Quick answer

Yes. Threatening SMS, iMessage, Messenger, Viber, WhatsApp, email, and similar electronic messages may be used as evidence in Philippine criminal, civil, administrative, and protection-order proceedings.

But a screenshot is not automatically conclusive. The person presenting the messages must ordinarily show that:

the messages are relevant to the case;
they are authentic and accurately reproduced;
the sender can be reliably identified;
the conversation has not been materially altered; and
the evidence was obtained lawfully.

Keep the original phone and complete conversation whenever possible. A cropped screenshot showing only a contact name may be challenged because contact names can be edited and another person may have used the account or device.

Why electronic messages are admissible

The Electronic Commerce Act of 2000 recognizes electronic documents as the functional equivalent of written documents for evidentiary purposes. Electronic evidence cannot be rejected merely because it is in digital form.

The Supreme Court’s Rules on Electronic Evidence apply to civil and criminal actions, as well as quasi-judicial and administrative proceedings. An electronic document is admissible when it satisfies the ordinary rules of admissibility and is properly authenticated.

In Enojas v. People, the Supreme Court specifically held that text messages may be proved through the testimony of a person who participated in the exchange or has personal knowledge of it. If such a witness is unavailable, other competent evidence may be considered. The decision is available in G.R. No. 204894, March 10, 2014.

Admissibility, however, is different from evidentiary weight. A court may admit a message but give it little weight if the sender’s identity, completeness, context, or integrity remains doubtful.

What must be proved

The messages are genuine

The person relying on a private electronic document bears the burden of authenticating it. Under Rule 5 of the Rules on Electronic Evidence, authenticity may be established through:

a digital signature;
an authorized security procedure or device; or
other evidence showing the document’s integrity and reliability to the judge’s satisfaction.

For ordinary text or chat messages, the third method is usually the relevant one. Authentication may come from the recipient’s testimony, the original device, account information, message metadata, related communications, admissions by the sender, witness testimony, or other surrounding facts.

The Supreme Court has warned that electronic material cannot be given probative value when the required authentication is missing. See G.R. No. 223274, June 19, 2019. More recently, the Court rejected reliance on printouts of message screenshots that had not been properly authenticated in G.R. No. 258888, April 8, 2024.

The alleged sender is properly identified

A message appearing under “Juan,” “Boss,” or another saved contact name does not by itself prove who sent it. Useful identifying evidence may include:

the actual mobile number, username, email address, or account URL;
earlier conversations containing facts known only to the parties;
the sender’s photograph, voice notes, writing patterns, or references to shared events;
replies or later conduct acknowledging the message;
testimony from the recipient or another participant;
subscriber, device, traffic, or account records lawfully obtained by investigators; and
possession or control of the sending device or account.

No single item is necessarily decisive. Courts evaluate the entire body of evidence.

The copy accurately reflects the original conversation

A readable electronic output may qualify as the equivalent of an original if it accurately reflects the data. The safest practice is to retain the message in its native form on the original device rather than relying only on printed screenshots.

Screenshots remain useful, especially when a sender can delete or unsend messages, but they should show enough information to establish context and continuity.

The messages are relevant to a disputed fact

Threatening messages may help prove more than the words used. Depending on the case, they may show intent, identity, motive, a demand or condition, a pattern of harassment, the recipient’s state of mind, or the circumstances surrounding later conduct.

Whether a message proves a crime still depends on all legal elements. An offensive, angry, or frightening message is not automatically the crime of grave threats.

What offense may be involved?

Grave threats

Article 282 of the Revised Penal Code covers a threat to inflict upon a person—or upon that person’s family, honor, or property—a wrong amounting to a crime. The legal consequences differ depending on whether the threat imposed a condition or demanded money, whether the offender achieved the purpose, and whether it was unconditional.

A written threat receives special treatment under Article 282. Because the precise charge and penalty depend on the threatened wrong and surrounding circumstances, they should not be determined from an isolated screenshot. The current statutory text, including amendments to monetary fines, appears in Republic Act No. 10951.

Light threats and other light threats

Articles 283 and 285 address narrower forms of threatening conduct, including certain threats involving a wrong that does not amount to a crime. Their application depends on matters such as whether a condition was imposed, whether the statement was oral or written, whether it occurred in the heat of anger, and whether later conduct showed persistence.

A text message cannot simply be placed into whichever category sounds closest. The exact language, context, threatened act, conditions, and subsequent behavior must be examined.

Coercion, harassment, or another offense

A message demanding that someone do—or stop doing—something may also raise coercion, extortion, stalking, sexual-harassment, or other issues. The controlling law depends on what was said, the parties’ relationship, and the sender’s conduct beyond the messages.

Republic Act No. 10175 does not make every threat sent electronically a separate “cybercrime.” It may apply where an offense covered by its provisions is committed through information and communications technology, but the correct charge remains fact-specific. See the Cybercrime Prevention Act of 2012.

Violence against women and their children

Threatening or incessant messages from a husband, former husband, dating partner, former dating partner, or person with whom a woman has a common child may fall under the Anti-Violence Against Women and Their Children Act. The law covers specified forms of physical, sexual, psychological, and economic abuse, including certain threats, harassment, and conduct causing or likely to cause psychological harm.

Not every unpleasant message from a partner establishes psychological violence. The qualifying relationship, prohibited conduct, required intent where applicable, and resulting mental or emotional anguish must be proved under the particular provision charged.

A victim who qualifies under this law may seek a barangay, temporary, or permanent protection order. Immediate safety measures need not wait for the criminal case to finish.

Gender-based online sexual harassment

Messages involving sexual, misogynistic, sexist, homophobic, or transphobic threats, cyberstalking, incessant messaging, impersonation, or non-consensual sharing of sexual content may fall under the Safe Spaces Act, provided its specific elements are present.

How to preserve threatening messages properly

Act before messages, accounts, backups, or device data disappear.

Do not delete the conversation. Keep the original message thread, including messages sent before and after the threat.
Take complete screenshots. Capture the mobile number, username, account profile, date, time, and surrounding conversation. If a message is long, use overlapping screenshots so no gap exists.
Make a screen recording. Start from the account profile or contact information, then slowly scroll through the conversation. This can help demonstrate continuity, although it does not replace formal authentication.
Export or back up the chat. Use the platform’s official export function if available. Preserve the exported file in its original format.
Keep the original device. Do not reset, trade in, repair, or dispose of it without first obtaining advice about preservation. Keep it charged and protected by a password.
Preserve related material. Save call logs, voice messages, emails, attachments, photographs, payment demands, location information, prior threats, and messages sent to relatives or co-workers.
Record the surrounding facts. Write a dated chronology stating when each message arrived, what happened immediately before and after it, and who saw the message on the device. Do not add facts you cannot honestly recall.
Keep copies in secure locations. Store an unchanged backup on another device or secure drive. Give a copy to a trusted person if there is a risk that the phone will be taken or destroyed.
Document later events. Preserve attempts to approach you, surveillance, property damage, apologies, admissions, or repeated contact from new accounts.
Give investigators the original files. If evidence is copied or forensically examined, ask that the transfer, device details, and handling be documented.

Under the Cybercrime Prevention Act, service providers must preserve specified computer data for at least six months after a lawful preservation request from law enforcement, with rules for extension and content data. This is not a six-month guarantee for users: platforms may follow shorter retention or deletion practices before an official request is made. Report promptly if provider-held data may identify the sender.

How to report the threat

If there is an immediate and credible danger, move to a safe place and contact the police or emergency services at once. Do not arrange a meeting with the sender merely to obtain more evidence.

For a non-immediate case:

bring the original phone, screenshots, exported files, identification, and a written chronology to the nearest police station;
if the conduct involves online accounts, spoofed identities, hacking, or provider records, ask for assistance from a cybercrime investigator;
execute a truthful complaint-affidavit and identify which facts you personally witnessed;
provide the sender’s known name, number, accounts, addresses, relationship to you, and access to weapons, if known;
disclose the full conversation, including messages that may appear unfavorable, rather than presenting a misleading extract; and
obtain and keep the complaint or incident reference number and copies of documents you submit.

The Department of Justice maintains an official page for reporting cybercrime incidents. A criminal complaint may ultimately require evaluation by the proper prosecutor or other authorized office. Venue, barangay conciliation, and preliminary-investigation requirements depend on the offense, penalty, residence of the parties, and circumstances.

Do not wait for a presumed filing deadline. Prescription periods vary with the offense and may involve questions about when the period began, whether it was interrupted, and which law governs. Delay can also cause the loss of account and telecom records.

Common mistakes that weaken the evidence

saving only a cropped screenshot;
showing a saved contact name but hiding the actual number or account;
deleting the original thread after printing it;
editing, annotating, filtering, or recompressing the only available copy;
combining separate screenshots without retaining the originals;
failing to preserve messages that provide context;
assuming that ownership of a number automatically proves who typed the message;
creating a new conversation intended to provoke more threats;
posting the entire exchange publicly, exposing private information or escalating the danger;
impersonating someone, hacking an account, or installing spyware to gather proof; and
secretly recording calls without first obtaining legal advice.

The Anti-Wiretapping Act restricts the secret interception or recording of private communications or spoken words without the required authorization. A message lawfully received on your own phone presents a different issue from secretly intercepting another person’s communications. Do not access someone else’s device or account without authority.

When legal help is urgent

Seek immediate police assistance and legal advice when:

the message gives a specific time, place, target, or method of attack;
the sender sender is nearby, following you, trying to enter your home, or has access to weapons;
threats are escalating or accompanied by physical violence or property damage;
a child, elderly person, or person with a disability is at risk;
the sender is a current or former intimate partner and protection is needed;
the sender threatens to release intimate images or demands money, sex, property, or another act;
evidence may soon be deleted or provider records are needed;
police seek consent to search or extract data from a device containing unrelated private information; or
a complaint, subpoena, protection-order application, or court deadline has already been received.

A lawyer can assess the proper offense, venue, preservation requests, protection-order options, and the evidence needed to connect the messages to the alleged sender. Those who cannot afford private counsel may ask the Public Attorney’s Office about eligibility for assistance.

Frequently asked questions

Is a screenshot alone enough?

Sometimes it may support a complaint, but it is safer to keep the original device and complete conversation. A screenshot can be challenged as incomplete, altered, or falsely attributed. Its sufficiency depends on authentication and the other evidence.

Must the recipient personally testify?

The testimony of a participant or person with personal knowledge is a recognized way of proving text messages. Other competent evidence may be considered when such a witness is unavailable, but the authentication problem still must be addressed.

Can deleted or “unsent” messages still be used?

Yes, if an accurate copy, notification, backup, recipient-side record, or lawfully obtained provider or device record remains. Recovery is not guaranteed, so preserve available material and report promptly.

Does blocking the sender destroy the evidence?

Blocking normally does not erase messages already stored, but platform behavior varies. Preserve and export the conversation first if it is safe to do so. Personal safety takes priority over collecting additional messages.

Is a threat still evidence if it came from an unknown or fake account?

Yes, but proving who controlled the account may be difficult. Preserve the profile URL, username, number, timestamps, account details, and related messages. Investigators may need lawful process to obtain subscriber, traffic, or device information.

Can messages be used even if no criminal case is filed?

Potentially. They may be relevant in protection-order, civil, employment, school, professional-discipline, or administrative proceedings, subject to the rules governing that forum.

Does an angry statement automatically amount to grave threats?

No. The court examines the words, context, threatened wrong, conditions, intent manifested by the communication, and subsequent conduct. A lawyer or prosecutor should assess the complete exchange rather than a single phrase.

Should the victim reply?

There is no general need to reply. Do not provoke the sender or promise compliance merely to gather evidence. If a response is necessary for safety, keep it brief and avoid arranging an in-person confrontation.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Admissibility, the correct charge, filing procedure, and available protection depend on the complete facts and documents. Primary legal sources and official procedures were checked as of 24 July 2026.