Quick answer
Yes. You may file a cybercrime complaint directly with the National Bureau of Investigation’s Cybercrime Division or an NBI office handling cybercrime cases. You do not need a prior barangay blotter, a Philippine National Police referral, or a lawyer merely to request an investigation.
The NBI’s published Citizen’s Charter makes its computer-crime investigation service available to the general public, lists no filing fee, and describes an intake process involving a complaint sheet, an interview, sworn statements or affidavits, supporting evidence, and—when relevant—examination of a device. Its stated processing time of about one hour and ten minutes covers the listed intake actions, not the full investigation or prosecution. See the NBI Citizen’s Charter service.
Filing with the NBI is primarily a request for law-enforcement investigation. It does not automatically file a criminal case in court, produce an arrest, remove online content, freeze an account, or recover lost money. After investigation, the evidence may be referred or submitted to the proper prosecution office. A prosecutor—not the NBI—determines whether the evidence justifies filing an Information in court.
Why the NBI may accept the complaint directly
Section 10 of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, designates both the NBI and the PNP as law-enforcement authorities responsible for enforcing the law. It requires each agency to maintain a specialized cybercrime unit. Read Republic Act No. 10175.
The NBI currently lists a Cybercrime Division and publishes ccd@nbi.gov.ph as its contact email. The email address is useful for confirming where and how to present a complaint, but an email inquiry should not be assumed to be a formally docketed complaint unless the NBI confirms that it has been accepted and assigned. Check the NBI’s current divisions and contacts.
You may also approach the PNP, whose cybercrime units have concurrent law-enforcement responsibility under the same statute. Choosing the NBI does not make the complaint less valid. The receiving office may route the matter to a regional cybercrime center, another NBI division, the PNP, or another government agency if the facts fall mainly within that office’s mandate.
Not every harmful online act is automatically a cybercrime
Republic Act No. 10175 covers offenses such as illegal access, illegal interception, data or system interference, misuse of devices, cybersquatting, computer-related forgery, computer-related fraud, computer-related identity theft, and certain content-related offenses. It also covers crimes under the Revised Penal Code or special laws when committed through information and communications technology, subject to the wording and elements of the particular offense.
Terms such as “hacking,” “scam,” “cyberbullying,” “fake account,” and “online harassment” are everyday descriptions, not complete legal conclusions. For example:
- A failed online transaction is not necessarily criminal fraud; breach of contract and estafa have different elements.
- An offensive post is not automatically cyberlibel.
- A fake profile may involve identity theft, fraud, harassment, or no completed criminal offense, depending on how it was created and used.
- Unauthorized access requires proof that access was made without right, not merely that the complainant disliked what the other person did.
- A data-privacy violation may require separate action before the National Privacy Commission even when the same facts are reported to law enforcement.
Describe what happened accurately. You do not have to identify the perfect criminal charge before asking the NBI for assistance.
How to file with the NBI
1. Preserve the evidence before confronting the suspected offender
Save the material in its original form whenever possible. Useful evidence may include:
- Full screenshots showing the account name, username, date, time, URL, and surrounding conversation
- Original emails, including available headers, attachments, and delivery notices
- Exported chat histories rather than screenshots alone
- Profile links, account identifiers, phone numbers, email addresses, domain names, and wallet or bank-account details
- Transaction receipts, reference numbers, statements, invoices, delivery records, and proof of the amount lost
- Password-reset notices, login alerts, one-time-password messages, and account-recovery correspondence
- Reports sent to the platform, bank, e-wallet, telecommunications company, or employer and their replies
- A chronological list of events and the names and contact details of witnesses
- The original phone, computer, storage device, or SIM connected with the incident
Do not crop or annotate the only copy of a screenshot. Keep the unedited original and make a separate working copy if you need to highlight something. Do not delete the account, factory-reset the device, reinstall applications, or “hack back.” Those steps can destroy evidence or create new legal problems.
If the material involves intimate images or sexual-abuse content, especially content involving a child, do not download, duplicate, or forward it unnecessarily. Preserve the location and account information, secure the device, and report it promptly so investigators can advise how the evidence should be handled.
2. Prepare a clear factual narrative
Write a chronological account answering:
- Who was involved, if known?
- What exactly was said, accessed, altered, posted, demanded, or transferred?
- When did each event occur?
- Which device, platform, account, website, bank, or e-wallet was used?
- Where were you and the relevant devices located?
- How did you discover the incident?
- What loss, threat, reputational harm, or account compromise resulted?
- What steps have you already taken?
- Which facts can each witness confirm?
Separate facts you personally observed from conclusions, assumptions, and information supplied by another person. Disclose any continuing business, employment, family, or personal relationship with the subject when it helps explain access rights or the context of the communications.
3. Contact the appropriate NBI office before travelling
The NBI maintains regional and district offices, but not every location necessarily has the same technical capability or receives every cybercrime complaint on site. Consult the official NBI office directory or NBI contact page and confirm the current receiving office, schedule, and local intake instructions.
A government-issued ID and organized copies of your evidence are sensible to bring, although the Cybercrime Division’s published checklist currently states “None” as an initial documentary requirement. If another person owns the affected account, device, or funds, expect investigators to ask that person to execute a statement or establish your authority to act for them.
4. Complete the complaint sheet and interview
Under the NBI’s published procedure, personnel assist the complainant in completing a complaint sheet. An agent or investigator then conducts a preliminary interview and initial investigation. The complainant and witnesses may execute sworn statements or submit prepared affidavits, and investigators collect supporting documents and may examine a relevant device.
Read every statement carefully before signing. Correct inaccurate dates, amounts, account names, and quotations. Never sign a blank or incomplete affidavit.
Ask for the complaint or reference number, the assigned office or investigator, and written acknowledgment of any original device or document left in NBI custody. Keep copies of everything you submit.
5. Cooperate with lawful preservation and warrant procedures
Investigators may need subscriber information, traffic data, communication content, or data stored by a service provider. A complainant generally cannot compel a platform or telecommunications company to disclose another user’s protected information.
Republic Act No. 10175 and the Supreme Court’s Rule on Cybercrime Warrants establish procedures for preserving data and obtaining court authority for disclosure, interception, search, seizure, or examination where required. Read the Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC.
The Supreme Court has also struck down provisions of the original Cybercrime Prevention Act that allowed warrantless real-time collection of traffic data and executive blocking of computer data. Investigations therefore remain subject to constitutional privacy and search protections. See Disini v. Secretary of Justice.
File promptly: evidence and prescription deadlines matter
There is no single filing deadline for every cybercrime complaint. The prescriptive period depends on the exact offense, governing statute, penalty, date of commission or discovery, and applicable jurisprudence. Do not assume that a complaint remains actionable merely because an online post or account is still visible.
A report to the NBI should also not be treated as automatically stopping the prescriptive period. In People v. Consebido, the Supreme Court clarified prospectively that filing the criminal complaint with the prosecution office tolls prescription. If a limitation period may be approaching, obtain legal advice and consider filing a properly supported complaint with the correct prosecution office without waiting for an open-ended law-enforcement investigation. Read People v. Consebido, G.R. No. 258563.
Digital evidence can disappear sooner than the legal deadline. Under Section 13 of Republic Act No. 10175:
- Traffic data and subscriber information relating to communications must be preserved by service providers for at least six months from the transaction.
- Content data must be preserved for six months from receipt of a law-enforcement preservation order.
- Law enforcement may order one extension for another six months, subject to the statute.
These are legal preservation rules, not promises that every foreign platform or service will retain every item for that long. File as soon as possible so investigators can assess whether a preservation request is needed.
For unauthorized transfers or scams, contact the bank or e-wallet immediately as well. A criminal complaint does not replace the provider’s fraud-reporting, account-security, dispute, or recovery procedures.
What happens after intake
Depending on the evidence, the NBI may:
- Conduct interviews and obtain additional sworn statements
- Examine voluntarily submitted devices or seek forensic assistance
- Request preservation of relevant computer data
- Apply for the appropriate cybercrime warrant
- Coordinate with service providers, banks, other agencies, or foreign authorities
- Identify additional witnesses or suspects
- Refer or file the resulting complaint with the proper prosecution office
- Close, archive, or refer the request if the evidence does not establish an investigable offense or another office has primary responsibility
The NBI’s intake estimate is not a deadline for completing these steps. Investigations involving anonymous accounts, foreign service providers, cryptocurrency, multiple jurisdictions, or deleted data may take considerably longer.
At the prosecution stage, the complainant may have to submit a formal complaint-affidavit, witness affidavits, and supporting documents in the required number and format. The prosecutor evaluates the evidence under the applicable DOJ rules and gives the respondent an opportunity to answer when required. An NBI recommendation is relevant but does not bind the prosecutor or the court.
Common mistakes that weaken a complaint
- Submitting cropped screenshots without URLs, dates, or account identifiers
- Deleting messages or resetting the affected device after making screenshots
- Sending only a long collection of files without a chronology
- Exaggerating facts or identifying a suspect solely on a display name or profile photo
- Omitting earlier conversations that provide important context
- Paying an “agent,” fixer, or supposed NBI employee to guarantee an arrest or favorable outcome
- Treating an email inquiry as a formally filed and docketed complaint
- Waiting for the NBI investigation when a prescriptive period may be close
- Posting accusations publicly while the identity of the offender remains unverified
- Assuming that reporting to a platform, barangay, bank, or employer is the same as filing a criminal complaint
- Giving away an original device without obtaining a clear acknowledgment of custody
When help is urgent
Call the Unified 911 Emergency Hotline or contact the nearest police station immediately if there is an imminent threat to life, physical safety, or an ongoing offense. Do not wait for a regular NBI appointment during an emergency. See current DILG guidance on Unified 911.
Urgent legal or law-enforcement assistance is also appropriate when:
- A child is being sexually exploited or abuse material is circulating
- The offender is threatening to release intimate images
- Money is still being transferred or withdrawn
- A compromised account controls banking, business, medical, or government records
- The offender has access to your home, workplace, or live location
- A device or account is actively being altered or wiped
- A prosecutor, court, or agency deadline is near
- You have received a subpoena, warrant, or notice naming you as a respondent
Secure affected accounts from a trusted device, notify the relevant bank, e-wallet, platform, or telecommunications provider, and preserve the alerts and reference numbers generated by those reports.
Frequently asked questions
Do I need a lawyer to complain to the NBI?
No lawyer is required merely to approach the NBI and request an investigation. Legal assistance is advisable when the facts are complex, the limitation period may be close, substantial money or business data is involved, or you may also face criminal or civil exposure.
Must I know the offender’s real name?
Not necessarily. Provide every available identifier, including usernames, profile and post links, phone numbers, email addresses, payment accounts, transaction references, and the dates and times of communications. Identification may require lawful requests or warrants.
Can I file only by email?
Do not assume so. The NBI publishes a Cybercrime Division email, but its Citizen’s Charter describes an in-person complaint sheet, interview, sworn statement, and evidence-gathering process. Use email to confirm current instructions and obtain written confirmation if the office accepts and formally dockets your submission electronically.
Is an NBI complaint free?
The NBI Citizen’s Charter lists no fee for its investigative-assistance process. Notarial, copying, transportation, private forensic, or lawyer’s costs—if independently incurred—are separate.
Can I report the same incident to the NBI and PNP?
Both agencies have cybercrime enforcement authority. If you report to more than one office, disclose the existing complaint and reference number to avoid duplicated or conflicting investigations.
Will the NBI immediately remove the post or recover my money?
No. Content removal usually requires action by the platform or lawful government or court process. Fund recovery depends on how quickly the financial provider is notified, whether the funds remain traceable or available, and the provider’s lawful procedures. A criminal investigation cannot guarantee either result.
Official sources
- NBI Citizen’s Charter: Investigative Assistance for Victims of Computer Crimes
- NBI Cybercrime Division and official contact directory
- Republic Act No. 10175, Cybercrime Prevention Act of 2012
- Implementing Rules and Regulations of Republic Act No. 10175
- Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC
- Disini v. Secretary of Justice, G.R. Nos. 203335 et al.
- DOJ requirements for filing a complaint for preliminary investigation
- People v. Consebido, G.R. No. 258563
This article provides general legal information, not advice for a particular case. The correct offense, venue, filing route, remedies, and deadlines depend on the facts and documents. Official sources and procedures were checked as of July 20, 2026.