Discovering that you have lost money to a fraudulent investment scheme, fake trading app, or crypto scam is overwhelming. However, taking immediate, deliberate action, such as stopping further deposits, securing your accounts, preserving digital evidence, and reporting through official enforcement channels, is essential to protect remaining assets and assist law enforcement build formal cases.
Last Updated: September 2026 | Primary Target: Victims of Financial Fraud, Ponzi Schemes, & Crypto Scams | Relevant Agencies: Philippine SEC, NBI Cybercrime Division, PNP Anti-Cybercrime Group (PNP-ACG), BSP
Emergency Response Summary in 60 Seconds
- Cut All Financial Ties Immediately: Never pay additional “withdrawal taxes,” “verification fees,” or “unlock charges.” These are stall tactics designed to extract more cash.
- Do Not Delete Apps or Group Chats: Screenshots, phone numbers, GCash transaction IDs, wallet addresses, and full chat exports are vital evidence for law enforcement.
- Notify Financial Gateways First: Immediately report compromised accounts to your bank, e-wallet (GCash/Maya), or crypto exchange to freeze unauthorized transfers.
- File Official Criminal & Regulatory Reports: File a criminal cybercrime report with the NBI Cybercrime Division or PNP-ACG, and submit unauthorized solicitation complaints to the SEC Enforcement and Investor Protection Department (EPD).
- Watch Out for Secondary Scams: Ignore anyone on Telegram, Facebook, or X who claims they can “hack back” or recover stolen crypto for an upfront fee. They are recovery scammers.
When an investment platform or individual suddenly blocks your withdrawal request, they will almost always demand additional fees, labeling them as “tax settlements,” “anti-money laundering compliance fees,” “gas charges,” or “tier upgrades.”
Critical Rule: Legitimate financial institutions and regulated platforms never require you to deposit new, separate funds to withdraw existing balances. Any requirement to pay money to receive money is 100% confirmation of a scam. Stop sending deposits immediately.
2. Secure Compromised Accounts and Wallets
If you interacted with a phishing website, connected a self-custody wallet (like MetaMask or Phantom), or shared account credentials, your remaining assets are at risk.
- Change Passwords & Revoke Sessions: Update passwords across all email, banking, and exchange accounts. Force logouts on all active sessions.
- Revoke Web3 Approvals: Use tools like Revoke.cash to cancel active dApp allowances on connected hot wallets.
- Migrate Remaining Funds: If your wallet’s seed phrase or private key was typed into a phishing site, consider that wallet permanently compromised. Create a brand-new wallet on an uncompromised device and transfer any uncompromised assets there immediately.
- Enable Authenticator 2FA: Replace SMS-based two-factor authentication with an authenticator app (Google Authenticator, YubiKey, or Microsoft Authenticator) to prevent SIM-swapping.
3. Preserve All Digital Evidence
In criminal investigations, law enforcement relies heavily on unbroken digital evidence chains. Do not delete message histories or exit group chats out of anger or shame.
- Export Messaging Logs: Download complete chat histories on Telegram, WhatsApp, Viber, or Messenger before the scammer deletes messages for both parties.
- Take Complete Screenshots: Capture full device screenshots showing sender names, handle handles, phone numbers, wallet addresses, and exact timestamps.
- Save Transaction Records: Download PDF receipts from your banking apps, e-wallets (GCash/Maya InstaPay reference numbers), or transaction confirmation pages on exchanges.
4. Identify What Kind of Scam Happened
Categorizing the specific method helps determine which primary authority handles the investigation:
| Scam Category | Common Mechanism | Primary Lead Agency |
|---|---|---|
| Unregistered Investment / Ponzi Scheme | Promised fixed daily/monthly returns; mandatory recruitment. | SEC (EPD) & NBI Cybercrime |
| Impersonation / Phishing / Fake Apps | Fake bank pages, copycat apps, advance-fee releases. | PNP-ACG & NBI Cybercrime |
| Task / Order-Grabbing Scam | Paying deposits to unlock “work tasks” for pseudo-commissions. | NBI Cybercrime & PNP-ACG |
| Unregistered Online Lending Harassment | Debt-shaming, illegal contact access, predatory rates. | SEC (EPD) & NPC (Privacy) |
If you transferred Philippine Pesos via GCash, Maya, or bank transfer (InstaPay/PESONet), file an immediate dispute ticket with the initiating platform:
- GCash / Maya: Report the account number and reference ID to customer support to flag the recipient account for suspicious activity or money laundering.
- Local Banks: Request a formal dispute or transaction trace with your bank’s fraud department.
- Regulated Exchanges: If you sent crypto from a licensed platform (e.g., Coins.ph or PDAX), submit the receiving transaction hash (TXID). Exchange security teams can tag the recipient address across industry compliance tools (such as Chainalysis).
6. Report Investment Solicitation to the SEC
If the entity solicited investments, offered unregistered shares, or operated a high-yield Ponzi structure in the Philippines, file a formal complaint with the Securities and Exchange Commission.
SEC Reporting Details
Division: Enforcement and Investor Protection Department (EPD)
Email: [email protected]
Hotlines: (02) 8818-6337 | (+63) 961-519-7829
Physical Office: 9th Floor, The SEC Headquarters, 7907 Makati Avenue, Salcedo Village, Brgy. Bel-Air, Makati City
Purpose: The SEC investigates unauthorized investment solicitations, issues Public Advisories, and executes Cease-and-Desist Orders (CDOs) against fraudulent operators.
7. Report Cybercrime to NBI and PNP-ACG
To initiate formal criminal prosecution for estafa, computer-related fraud under Republic Act 10175 (Cybercrime Prevention Act), file reports directly with specialized law enforcement agencies.
NBI Cybercrime Division (CCD)
PNP Anti-Cybercrime Group (PNP-ACG)
- Email: [email protected]
- Hotline: (02) 8723-0401 loc. 7491 | (+63) 998-598-8116
- Main Office: Anti-Cybercrime Group Building, Camp Crame, Quezon City
8. When BSP or Other Agencies May Be Relevant
- Bangko Sentral ng Pilipinas (BSP): If the scam involved a regulated bank, licensed VASP exchange, or e-wallet failing to address a formal dispute ticket. File complaints via the BSP Online Buddy (BOB Chatbot) on the BSP website or email [email protected].
- National Privacy Commission (NPC): If an unauthorized online lending app or scammer accessed your phone contact list, doxed your identity, or committed privacy violations. Submit reports at privacy.gov.ph.
9. How to Document Blockchain Transactions
When digital assets (USDT, BTC, ETH, SOL) are involved, police investigators require specific blockchain metadata rather than plain app screenshots.
- Locate the Transaction Hash (TXID): A unique 64-character alphanumeric string generated for every completed transaction.
- Use Public Blockchain Explorers: Input the TXID into the corresponding network explorer (e.g., Etherscan for Ethereum, Tronscan for TRC-20 USDT, Solscan for Solana).
- Export PDF Records: Print or save the public explorer page showing the Sender Address, Recipient Address, Exact Timestamp, Amount Transferred, and Block Confirmation Number.
10. What Information to Include in a Complaint
When drafting an affidavit or formal complaint letter for the SEC, NBI, or PNP, organize your narrative clearly:
- Complainant Details: Full legal name, residential address, contact number, and valid government ID copy.
- Respondent Details: Names, social media handles, phone numbers, e-wallet account numbers, bank details, or wallet addresses used by the perpetrator.
- Chronological Summary: A clear step-by-step account detailing how you were introduced to the platform, agreed terms, deposited money, and were subsequently denied withdrawals.
- Financial Loss Breakdown: A precise table listing dates, channels used, reference numbers, and PHP/crypto equivalent values.
11. What Authorities May and May Not Be Able to Recover
Managing expectations is vital when dealing with financial fraud enforcement:
| Action / Expectation | Realistic Regulatory / Law Enforcement Outcome |
|---|---|
| Domestic Bank / GCash Freezes | Possible: If reported rapidly before scammers cash out, law enforcement can request freeze orders on local bank/e-wallet recipient accounts. |
| Exchange Account Freezes | Possible: Regulated international and local exchanges can freeze tagged funds if bad actors attempt to cash out via KYC-verified accounts. |
| Unhosted / Self-Custody Crypto Transfers | Extremely Difficult: Once funds enter private, unhosted wallets or decentralized mixers, no government agency can reverse smart contract transactions. |
| SEC Regulatory Actions | Enforcement-Focused: The SEC issues CDOs and pursues criminal charges, but does not act as a direct personal fund-reimbursement agency. |
12. Beware of Secondary Recovery Scams
Shortly after posting about a scam online or joining victim group chats, you will be targeted by **”Recovery Experts”** or fake cyber intelligence agencies on Telegram, X, Facebook, or Instagram.
Warning: Recovery Scam Red Flags
- They claim they can “hack into the blockchain” or force smart contracts to return your tokens.
- They ask for an upfront “software fee,” “code cracking fee,” or “investigation deposit.”
- They impersonate law enforcement officers or private intelligence firms in private messages.
- The Fact: No legitimate entity can hack a decentralized blockchain to reverse a transaction. Anyone demanding money to recover lost crypto is a scammer.
13. What to Do If the Scammer Is Still Actively Recruiting
If the scheme remains live and continues luring new victims on social media:
- Report Social Media Pages: Report the Facebook pages, Telegram channels, and TikTok profiles directly to platform moderation teams using “Scam/Fraud” flags.
- Submit a Tip to BitPinas: Send verified links and documentation to BitPinas to assist our editorial team in tracking active schemes for the SEC Investment Watchlist Tracker.
- Alert Community Networks: Share factual, evidence-backed warnings in local investor groups without publishing unverified personal home addresses (doxing).
14. Emergency Evidence Checklist
Save the Crypto Scam Emergency Checklist
Get the printable evidence checklist and future Philippine scam alerts by email.
Evidence Preservation Master Checklist
Download, print, or check off these items before filing reports with the SEC, NBI, or PNP.
- Full Platform URLs & Domains: Saved web addresses, landing pages, and app download links.
- Transaction Hashes (TXIDs): Complete 64-character blockchain transfer strings for all crypto deposits.
- Public Wallet Addresses: Both your sending address and the recipient wallet addresses.
- Bank & E-Wallet Receipts: Official PDF/screenshot receipts showing InstaPay/PESONet reference numbers, GCash account numbers, and timestamps.
- Complete Chat Exports: Exported JSON/TXT files and full visual screenshots of Telegram, WhatsApp, Messenger, or Viber conversations.
- Scammer Identifiers: Phone numbers, social media handles, profile links, middleman names, and provided bank account names.
- Promotional Materials: Screenshots of flyers, promised interest rate tables, recruitment bonuses, or fake certificates of registration.
- Chronological Timeline Log: A written document summarizing dates, amounts paid, and conversation summaries.
Frequently Asked Questions (FAQ)
This article is published on BitPinas: How to Report a Crypto or Investment Scam in the Philippines: SEC, NBI, PNP, and Other Authorities
What else is happening in Crypto Philippines and beyond?
