If you have been scammed online, stop further transactions, contact your bank or e-wallet immediately, secure your accounts, preserve every piece of evidence and file reports with the appropriate Philippine authorities.
Do not wait for the scammer to explain, refund the payment or “fix” the transaction. Every hour matters because stolen funds can quickly pass through several accounts, e-wallets or cryptocurrency platforms.
The steps below follow the practical response sequence outlined in the supplied brief: contain the damage, contact the financial institution, report the incident, preserve evidence and protect yourself against further attacks.
Immediate action plan
Stop → Call your bank or e-wallet → Secure your accounts → Save evidence → Report the scam
What to Do Within the First 30 Minutes
Complete these actions before arguing with the scammer, posting publicly or attempting to investigate the person yourself.
| Priority | What to do | Why it matters |
|---|---|---|
| 1 | Stop sending money | Scammers frequently invent new fees, taxes or verification payments |
| 2 | Contact your bank or e-wallet | The provider might still flag, hold or investigate the transaction |
| 3 | Lock affected accounts | This can stop additional unauthorized activity |
| 4 | Change passwords and PINs | Your login details may already be compromised |
| 5 | Save screenshots and receipts | Deleted conversations are difficult to reconstruct |
| 6 | File official reports | Authorities and providers need documentary evidence |
| 7 | Warn trusted contacts | The scammer might impersonate you or target your family |
If your phone, SIM card or email account was compromised, use a different trusted device to contact your financial provider and change your credentials.
Step 1: Stop All Communication With the Scammer
End the conversation as soon as you recognize the scam.
Scammers commonly keep victims engaged by promising:
- A refund after another payment
- Release of an investment withdrawal
- Delivery after paying an insurance or customs fee
- Account recovery after paying a technician
- Cancellation of a supposed loan
- Removal of intimate images or personal information
- Return of stolen funds through a “recovery agent”
These are usually extensions of the original fraud.
Preserve the evidence before blocking the account
Before blocking the scammer, record:
- Account name and username
- Mobile number and email address
- Social-media profile URL
- Marketplace listing
- Bank or e-wallet account details
- Cryptocurrency wallet address
- Payment reference numbers
- Dates and times of conversations
- Screenshots of promises, instructions and threats
- Product photos or investment materials
- Website addresses and shortened links
- Courier details, receipts and tracking numbers
Take full-page screenshots where possible. A cropped image without the account name, date or transaction reference is weaker evidence.
You can also export the conversation or record your screen while scrolling through it. Do not alter the original files.
Do not threaten the scammer
Threatening to expose, arrest or physically confront the person can encourage the scammer to:
- Delete the account
- Remove the listing
- Transfer the money
- Destroy evidence
- Block you
- Target you with threats
- Impersonate you elsewhere
Document first. Report second. Let the relevant platform, financial institution and authorities handle the investigation.
Step 2: Contact Your Bank or Payment Provider Immediately
Call the official fraud hotline shown in your banking app, on the back of your card or on the provider’s verified website.
Tell the representative:
“I need to report a suspected scam or unauthorized transaction. Please secure my account, check whether the transfer can be stopped and create an official fraud case.”
Ask for a case number, ticket number or reference number before ending the call.
Request the appropriate action
The correct request depends on what happened.
| Situation | Action to request |
|---|---|
| You did not authorize the transaction | Unauthorized-transaction investigation |
| Your card details were stolen | Block and replace the card |
| Your online banking was accessed | Lock the account and reset access |
| You were deceived into transferring money | Scam or fraud investigation |
| A merchant failed to deliver | Purchase dispute or chargeback review |
| Your phone or SIM was stolen | Temporary account restriction |
| Your e-wallet was taken over | Account recovery and fraud investigation |
| The transfer is still pending | Cancellation, recall or hold request |
A scam payment and an unauthorized transaction are different
An unauthorized transaction occurs when another person accesses your account or payment method and completes a transaction without your approval.
An authorized scam transaction occurs when you personally approved the payment because a scammer deceived you.
This distinction affects how the bank or e-wallet evaluates the case. A provider may have stronger reversal procedures for unauthorized transactions than for payments voluntarily approved by the account holder.
Still, report both immediately. A fast report can help the receiving institution identify and restrict suspicious accounts.
What documents should you prepare?
Your bank or payment provider might request:
- Valid government-issued ID
- Signed dispute or fraud form
- Transaction receipt
- Account statement
- Police or cybercrime report
- Screenshots of the conversation
- Merchant or recipient information
- Written timeline of events
- Proof that you attempted to contact the seller
- Affidavit describing the incident
Keep one folder containing every document and reference number. Use clear filenames such as:
2026-07-14_GCash-Receipt_Reference-12345.png
Reporting a GCash scam
GCash instructs users who were tricked into sending money to report the incident to the PNP or NBI, submit the scam details and screenshots to GCash, and block the scammer. Its help page also distinguishes scam transfers from transactions the account holder did not make.
For an unauthorized GCash transaction, the company currently instructs users to:
- Check whether the charge came from a linked subscription.
- Change the account MPIN.
- Report the transaction within 15 days.
- Monitor the resulting support ticket.
GCash states that an unauthorized-transaction investigation can take approximately 48 hours to seven days, depending on the case.
GCash’s published guidance for a scam transfer warns that reporting does not guarantee that the sent funds will be returned.
Reporting a Maya scam
Maya provides an official fraud-report form and directs users to contact its support channels immediately for scams, account takeovers and unauthorized transactions. Its listed emergency channels include in-app chat and telephone support.
When contacting Maya:
- Secure the account
- Temporarily block affected cards
- Submit the fraud complaint form
- Include the transaction details
- Retain the resulting case number
- Follow any document-submission instructions
Will the bank refund money lost to a scam?
A refund is not automatic.
The outcome depends on:
- Whether the payment was authorized
- How quickly the incident was reported
- Whether the funds remain in the receiving account
- The payment channel used
- Whether the transaction qualifies for a chargeback
- Evidence of account takeover or credential theft
- The provider’s investigation
- Applicable laws, regulations and contractual terms
Never assume that a completed InstaPay, e-wallet or cryptocurrency transfer can simply be reversed. Report it anyway. The receiving account could still be flagged or connected to other complaints.
What if the bank or e-wallet rejects the complaint?
Ask the institution for:
- Its written decision
- The reason for the denial
- The investigation reference number
- The evidence it still requires
- Its internal appeal or escalation process
For concerns involving a BSP-supervised financial institution, first use the institution’s own Financial Consumer Protection Assistance Mechanism. BSP guidance identifies this as the consumer’s first-level recourse before escalating a complaint to the central bank’s consumer-assistance channels.
Step 3: Secure Your Accounts and Devices
A payment scam can also be an account-compromise incident.
Change the passwords for:
- Your primary email
- Online banking
- E-wallets
- Social-media accounts
- Shopping platforms
- Cloud-storage accounts
- Password manager
- Mobile carrier account
- Cryptocurrency platforms
Start with your email because it is commonly used to reset your other accounts.
Use a clean device
If you installed an unknown app, remote-access program, configuration profile or browser extension, do not use the affected device for banking until it has been checked.
Remove suspicious applications such as:
- Unknown screen-sharing tools
- Remote-support apps installed at a stranger’s request
- Unofficial banking or lending apps
- Keyboard or accessibility apps from unknown sources
- APK files downloaded outside official app stores
Run the device’s security scan, update its operating system and review application permissions. A factory reset can be appropriate when an attacker had remote control, but preserve your evidence before erasing anything.
Contact your mobile provider when the SIM is involved
Contact your telecom provider immediately when:
- Your phone was stolen
- Your SIM suddenly lost service
- You received an unexpected SIM-replacement notice
- OTP messages stopped arriving
- Someone obtained your SIM PIN or PUK
- Your number was transferred without your permission
Ask the provider to restrict the SIM and explain the replacement process.
Turn on stronger security
Enable:
- Multi-factor authentication
- Biometric login
- Transaction alerts
- New-device alerts
- Withdrawal and transfer limits
- Card locking controls
- Login alerts for email and social media
- A unique password for every important account
Never use your banking PIN as your phone unlock code.
Step 4: Build an Evidence File
Evidence is the spine of your complaint. Without it, every agency and provider has to work through fog.
Create one master folder with the following sections.
Identity of the suspected scammer
Save:
- Display name
- Usernames
- Profile URLs
- Mobile numbers
- Email addresses
- Account numbers
- E-wallet numbers
- QR codes
- Wallet addresses
- Seller pages
- Company names used
- Photographs or IDs sent to you
A submitted ID might be stolen or fabricated. Label it as something the scammer provided, not as confirmed identification.
Transaction evidence
Keep:
- Official receipts
- Reference numbers
- Bank statements
- Card statements
- E-wallet history
- Deposit slips
- QR-payment records
- Cryptocurrency transaction hashes
- Delivery fees
- Insurance or processing payments
- Cash-deposit details
Communication evidence
Include:
- Complete chat history
- Emails with full headers when available
- SMS messages
- Call logs
- Voice recordings you legally possess
- Product descriptions
- Advertisements
- Investment presentations
- Contract documents
- Promised delivery dates
- Refund promises
- Threats or demands
Prepare a chronological incident report
Use a simple timeline:
| Date and time | What happened | Evidence |
|---|---|---|
| July 12, 10:15 a.m. | Saw marketplace listing | Screenshot 01 |
| July 12, 11:20 a.m. | Seller requested deposit | Chat export |
| July 12, 11:45 a.m. | Sent ₱5,000 | Receipt 01 |
| July 13, 3:00 p.m. | Seller demanded another fee | Screenshot 08 |
| July 13, 4:10 p.m. | Contacted bank | Case number |
| July 13, 5:00 p.m. | Filed platform report | Report confirmation |
This timeline makes it easier for the bank, police, NBI or consumer agency to understand the case.
Step 5: File an Official Report With Philippine Authorities
You can report the same incident to more than one organization because each handles a different part of the case.
| Where to report | Best used for |
|---|---|
| Bank or e-wallet | Transaction investigation and account restriction |
| PNP cybercrime unit | Criminal complaint and investigation |
| NBI Cybercrime Division | Cyber-enabled fraud and digital evidence |
| CICC | Cybercrime reporting and coordination |
| DTI | Online-shopping and consumer disputes |
| SEC | Investment solicitation and securities-related complaints |
| BSP | Escalated complaint involving a supervised financial institution |
| Online platform | Removing the account, listing or advertisement |
Philippine National Police
Report the incident to the nearest police station or appropriate cybercrime office. Bring printed and digital copies of your evidence.
State clearly:
- What the scammer represented
- How contact began
- How much was lost
- Where the money was sent
- What identifying information you possess
- Whether the scammer is still making contact
- Whether there are threats or account takeovers
Ask for the report or complaint reference number.
National Bureau of Investigation Cybercrime Division
The NBI operates an online complaint channel and provides investigative assistance for victims of computer-related crimes. Its published citizen-service guidance states that complainants complete the required complaint and evaluation forms and submit them for processing. The NBI currently identifies a Cybercrime Division within its investigation services.
Prepare:
- Valid ID
- Written complaint
- Incident timeline
- Screenshots and conversation files
- Transaction records
- Account information
- Platform URLs
- Bank or e-wallet case number
- Police report, when already available
Cybercrime Investigation and Coordinating Center
The CICC operates the government’s 1326 cybercrime hotline, which victims can use to report scams and seek guidance on the appropriate reporting channel.
Include the same evidence package submitted to your financial provider and law-enforcement agency.
Department of Trade and Industry
For a dispute involving an online seller or merchant, use the DTI Consumer Care system.
The platform supports electronic filing and online dispute resolution, allowing consumers and businesses to communicate and work toward resolution without requiring every step to take place in person.
DTI is particularly relevant when:
- A seller failed to deliver
- A product was materially different from the listing
- A merchant refused a valid consumer remedy
- A business used deceptive sales practices
- The seller is identifiable and operating as a business
A fake seller who disappears after payment can also involve criminal fraud, so a DTI complaint does not replace reporting to law enforcement.
Securities and Exchange Commission
Report suspected investment scams, unauthorized investment solicitations and questionable securities offerings to the SEC.
The SEC’s iMessage system accepts public complaints, inquiries and incident reports, generates an electronic ticket and lets users monitor the status of their submission.
Include:
- Name of the company or investment group
- Names used by recruiters
- Social-media pages
- Investment contracts
- Promised returns
- Deposit instructions
- Referral or commission structure
- Proof of payment
- Withdrawal attempts
- Messages explaining why funds cannot be released
Bangko Sentral ng Pilipinas
Use BSP consumer-assistance channels when your complaint concerns a BSP-supervised bank, electronic-money issuer or other covered financial institution and you have already raised the issue through that institution’s complaint mechanism.
BSP escalation is not a substitute for promptly notifying the bank or e-wallet. The financial institution should receive the first report because it controls the affected account and transaction records.
Step 6: Report the Scammer to the Platform
Reporting the account can protect other users and preserve platform records.
Report:
- The user profile
- The individual message or conversation
- The marketplace listing
- The business page
- The advertisement
- The fraudulent website
- The email address
- The payment account, when the provider has a reporting channel
Include precise reasons
Select the most accurate category available:
- Scam or fraud
- Impersonation
- Fake seller
- Phishing
- Account takeover
- Counterfeit goods
- Investment fraud
- Harassment or extortion
- Stolen identity
- Unauthorized transaction
Save a screenshot of the confirmation page and its report number.
Do not rely only on a platform report
Platform moderation might remove an account, but it does not automatically:
- Recover your money
- Start a criminal investigation
- Notify your bank
- Preserve every record indefinitely
- File a government complaint for you
Complete the financial and official reporting steps separately.
Step 7: Attempt to Recover the Money
Recovery is most likely when the victim reports quickly and the money remains traceable inside a regulated financial system.
Possible recovery routes include:
- Bank transfer recall
- E-wallet fraud investigation
- Card chargeback
- Merchant dispute
- Insurance claim
- Freezing of a receiving account
- Voluntary refund
- Mediation or settlement
- Civil action
- Criminal restitution ordered through legal proceedings
Be realistic about recovery
Money becomes harder to recover after it is:
- Withdrawn as cash
- Distributed among mule accounts
- Converted into cryptocurrency
- Sent abroad
- Used to purchase digital assets
- Transferred through multiple payment providers
- Passed through accounts opened with stolen identities
There is no universal Philippine success rate for recovering money lost to online scams. Any website or “investigator” promising a fixed recovery percentage should be treated cautiously.
Consider a chargeback for card purchases
A card dispute can be relevant when:
- You did not authorize the transaction
- Goods were never delivered
- The product materially differed from the description
- A cancelled service was still charged
- The merchant processed a duplicate payment
Submit the dispute within the issuer’s stated deadline. Chargeback rights depend on the card network, transaction type, evidence and issuing bank rules.
Check whether you purchased scam insurance
Some financial products include optional fraud or scam insurance.
For example, GCash publishes specific claim requirements for its Express Send Scam Insurance, including prompt notification, documentary evidence and a police report within the policy’s stated period. Coverage applies only when the user actually obtained the insurance and the incident satisfies its policy conditions.
Do not assume that every transfer is insured.
When should you consult a lawyer?
Legal advice can be worth considering when:
- The amount is substantial
- The scammer’s identity is known
- A business or organized group is involved
- Several victims can coordinate evidence
- The scam includes threats or extortion
- The incident damaged your business
- You need help preparing an affidavit or complaint
- A financial provider’s response raises a contractual or regulatory issue
Ask about consultation fees, filing costs, possible remedies and the practical likelihood of collection before committing to litigation.
Avoid public accusations without verified evidence
Posting the scammer’s name, address, ID or family information can create risks involving:
- Misidentification
- Harassment
- Privacy violations
- Defamation complaints
- Destruction of evidence
- Retaliation
- Exposure of another victim’s stolen identity
You can warn others by describing the scam method and reporting the account through proper channels. Avoid presenting unverified personal information as fact.
Step 8: Watch Out for Recovery Scams
Recent victims are prime targets for a second wave of fraud.
A recovery scammer claims to be:
- A hacker
- A lawyer
- A bank investigator
- A government officer
- A cryptocurrency specialist
- A cybercrime agent
- A private recovery company
- A representative of the platform
The person then asks for an advance payment to:
- Trace the scammer
- Unlock frozen funds
- Pay taxes
- Obtain a court order
- Recover cryptocurrency
- Bribe an insider
- Purchase special software
- Verify your identity
Do not send money or provide remote access to your phone.
A legitimate authority or financial provider will not ask you to transfer money to a personal account, disclose an OTP or install a remote-control application to recover stolen funds.
Step 9: Monitor for Identity Theft
A scammer who obtained your ID, selfie, address, signature or account information might use it for future fraud.
Watch for:
- Unknown loan applications
- New mobile accounts
- Password-reset messages
- Unexpected OTPs
- New-device login alerts
- Unrecognized transactions
- Messages from people who received requests from “you”
- Fake profiles using your name and photos
- Collection notices for unfamiliar accounts
Tell trusted family members and coworkers that someone might impersonate you. Give them a separate verification method, such as calling you directly before acting on a request for money.
What Information Should You Never Share?
Never give another person your:
- One-time password
- Banking PIN
- E-wallet MPIN
- Card CVV
- Password
- Password-reset code
- Recovery phrase or seed phrase
- Full screen-sharing access
- Remote-control access
- Authentication approval
- Unredacted identity documents without a legitimate purpose
Financial providers repeatedly warn users that OTPs, PINs and authentication credentials should not be shared. GCash specifically states that it does not request a user’s MPIN or OTP over the phone.
Scam Victim Checklist
Use this checklist to track your response:
- I stopped communicating with the scammer.
- I saved the complete conversation.
- I recorded the scammer’s accounts and contact details.
- I saved all transaction receipts.
- I contacted my bank or e-wallet.
- I received a case or ticket number.
- I changed affected passwords and PINs.
- I enabled multi-factor authentication.
- I checked my device for suspicious applications.
- I contacted my mobile provider when necessary.
- I reported the platform account or listing.
- I filed a police, NBI or CICC report.
- I filed with DTI, SEC or BSP when relevant.
- I organized my evidence chronologically.
- I warned trusted contacts about possible impersonation.
- I ignored anyone promising guaranteed fund recovery.
Frequently Asked Questions
How can I get my money back after being scammed online?
Contact the financial provider immediately and request a fraud investigation, transfer recall, account hold, card dispute or other applicable recovery process. Preserve the evidence and file reports with law enforcement and the relevant regulator. Recovery depends on the transaction type, timing, available evidence and whether the funds can still be traced.
Do banks refund money lost to scams in the Philippines?
Banks do not automatically refund every scam payment. Unauthorized transactions and payments personally approved under deception can be treated differently. The bank investigates the circumstances, security controls, transaction records and applicable rules before deciding the claim.
Can GCash return money that I sent to a scammer?
GCash’s published scam guidance states that users should report the scam immediately, but it also warns that funds sent in a scam transaction might no longer be recoverable. Unauthorized transactions follow a separate investigation process.
How long does a scam investigation take?
There is no standard period covering every provider or government agency. The timeline depends on the complexity of the incident, completeness of the evidence, number of institutions involved and whether legal processes are needed. GCash currently publishes a 48-hour-to-seven-day range for its investigation of reported unauthorized transactions, depending on the case.
Which government agencies handle online scams?
The appropriate organization depends on the incident. Relevant channels include the PNP, NBI Cybercrime Division, CICC, DTI, SEC and BSP. Report the transaction separately to the bank, e-wallet or payment provider.
Is it worth reporting a small scam?
Yes. A single report can connect the account, number or profile to other complaints. Multiple reports can help platforms, financial institutions and investigators detect a wider fraud network.
Can Philippine authorities track an online scammer?
Authorities can investigate digital accounts, transaction trails, device records and platform information through applicable legal processes. Identification is not guaranteed because scammers can use stolen identities, mule accounts, foreign services and anonymization tools.
Should I pay someone who promises to recover the money?
Do not pay an unknown person who promises guaranteed recovery. Verify any lawyer or service provider independently. Never provide an OTP, seed phrase, password or remote access to someone claiming they can retrieve the funds.
Final Advice
Being scammed can create panic, embarrassment and a strong urge to fix everything privately. That reaction is exactly what many scammers exploit.
Focus on the sequence that gives you the strongest chance of limiting the damage:
Stop the payment trail. Secure your accounts. Preserve the evidence. Report through official channels.
Recovery is not guaranteed, but delay lowers your options. Reporting also helps financial institutions, platforms and authorities identify repeat offenders and protect other Filipinos.
