Money Muling and Safe Financial Account Use

Social engineering disputed transfers and Philippine law

Money muling and related financial account scams raise questions about the source of funds, account access, and the purpose of a transfer. Under Philippine law, assessing prohibited conduct requires attention to the statutory elements as well as the transaction record.

An offer to earn money by receiving transfers and forwarding them elsewhere can expose an account holder to serious legal risk. So can buying or selling a bank account or e-wallet.

The Anti-Financial Account Scamming Act, Republic Act No. 12010 or AFASA, addresses how financial accounts are used in fraud and how institutions should respond to disputed transactions.[1]

Understanding the prohibited conduct helps businesses protect payments and helps individuals recognize when an apparently simple favor or online job requires closer scrutiny.

Understanding money muling and social engineering

AFASA’s money muling provision covers specified acts involving accounts for the purpose of handling proceeds known to come from crimes, offenses or social engineering schemes.

The acts include using or allowing the use of accounts, lending or renting accounts, and recruiting others for the prohibited conduct. The required purpose and knowledge matter. Receiving a disputed transfer does not, by itself, prove every element of money muling.[2]

The law separately penalizes buying or selling financial accounts and opening accounts under fictitious names or another person’s identity. It defines social engineering through deception or fraud used to obtain sensitive identifying information, resulting in unauthorized access and control over another person’s financial account.[3]

An unsolicited message asking for a one-time password (OTP), a fake bank verification call or a fraudulent login page may form part of such a scheme. Whether a particular incident satisfies AFASA or another offense depends on the evidence. An ordinary payment dispute should be assessed on its actual facts.

Begin with the actual arrangement. Identify who owns and controls the account, who gave the instructions, and what the account holder was told about the funds. Keep the promised work, requested access, and proposed payment route together when assessing the available evidence.

A money muling assessment should distinguish the account holder’s actions from the information available to that person at the time. Messages, payment records, and the surrounding commercial explanation may be important. A suspicious transaction calls for investigation; the legal conclusion must still address the elements of the particular offense.

The statutory treatment of account sales and identity misuse also requires attention. Describe the conduct accurately before selecting a legal characterization. The same transaction may raise questions about account access, deceptive communications, and the movement of funds, which should be assessed against the evidence and applicable provisions.

Read AFASA when examining money muling, social engineering, and the duties of financial institutions. The legislation addresses prohibited conduct and mechanisms for dealing with disputed transactions, while the applicable BSP rules provide further detail on the institutional process.

Recognizing unusual recruitment and payment instructions

Be cautious when someone offers a commission for using your account, asks you to surrender account access, or directs you to move unfamiliar funds immediately. A claimed employer’s name and an attractive contract are not sufficient verification. Independently confirm the business, the work, and why the payment route is necessary.

For example, an online recruiter may describe receiving customer payments as an accounting task but insist that the worker use a personal e-wallet and keep a percentage. Before participating, the worker should verify the arrangement and obtain advice.

If funds have already arrived, preserve the instructions and contact the institution through an official channel rather than forwarding the funds as directed.

Businesses should also review who may open accounts, authorize transfers, change payment details, and access authentication devices. Shared passwords and informal account lending make investigation and accountability more difficult.

Verification should use a source independent of the message that requested the transfer. Check the claimed organization and contact an established representative through details obtained separately. Ask for an explanation of the work and why the proposed account is being used to collect or disburse money.

Money muling concerns can arise in an arrangement presented as remote work, payment assistance, or a favor for another person. A job description or written agreement should be examined with the actual instructions. Record discrepancies between the promised role and the transactions the person is asked to perform.

For a business, identify when a proposed payment departs from the agreed commercial arrangement. A new beneficiary, sudden account change, or urgent instruction to bypass approval should trigger review. Staff need a clear person to contact before the payment is released and an accessible record of the verification.

Reporting a suspected scam and preserving the record

Contact the bank or payment provider using its verified app, website or official hotline. Report the affected transaction, request protective action and obtain a complaint reference. Provide the transaction identifier, amount, date, recipient details available to you and a clear chronology. Ask what further documents the institution requires.[4]

Secure affected accounts through trusted channels. Preserve original messages, receipts, emails, and device records; avoid deleting conversations or editing the only copy of a screenshot. A company should preserve relevant access and payment approval logs while controlling who can view them.

Prepare a documented report for the appropriate law enforcement agency, such as the Philippine National Police Anti-Cybercrime Group or National Bureau of Investigation. Legal advice can help organize the evidence, identify possible claims or defenses, and avoid unsupported public accusations.

If you are dissatisfied with the institution’s response after using its complaint process, you may escalate the concern to the Bangko Sentral ng Pilipinas (BSP) Consumer Assistance Mechanism.[5]

Prepare a factual chronology while events are still clear. Record the first contact, instructions, transfers, discovery of the problem, and reports made. Identify the source of each entry. Distinguish information personally observed from statements made by the other party or an institution.

A money muling report should describe the person’s actual role and the instructions received. Provide relevant communications and transaction records through the appropriate channel. If an amount, identity, or event remains unconfirmed, state that limitation and identify the records needed to clarify it.

Use the information requirements for the particular complaint channel. Keep original evidence securely and prepare suitable copies for submission. Access credentials should remain protected. Check the BSP’s complaint guidance before attaching material to an escalation, including its instructions on information that should not be shared.

If a caller claims to be the institution’s fraud team, end the call and contact the institution through an independently verified channel before following recovery instructions. A promise of faster recovery should not be treated as authority to disclose authentication information or make another transfer.

The BSP’s consumer complaint guide explains the institution’s role as the first level of recourse and the BSP mechanism as the second. A money muling or account scam complaint should retain its reference numbers, submissions, and responses so that later reviewers can follow what occurred.

Temporary holds and coordinated verification

BSP Circular No. 1215 governs temporary holds for disputed electronic transfers between financial accounts. It excludes erroneous transfers and generally excludes credit card transactions, except where a card is used for an electronic transfer through an automated clearing house.

An initial hold may last up to five calendar days; a justified extension may add up to 25. Holding beyond 30 calendar days requires a competent court’s extension.[6]

To support an extended hold, the sending account holder must submit a sworn complaint, affidavit, police report or other supporting evidence within the initial period, unless the industry protocol provides otherwise. Confirm the institution’s requirements promptly.[7]

Ask the institution what action has been taken and what the next step requires. Record the relevant dates, affected transaction, amount reportedly held, and outstanding information. A request for protective action should be followed by timely responses to the institution’s verification and documentation requirements.

In a money muling or social engineering incident, the availability of funds and the legitimacy of a transaction are separate questions requiring verification. A report should identify the disputed transfer accurately and preserve information that can assist the institution in tracing and assessing it.

The initial and extended periods should be tracked carefully. Record when the institution says the hold began, what evidence has been submitted, and whether an extension or court action is involved. The account holder should understand the current status rather than assume that a complaint creates an indefinite hold.

Review BSP Circular No. 1215 with the institution’s notices. Money muling allegations do not replace the requirements for coordinated verification, supporting evidence, and the applicable holding period. Keep records of the institution’s explanation and the documents provided in response.

Challenging a hold and assessing restitution

If your funds are held, you may challenge the hold through your institution by providing evidence of the transaction’s purpose, the parties’ relationship or the source of funds.

Substantiated legitimacy requires the institution to lift the hold after evaluation. Release or return follows the applicable verification findings and legal conditions; a complaint alone does not guarantee recovery.[8]

AFASA requires institutions to protect account access through adequate controls. It provides for restitution when those controls or the required highest degree of diligence are lacking, while protecting institutions the BSP determines to be compliant.

A criminal conviction is not a prerequisite to that restitution. Failure to hold disputed funds when legally required can also create liability for resulting loss. Assessing responsibility therefore requires review of the institution’s controls, response and the facts.[9]

An account holder challenging a hold should connect each supporting record to the disputed transaction. Relevant material may include the underlying agreement, invoice, delivery evidence, and communications with the payer. Explain the relationship between the parties and address any discrepancy identified by the institution.

Money muling allegations should be assessed separately from a request to lift a hold or obtain restitution. Identify the particular remedy sought and the evidence supporting it. A legal review can distinguish the alleged conduct, the institution’s response, and the basis on which responsibility for a loss is asserted.

Keep a record of the institution’s decision and its stated reasons. Compare those reasons with the documents submitted and identify any material issue left unanswered. Further action should be based on the applicable remedy and the evidence available, including relevant notices and the chronology of the response.

Reducing opportunities for payment fraud

Train staff to escalate unusual payment instructions and make the reporting route easy to find. Review incidents for control weaknesses after immediate protective steps are taken.

Businesses can reduce exposure to money muling and related scams by assigning clear authority for account access and payment approval. Confirm which accounts the business uses, who may receive funds, and who can approve a change. Review arrangements that depend on an employee’s personal account.

The following controls address common payment situations. Adapt them to the business’s actual payment process and retain enough evidence to show that the required verification occurred. A written policy should be supported by permissions and approval arrangements that staff can use.

Payment risk	Suggested control	Evidence to retain
False supplier bank change	Confirm through an established independent contact	Verification record
Compromised employee account	Require separate approval for transfers	Approver and access logs
Impersonated executive request	Verify urgent requests outside the message thread	Approval trail

Set a process for changes to supplier payment details. The person verifying the change should use an established contact route and record the confirmation before the new details are used. Urgency should be escalated to an authorized approver with the verification question clearly identified.

Money muling awareness should form part of staff instructions on unusual collections and transfers. Explain how to report a request to lend an account, receive unexplained funds, or surrender access. Review access when personnel change roles and ensure that former users cannot continue authorizing business payments.

ATL Law Firm’s corporate practice can assist with payment authority and commercial procedures. Where money muling or social engineering is suspected, the review should connect the immediate protective response with the records, responsibilities, and controls involved in the transaction.

Preparing a transaction record for legal review

A concise transaction file helps the institution, investigators, and legal advisers assess the same events. Keep the originals available and organize submitted copies by date. Identify missing records accurately and explain where further information may be held.

• The disputed transaction details, available account records, amounts, dates, and reference numbers.
• The original messages, recruitment instructions, agreements, invoices, and other evidence of the proposed purpose.
• The institution’s complaint acknowledgment, notices of a hold or extension, and requests for supporting documents.
• The submissions made to the institution or authorities, with evidence of receipt and the responses obtained.
• The internal access, verification, and approval records relevant to a business payment.

For a money muling assessment, record who controlled the account and what each person knew or was told. Avoid reconstructing uncertain events as established facts. The file should allow the reviewer to distinguish the underlying transaction from later explanations and the steps taken after the dispute arose.

Questions on money muling and disputed transfers

Does receiving a disputed transfer automatically establish money muling

No. The money muling provision requires assessment of the specified conduct, purpose, and knowledge. Receiving funds is part of the factual record, but it does not by itself establish every element. Preserve the instructions, transaction details, and evidence explaining the arrangement.

Can a bank account or e wallet be sold to another person

AFASA separately penalizes buying or selling financial accounts and opening accounts under fictitious names or another person’s identity. An offer presented as employment or account assistance should be assessed against the actual conduct requested. Verify unusual arrangements before providing access or participating in transfers.

How long can disputed funds be temporarily held

Under BSP Circular No. 1215, an initial hold may last up to five calendar days and a justified extension may add up to 25. A further extension requires a competent court. Review the institution’s notices and the applicable verification and release conditions for the particular transaction.

Can an account holder challenge a temporary hold

Yes. The beneficiary account holder may provide evidence supporting the transaction’s legitimacy through the institution. Relevant records can address the purpose, parties’ relationship, or source of funds. A money muling allegation should be examined alongside that evidence and the applicable process for evaluating the hold.

Are erroneous transfers covered by the same temporary hold rules

BSP Circular No. 1215 excludes erroneous transactions from this temporary holding framework. Describe the transfer accurately to the institution so it can identify the applicable process. A mistaken payment, a disputed transaction involving suspected fraud, and a money muling allegation require separate assessment.

Does reporting a scam guarantee that the money will be returned

Recovery depends on the evidence, the status of funds, verification findings, and applicable legal conditions. A temporary hold and a restitution claim involve different requirements. For money muling or social engineering concerns, obtain a clear record of the action taken and the basis for any decision.

Where should an unresolved institutional complaint be escalated

Use the institution’s complaint mechanism first. If dissatisfied with its action or response, the financial consumer may escalate to the BSP Consumer Assistance Mechanism. A report to law enforcement serves a different purpose and should be considered with the facts and evidence of the suspected offense.

Legal assistance with financial account scams

ATL Law Firm can assist with assessing a financial account scam, preparing the legal response, and reviewing business payment procedures.

---

[1] Anti-Financial Account Scamming Act (AFASA), Republic Act No. 12010, §§ 3(d), 4–8 (July 20, 2024) (Phil.).
[2] AFASA, § 4(a).
[3] AFASA, §§ 4(b), 5(c)–(d).
[4] Bangko Sentral ng Pilipinas, Circular No. 1215, Regulations on the Temporary Holding of Funds Subject of Disputed Transactions and Coordinated Verification Process, § 1, at 9–12 (May 30, 2025) (Phil.).
[5] Bangko Sentral ng Pilipinas, How to File a Complaint Against a BSP-Supervised Institution, at 1–2 (Sept. 2025).
[6] BSP Circular No. 1215, § 1, at 1–2, 8–13.
[7] BSP Circular No. 1215, § 1, at 12.
[8] BSP Circular No. 1215, § 1, at 14, 16–17.
[9] AFASA, §§ 6, 9; Bangko Sentral ng Pilipinas, Circular No. 1213, Amendments to Regulations on Information Technology Risk Management to Implement Section 6 of the Anti-Financial Account Scamming Act, § 1, at 3–5 (May 30, 2025) (Phil.).