A practical legal guide for cybercrime investigations

Short answer

Yes—often. Even if an online account is deactivated (or sometimes even “deleted”), investigators in the Philippines can frequently trace the person behind it when they move quickly, use the correct legal processes, and follow sound digital-forensics practice. Success turns on (1) what metadata still exists with the platform or local internet/telco providers, (2) whether evidence is preserved in time, and (3) whether proper warrants and chain-of-custody rules are observed so the results are admissible in court.

The legal framework

1) Cybercrime Prevention Act of 2012 (Republic Act No. 10175)

Jurisdiction & penalties. Defines and penalizes cybercrimes (e.g., illegal access, computer-related fraud/forgery, cyber-libel, online sexual exploitation, etc.) and provides the enforcement toolbox.
Data preservation. Service providers must preserve computer data for at least six (6) months, extendable by court order. This is critical when chasing recently deactivated accounts.
Real-time collection & disclosure. Law enforcement may obtain court-authorized real-time traffic data collection and compel disclosure of subscriber information/traffic data/content through specialized cyber warrants.

2) Supreme Court Rules on Cybercrime Warrants (A.M. No. 17-11-03-SC)

These rules operationalize RA 10175 and specify what judges can issue and what officers can ask for:

WDCD – Warrant to Disclose Computer Data: to compel platforms/ISPs/telcos to disclose subscriber info, logs, traffic data, and stored content.
WSECD – Warrant to Search, Seize, and Examine Computer Data: to forensically image devices, cloud accounts, and storage.
WICD – Warrant to Intercept Computer Data: for prospective or real-time capture of traffic/content (when legally permissible).
Other relief (e.g., preservation orders) may accompany applications. These warrants are typically filed with designated cybercrime courts and can have extraterritorial reach where allowed by law and treaties.

3) Rules on Electronic Evidence (REE) and the Rules of Court

Establish admissibility standards, authentication of digital evidence, and how metadata, logs, screenshots, and forensic images are introduced at trial.
Chain of custody is essential: collection → preservation → examination → presentation must be properly documented by trained personnel.

4) Data Privacy Act of 2012 (RA 10173)

Allows lawful processing of personal data for compliance with legal obligations and law-enforcement purposes, subject to necessity, proportionality, and due process.
Platforms and telcos may disclose data only upon proper legal authority (e.g., cybercrime warrants, lawful orders).

5) Related sectoral laws & rules

BSP e-money/KYC rules and AML laws: where dummy accounts interact with wallets/banks, law enforcement—with proper process—can obtain KYC information, device/app logs, and transaction trails.
SIM Registration Act: mobile-number–based accounts may be linked to registered SIM details (again, upon lawful order).
NTC/DICT/ISPs: IP address attribution, CGNAT logs, and tower/location records are generally reachable by court order.

“Deactivated” vs. “Deleted”: Why the distinction matters

Deactivated typically means the profile is hidden but data remains on the platform (profile identifiers, login/IP logs, device fingerprints, message/content archives subject to the platform’s retention policy).
Deleted generally means the user requested erasure; however, backups and server-side logs may persist for a time, and Philippine law can require preservation once authorities properly notify the provider.
The earlier investigators act, the greater the chance that logs still exist.

What can actually be traced?

1) Subscriber & account identifiers

Registered name/email/phone, recovery contacts, device lists, and login timestamps.
For phone-linked accounts, SIM registration data is requestable through the proper warrant.

2) Network metadata

IP addresses used to create, log into, or post from the account; port numbers; sometimes user agent strings (OS/browser).
With IPs and timestamps, investigators can compel the ISP to identify the subscriber line or mobile connection at that time.

3) Device and browser fingerprints

Platform-side device IDs, advertising IDs, cookie identifiers, push tokens, and overlapping fingerprints that link one dummy account to a user’s other accounts or sessions.

4) Content & attachments

Depending on scope of the warrant and platform policy: messages, posts, comments, images, and their embedded EXIF/metadata.

5) Financial trails

If the dummy account transacts (marketplaces, ad buys, wallet loads, ride-hailing, deliveries), law enforcement can—by lawful order—obtain KYC info, shipping addresses, and payment instrument fingerprints from regulated entities.

Typical tracing workflow (Philippine context)

Intake & evidence capture
- Complainant preserves evidence: full-page screenshots, screen recordings, message exports, URLs, and headers where possible.
- File a report with PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division (CCD).
Rapid preservation
- Investigators send preservation requests to platforms/ISPs to freeze relevant data (vital for deactivated/ephemeral accounts).
Apply for cyber warrants
- WDCD to the platform for subscriber/login logs, device IDs, IP history, and content (as justified).
- If needed, WSECD to examine seized devices/cloud storage; WICD for prospective interception in ongoing schemes.
Correlate logs
- Map platform IP logs → local ISPs/telcos.
- Obtain subscriber details and tower/IP assignment logs for the precise timestamps (CGNAT resolution may require port/time data).
- Cross-match device fingerprints across multiple services.
Follow the money / logistics
- If transactions exist, seek BSP-regulated entity records (wallets, banks, couriers, marketplaces) to surface real-world identities.
Attribution & charging
- Build a timeline linking the suspect to specific acts using admissible digital evidence; prepare sworn statements and forensic reports; file the appropriate Informations/complaints.

Cross-border & platform cooperation

Many large platforms are offshore. Philippine authorities typically use:
- MLAT or letters rogatory routed through the DOJ – OLAJ for foreign providers;
- The 24/7 cybercrime contact network and cooperation channels associated with the Budapest Convention on Cybercrime (to which the Philippines is a Party).
Expect provider-specific response formats and retention windows; speed is crucial.

Practical hurdles (and how investigators overcome them)

Short retention windows. Some logs roll off quickly—hence the need for immediate preservation.
CGNAT masking. Mobile/broadband ISPs often use carrier-grade NAT; investigators must request IP + port + timestamp to reliably attribute a session.
Shared networks & cafés. Attribution may require CCTV, Wi-Fi logs, receipts, delivery records to connect a person to the access point at the relevant time.
Privacy & overbreadth. Warrants must be specific and proportionate; overly broad requests risk denial or suppression of evidence.
“Clean” opssec by offenders. Even then, slip-ups—reused devices, payment rails, recovery emails, or timing overlaps—often expose identity.

Admissibility and courtroom issues

Authentication. Show that the evidence is what it purports to be—usually via custodian certificates, platform declarations, or forensic analyst testimony.
Integrity. Maintain hash values, imaging logs, and an unbroken chain of custody.
Hearsay exceptions/records of regularly conducted activity. Business-records certifications from platforms/ISPs are commonly used.
Expert testimony. Forensic examiners explain how logs, headers, and device artifacts tie the accused to the acts.

For complainants: how to maximize traceability

Preserve early. Keep original devices and avoid altering messages; export chats where possible.
Capture context. Save full URLs, timestamps, and profile IDs, not just screenshots.
Report fast to the PNP-ACG or NBI-CCD; ask about preservation letters while warrants are prepared.
List linked accounts/devices you suspect (same phone number, email, marketplace profile).
Keep receipts: deliveries, payments, load purchases, or ad buys tied to the dummy account.

Ethical and privacy guardrails

Tracing must respect constitutional rights, the Data Privacy Act, and procedural safeguards.
No fishing expeditions: requests should be narrowly tailored to the offense, timeframe, and accounts involved.
Victim-initiated doxxing or vigilante tactics risk liability; always route through law enforcement and lawful process.

Bottom line

A “dummy” account that has been deactivated is not automatically untraceable in the Philippines. With swift preservation, proper cyber warrants, and methodical correlation of platform logs, ISP/telco records, device fingerprints, and financial/logistics data, investigators routinely identify the human operator behind such accounts. The key is speed, precision, and strict adherence to legal procedure so that any identification holds up in court.