Scammed by a Fake Courier, Fake Raffle or Fake Christmas Sale in the Philippines: Stop the Payment First, Then Report

The first hour: stop the payment by method, then change your passwords

The order of operations depends on how you paid. Each channel has a different window, but all share one feature: earlier is better. Do not message the scammer, do not ask the group chat, do not post screenshots to your feed. All of that comes after the money is stopped.

• E-wallet transfer. Report the transaction inside the app and request a freeze on the recipient, then call the hotline and state that it was fraud. E-wallet transfers are near-instant, but the platform can sometimes restrict the receiving account before the funds are cashed out. Change your login and transaction PINs and check for newly linked devices or auto-debits. If the money is already gone, continue with money taken from GCash or Maya without authorisation.
• Bank or instant transfer. Call your bank immediately with the recipient account, amount and time, and ask for a recall and a freeze request to the receiving bank. Recall depends on the receiving bank's cooperation and is not guaranteed, but not asking guarantees nothing comes back. Ask the bank to check for other transactions you do not recognise.
• Credit card. Call the issuer to dispute the charge and replace the card. Of all methods, credit cards offer the best recovery odds because of the formal dispute process. See disputing an unauthorised credit card charge.
• Cash on delivery. Cash handed to a fake courier is essentially unrecoverable. The focus shifts to the next section: whether the parcel or receipt contains anything that identifies the sender, and whether you gave up other information at the door.
• Gift cards, load or game credits. If you were told to buy cards and read out the codes, contact the card issuer immediately to freeze any unused balance. Sometimes it is still there.

Once payment is stopped, change every password you entered during the incident: bank, e-wallet, email, social media, anything typed into the fraudulent page. If you reuse one password across accounts, change all of them, and switch on two-factor authentication. Only then move to screenshots, saved chats and payment records in preparation for the report.

What the holiday scripts look like: five common versions and where each one cracks

Holiday scams all rely on one mechanism: the season supplies the plausibility. You really are expecting parcels, really are entering promotions, really are hunting discounts, so things you would spot instantly in March get through in December. Recognising the script tells you what was taken and what to protect next.

1. Fake parcel awaiting collection. A text or chat message says a parcel is held and asks you to click a link to confirm your address or pay a small customs or storage fee. The crack: legitimate couriers do not collect fees through short links, and you can check any tracking number in the courier's own app. After stopping payment, the real concern is the name, address and ID number you typed into the link. For unordered cash-on-delivery parcels, see a COD parcel you never ordered.
2. Fake raffle win. You supposedly won a Christmas raffle run by a mall, brand or marketplace, and claiming the prize requires a tax, a handling fee or your bank details. The crack: you never entered, or the prize requires payment first. Genuine draws never ask winners to send money.
3. Fake flash sale. A cloned brand page or social account posts a discount ending in hours; you pay and nothing arrives, or something entirely different does. The crack: the domain does not match the official one, the price is implausibly low, and payment is only accepted by transfer to a personal account.
4. Fake charity drive. Appeals in the name of an orphanage, a disaster area or a church, often built on a real news event. The crack: a personal receiving account, no registration details, and pressure to give today.
5. Fake internal company notice. Someone impersonates your employer or HR with a link for year-end gift registration or 13th month pay confirmation, asking for bank and ID details. The crack: companies do not collect bank details through external links. Confirm with HR in person.

Two other scripts also heat up in December: callers posing as immigration, the embassy or police saying you have a case and must pay a bond, covered in calls claiming to be from immigration or the embassy; and people arriving at your door asking for holiday gifts or sponsorship in an official capacity, which is a different problem covered in officials asking for Christmas gifts or sponsorship.

Will the money come back? An honest answer by channel

Recovery depends on three things: how you paid, whether the scammer has already cashed out, and how quickly you reported. No channel can guarantee recovery, but every channel has one step that, if skipped, guarantees the money is gone.

Credit card: the best odds. The issuer's dispute process allows a cardholder to contest charges for goods or services not received or for unauthorised transactions, and there is normally interim handling while the dispute is reviewed. You will need the transaction record, your communication with the seller and evidence that nothing was delivered. The outcome follows the issuer's and card network's rules.

E-wallet: depends on how fast the recipient moved. The platform can restrict a receiving account after a report, but once funds have been moved to a bank or withdrawn, the platform's role shrinks to cooperating with police. Report anyway: a flagged account protects the next victim.

Bank transfer: requires the receiving bank to freeze the account, and that bank usually wants a formal complaint from you or the police as its basis. Stopping payment and filing a report are therefore tied together; the police report is often what lets the bank act.

Cash on delivery: essentially unrecoverable unless police catch the people involved. Still report it, because the same crews work the same areas repeatedly and your report helps assemble the pattern.

Gift and load cards: unused balance can sometimes be frozen; spent balance is very hard to recover.

Two realities. First, never pay money to recover money. Anyone offering to recover your funds for a fee is running the second scam, discussed in the last section. Second, separate recovery from containment. Even if this payment is lost, stopping the card, changing passwords and reporting still protect you from the second and third payment. The full recovery path, including Barangay conciliation, small claims and platform complaints, is in the recovery sequence after a scam.

Reporting: police cybercrime channels, payment platforms, marketplaces and the impersonated brand

Reporting is not only about recovery. It creates the formal record that banks, platforms and insurers will ask for at almost every later step. Where to report depends on where the scam happened, and several channels can run at the same time.

1. Police. Scams carried out by text, messaging app or website fall under cybercrime and can be reported to the police cybercrime unit or your local station; cash handed over in person goes to the local station. Bring payment records, chat screenshots, the scammer's account details, the link address, and any parcel and waybill you received. Ask for a copy of the report or a reference number. How to preserve electronic evidence and whom to report to is in reporting online fraud in the Philippines.
2. Payment platform or bank. File the dispute both in-app and through the hotline and obtain a ticket number. They will ask whether you have reported to police, so do that first or in parallel.
3. Marketplace. If the scam ran through a store on a legitimate e-commerce platform, for example paid but never shipped or goods wholly unlike the listing, use the platform's dispute and refund process and never settle privately by transfer. Platforms generally do not cover off-platform transactions, which is exactly why scammers steer you off-platform.
4. The impersonated brand or company. Send the fake page's link and screenshots to the brand's official channels so they can request a takedown and post a warning. If your own company is being impersonated, see taking down a fake site impersonating your company.
5. Telecom carrier. Report scam text numbers to your carrier. It will not recover money but speeds up action against the number.

Organise your file in one folder: a timeline (when received, when clicked, when paid, when discovered), payment proof, the counterparty's details, chat and page screenshots, and the stop-payment actions already taken with their reference numbers. A complete, ordered file is accepted and acted on far more readily than a pile of loose screenshots.

No money lost but your information was taken: OTP, ID photos, address and bank details each need a different fix

The real target of many holiday scams is not the small payment but the information you typed into the page, later used for identity fraud, card fraud or targeted follow-up scams. Having filled in a form without paying is not the same as being safe. Handle it by type of information leaked:

• You entered a one-time password (OTP). The most dangerous case: it means the other side may already have logged in or completed a transaction. Log in to that account now, check transactions and login history, change the password, sign out all devices and contact support. For e-wallets and online banking, check specifically whether a credit product was activated.
• You entered a bank account or card number. If card number, expiry and security code were all entered, block and replace the card. If only the account number, alert the bank and switch on transaction alerts.
• You uploaded an ID photo or ID number. These can be used to open accounts, take loans or register e-wallets in your name. Notify your bank and your e-wallet providers that your identity may be misused, enable every available alert, and watch for unexplained collection calls or account-opening notices over the following months. If a loan has already been taken in your name, follow identity used to open a loan or account.
• You gave your real address and phone number. Expect more targeted harassment, fake parcels and precision scams, because the other side now knows you respond. Be stricter with unknown callers and deliveries, and consider changing the delivery number on your shopping accounts.
• You logged in with a company email or work account. Tell your company's IT immediately; it may be the entry point for an attack on the whole organisation.

If your phone number is your main verification channel and you suspect the other side has enough personal data, guard against a SIM swap or replacement by asking your carrier to add verification requirements for SIM replacement. The more information leaked, the more important the quarantine period that follows: for the next few months, any caller claiming to be your bank, a platform or the police gets verified by calling back on the official number you saved yourself.

Avoiding the recovery scam, preventing next year's, and what Yixing can do

The weeks after a scam carry the highest risk of a second one, because your details are now on a list and you are anxious to recover the loss. The rule is simple: anyone who asks you to pay first in order to recover your money is a scammer.

The recovery scam wears familiar faces: a supposed police officer or lawyer says your money has been traced and needs an unfreezing fee; a supposed platform agent says a refund requires a verification deposit; a helpful group organiser collects a documentation fee; a hacker offers to retrieve your account. Legitimate channels have public costs: police reports are free, platform and bank disputes are free, Barangay conciliation is essentially free. The moment someone wants payment first, stop. And do not post payment screenshots or ID documents in public groups; that is the raw material for the next round.

Next year's prevention list adds these to the usual precautions:

1. Track every parcel in the courier's official app, never through a link in a text, and never pay anything for a parcel awaiting collection.
2. Treat any raffle you did not enter as fake, trust only official channels for ones you did enter, and never pay to claim a prize.
3. Enter sales only through official URLs and verified accounts, check the domain, and pay only inside the platform.
4. Donate only to organisations whose registration you can check, through their official channels, never to a personal account.
5. Confirm internal company notices in person; HR does not collect bank details through external links.
6. Walk your family and staff through these scripts; scammers favour people newly arrived in the Philippines who are still finding their footing. The overview is in common scams in the Philippines and how to avoid them.

What Yixing can do: Yixing is a private consultancy registered with the Philippine SEC offering Chinese-language accompaniment and settling-in support. We can accompany you to the police station, help you communicate with banks and platforms, and help you assemble your report file and timeline. Yixing is not a law enforcement body, cannot recover funds, and never charges any recovery fee. → Chinese-speaking accompaniment and emergency assistance

For disputes over amounts and recovery in your specific case, consult a licensed attorney. This article is not legal advice.