Here’s a practical, plain-English legal guide to filing a cybercrime complaint against an online scammer in the Philippines—what charges fit which scheme, where to file, what evidence wins, how to freeze or trace money, and what to expect from investigators and prosecutors. Use it as a step-by-step playbook whether you’re a private individual, company counsel, or platform trust & safety lead.

Cybercrime Complaint Against an Online Scammer (Philippines)

What counts as a cybercrime scam (common fact patterns)

Marketplace/buy-and-sell fraud: bogus listings, payment taken but no delivery, “switch and bait,” fake couriers, counterfeit goods.
Social-engineering & phishing: links or forms stealing logins/OTP; fake bank/e-wallet pages; “customer support” OTP harvests; SIM swap.
Investment/crypto/forex “doublers” & romance scams: guaranteed returns, trading “mentors,” pig-butchering schemes, catfishing for money.
Card-not-present/Account takeovers: unauthorized card/e-wallet/bank transactions.
Identity takeovers for loans: your ID used to open accounts/obtain loans or to solicit funds.
Raffle/job-application fee fraud: asks for “processing”/“training”/“clearance” payments.

If information and communications technology (ICT) is used—apps, emails, social networks, e-wallets, crypto, online banking—the penalties for many offenses can be increased compared to their offline equivalents.

Core laws you’ll rely on (in plain terms)

Cybercrime Prevention Act (RA 10175). Creates computer-related offenses (e.g., computer-related fraud, identity theft) and increases penalties by one degree for crimes under other laws when committed through ICT.
Revised Penal Code – Estafa (swindling). Classic deceit/defraud—now qualified by cybercrime if done online.
Access Devices Regulation Act (RA 8484). Credit/debit card and access-device fraud; phishing that captures card data.
SIM Registration Act (RA 11934). Lets authorities obtain SIM subscriber info via due process; criminalizes false registration.
Rules on Electronic Evidence. Sets how to authenticate screenshots, chats, emails, and logs—crucial for court.
Data Privacy Act (RA 10173). Useful for companion complaints (e.g., identity theft, doxxing), not a substitute for estafa charges.
Consumer protection & e-commerce rules. Useful for platform takedowns/refunds; criminal route remains separate.

Prosecutors typically stack charges: e.g., Estafa with penalty qualified by RA 10175 plus Computer-Related Identity Theft, plus RA 8484 if cards were used.

Where to file (and who handles what)

PNP Anti-Cybercrime Group (ACG) – complaint desks nationwide (criminal investigation, digital forensics, entrapment ops).
NBI Cybercrime Division – similar purview; good for complex or cross-border cases.
City/Provincial Prosecutor (DOJ-NPS) – you submit a complaint-affidavit with annexes; preliminary investigation follows.
Courts – after prosecutors find probable cause and file an information.
Civil/administrative side (parallel) – bank/e-wallet dispute desks, BSP-regulated channels, platform abuse teams, and DTI consumer complaints for refunds/takedowns.

You can file with PNP ACG or NBI first (they can help gather and preserve evidence) or file directly with the Prosecutor if your documentation is ready. Doing both in parallel is common.

Jurisdiction & venue (don’t overthink it)

You may file where you reside, where any element happened (payment made/received, message sent/received), or where any ICT component sits (server, device). RA 10175 allows broad venue to prevent evasion.
Cross-border suspects can still be pursued if any part of the offense touched the Philippines (victim, device, bank, or platform used here). Law enforcement uses MLAT/letters rogatory for foreign data.

The evidence that wins (build this folder now)

A. Digital communications (show the deceit)

Full chat/email threads with timestamps, usernames/IDs/handles, and visible URLs; export if the platform allows.
Screenshots + native exports (e.g., “download your data”)—keep both. Don’t edit originals; annotate only in a separate note.

B. Money trail (show the loss & destination)

Bank/e-wallet proofs: transaction receipts, reference numbers, account names and numbers, enrolled payees, SMS OTP logs (do not share full OTPs publicly).
Crypto: wallet addresses, TX hashes, exchange names/ticket numbers.

C. Identity & device breadcrumbs (show the actor)

Phone numbers (with network), email addresses, usernames, marketplace profile links, courier tracking numbers, IP logs if available.
Copies of IDs the scammer sent (even if forged).

D. Damages

Receipts of payments, shipping, credit-card statements, and any chargeback or dispute correspondence.

E. Integrity & authenticity

Keep original files (JPEG/PNG/MP4/PDF) and email headers; save to a write-once medium or cloud. Hashing files is helpful but not required; affidavit of the person who captured the evidence typically suffices under the Rules on Electronic Evidence.

Ephemeral messages (Stories, disappearing chats) are admissible if the sender/recipient or someone privy testifies and provides captures. Save them immediately.

First 24–48 hours playbook (maximum recovery odds)

Secure accounts: change passwords, enable 2FA, revoke unknown devices/sessions; call your telco if you suspect SIM swap.
Notify your bank/e-wallet immediately: dispute the transfer; request account freeze/recall against recipient accounts; obtain a ticket/reference number.
Report to platforms (marketplace/social/crypto exchange) for takedown and account freeze; keep the confirmation.
File a police blotter (optional but helpful), then PNP ACG/NBI complaint; ask for data preservation letters for platforms and telcos.
Document everything—a running incident log with times, people spoken to, and reference numbers.

Early reports increase odds of freezing funds before they’re cashed out.

How to file a criminal complaint (step-by-step)

Draft a Complaint-Affidavit (your narrative + legal charges). Attach your IDs.
Attach Annexes: chats, screenshots, receipts, bank/e-wallet proofs, courier logs, etc. Label them Annex “A,” “B,” etc.
Include a Prayer for:
- Issuance of subpoena to platforms/telcos/banks for subscriber info, login/IP logs, KYC files.
- Data preservation and live takedown of active scam pages.
- Warrant to disclose computer data (WDCD) and, if appropriate, search/seizure (WSWD) of devices/locations.
File with PNP ACG/NBI (investigation first) or directly with the Prosecutor (preliminary investigation). Bring a USB with soft copies and printed annexes.
Expect issuance of subpoenas to the respondent and requests to platforms for records. Provide follow-up evidence promptly.

Charges that typically fit (match to your scenario)

Estafa (swindling) – deceit causing you to part with money/property. Penalty is increased if done via ICT.
Computer-Related Fraud – manipulations/inputs causing wrongful benefit/loss (e.g., phishing).
Computer-Related Identity Theft – unauthorized acquisition/use of your identifiers (name, photos, ID numbers) online.
Access Devices fraud (RA 8484) – credit/debit card and access device crimes; phishing/card-testing.
Illegal access / system interference – if your account/devices were hacked or tampered with.
Falsification / use of falsified documents – forged IDs, receipts, or certifications.
Unjust vexation / threats – where harassment accompanies the scheme (often added when appropriate).

Prosecutors often file multiple counts arising from the same scheme. Your complaint should narrate facts; charging is the prosecutor’s job, but proposing likely violations helps.

Money recovery: practical channels (parallel to the criminal case)

Bank/e-wallet dispute: request chargeback/recall; escalate with your ticket number; ask for recipient KYC freeze.
Crypto: notify the exchange (if on-ramp/off-ramp known) with TX hashes; many have AML teams that can freeze within the exchange pending lawful process.
Courier/marketplace: request parcel intercept or seller payout hold; provide police reference.
Civil suit: file Small Claims for pure money recovery (no lawyers required up to the current cap) against identified local respondents. Use when the scammer is known and reachable.
Insurance: some banks/e-wallets offer fraud cover; check terms and exclusions (phishing may be excluded if OTP shared).

Subpoenas to platforms, telcos, and banks (what to ask for)

Investigators/prosecutors typically request:

Subscriber KYC of phone numbers, emails, accounts (names, addresses, IDs, selfies, device info).
Login/IP logs with timestamps and user-agent strings.
Transaction histories, counterparties, linked accounts/devices.
Delivery records (courier scans, pickup CCTV, rider details).
Ad/account data (for social platforms: page admins, payment instruments).

Expect response times—build this into your expectations. Your early preservation letters help prevent data deletion by retention-policy clocks.

Authentication & admissibility (keep it courtroom-ready)

Affidavit of the person who captured the evidence stating when/how the screenshots/exports were made and that they are faithful copies.
Email headers and platform export files bolster integrity.
Bank officers/platform representatives authenticate business records when subpoenaed. Your role is to bridge facts until they appear.

Red flags & defenses you’ll hear (and how to counter)

“You volunteered the OTP, so it’s your fault.” → Criminal liability doesn’t vanish when deceit induced the disclosure; estafa and computer-related offenses still apply.
“We’re just a platform—safe harbor.” → Safe harbors are conditional; platforms must act on valid notices. Your goals: takedown, account freeze, and records—not necessarily platform liability.
“The account holder isn’t the culprit.” → True mules exist; that’s why subpoenas look for device/IP overlap, video KYC, pickup CCTV, and downstream transfers. Keep the net wide at first.

Employer/corporate victims (extra pointers)

Trigger your incident-response plan; isolate compromised endpoints; force password resets and token revocation.
Preserve server/app logs, email gateway logs, and SIEM exports.
Prepare a sworn certification from your IT custodian describing systems and logs (for evidence foundation).
Consider data-breach notification obligations under the Data Privacy Act if personal data was compromised.

Personal safety & hygiene

Don’t confront scammers directly after filing; let investigators work.
Don’t post full bank details or IDs publicly. Share only with law enforcement and the prosecutor.
Enable 2FA, use password managers, and be wary of remote-access apps and QR/OTP “verifications.”

Template: Complaint-Affidavit (skeleton you can adapt)

I. Parties I, [Name], of legal age, residing at [Address], state: Respondent is [Name/Handle/Unknown], using mobile no. [], email [], and accounts [bank/e-wallet/crypto].

II. Material Facts

On [date/time], I saw [post/ad/link] for [item/investment].

Respondent, using [handle], instructed me via [platform] to pay [amount] to [account/wallet]. Screenshots are Annex “A” series.

I paid [amount] on [date/time]; proof is Annex “B” (bank/e-wallet receipt).

After payment, respondent [blocked me/did not deliver/sent fake tracking], Annex “C.”

I suffered loss of ₱[amount].

III. Offenses The acts constitute Estafa under the Revised Penal Code, qualified under RA 10175 for having been committed through ICT, and Computer-Related Fraud/Identity Theft (as applicable).

IV. Prayer I pray that respondents be charged accordingly and that subpoenas/WDCDs issue to [platforms, banks, telcos] for KYC, logs, and transaction data, and that preservation/takedown orders be sent.

V. Oath & Signature [Signature over printed name] [Government ID details] (Subscribed and sworn…)

Timeline expectations (realistic)

Bank/platform freezes: can be same-day to several days, if reported fast and supported by police reference.
Preliminary investigation: weeks to months (depends on service of subpoena and annex retrieval).
Trial: longer; many cases settle once identity is pinned and funds are frozen.

Quick checklists

Victim’s “Go-Bag”

Valid government ID
Printed and soft copies of chats/receipts
Bank/platform ticket numbers
Incident log (dates/times)
USB drive with evidence

Law-enforcement request list (for subpoenas)

KYC of recipient accounts/phones/emails
Login/IP logs (date-time range)
Transaction histories & counterparties
Courier CCTV/pickup scans
Ad/page admin info & payment instruments

Bottom line

Treat online scams as criminal—not just customer service issues.
Move fast: secure accounts, alert banks/e-wallets/platforms, and file with PNP ACG or NBI, then the Prosecutor.
Build a clean evidence package (story → money trail → actor breadcrumbs) and ask for subpoenas/preservation.
Use parallel tracks (criminal + platform + bank dispute + small claims) to maximize recovery and deterrence.

This is general legal information (Philippine context), not legal advice. If you share your fact pattern (what platform, amount, where the money went, and what you’ve saved so far), I can draft a tailored complaint-affidavit and a subpoena list you can file right away.