 1 below), because a fast report is what makes a hold on the funds possible.
This page is a printable checklist. For the full reporting and recovery procedure, see our online scam complaint procedure.
Step 1: If money left your account
- Call your bank or e-wallet’s official hotline or in-app help from its official app, not a number sent by anyone else. Report the transfer as fraudulent and ask them to hold the funds. Under Section 7 of the Anti-Financial Account Scamming Act (RA 12010), banks, e-wallets and other BSP-supervised institutions may temporarily hold funds subject of a disputed transaction for up to 30 calendar days unless a court extends it (BSP AFASA booklet).
- Write down the reference number, the date and time of the call, and the name of the person you spoke to.
- Then come back to this checklist.
Step 2: The evidence checklist
Tick each item as you save it. The right-hand column says why an investigator or your bank will ask for it.
| Item to save | How to capture it | Why it matters |
|---|---|---|
| Full conversation | Screenshots from the first message to the last, with the account name and dates visible; use the app’s chat export if it has one | Shows the lie or promise that made you pay |
| Profile or page link | Copy the full URL and username into a note; screenshot the profile page | Names change; the URL or numeric ID lets investigators find the account |
| Listing or advertisement | Screenshot the post, price, photos and seller details; save the URL | Proves what was offered |
| Phone numbers and emails used | Copy them exactly as they appeared | Investigators can subpoena a telco for a registered SIM’s owner details on a sworn complaint (SIM Registration Act IRR, Sec. 12) |
| Receiving account details | Bank or e-wallet name, account name and account number you paid | Lets your bank and investigators trace and hold the money |
| Your payment records | Transfer confirmation, reference number, receipt and bank statement | Proves the amount, time and destination of each payment |
| Emails and texts | Keep the original message; for email, save the full headers | Headers carry routing data a screenshot does not |
| Delivery or order records | Order number, tracking number, courier messages, photos of the parcel if one arrived | Separates a scam from a delivery or quality dispute |
| Refund attempts | Your messages asking for a refund and any replies | Shows you tried to resolve it; platforms and regulators ask for this |
| Written timeline | A dated list: first contact, each promise, each payment, when contact stopped | Investigators and complaint forms are organised around the timeline |
Step 3: Preserve it properly
- Do not crop or edit. Keep usernames, dates, URLs and reference numbers visible. If you want to mark something, mark a copy, never the original.
- Keep the originals on your phone as well as copies. Do not delete the chat, the app or your account, and do not factory-reset the phone.
- Make two backups: for example, one on a computer or USB drive and one in cloud storage you control.
- Print a set of the key screenshots and your timeline. Most desks will still want paper copies with your signature on the timeline.
- Record only what you lawfully received. Do not try to hack or log in to the scammer’s accounts to gather evidence.
Whether a screenshot or message is accepted in court depends on how it is authenticated. See are screenshots admissible evidence? and electronic evidence preservation.
Step 4: Where to report, and what each place will ask for
| Where | When to use it | Bring |
|---|---|---|
| Your bank or e-wallet | First, whenever money moved | Payment records, receiving account details, timeline |
| The platform (Facebook, Shopee, Lazada and others) | To report the account or listing and ask for a refund under its own rules | Order number, chat, listing screenshots |
| CICC Inter-Agency Response Center, hotline 1326 | To report a scam or fraud; the hotline runs 24/7 (Philippine Information Agency) | Your timeline and the numbers, accounts and links used |
| PNP Anti-Cybercrime Group or NBI Cybercrime Division | To file a criminal complaint | Valid ID, printed evidence, digital copies on a USB drive, signed timeline |
| BSP Consumer Assistance | If your bank or e-wallet refuses or ignores your dispute | Your complaint to the institution and its reply (BSP channels) |
Guides: PNP ACG complaint process, NBI cybercrime complaint process, complaining to the BSP about a bank or e-wallet, and the Cybercrime Reporting Directory.
Common mistakes
- Blocking the scammer or deleting the chat before taking screenshots.
- Paying a “recovery agent” who promises to get your money back. That is usually a second scam.
- Sending only cropped screenshots without dates or account names.
- Waiting days before calling the bank or e-wallet.
Related Digital Evidence Guides
- Electronic Evidence Checklist
- Text Messages as Evidence
- Social Media Posts as Evidence
- Electronic Evidence Preservation
- Romance scam: how to report it and try to get your money back
Official Sources
- BSP — Anti-Financial Account Scamming Act (RA 12010) booklet with implementing circulars
- Republic Act No. 12010 (Official Gazette)
- Philippine Information Agency — report online shopping scams to hotline 1326
- BSP Consumer Assistance channels
- Cybercrime Investigation and Coordinating Center
Related: For an investment or trading scheme, the most probative document is the demand for a fee before withdrawal — see investment or crypto scam: how to report it and what the SEC can do.
Related: In a task or job scam the single most probative item is the blocked withdrawal with a demand for a further payment to “fix” it — see job or task scam in the Philippines for the full preservation list.
Disclaimer
Access-device evidence: Card, account-number, PIN, skimming and credential cases should also be mapped to the Access Devices Regulation Act.
Account-scam context: For evidence connecting disputed transfers, mule accounts and social engineering, use the RA 12010 authority guide together with this preservation checklist.
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.