I. Introduction

Online scams have become one of the most common forms of cybercrime in the Philippines. With the widespread use of social media, online marketplaces, e-wallets, online banking, cryptocurrency platforms, messaging apps, and digital payment systems, fraudsters can now deceive victims without ever meeting them in person. A person may be tricked into paying for goods that are never delivered, investing in a fake scheme, sending money through GCash or Maya to a fraudulent account, disclosing banking credentials, or clicking a malicious link that enables unauthorized transactions.

In the Philippine legal system, an online scam may give rise to criminal, civil, administrative, and regulatory consequences. The most common criminal complaint is for estafa, especially when deceit is used to obtain money or property. When the deception is committed through information and communications technology, the offense may also be treated as a cybercrime, particularly under the Cybercrime Prevention Act of 2012, Republic Act No. 10175.

A cybercrime complaint for an online scam is therefore not a separate “informal report.” It is a legal process that may involve the preservation of digital evidence, investigation by cybercrime authorities, filing of a complaint-affidavit, referral to prosecutors, preliminary investigation, and, when supported by evidence, the filing of criminal charges in court.

II. Legal Framework

A. Revised Penal Code: Estafa

The primary offense in many online scam cases is estafa under Article 315 of the Revised Penal Code. Estafa generally involves fraud or deceit resulting in damage to another person. In an online scam, the deceit may consist of false representations such as:

pretending to sell a product or service;
claiming to be a legitimate business;
promising investment returns that do not exist;
impersonating a bank, government office, employer, relative, or company representative;
inducing the victim to send money through digital platforms;
falsely representing that an item has been shipped;
misusing another person’s trust to obtain funds or property.

The essential idea is that the offender deceives the victim, the victim relies on the deception, and because of that reliance, the victim suffers damage.

B. Cybercrime Prevention Act of 2012

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, punishes certain crimes committed through computer systems and also increases the penalty for crimes under the Revised Penal Code and special laws when committed through information and communications technology.

For online scams, the important concept is that estafa committed through ICT may be treated as cyber-related estafa. The use of Facebook, Messenger, Instagram, TikTok, Shopee, Lazada, email, fake websites, online banking, e-wallets, or other digital systems may bring the offense within the cybercrime framework.

The law also recognizes offenses such as illegal access, computer-related fraud, identity theft, and other acts that may accompany online scams. For example, a scammer may commit identity theft by using another person’s name, photo, business identity, account, or credentials to deceive victims.

C. Special Laws That May Apply

Depending on the facts, an online scam may also involve other laws, including:

E-Commerce Act, when electronic documents, electronic signatures, or online transactions are involved;
Data Privacy Act, when personal information is unlawfully collected, processed, sold, leaked, or misused;
Consumer protection laws, when deceptive online selling or unfair trade practices are involved;
Securities laws, when fake investments, unregistered securities, or Ponzi-type schemes are involved;
Anti-Money Laundering laws, when criminal proceeds are transferred through bank accounts, e-wallets, crypto wallets, or layered transactions;
SIM Registration Act, when registered SIM cards are used in scams, though registration does not automatically identify the true offender if the SIM was obtained using false or borrowed identity details.

III. Common Types of Online Scams in the Philippines

A. Online Selling Scam

This occurs when a seller advertises goods online, receives payment, and fails to deliver the item. The seller may block the buyer, delete the post, deactivate the account, or provide fake shipping details.

Evidence usually includes screenshots of the listing, chat conversations, proof of payment, account details, delivery promises, and proof that the goods were not received.

B. Investment Scam

An investment scam involves false promises of high returns, guaranteed profits, quick earnings, crypto trading profits, forex returns, “paluwagan,” “double your money” schemes, or referral-based income. Some schemes use professional-looking websites, fake certificates, fabricated testimonials, or impersonation of legitimate companies.

These cases may involve estafa, cybercrime, securities violations, and money laundering concerns.

C. Phishing and Bank Scam

Phishing occurs when the offender tricks the victim into giving passwords, OTPs, card details, banking credentials, or e-wallet access. This may happen through fake links, fake bank advisories, fake customer service accounts, or spoofed websites.

Depending on the facts, the offender may be liable for cyber-related fraud, identity theft, illegal access, or other cybercrime offenses.

D. E-Wallet Scam

Many scams involve GCash, Maya, bank transfers, remittance centers, or QR code payments. The scammer may use mule accounts, borrowed accounts, fake identities, or multiple transfers to hide the trail of money.

Victims should immediately report unauthorized or fraudulent transactions to the platform and request preservation of transaction details.

E. Romance Scam

In a romance scam, the offender develops an online relationship with the victim and later asks for money due to emergencies, travel expenses, business problems, medical needs, customs fees, or supposed gifts. The fraud relies on emotional manipulation and false identity.

F. Job Scam

A job scam involves fake recruitment, fake employment offers, fake processing fees, fake work-from-home tasks, or bogus overseas opportunities. Victims may be asked to pay fees, disclose personal information, or perform tasks that later become part of another scam operation.

G. Impersonation Scam

The offender pretends to be a relative, friend, government official, bank employee, celebrity, company representative, police officer, or lawyer. The goal is to induce payment or obtain personal information.

Impersonation may also involve identity theft if the offender uses another person’s name, image, or account without authority.

IV. Elements Usually Needed to Prove an Online Scam

The exact elements depend on the offense charged, but in many cases involving cyber-related estafa, the complainant must show:

Deceit or fraudulent representation The offender made a false statement, false promise, fake identity, fake listing, fake investment offer, or misleading representation.
Reliance by the victim The victim believed the representation and acted because of it.
Delivery of money, property, information, or benefit The victim transferred money, sent goods, disclosed credentials, or gave something of value.
Damage or prejudice The victim suffered financial loss, loss of property, unauthorized transaction, or other harm.
Use of ICT The scam was committed through online platforms, computer systems, mobile applications, websites, social media, e-wallets, online banking, or digital communications.

The use of ICT is important because it may qualify the offense as a cybercrime or cyber-related offense.

V. Where to File a Cybercrime Complaint

A victim of an online scam in the Philippines may usually seek assistance from:

A. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group investigates cybercrime complaints, including online scams, phishing, identity theft, and cyber-related fraud.

B. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division also receives and investigates complaints involving online fraud, hacking, phishing, impersonation, identity theft, and related cyber offenses.

C. Office of the City or Provincial Prosecutor

A complainant may file a criminal complaint directly before the prosecutor’s office, usually through a complaint-affidavit and supporting evidence. The prosecutor determines whether there is probable cause to file charges in court.

D. Barangay or Police Station

For initial assistance, a victim may approach the local police station or barangay. However, online scam cases often require cybercrime investigation, digital evidence preservation, and coordination with banks, e-wallets, telcos, or online platforms.

E. Banks, E-Wallet Providers, and Platforms

The victim should immediately report the fraudulent transaction to the relevant bank, e-wallet provider, remittance center, marketplace, or social media platform. These reports may help freeze accounts, preserve records, suspend scam accounts, or support the criminal complaint.

VI. Documents and Evidence Needed

A cybercrime complaint depends heavily on evidence. The victim should preserve and organize all available proof, including:

screenshots of conversations;
screenshots of social media profiles, posts, listings, pages, websites, or advertisements;
proof of payment, bank transfer receipts, GCash/Maya transaction records, remittance slips, QR code details, and account numbers;
names, usernames, profile links, mobile numbers, email addresses, bank account details, and wallet account details used by the scammer;
shipping records, tracking numbers, or delivery promises;
call logs, SMS messages, emails, and app notifications;
proof of non-delivery or failure to perform the promised service;
demand letters, follow-up messages, and replies, if any;
platform reports or complaint tickets;
identification documents of the complainant;
affidavit of the complainant;
affidavits of witnesses, if any.

Screenshots should ideally show the date, time, account name, username, URL, phone number, and full conversation thread. Cropped screenshots may be useful, but complete screenshots are stronger.

VII. Importance of Digital Evidence Preservation

Digital evidence can disappear quickly. A scammer may delete messages, deactivate accounts, change usernames, remove listings, block the victim, or transfer funds immediately. The victim should therefore act quickly.

Recommended preservation steps include:

take screenshots immediately;
export chat histories when possible;
save URLs and profile links;
record transaction reference numbers;
keep original files and avoid editing them;
preserve the device used in the transaction;
avoid deleting messages, emails, SMS, and notifications;
report to the platform and request preservation of records;
report to law enforcement as soon as possible.

Digital evidence is more credible when it can be connected to the account, transaction, platform, device, or person involved.

VIII. Complaint-Affidavit

A criminal complaint for online scam usually requires a complaint-affidavit. This is a sworn written statement narrating the facts and attaching supporting evidence.

A complaint-affidavit should ordinarily contain:

the personal details of the complainant;
the identity of the respondent, if known;
the online account, phone number, email, bank account, or wallet details used by the respondent;
a chronological narration of events;
the false representations made by the respondent;
the amount or property lost;
proof of payment or transfer;
the complainant’s attempts to contact the respondent;
the respondent’s failure to deliver, refund, or perform;
the laws believed to have been violated;
a statement that the allegations are true based on personal knowledge and authentic records.

The affidavit must be notarized or subscribed before an authorized officer, depending on the filing procedure.

IX. Sample Structure of a Complaint-Affidavit

A simple structure may be:

Republic of the Philippines City/Province of ________ Complaint-Affidavit

I, [Name], of legal age, Filipino, residing at [address], after being sworn, state:

I am the complainant in this case.
On [date], I saw an online post by [name/account] offering [product/service/investment].
The respondent represented that [state false representation].
Relying on such representation, I sent the amount of ₱[amount] through [bank/e-wallet/remittance] to [account details].
After payment, the respondent [failed to deliver/blocked me/gave false tracking details/refused refund/deactivated account].
Attached are screenshots of the conversation, proof of payment, profile page, and other relevant documents.
I suffered damage in the amount of ₱[amount].
The acts were committed through online communication and digital payment channels.
I am executing this affidavit to file a complaint for cyber-related estafa and other appropriate offenses.

The complainant should attach the evidence as annexes, such as Annex “A” for screenshots, Annex “B” for proof of payment, and so on.

X. Immediate Steps for Victims

A victim should do the following as soon as possible:

Stop sending money.
Do not negotiate further if the scam is ongoing.
Preserve all messages and transaction records.
Report the transaction to the bank, e-wallet provider, or remittance platform.
Request account freezing or transaction reversal if available.
Report the account to the social media platform or marketplace.
File a report with PNP Anti-Cybercrime Group or NBI Cybercrime Division.
Prepare a complaint-affidavit.
Consult a lawyer if the amount is substantial, the facts are complicated, or urgent legal action is needed.
Avoid publicly accusing named individuals without evidence, as this may expose the victim to defamation or cyberlibel concerns.

XI. Reporting to Banks and E-Wallet Providers

When the scam involves a bank or e-wallet transaction, time is critical. The victim should report immediately and provide:

transaction reference number;
date and time of transaction;
amount transferred;
sender and receiver account details;
screenshots of conversations;
explanation that the transaction is fraudulent;
police report or complaint reference number, if available.

Banks and e-wallet providers may not always reverse completed transactions, especially if the funds have already been withdrawn or transferred. However, timely reporting may help preserve records, freeze suspicious accounts, or assist law enforcement.

XII. Jurisdiction and Venue

Online scams often involve parties in different cities, provinces, or countries. The victim may be in one location, the scammer in another, the platform hosted elsewhere, and the payment account registered in a different place.

For criminal complaints, venue may depend on where the elements of the offense occurred, where the victim was deceived, where the money was sent, where the damage was suffered, or where digital evidence and transactions are connected. Because cybercrime cases may involve complex jurisdictional questions, law enforcement and prosecutors may evaluate where the complaint should properly proceed.

XIII. If the Scammer Is Unknown

Many victims know only the scammer’s username, mobile number, bank account, e-wallet number, or social media profile. A complaint may still be filed against an unidentified person, often referred to as “John Doe,” if the identity is not yet known.

Investigators may attempt to identify the offender through:

account registration details;
SIM registration records;
bank or e-wallet KYC records;
IP logs, when legally obtainable;
platform records;
CCTV or withdrawal records;
linked accounts and transaction trails;
witness statements.

However, access to such records usually requires proper legal process. Private individuals generally cannot compel banks, telcos, or platforms to disclose confidential information without lawful authority.

XIV. The Role of Subpoenas and Preservation Requests

In cybercrime investigations, law enforcement and prosecutors may seek records from platforms, telcos, financial institutions, and service providers. Relevant records may include account registration data, transaction logs, IP addresses, mobile numbers, device information, login history, and payment details.

Victims should understand that screenshots alone may not always identify the offender. They help prove what happened, but official records may be needed to connect the scam account to a real person.

XV. Civil Liability

A criminal case may include civil liability. If the accused is convicted, the court may order restitution or payment of damages. The victim may seek recovery of the amount lost, and in proper cases, other damages and costs.

However, recovery is not guaranteed. If the money has already been withdrawn, transferred, spent, or hidden, actual collection may be difficult. This is why early reporting is important.

XVI. Distinguishing Scam from Mere Breach of Contract

Not every failed online transaction is automatically a criminal scam. A seller’s delay, business failure, supply problem, or inability to perform may be a civil matter if there was no deceit at the beginning.

The key issue is whether the accused had fraudulent intent or made false representations at the time the victim parted with money or property. Indicators of fraud may include:

fake identity;
fake business registration;
repeated identical complaints from other victims;
immediate blocking after payment;
use of mule accounts;
false proof of shipment;
refusal to refund despite no intention to deliver;
deleting accounts after receiving payment;
unrealistic promises;
fabricated documents.

The stronger the evidence of deceit from the beginning, the stronger the criminal complaint.

XVII. Online Marketplace Scams

For scams involving online marketplaces, the victim should also report through the platform’s internal dispute or fraud mechanism. If the transaction occurred outside the platform, such as through direct bank transfer or off-platform messaging, recovery may be harder.

Victims should preserve:

product listing;
seller profile;
chat messages;
checkout or order details;
proof of payment;
shipping details;
platform complaint records.

XVIII. Social Media Scams

Many online scams occur through Facebook Marketplace, Messenger, Instagram, TikTok, Telegram, Viber, and similar platforms. The scammer may use a hacked account or a fake account. Victims should be careful in assuming that the profile owner is the actual offender, especially if the account may have been compromised.

Evidence should include the profile link, username, display name, screenshots, and any changes made after the scam.

XIX. Cryptocurrency and Online Investment Scams

Crypto-related scams may involve fake exchanges, fake trading bots, wallet-draining links, fake mining platforms, fake brokers, or romance-investment schemes. These cases are difficult because funds may move across wallets and foreign platforms.

Victims should preserve:

wallet addresses;
transaction hashes;
exchange account details;
screenshots of dashboards;
chat records;
investment promises;
deposit and withdrawal records.

A complaint may still be filed, but tracing and recovery may be complex.

XX. Identity Theft in Online Scam Cases

Identity theft may occur when a scammer uses someone else’s name, photo, ID, business page, company name, or account. The person whose identity was used may also be a victim.

For identity theft complaints, evidence may include:

proof of the real identity owner;
fake account screenshots;
unauthorized use of photos or documents;
messages sent by the impersonator;
reports from people deceived by the fake account;
platform reports.

XXI. Liability of Account Holders and Money Mules

A person whose bank account, e-wallet, or SIM card was used to receive scam proceeds may become a subject of investigation. Some account holders knowingly lend, sell, or rent their accounts. Others may claim they were also deceived.

Possible liability depends on knowledge, participation, benefit, and evidence connecting the account holder to the scam. A person who knowingly allows an account to be used for fraud may face criminal exposure.

XXII. Prescription of Offenses

Criminal offenses have prescriptive periods, meaning complaints must be filed within a legally allowed period. The applicable period depends on the offense and penalty. Victims should not delay filing because digital evidence may disappear and financial records may become harder to obtain.

XXIII. Penalties

Penalties depend on the offense charged, amount involved, circumstances, and whether the crime is treated as cyber-related. Cyber-related offenses may carry heavier penalties than their ordinary counterparts.

For estafa, penalties under the Revised Penal Code may vary depending on the amount defrauded and applicable legal rules. When committed through ICT, the Cybercrime Prevention Act may affect the penalty.

XXIV. Preliminary Investigation

After a complaint is filed, the case may undergo preliminary investigation. The prosecutor evaluates whether there is probable cause to charge the respondent in court.

The process may involve:

filing of complaint-affidavit and evidence;
issuance of subpoena to the respondent;
submission of counter-affidavit;
reply-affidavit, if allowed;
prosecutor’s resolution;
filing of information in court if probable cause exists;
dismissal if evidence is insufficient.

The complainant must present clear, organized, and credible evidence.

XXV. Court Proceedings

If the prosecutor finds probable cause, an information may be filed in court. The court may issue a warrant or summons depending on the offense and procedure. The accused may be arraigned, and the case may proceed to pre-trial and trial.

The prosecution must prove guilt beyond reasonable doubt. The complainant may testify, identify screenshots and records, explain the transaction, and prove the loss suffered.

XXVI. Practical Problems in Online Scam Complaints

Victims commonly face several challenges:

the scammer used a fake name;
the account was deleted;
the mobile number is no longer active;
the receiving account belongs to a mule;
the amount was transferred through several accounts;
the scammer is outside the Philippines;
the platform refuses to disclose records without legal process;
screenshots are incomplete;
the victim waited too long before reporting;
the transaction happened outside a protected marketplace system.

These problems do not automatically defeat a complaint, but they show why quick reporting and complete evidence are important.

XXVII. Demand Letter

A demand letter may be useful in some cases, especially when the respondent is known. It can show that the complainant demanded delivery, refund, or explanation before filing a case. It may also help demonstrate refusal or bad faith.

However, sending a demand letter is not always required before filing a criminal complaint, especially when the scammer is unknown, has blocked the victim, or is actively hiding.

XXVIII. Public Posting Against the Scammer

Victims often want to post warnings online. While public warnings may help others, victims should be cautious. Publicly naming a person as a scammer without sufficient proof may create legal risks, including possible defamation or cyberlibel allegations.

A safer approach is to report to authorities, preserve evidence, warn others in factual and careful language, and avoid exaggerated or unverified accusations.

XXIX. Preventive Measures

To avoid online scams, the public should observe basic precautions:

verify the seller, business, or investment provider;
avoid transactions that require rushing;
do not send OTPs, passwords, or banking credentials;
be skeptical of guaranteed high returns;
use official websites and apps;
avoid clicking suspicious links;
transact within protected marketplace systems;
check reviews and account history;
avoid sending large advance payments to strangers;
confirm identities through independent channels;
keep screenshots and receipts;
use strong passwords and two-factor authentication;
report suspicious accounts immediately.

XXX. Remedies Available to Victims

A victim may pursue several remedies:

criminal complaint for cyber-related estafa or other applicable offenses;
complaint for identity theft, phishing, illegal access, or computer-related fraud when applicable;
report to PNP Anti-Cybercrime Group or NBI Cybercrime Division;
report to bank, e-wallet, remittance center, or platform;
request freezing, preservation, or investigation of accounts;
civil action or civil claim for recovery of money;
regulatory complaint, if the scam involves securities, financial products, consumer transactions, or data misuse.

The best remedy depends on the facts, evidence, amount involved, identity of the offender, and urgency of the situation.

XXXI. Checklist for Filing a Cybercrime Complaint

Before filing, the complainant should prepare:

valid government ID;
complaint-affidavit;
screenshots of conversations;
screenshots of profile, listing, page, or website;
proof of payment;
receiving account details;
phone numbers, emails, usernames, links, and other identifiers;
demand messages, if any;
bank or e-wallet complaint ticket, if any;
platform report, if any;
witness affidavits, if any;
chronological summary of events;
printed and digital copies of evidence.

XXXII. Conclusion

An online scam in the Philippines is not merely an unfortunate digital transaction. When deceit is used to obtain money, property, credentials, or other benefits through online means, it may constitute estafa, cyber-related estafa, identity theft, computer-related fraud, or other punishable acts.

The strength of a cybercrime complaint depends on prompt action, organized evidence, and a clear showing of deceit, reliance, damage, and use of ICT. Victims should immediately preserve digital evidence, report fraudulent transactions to financial institutions or platforms, and seek assistance from cybercrime authorities such as the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. Where appropriate, a complaint-affidavit may be filed before the prosecutor’s office for preliminary investigation.

Because online scams often involve fake identities, mule accounts, deleted accounts, and fast-moving digital transactions, delay can seriously weaken a case. The victim’s best protection is immediate reporting, careful documentation, and proper legal action.