The Philippines now has a real mechanism for holding scammed money in place, and it comes with the tightest deadline in the region. Miss it and the hold expires. The rule that surprises people: the clock starts with your bank or e-wallet, not with the police.
Your bank or e-wallet, immediately
Under the central bank’s 2025 rules, the only consumer action that triggers a hold on scammed funds is a complaint to your own institution’s 24-hour fraud reporting channel. Report inside the app or on the published hotline, and get a ticket number in writing. A police report alone does not start the process.
The institution can hold the funds for up to five calendar days at first. Within those same five days you have to give it a sworn complaint, an affidavit or a police report — otherwise the hold cannot be extended and the money is released. After that the hold can be extended by 25 more days, to a hard cap of 30, beyond which only a court can go further.
This is why the police report matters even though the police will not refund you: it is the document that keeps the hold alive, and it is accepted faster than a notarised affidavit.
Where to report the crime
The Cybercrime Investigation and Coordinating Center runs the anti-scam hotline 1326 and takes reports at [email protected]. The police anti-cybercrime group is at acg.pnp.gov.ph and [email protected]. The NBI cybercrime division takes reports at [email protected] and on (02) 8523-8231.
Two corrections worth having. The NBI has moved to the Filinvest Cyberzone in Pasay City; the old Taft Avenue address is now the clearance centre only, and some official handouts still print it. And if you search for the anti-cybercrime group, use the address above — the similar-looking pnpacg.ph serves a certificate for a different name and will throw a browser security error.
The central bank, and what it can order
The central bank’s consumer assistance route is a second-level one: it is a claim against your bank, not against the scammer, and it only opens after your bank has had the complaint. Use the BOB chatbot on the central bank’s site or its official Facebook page, and keep the reference number it issues. It can order restitution from your bank where the bank is at fault, for civil claims up to ten million pesos.
Investment offers belong with the Securities and Exchange Commission, through its ticketing portal at imessage.sec.gov.ph. The older address printed on several government handouts now redirects to an unrelated education site.
What the new law does and does not give you
The Anti-Financial Account Scamming Act took effect in August 2024. It criminalises money muling and social engineering, and it lets investigators reach behind bank secrecy. What it does not do is give you a right to be reimbursed. If the money is caught within the holding window and the recipient cannot justify it, it goes back to you — that is the realistic path. If it has already been cashed out, there is no statutory refund.
One clause deserves a warning of its own. Because lending or letting someone use your financial account is now an offence, the classic follow-up con — “we will process your refund, just let us route it through your account” — can make the victim criminally liable. So can filing a knowingly false report. Say what happened, and nothing more.
What to have ready
The transaction reference number, the source account name and number, the exact amount, the mode, the date and time, the receiving institution and beneficiary if you know it, a government ID, screenshots, your earlier support chats, and a plain written account of why you are disputing the transaction.
Two local specifics
The most impersonated organisation is your own bank — the law itself defines social engineering as someone misrepresenting themselves as acting for a financial institution. The central bank’s own line is worth repeating: it will never ask for your PIN, password, account or card number, passbook or ID.
And check the address of the government super-app carefully. The official domain is e.gov.ph. A hyphenated lookalike hosted abroad is not it.
The page itself
None of these agencies takes a scam website down quickly. Its hosting provider and its domain registrar can, usually within hours of a clear abuse report naming the exact address.
Leave a Reply