Scammed Online or Through an E-Wallet: What the Law Says

Act fast, because the hold periods are short.

1. Report to your bank or e-wallet right away. BSP Circular No. 1215 says account owners "shall immediately report any disputed transaction" so the institution can investigate and protect the account.
2. Send your documents within the initial hold. The circular says you must submit supporting documents, such as a "sworn complaint, affidavit, police report, or any other supporting document", within the initial holding period, unless the industry protocol says otherwise.
3. Keep your evidence. Save screenshots of messages, links, reference numbers and the receiving account name or number.
4. Consider a criminal complaint. The circular requires the bank or e-wallet to tell you about other legal remedies, such as filing a complaint with law enforcement agencies. The NBI and the PNP are in charge of enforcing the Cybercrime Prevention Act (RA 10175, Section 10). For NBI services, see our NBI guides.

Section 7 of RA 12010 lets banks and e-wallets temporarily hold funds subject of a disputed transaction, for a period set by the Bangko Sentral that "shall not exceed thirty (30) calendar days", unless a court extends it.

BSP Circular No. 1215 splits this into:

• an initial holding of not more than 5 calendar days; and
• an extended holding of not more than 25 calendar days after the initial hold ends;

for a total of not more than 30 calendar days.

A transaction counts as disputed if the institution has reasonable ground to believe it is unusual, has no clear economic purpose, comes from an unknown or illegal source, or was facilitated through social engineering schemes (Section 7). If an institution fails to hold funds as required, it is liable for the loss, including restitution of the disputed funds to the account owner (Section 9).

It depends on the facts. Section 6 of RA 12010 says banks and e-wallets "shall be liable for restitution of funds" to account owners if they failed to employ adequate risk management systems and controls, or failed to exercise "the highest degree of diligence" in preventing the loss. It adds: "Conviction shall not be a prerequisite to the restitution of funds."

But the same section says an institution that the BSP finds compliant with those requirements is not liable for the loss. So a refund is not automatic.

If the scammer is convicted, the conviction carries civil liability, which may include restitution in favor of the victim (Section 17).

RA 12010 punishes:

• Social engineering schemes (Section 4(b)): obtaining another person's sensitive identifying information through deception or fraud, resulting in unauthorized access to and control of the account. Examples in the law are pretending to act for a bank or e-wallet to get your details, and using electronic communications to get them. "Sensitive identifying information" includes usernames, passwords, bank account details, credit card and e-wallet information (Section 3).
• Money muling (Section 4(a)): using, borrowing or allowing the use of a financial account, opening one under a fake name or someone else's ID, buying or renting one, selling or lending one, or recruiting others, to move money "known to be derived from crimes, offenses, or social engineering schemes". A financial account includes an e-wallet.
• Economic sabotage (Section 4(c)): the same acts committed by a group of three or more persons, against three or more persons, through a mass mailer, or through human trafficking.

Section 16 sets these penalties (the court may impose prison, a fine, or both):

For money muling under items (1) to (4) of Section 4(a), the court also orders the closure of the financial account involved and its forfeiture (Section 16(a)).

Yes. Section 19 says prosecution under RA 12010 is "without prejudice" to prosecution under the Revised Penal Code and special laws, including the Cybercrime Prevention Act.

Under RA 10175, computer-related fraud (Section 4(b)(2)) and identity theft (Section 4(b)(3)) are crimes. And Section 6 makes the penalty for a Revised Penal Code crime, such as estafa, one degree higher when committed through information and communications technology. For estafa itself, see Estafa penalty in the Philippines.

Yes. Section 11 punishes anyone who, "with malice or in bad faith", reports completely unwarranted or false information that results in a hold on someone's funds. The penalty is in the table above. An honest report that turns out to be mistaken is not the same as a malicious one.

These are made-up examples to show how the rules work. They are not advice for any real case.

Ana gets a text that looks like it is from her e-wallet. She clicks the link and types her MPIN, and P18,000 leaves her account. She reports it to her e-wallet the same day and sends a sworn complaint within the initial hold period. The receiving funds may be held for up to 5 days, and up to 30 days in total. The sender of the text may be liable for a social engineering scheme (Section 4(b)).

Ben, a student, "rents out" his bank account to a stranger for a monthly fee, and scam money passes through it. If he knew the money came from crimes or scams, allowing the use of his account makes him a money mule (Section 4(a)), with 6 to 8 years in prison, a fine, or both, and the court also orders the account closed.

Lola Nena, 72, is tricked by a fake "bank officer" on the phone into giving her one-time PIN. Because she is a senior citizen, the scammer faces the higher range of 12 to 14 years (Section 16(b)). If her bank lacked adequate safeguards, it can be required to restore her money without waiting for a conviction (Section 6).

You do not need a lawyer to report to your bank or e-wallet; do that first. Talk to a lawyer if your bank refuses to restore a large amount and you believe it lacked proper safeguards, if you need a court to extend the hold on the funds, if you want to file a criminal complaint, or if you were accused of being a money mule or of filing a false report.

If you cannot afford a lawyer, see Free legal help in the Philippines for the Public Attorney's Office (PAO) and other options. If your problem is harassment by a lending app rather than a scam, see Online lending app harassment.