Cyber Slander and Phishing Criminal Charges (Philippines): A Complete Guide

Philippine private-sector and general public context. This is general information, not legal advice. Laws and jurisprudence evolve; consult counsel for specific cases.

1) The legal backbone

Revised Penal Code (RPC) — crimes against honor (libel, slander/slander by deed), estafa, falsification, etc.
Cybercrime Prevention Act of 2012 (Republic Act No. 10175) — defines and penalizes cyber libel (libel through a computer system), computer-related fraud and identity theft, illegal access, data/system interference, misuse of devices, cybersquatting, and others. It also sets jurisdiction, law-enforcement powers, and procedural rules unique to cybercrime.
Data Privacy Act of 2012 (RA 10173) — criminalizes unauthorized processing, access, and malicious disclosure of personal information; often overlaps with phishing cases.
Access Devices Regulation Act (RA 8484) — used when phishing involves credit/debit cards or similar “access devices.”
E-Commerce Act (RA 8792) — general rules on electronic documents and limited safe-harbor concepts for service providers.
Other related frameworks: Anti-Money Laundering Act (AMLA) for freezing proceeds of online fraud; SIM Registration and allied telecom/consumer-protection regimes for SMS/email scams.

2) “Cyber slander” vs cyber libel (the correct charge)

In Philippine law, slander = oral defamation (RPC Art. 358).
Libel = written or similarly published defamation (RPC Arts. 353–355).
Online defamation is ordinarily prosecuted as libel committed “through a computer system” — i.e., cyber libel under RA 10175.
A purely ephemeral voice call that is not recorded or published may still be slander; but posts, articles, comments, tweets, livestreams with recording/archiving, images, memes, and messages shared to third persons typically fall under cyber libel.

3) Elements of libel / cyber libel

Libel (RPC) requires:

Imputation of a discreditable act, condition, crime, or vice;
Malice (either presumed by law or shown as “actual malice” in qualified situations);
Publication to a third person; and
Identifiability of the person defamed.

Cyber libel (RA 10175) = the same elements + the imputation is committed through a computer system (internet, platform, device, email, messaging app, etc.).

Who may be liable: the author/originator of the libelous post or article. Courts have limited liability for mere likers/sharers/commenters absent proof they authored the defamatory imputation or legally participated under the RPC rules on principals/accomplices.
Platforms/ISPs: generally not criminally liable for user content absent actual participation/knowledge and control, consistent with safe-harbor concepts.

Malice, public figures, and privilege

Malice in law is generally presumed in libel against private persons, unless the statement is privileged (e.g., fair and true report of official proceedings; communications made in good faith to authorities; fair comment on matters of public interest).
For public officers/figures or matters of public concern, the complainant usually must show “actual malice” (knowledge of falsity or reckless disregard of truth).
Truth alone is not always a defense; the RPC requires truth + good motives and justifiable ends for certain imputations.

Venue & jurisdiction

Traditional libel is filed under Article 360 venue rules (e.g., where printed and first published; or complainant’s residence at the time of the offense, subject to special rules for public officers).
Online publication raises venue concerns; courts look for territorially significant acts (e.g., where the content was first uploaded/managed, or where the offended party resided) to avoid limitless venue.

4) Penalties & prescription (high level)

Libel (offline): punished under the RPC by imprisonment (prisión correccional) and/or fine (amounts updated by later laws).
Cyber libel: one degree higher than traditional libel (RA 10175, Sec. 6). In practice, this places potential imprisonment into the upper range of prisión correccional up to prisión mayor (lower range), plus fines. Courts can impose both imprisonment and fine, or fine alone, depending on circumstances.
Prescription: Ordinary libel generally prescribes in 1 year under the RPC. Cyber libel, being under a special law, follows special-law prescription rules (longer than 1 year). Jurisprudence on exact periods and republication triggers has developed; get case-specific advice.

Tip for both sides: Even when a case is criminal, civil damages (moral, exemplary, temperate) may be awarded. Retractions/apologies mitigate but rarely erase liability.

5) Filing, defending, and evidence (cyber libel)

For complainants

Preserve evidence: take full-page screenshots, capture URLs, timestamps, and permalinks; export metadata if available; record who could view the post (public/friends/groups).
Identify the author: link the account to a person via admissions, public profile, IP/subpoena returns, device forensics, or corroborating witnesses.
Venue & affidavit: file a criminal complaint-affidavit with the NBI Cybercrime Division or PNP Anti-Cybercrime Group, or directly with the Prosecutor’s Office in the proper venue. Attach evidence and computations of damages.
Take-down: Courts may issue orders; executive “summary” take-down powers were curtailed by the Supreme Court on constitutional grounds. Expect to go through judicial channels.

For the accused

Preserve your own evidence: drafts, edit history, context, and proof of good faith, fair comment, or truth with good motives.
Challenging elements: identity, publication, defenses/privilege, lack of malice, and venue.
Avoid new publications: responding online can create fresh publications.

6) What phishing covers in Philippine law

“Phishing” (including smishing via SMS and vishing via calls) is not a single code-word in the statutes but is charged through multiple provisions, usually in combination:

Computer-Related Identity Theft (RA 10175, Sec. 4[b][3]) – Unauthorized acquisition/transfer/possession/use of another’s identifying information (names, credentials, OTPs, card data, account numbers) without right.
Computer-Related Fraud (Sec. 4[b][2]) – Input/alteration/deletion of data, or interference with systems, with fraudulent intent, causing damage or obtaining benefit.
Illegal Access / Data or System Interference (Sec. 4[a]) – Accessing an account/system without authorization; altering data; introducing malware.
Estafa (RPC Art. 315) – Deceit causing damage (e.g., luring victims to transfer money, divulge OTPs, or approve transactions).
Access Devices Regulation Act (RA 8484) – Using or possessing stolen/skimmed card numbers and related schemes.
Data Privacy Act (RA 10173) – Unauthorized processing/disclosure of personal data harvested through phishing; liability for the perpetrators and, in some cases, for negligent controllers/processors who enabled the breach.
IP/Trademark (RA 8293) – Using bank or brand logos in phishing sites/emails can add trademark violations; typically auxiliary to the core cybercrime.

Consent obtained by trickery is not “with right.” If credentials were surrendered due to deception, later use is still unauthorized.

7) Typical charging theories in phishing cases

Email/SMS lure → fake site → credential capture → account takeover → Identity Theft + Illegal Access + Computer-Related Fraud + Estafa (plus RA 8484 if cards)
Malware/remote-access trojan → silent data exfiltration → Illegal Access + Data Interference + Identity Theft (+ DPA if personal data)
SIM-swap/social-engineering of telco/bank support → Identity Theft + Illegal Access + Estafa (and administrative liability under sectoral rules)
Mule accounts / money mules receiving proceeds → Estafa and possible Anti-Money Laundering exposure; assets may be frozen.

8) Penalties & aggravations (phishing-related)

RA 10175 offenses generally carry correctional to afflictive penalties (roughly 6 months to 12 years, depending on the offense), plus fines.
Qualifiers can raise penalties (e.g., victim is a minor; damage magnitude; use of multiple accounts/devices; syndicate involvement).
RA 8484 imposes separate imprisonment and fines for access-device fraud.
DPA adds imprisonment and significant fines per offense.
Courts may order restitution, forfeiture of instrumentalities, and civil damages; AMLC may obtain freeze orders over proceeds.

9) Evidence & procedure (phishing)

Preserve everything early:
- Emails (save raw source with full headers), SMS screenshots, call logs/recordings, phishing URLs/QR codes, site SSL/TLS certificate details, wallet IDs/transaction hashes, timestamps.
- Bank statements and transaction logs; SMS/OTP timestamps matching fraudulent entries.
- Device forensics (malware indicators, browser saved passwords, keyloggers).
Report fast to your bank/e-wallet for blocking and tracebacks; escalate to NBI-CCD or PNP-ACG with a complaint-affidavit.
Cyber warrants: investigators apply for special cybercrime warrants (e.g., to disclose, intercept, or search, seize and examine computer data) from designated courts.
Chain of custody: hash values (e.g., SHA-256) for seized drives/files; detailed logs of collection and handling.

10) Defenses & mitigation (phishing-related)

No “without right”: show authorization (e.g., test activity within scope, written consent).
Mistaken identity: prove the accused did not control the device/account; challenge IP attribution and subscriber data.
No fraudulent intent / no damage: some offenses require intent to defraud or actual damage.
Suppression issues: evidence excluded if acquired without proper warrants or with broken chain of custody.

11) Corporate & institutional duties (both topics)

Governance: risk assessments, acceptable-use policies, moderation/defamation guidelines, and incident-response playbooks.
Security controls: MFA, phishing-resistant authentication, email DMARC/DKIM/SPF, anti-malware, EDR, secure coding, least privilege, and vendor diligence.
Training: simulated phishing, reporting channels, and no-blame culture for early reporting.
Records: log retention, audit trails, and breach-notification workflows (including DPA reporting to the National Privacy Commission, when applicable).
Platform liability: comply with lawful orders; maintain notice-and-takedown processes consistent with due-process requirements.
Documentation: for newsrooms/blogs, keep editorial standards, fact-checking trails, and legal review in high-risk pieces.

12) Practical playbooks

If you’re a victim of cyber libel

Collect evidence (full screenshots, URLs, audience scope).
Send a legal demand (optional but useful for mitigation, apology, and settlement).
File with NBI/PNP or Prosecutor; consider civil damages.
Seek court orders for take-down or preservation (do not rely on extra-judicial blocking).

If you’re accused of cyber libel

Stop posting about the dispute; preserve drafts/context.
Evaluate privileged communication, good motives, public-figure status, lack of malice, truth.
Explore mediation/settlement and calibrated public statements.

If you’re a phishing victim

Call your bank/e-wallet immediately; request freeze/chargeback where possible.
Change all credentials; revoke tokens/sessions; scan devices.
File a complaint (attach headers, URLs, logs).
Notify your employer/IT and (if personal data was exposed) consider NPC breach notification.

If your firm is breached via phishing

Activate IR team; contain (isolate hosts, disable accounts), eradicate, recover, notify stakeholders/regulators as required; conduct post-incident review.

13) Frequently asked questions

Is “sharing” a libelous post a crime? Not automatically. Liability centers on the author/originator. Others may be liable only if they legally qualify as participants under the RPC and with proof of malice/intent.
Does deleting a post cure liability? No, but it can mitigate damages and show good faith.
Are banks liable for phishing losses? Depends on culpability on both sides (security controls vs customer negligence). Regulatory and civil remedies may apply even when criminal charges are pursued against the phisher.
Can law enforcement read my emails without notice? They need proper cyber warrants (or recognized exceptions).
Is an apology enough to avoid cyber-libel charges? It can reduce damages and sometimes avoid filing, but the crime is not automatically extinguished.

14) Key takeaways

“Cyber slander” is a misnomer; the charge is cyber libel when defamation is committed through a computer system.
Phishing is prosecuted via a stack of offenses: identity theft, computer-related fraud, illegal access, estafa, and more.
Penalties for cyber versions can be stiffer than offline analogs; prescription timelines also differ.
Success in both prosecution and defense hinges on evidence discipline: early preservation, proper venue, and sound digital forensics.
For organizations, governance + controls + training are your best defense; for individuals, preserve evidence and act fast.

If you want, tell me your scenario (facts, posts/messages, dates, amounts involved), and I’ll map the exact charges/defenses, draft a complaint-affidavit outline, or sketch an incident-response plan you can use immediately.