Here’s a practical, everything-you-should-know legal article on Complaint Filing with the NBI Cybercrime Division (Philippines)—clear for laypersons but careful about the law and real-world procedure. (General info only; not legal advice. You asked me not to search, so I’m drawing from stable statutory principles and standard agency practice.)

Big picture: when the NBI Cybercrime Division is your venue

The National Bureau of Investigation (NBI) – Cybercrime Division investigates crimes committed through or against computers, networks, and digital platforms. It often handles cases that are:

Complex, organized, cross-border, or high-value (e.g., large-scale online fraud, sextortion rings, child sexual abuse/exploitation online, business email compromise (BEC), crypto/fintech scams, hacking).
Sensitive (e.g., cyber libel of public interest, data breaches, doxxing, deepfakes, revenge porn).
Multi-jurisdictional (i.e., offender, victim, data, or platform in different places).

It operates alongside PNP-ACG (Philippine National Police – Anti-Cybercrime Group). Either agency can take a case; dual coordination happens, especially when speed matters (e.g., live threats, ongoing fraud).

Core legal anchors (what typically applies)

Cybercrime Prevention Act (RA 10175): defines core cyber offenses, gives tools like computer data preservation, search/seizure of computer data, and real-time collection (subject to judicial oversight).
Rules on Electronic Evidence: governs admissibility and authentication of digital files, logs, emails, chats.
Special penal laws commonly involved online:
- Anti-Photo and Video Voyeurism (RA 9995)
- Anti-Child Pornography (RA 9775)
- Access Devices Regulation Act (RA 8484) – carding/phishing, OTP fraud
- E-Commerce Act (RA 8792) – e-signatures, e-doc validity; certain offenses
- Data Privacy Act (RA 10173) – breaches, unlawful processing/disclosure
- Intellectual Property Code – online IP infringement
- Anti-VAWC (RA 9262) – tech-facilitated abuse, stalking, harassment
- Revised Penal Code – estafa, threats, coercion, libel (as “cyber libel” when committed online)
- SIM Registration Act (RA 11934) – SIM-related violations

You don’t need to cite laws in your complaint. NBI agents will map your facts to the right offenses.

What kinds of incidents you can bring

Online scams/fraud: marketplace/crypto/forex “investments,” fake shops, “parcel/customs” scams, BEC, account takeovers, QR/OTP fraud.
Harassment & threats: cyberstalking, doxxing, death threats, deepfake abuse, non-consensual intimate images (NCII).
Intrusions: hacking, unauthorized access, data theft, ransomware.
Child sexual abuse/exploitation materials (CSAEM): possession, production, distribution, grooming—prioritize reporting immediately.
IP violations: large-scale piracy, counterfeit sales online.
Data privacy breaches: unlawful disclosure, leaks with harm indicators.
Cyber libel (fact-sensitive; NBI typically screens for public interest, evidence strength, and venue issues).

How to file: two standard pathways

1) Walk-in filing (recommended for urgent/sensitive cases)

Bring:

1 valid government ID.
Affidavit-Complaint (drafted; see template below) or be ready to give a sworn statement on site.
Evidence (see “Forensic-grade evidence” below):
- Printed and soft copies (USB) of chats, emails, posts, screenshots, photos, videos.
- Native files (original formats) whenever possible.
- Metadata or headers/logs if you have them.
Any witnesses or supporting affidavits.
For financial scams: deposit slips, bank/fintech statements, transaction IDs, wallet addresses, payment platform tickets.

Process:

Triage/Intake: You narrate the facts; an agent screens the case.
Sworn statement: You’ll sign an Affidavit-Complaint before an administering officer.
Case build: Agent lists follow-up evidence (subpoenas, preservation requests).
Operations (if applicable): e.g., preservation orders, subpoenas, forensic imaging, covert coordination with platforms/banks, and entrapment (only if lawful and necessary).
Filing: NBI files a criminal complaint with the Prosecutor’s Office for preliminary investigation (or inquest if arrest without warrant is valid).

Fees: Generally no filing fee with the NBI; you may incur notarization or copying costs.

2) Online/remote intake

Many incidents start with email or hotline intake followed by an in-person sworn statement. For child exploitation or imminent threats, remote triage may trigger immediate preservation and coordination first, then paperwork onsite.

For live threats (e.g., active extortion, ongoing stream, imminent doxxing), report immediately—even by phone—then follow with evidence.

Forensic-grade evidence: how to preserve and package

Golden rules

Don’t alter the evidence. Avoid editing, renaming, or re-saving originals.
Capture both content and context.
Create a preservation trail (who collected what, when, how).

What to gather

Screenshots that show URL, date/time, handle, and full conversation sequence (not cherry-picked).
Native exports:
- Messaging apps: chat exports (with media), server/channel IDs for platforms that use them.
- Email: full headers (.eml/.msg files).
- Social media: profile URLs, post URLs, user IDs; use platform “download your data” when available.
Device/Account logs: login alerts, IP logs (if provided), recovery emails/SMS.
Financial trails: account names/numbers, transaction references (ARN, trace IDs), bank advice, blockchain tx hashes.
Platform tickets: your reports to Facebook/Google/X/TikTok/etc. (case numbers + replies).

Chain of custody (simple version)

Put files in a folder named CASE_<YourSurname>_<YYYYMMDD>.
Create a ReadMe.txt noting who collected, date/time, device used, source (URL/app), and steps taken.
Save to write-protected media (or at least a labeled USB). Bring originals + a working copy.

What not to do

Don’t message or threaten the suspect after deciding to file—you risk evidence tampering or entrapment problems.
Don’t post publicly about the suspect (“name and shame”)—you might expose yourself to counterclaims (e.g., cyber libel), especially before takedown or arrest.

Quick wins before you show up

Issue a Preservation Letter (optional but useful) to the platform or service provider, requesting they preserve logs and content linked to specific URLs, usernames, and timestamps pending law enforcement request. (See template below.)
Secure accounts: Change passwords, enable 2FA, revoke suspicious sessions—but don’t delete evidence.
Freeze window (financial): Immediately notify your bank/fintech to flag the transaction/recipient account; they may hold funds if still in transit (speed is critical, success varies).

What the NBI can do (tools & coordination)

Preservation requests to platforms/ISPs/fintechs (to prevent auto-deletion/overwriting of logs).
Subpoenas (via Prosecutor/DOJ/NBI authority) for subscriber information, IP logs, and transaction details.
Search, seizure, and forensic imaging of devices—with warrant or valid consent.
Takedown coordination with platforms and domain hosts (especially for CSAEM and live threats).
Financial tracing: interbank/fintech liaison, AML coordination where money-laundering red flags arise.
International coordination: MLAT/Interpol channels for foreign-located actors or platforms.

Jurisdiction, venue, and cross-border realities

Venue: Often where any element of the crime occurred—where the victim accessed content, where money was sent, where servers are accessed, or where the complainant resides (context-specific).
Extraterritorial effect: Cybercrime tools allow pursuing suspects abroad via international cooperation, but timelines depend on foreign response and treaties.
Multiple agencies: NBI may coordinate with PNP-ACG, DOJ-Office of Cybercrime, BC/BOC, NPC (Data Privacy), and DSWD/ICAC for CSAEM.

After filing: what to expect

Investigation plan: Agent will outline target data: platform replies, bank KYC, IP logs, device forensics.
Follow-ups: You may be called to clarify facts or identify the suspect from datasets.
Filing with Prosecutor: NBI submits a Complaint-Affidavit with annexes. You’ll receive notices for preliminary investigation (counter-affidavits, rejoinders).
If probable cause is found: Case goes to court; warrants may issue; you might later testify.
Civil remedies: You can claim damages in the criminal case or file a separate civil action. For IP or privacy issues, additional administrative tracks may be available.

Special notes by case type

Child sexual exploitation online: Report immediately; NBI prioritizes; do not engage the offender. Preserve chat logs, screenshots, and any payment/transfer trail. Expect swift takedown and covert ops.
Cyber libel: Fact-sensitive. Before filing, expect agents to test defenses (truth, privilege, public interest, actual malice). Keep original posts, context, and publication proof (reach/recipients).
Crypto/Fintech fraud: Bring wallet addresses, hashes, exchange tickets, KYC records if you have them; earlier reports raise chances of freezing residual funds.
Hacking/ATO: Capture login alerts, IP addresses, device fingerprints, password reset emails.

Templates you can adapt

A) Affidavit-Complaint (gist)

I, [Name, Age, Status, Address], after being duly sworn, state:

I am the owner/user of [account/email/number] and victim of [scam/hacking/harassment] on [date/time] via [platform/URL/app].

The respondent [Name/Handle if known] did [acts], evidenced by Annexes A-__ (screenshots, exports, headers, receipts).

I suffered [loss/harassment/privacy breach] amounting to ₱[amount]/specific harm.

I respectfully request investigation for possible violations of applicable cyber and special penal laws, issuance of preservation, and filing of charges.

I certify the annexes are true and correct copies of data taken from my devices/accounts, which I preserved as described in Annex X (Chain of Custody). PRAYER: Issue the necessary processes (preservation, subpoenas), coordinate takedown/freeze as warranted, and file the appropriate case. [Signature over Printed Name] (Subscribed and sworn…)

B) Evidence Chain-of-Custody Note

Collector: [Name]; Date/Time: [YYYY-MM-DD HH:MM]; Device: [Make/Model/OS]; Sources: [URLs/apps]. Steps: I captured full-page screenshots showing URL/date/time, exported native chats/emails as [format], saved to USB [label], and printed copies attached as Annexes. I did not alter file contents.

C) Preservation Letter to Platform/Provider (pre-LEO)

To: [Platform/Provider Legal/Support] Re: Preservation Request – Account/URL/Order # I am a victim of [incident]. Please preserve content and server logs (access, IPs, timestamps) for [accounts/URLs/time window, with time zone] pending formal law-enforcement process. My NBI filing is underway. Contact: [email/phone]. [Name, Address, ID]

D) Bank/Fintech Early Alert (if money is in transit)

Re: Urgent Fraud Flag – Txn Ref [____] I report unauthorized/fraudulent transfer [date/time, amount, counterparty]. Please flag/freeze where possible and advise on your recovery/fraud ops workflow. NBI Cybercrime complaint to follow. [Name, Account #, Contact]

Frequently asked questions (fast answers)

Is anonymous filing possible? NBI typically requires a complainant willing to execute a sworn statement and testify. Anonymous tips help but rarely replace a formal complaint, except in CSAEM and national-security contexts where intel triggers proactive work.

How long will it take? Depends on complexity, platform/bank response times, and cross-border requests. Early reporting increases chances of fund recovery and data retention.

Will NBI take my phone/computer? If device forensics are needed, they may forensically image devices (with warrant or written consent). Ask about turnaround and data privacy handling.

Can I “entrap” the suspect myself? Don’t. Self-entrapment can endanger you and risk evidence admissibility. Let NBI plan lawful operations.

What if the suspect is abroad? NBI can use international cooperation. Outcomes vary, but preservation, takedown, and account attribution can still proceed.

Do I need a lawyer to file? Not required to start. A lawyer helps with affidavits, strategy, and civil claims.

Practical checklists

Bring to NBI (as applicable)

Government ID
Draft Affidavit-Complaint (or be ready to swear one)
Printed evidence + USB with native files
Transaction proofs (bank/fintech, wallet hashes)
Platform report ticket numbers/replies
Witnesses (if any)

Evidence hygiene

Full-page screenshots with URL/time
Native exports (email .eml/.msg; chat exports)
File headers/logs when available
Chain-of-custody note
Keep originals intact

Safety & post-incident

Secure accounts (2FA, password manager)
SIM and email recovery hardening
Remove app/session tokens you don’t recognize
Consider credit monitoring if PII was leaked

Key takeaways

Speed + documentation win cyber cases. Preserve quickly; report early.
You don’t need to know the exact charges—tell the story with evidence; agents will map the law.
Deliver forensic-grade proof: native files, headers, logs, URLs, timestamps, and a short chain-of-custody note.
For money cases, bank/fintech alerts and platform preservation in the first 24–72 hours can make the difference.
Coordinate with NBI (and/or PNP-ACG) and be prepared for prelim investigation at the Prosecutor’s Office.

If you want, tell me your scenario (what happened, when, which platform/payment path, and what you already saved). I can turn it into a ready-to-file Affidavit-Complaint, preservation letters, and a document checklist tailored to your facts.