I. Introduction

Cybercrime complaints in the Philippines have become increasingly common because many disputes, scams, threats, harassment, defamatory statements, identity theft incidents, and financial fraud now happen through phones, messaging apps, email, social media, online marketplaces, dating apps, e-wallets, and banking platforms.

A cybercrime complaint is not limited to “hacking.” It may involve online libel, online threats, unauthorized access, identity theft, phishing, investment scams, sextortion, cyberbullying, fraudulent online selling, unauthorized use of accounts, fake profiles, data interference, computer-related fraud, and other offenses committed through information and communications technology.

The main law is the Cybercrime Prevention Act of 2012, officially Republic Act No. 10175. Cybercrime complaints may also involve the Revised Penal Code, Special Protection of Children Against Abuse, Exploitation and Discrimination Act, Anti-Photo and Video Voyeurism Act, Safe Spaces Act, Anti-Violence Against Women and Their Children Act, Data Privacy Act, Access Devices Regulation Act, Consumer Act, Securities Regulation Code, Anti-Money Laundering laws, and other special laws depending on the facts.

This article explains, step by step, how a cybercrime complaint is usually prepared, filed, investigated, and prosecuted in the Philippine setting.

II. What Is a Cybercrime Complaint?

A cybercrime complaint is a sworn complaint filed by a victim, complainant, or authorized representative asking law enforcement or prosecutors to investigate and prosecute an offense committed through a computer system, internet platform, mobile device, electronic communication, or digital service.

It may be filed when the offender used:

Facebook, Instagram, TikTok, X, YouTube, Reddit, Telegram, Viber, WhatsApp, Messenger, Discord, dating apps, or similar platforms;
Email;
Websites;
Online banking or e-wallets;
Online marketplaces;
SIM cards or mobile numbers;
Fake accounts;
Malware, hacking tools, or phishing links;
Cloud storage;
Computer systems or networks;
Digital images, videos, or documents;
Electronic signatures or electronic records.

A cybercrime complaint usually has two broad components:

The legal offense — what crime was committed; and
The digital evidence — how the crime can be proven.

III. Common Cybercrime Complaints in the Philippines

A. Cyberlibel

Cyberlibel is libel committed through a computer system or similar means. It usually involves defamatory posts, comments, videos, messages, articles, or captions published online.

Typical examples:

Accusing someone online of being a scammer, thief, adulterer, corrupt official, criminal, or immoral person without proof;
Posting defamatory accusations on Facebook;
Uploading a defamatory video;
Sharing a defamatory article;
Commenting false and damaging statements in a public thread;
Posting edited images meant to dishonor someone.

Cyberlibel generally requires:

Defamatory imputation;
Publication;
Identifiability of the person defamed;
Malice, either presumed or proven depending on the case.

B. Computer-Related Fraud

This involves using computer systems, online platforms, or electronic means to defraud another person.

Examples:

Online selling scam;
Fake investment scheme;
Phishing;
Fake bank or e-wallet transaction;
Unauthorized fund transfer;
Fake payment screenshot;
Romance scam;
Job scam;
Fake loan processing fee;
Marketplace fraud;
Cryptocurrency scam;
Fake delivery or parcel scam.

Computer-related fraud may overlap with estafa under the Revised Penal Code.

C. Computer-Related Identity Theft

This involves acquiring, using, misusing, transferring, possessing, or altering identifying information belonging to another person through computer systems or digital means.

Examples:

Creating a fake account using another person’s name and photos;
Using someone’s ID to open accounts;
Using another person’s personal information for scams;
Taking over someone’s account;
Pretending to be another person online;
Using another person’s details to obtain loans or transactions.

D. Illegal Access or Hacking

Illegal access involves accessing a computer system, account, network, or device without authority.

Examples:

Opening someone’s email without permission;
Accessing a social media account through stolen passwords;
Logging into a company system without authority;
Using spyware or keyloggers;
Unauthorized access to phones, laptops, cloud storage, or databases.

E. Data Interference and System Interference

Data interference involves unauthorized alteration, deletion, deterioration, or suppression of computer data.

System interference involves seriously hindering or interfering with the functioning of a computer system.

Examples:

Deleting files;
Altering account records;
Changing passwords to lock someone out;
Disrupting a website;
Deploying malware;
Tampering with company databases.

F. Cybersex and Online Sexual Exploitation

Cybersex offenses involve willful engagement, maintenance, control, or operation of lascivious exhibition of sexual organs or sexual activity through computer systems for favor or consideration.

Where minors are involved, the matter becomes much more serious and may involve child exploitation, trafficking, child abuse, child pornography, and other special laws.

G. Non-Consensual Sharing of Intimate Images or Videos

This may involve violations of the Anti-Photo and Video Voyeurism Act, the Safe Spaces Act, the Cybercrime Prevention Act, or other laws.

Examples:

Uploading intimate photos without consent;
Threatening to release private videos;
Sharing screenshots of private sexual conversations;
Creating fake nude images;
Sextortion;
Revenge porn.

H. Online Threats, Harassment, and Stalking

Online threats may be prosecuted under the Revised Penal Code, special laws, or in connection with cybercrime provisions.

Examples:

Threatening to kill or harm someone through chat;
Repeated harassment through fake accounts;
Sending abusive messages;
Doxxing;
Threatening to release private information;
Online stalking;
Coordinated harassment campaigns.

I. Cyberbullying

There is no single universal “cyberbullying” offense that covers all situations. The applicable law depends on the conduct.

Possible legal bases include:

Cyberlibel;
Unjust vexation;
Grave threats;
Light threats;
Slander by deed;
Safe Spaces Act;
Child protection laws;
School disciplinary rules;
Data Privacy Act;
Anti-VAWC law, if the relationship and acts qualify.

J. Unauthorized Use of Credit Cards, Debit Cards, E-Wallets, or Access Devices

Unauthorized use of cards, account numbers, OTPs, credentials, e-wallets, or other access devices may involve cybercrime, access device fraud, estafa, identity theft, or banking-related offenses.

Examples:

Unauthorized GCash, Maya, or bank transfer;
Use of stolen OTP;
SIM swap fraud;
Card-not-present fraud;
Unauthorized online purchase;
Phishing leading to account takeover.

IV. Step-by-Step Process for Filing a Cybercrime Complaint

Step 1: Identify the Exact Act Complained Of

Before filing, identify what happened in plain language.

Ask:

What did the offender do?
When did it happen?
Where online did it happen?
What account, page, number, email, or platform was used?
Who is the suspected offender?
What evidence connects the offender to the account or act?
What damage resulted?
Is the content still online?
Is there urgency, such as threats, extortion, ongoing posting, or risk to a child?

Examples:

“Someone created a fake Facebook account using my photos and is soliciting money.”
“An online seller received payment but blocked me and never delivered the item.”
“My ex-partner is threatening to upload intimate videos.”
“A person posted false accusations about me on TikTok.”
“My e-wallet was accessed without authority and funds were transferred.”
“A company employee deleted files from our system after resignation.”

This first step matters because the legal charge depends on the facts.

Step 2: Preserve the Evidence Immediately

Digital evidence can disappear quickly. Posts may be deleted, accounts may be deactivated, messages may be unsent, and usernames may be changed.

Preserve evidence before confronting the offender.

Important evidence includes:

Screenshots;
Screen recordings;
URLs or links;
Profile links;
Account names and usernames;
User IDs, if visible;
Email headers;
Chat logs;
Transaction receipts;
Bank or e-wallet records;
Reference numbers;
Phone numbers;
SIM card details;
IP-related information, if available;
Device logs;
Photos or videos posted;
Metadata, if available;
Witness statements;
Demand messages;
Proof of payment or damage.

Do not rely on screenshots alone when more reliable evidence can be preserved.

Step 3: Take Proper Screenshots and Screen Recordings

For online posts, the screenshot should show:

The offending post or message;
The name of the account;
The profile photo;
The date and time;
The URL or link;
The comments, captions, or replies;
The number, email, username, or handle;
The full context of the conversation;
The device date and time, if visible.

For chats, capture the entire thread, not just isolated lines. The context is important because the respondent may claim the screenshot was edited, incomplete, or misleading.

For websites, save the page as PDF where possible and record the URL.

For email, preserve the original email and headers. Do not merely print the email body.

For financial transactions, save receipts, account statements, reference numbers, and communications with the platform or bank.

Step 4: Avoid Altering the Evidence

Do not edit, crop, annotate, filter, or rename evidence in a way that may raise authenticity issues.

It is better to keep:

Original screenshots;
Original files;
Original videos;
Original device;
Original messages;
Original emails;
Original receipts.

Copies may be submitted, but originals should be preserved.

If possible, back up evidence in multiple secure locations, such as external drive and cloud storage.

Step 5: Consider a Notarized Affidavit of Screenshots or Digital Evidence

A complainant may execute an affidavit explaining:

Who took the screenshots;
When they were taken;
What device was used;
What account or platform was accessed;
What the screenshots show;
That the screenshots are true and faithful captures;
That the original messages, posts, or files remain available, if true.

This does not automatically prove the case, but it helps establish the source and context of the evidence.

Step 6: Determine Whether There Is Urgency

Some cybercrime situations require immediate action.

Urgent cases include:

Threats to life or physical safety;
Sextortion;
Ongoing blackmail;
Child exploitation;
Active hacking;
Ongoing unauthorized bank transfers;
Ongoing identity theft;
Continued publication of defamatory or intimate material;
Impersonation used to scam others;
Threatened release of private photos or videos.

In urgent cases, the complainant may report immediately to law enforcement, the platform, the bank, and relevant agencies.

Step 7: Report to the Platform, Bank, or Service Provider

Apart from filing a criminal complaint, report the incident to the platform or service provider.

Examples:

Report fake accounts to Facebook, Instagram, TikTok, or X.
Report phishing emails to the email provider.
Report unauthorized transactions to the bank or e-wallet.
Report marketplace scams to the marketplace platform.
Report SIM-related fraud to the telecom provider.
Report leaked intimate images to the hosting platform for takedown.

This is not a substitute for a criminal complaint, but it may help prevent further harm and preserve platform records.

For financial fraud, immediately request freezing, reversal, chargeback, investigation, or hold, where available.

Step 8: Prepare the Complaint-Affidavit

A cybercrime complaint usually begins with a complaint-affidavit.

The complaint-affidavit should state:

The complainant’s full name, age, address, and contact details;
The respondent’s identity, if known;
The respondent’s account, phone number, email, or online identity;
A chronological narration of facts;
The specific online acts committed;
The dates and times of the acts;
The platform or device used;
The evidence attached;
The damage suffered;
The laws believed to have been violated;
A request for investigation and prosecution.

The affidavit must be sworn before a notary public or authorized officer.

Step 9: Attach Supporting Evidence

A complaint-affidavit should include annexes.

Common annexes include:

Screenshots of posts;
Screenshots of chats;
URLs;
Screen recordings;
Photos or videos;
Transaction receipts;
Bank or e-wallet statements;
Demand letters;
Platform reports;
Police blotter, if any;
Identity documents of the complainant;
Birth certificate or proof of minority, if a child is involved;
Medical or psychological reports, if relevant;
Witness affidavits;
Device logs or technical reports;
Company IT reports, for business-related cyber incidents.

Each annex should be marked clearly, such as Annex “A,” Annex “B,” and so on.

Step 10: Decide Where to File

A cybercrime complaint may be filed with law enforcement or directly with the prosecutor, depending on the situation.

Possible filing venues include:

Philippine National Police Anti-Cybercrime Group;
National Bureau of Investigation Cybercrime Division;
Local police stations, especially for blotter and referral;
City or Provincial Prosecutor’s Office;
Department of Justice cybercrime-related offices, depending on the matter;
Specialized agencies, depending on the offense.

For many complainants, the usual practical route is to file with the PNP Anti-Cybercrime Group or the NBI Cybercrime Division, especially where technical investigation is needed.

A complaint may also be filed directly with the prosecutor if the evidence is already sufficient and the respondent is identifiable.

Step 11: Filing with the PNP Anti-Cybercrime Group

When filing with the PNP Anti-Cybercrime Group, the complainant should bring:

Government-issued ID;
Printed complaint-affidavit, if already prepared;
Printed screenshots;
Digital copies of evidence in USB or storage device;
Device used, if relevant;
Transaction records;
Links, usernames, phone numbers, and account details;
Witnesses, if any.

The cybercrime officers may:

Interview the complainant;
Review the evidence;
Require additional documents;
Prepare or assist with a complaint sheet;
Conduct technical assessment;
Issue requests or referrals;
Coordinate with platforms, banks, or telecoms where legally available;
Refer the matter for inquest or preliminary investigation if a suspect is arrested or identified.

Step 12: Filing with the NBI Cybercrime Division

The NBI Cybercrime Division may handle complaints involving:

Online scams;
Identity theft;
Hacking;
Cyberlibel;
Sextortion;
Online threats;
Unauthorized access;
Financial cybercrime;
Large-scale or organized online fraud;
Technically complex matters.

The complainant should bring the same evidence: IDs, screenshots, links, devices, receipts, account details, and sworn statements.

The NBI may evaluate whether the matter is actionable, request further evidence, conduct technical investigation, or refer the matter for prosecution.

Step 13: Filing Directly with the Prosecutor

A complainant may file directly with the Office of the City Prosecutor or Provincial Prosecutor.

This is common when:

The respondent is known;
The evidence is already gathered;
The offense is clear;
The complainant wants immediate preliminary investigation;
Technical tracing is not necessary;
The case is cyberlibel based on identifiable posts;
The complaint is supported by affidavits and annexes.

The prosecutor may require:

Complaint-affidavit;
Supporting affidavits;
Evidence;
Number of copies;
Payment of filing or legal fees, if applicable;
Proof of authority if filed by a representative.

The prosecutor then evaluates whether there is probable cause.

V. Jurisdiction and Venue

Cybercrime venue can be complex because online acts may involve different locations.

Relevant locations may include:

Where the complainant resides;
Where the respondent resides;
Where the post was accessed;
Where the computer system was used;
Where the harmful effect occurred;
Where the transaction took place;
Where the bank or e-wallet account is located;
Where the company system is located;
Where the defamatory material was first published or accessed.

In practice, complainants often file with the cybercrime units or prosecutor’s office in their area, especially if they suffered damage there. Venue issues may still be raised later by the respondent.

VI. What Happens After Filing?

A. Initial evaluation

The receiving office reviews whether the complaint states a possible offense and whether evidence is sufficient.

The complainant may be asked to submit additional documents or clarify facts.

B. Investigation

Law enforcement may conduct investigation, such as:

Identifying the account user;
Preserving evidence;
Coordinating with platforms;
Reviewing devices;
Tracing transactions;
Interviewing witnesses;
Conducting entrapment, where lawful and appropriate;
Preparing reports;
Referring the case to the prosecutor.

C. Preliminary investigation

If the complaint proceeds to the prosecutor, the respondent is usually required to file a counter-affidavit.

The process may involve:

Filing of complaint-affidavit;
Issuance of subpoena;
Submission of counter-affidavit;
Submission of reply-affidavit, if allowed;
Clarificatory hearing, if needed;
Resolution by the prosecutor.

The prosecutor determines probable cause, not guilt beyond reasonable doubt.

D. Filing of information in court

If probable cause exists, the prosecutor files an information in court.

The case then proceeds to:

Raffling of case;
Issuance of warrant or summons, depending on the offense and procedure;
Arraignment;
Pre-trial;
Trial;
Judgment.

E. Dismissal or resolution against the complaint

If the prosecutor finds no probable cause, the complaint may be dismissed.

The complainant may consider legal remedies such as motion for reconsideration or petition for review, depending on the rules and circumstances.

VII. Evidence in Cybercrime Cases

A. Screenshots

Screenshots are commonly used, but they are not always enough by themselves. Their value improves when supported by:

URLs;
Full conversation context;
Device used;
Witness affidavit;
Admission by respondent;
Platform records;
Corroborating messages;
Transaction records;
Identity links to the respondent;
Technical report.

B. Electronic documents

Electronic documents may be admissible if properly authenticated under rules on electronic evidence.

Examples:

Emails;
Chat logs;
Digital receipts;
Electronic contracts;
Metadata;
Server logs;
Online posts;
Audio or video files;
Transaction confirmations.

C. Chain of custody

The complainant should be able to explain how evidence was obtained, stored, copied, and submitted.

For example:

Who captured the screenshot?
From what account?
On what date?
On what device?
Was the file edited?
Where is the original?
Who had access to the device?

Chain of custody is especially important for files, videos, devices, and forensic evidence.

D. Authentication

The party presenting electronic evidence must show that the evidence is what it claims to be.

Authentication may be done through:

Testimony of the person who captured or received the message;
Testimony of a system administrator;
Metadata;
Distinctive characteristics;
Admissions by the respondent;
Corroborating circumstances;
Certification or records from service providers, when available.

VIII. How to Prove the Identity of the Offender

One of the hardest parts of cybercrime prosecution is proving who was behind an account, number, or transaction.

Helpful proof includes:

The account uses the respondent’s name, photo, phone number, email, or nickname.
The respondent admitted ownership of the account.
The account communicated facts only the respondent would know.
The account was linked to the respondent’s bank, e-wallet, address, or delivery details.
The respondent received money.
The respondent used the same username across platforms.
The respondent’s friends, relatives, or contacts are connected to the account.
The respondent appeared in photos or videos posted by the account.
The account was accessed from devices controlled by the respondent.
The respondent continued the same conduct offline.
The phone number or SIM is connected to the respondent.
The platform records identify the respondent.
Witnesses can testify that the respondent owns or uses the account.

A mere suspicion is not enough. The complaint should show facts linking the online act to a real person.

IX. Special Issues in Cyberlibel Complaints

Cyberlibel is one of the most commonly filed cybercrime complaints.

A. Elements to establish

A cyberlibel complaint should show:

The exact defamatory statement;
Where it was published;
When it was published;
Who published it;
Who saw or could see it;
Why it refers to the complainant;
Why it is false or malicious;
How it damaged the complainant.

B. Public posts versus private messages

A public post is easier to treat as publication.

Private messages may still be relevant, but publication may be harder to establish unless sent to a third person.

A defamatory message sent only to the person defamed may not satisfy the publication element in the same way as a public post or message to a third party.

C. Opinion versus defamatory fact

Statements of pure opinion may be treated differently from factual accusations.

For example:

“I do not like his service” may be opinion.
“He stole my money” is a factual accusation.
“She is a scammer” may be defamatory if false and malicious.

Context matters.

D. Identifiability

The complainant must be identifiable. The post need not always state the full name if the surrounding facts make clear who is being referred to.

Examples:

Nicknames;
Photos;
Job title;
Business name;
Address;
Tags;
Comments identifying the person;
Context known to the audience.

X. Special Issues in Online Scam Complaints

For online selling, marketplace, and investment scams, the complaint should focus on deception, payment, damage, and identity.

Important evidence includes:

Product listing;
Seller profile;
Chat negotiation;
Promise to deliver;
Proof of payment;
Bank or e-wallet account details;
Delivery details;
Failure to deliver;
Blocking or disappearance;
Similar complaints by other victims;
False payment confirmations;
Fake tracking numbers.

The complaint should explain the fraudulent representation clearly.

Example:

“The respondent represented that he had a laptop for sale, induced me to pay PHP 25,000 through e-wallet transfer, confirmed receipt, promised delivery, then blocked me and deleted the listing.”

XI. Special Issues in Sextortion and Intimate Image Cases

Sextortion and non-consensual intimate image cases require urgent action.

The victim should:

Preserve all threats and messages.
Do not send more money or intimate images.
Do not negotiate alone if safety is at risk.
Report the account to the platform.
File with cybercrime authorities.
Seek takedown of content.
Inform trusted persons if necessary.
Preserve payment details if money was demanded.
Seek protection orders if the offender is an intimate partner.
Seek psychosocial support if needed.

If the victim is a minor, child protection laws and child exploitation laws may apply. Reports should be made immediately to appropriate authorities.

XII. Special Issues in Hacking and Account Takeover

For unauthorized access cases, preserve:

Login alerts;
Password reset emails;
Unauthorized transaction notices;
IP login notices, if available;
Device information;
Account recovery correspondence;
Screenshots of changed profile details;
Messages sent by the hacker;
Financial losses;
Malware or suspicious links.

The victim should also:

Change passwords;
Enable two-factor authentication;
Secure email accounts first;
Log out other sessions;
Report to the platform;
Inform contacts not to transact with the hacked account;
Preserve proof before recovery steps erase logs.

XIII. Special Issues in Business Cybercrime

Businesses may file cybercrime complaints for:

Unauthorized access by former employees;
Data theft;
Deletion of company files;
Website defacement;
Ransomware;
Business email compromise;
Invoice fraud;
Fake supplier emails;
Trade secret theft;
Unauthorized use of customer data.

The company should preserve:

Server logs;
Access records;
HR records;
IT reports;
Device assignment records;
Employment contracts;
Confidentiality agreements;
Resignation or termination records;
Emails and chat logs;
Audit trails.

A corporate complainant should also attach proof that the representative is authorized to file the complaint.

XIV. Civil Remedies Alongside Criminal Complaint

A cybercrime victim may have civil remedies in addition to criminal remedies.

Possible civil claims include:

Damages;
Injunction;
Takedown-related relief;
Protection orders;
Recovery of money;
Return of property;
Account recovery assistance;
Restraining orders in harassment cases;
Data privacy complaints;
Consumer complaints.

Civil liability may be pursued in the criminal case or through a separate civil action, depending on the situation and applicable rules.

XV. Provisional and Protective Remedies

Depending on the facts, a complainant may seek urgent relief.

A. Protection orders

In cases involving violence against women and children, harassment by intimate partners, threats, stalking, or abuse, protection orders may be available.

B. Injunction

For ongoing publication, disclosure, misuse of data, or unauthorized use of property, injunction may be considered in a civil case.

C. Takedown requests

Takedown may be requested from platforms. Formal legal processes may also be explored when content violates law or platform rules.

D. Account freezing or transaction hold

For financial fraud, immediately contact banks, e-wallets, payment processors, and platforms. Law enforcement or court orders may be needed for certain freezes or disclosures.

XVI. Role of Barangay Proceedings

Cybercrime complaints are often criminal in nature and may not be resolved through barangay conciliation, especially where the offense is serious, punishable beyond barangay jurisdiction, involves parties in different cities, requires urgent police action, or involves public offenses.

However, some related disputes, such as minor harassment, neighborhood conflicts, or personal disputes between residents of the same city or municipality, may raise barangay conciliation issues before certain civil or criminal actions.

Before filing in court, check whether barangay conciliation is required. For urgent criminal cybercrime matters, complainants typically proceed directly to law enforcement or the prosecutor.

XVII. Data Privacy Complaints

Some cyber incidents may also involve violations of data privacy rights.

Examples:

Unauthorized posting of personal information;
Doxxing;
Unauthorized processing of personal data;
Data breach;
Unlawful disclosure of customer records;
Use of personal data for harassment or scams.

The victim may consider a complaint with the National Privacy Commission if the facts involve personal data processing, unauthorized disclosure, or data protection violations.

Data privacy remedies may proceed separately from criminal cybercrime remedies.

XVIII. Complaints Involving Minors

If the victim is a child, the matter becomes more sensitive.

Possible issues include:

Online sexual exploitation;
Child abuse;
Grooming;
Sextortion;
Cyberbullying;
Non-consensual intimate images;
Trafficking;
Harassment;
Threats;
Identity theft.

Parents, guardians, schools, social workers, and law enforcement may be involved. Child-sensitive procedures should be followed, and the child’s privacy must be protected.

Avoid reposting or forwarding harmful images. Preserve evidence in a way that does not further distribute exploitative material.

XIX. Complaints Involving Anonymous Accounts

A common problem is that the offender is anonymous.

The complaint can still be filed against:

John Doe;
Jane Doe;
Unknown person using a specific account;
Unknown owner of a number, email, wallet, or profile.

The complaint should provide all identifiers available:

Profile link;
Username;
Display name;
Photos;
Phone number;
Email;
Bank or e-wallet account;
Transaction reference number;
IP-related data, if available;
Device logs;
Screenshots;
Witnesses;
Related accounts.

Law enforcement may investigate identity through lawful channels.

XX. Complaints Involving Overseas Offenders

Cybercrime often crosses borders. The offender may be outside the Philippines, or the platform may be foreign.

Practical issues include:

Identifying the offender;
Obtaining platform records;
Preserving foreign-hosted evidence;
Enforcing subpoenas or orders;
Coordinating through international channels;
Determining jurisdiction;
Extradition or mutual legal assistance, in serious cases.

If the victim is in the Philippines and harm occurred in the Philippines, a complaint may still be filed locally, but enforcement may be more difficult.

XXI. Takedown of Online Content

Filing a criminal complaint does not automatically remove online content.

The victim may separately:

Use platform reporting tools;
Send a takedown request;
Send a demand letter;
Request assistance from counsel;
Seek court relief where appropriate;
Coordinate with cybercrime authorities in serious cases.

For intimate images, impersonation, scams, and child exploitation, platforms often have specific reporting categories.

XXII. Demand Letters: Are They Required?

A demand letter is not always required before filing a cybercrime complaint.

However, demand letters may be useful in some cases, such as:

Online scams;
Debt-related defamatory posts;
Business disputes;
Account misuse;
Unauthorized content;
Removal requests;
Demand to preserve evidence.

In criminal cases, a demand letter may sometimes help show refusal, bad faith, or intent, but it may also give the offender time to delete evidence. Therefore, preserve evidence first before sending any demand.

XXIII. Police Blotter: Is It Enough?

A police blotter is not the same as a criminal complaint.

A blotter is merely a record of an incident reported to police. It may be useful as supporting evidence, but it does not automatically start prosecution.

For actual prosecution, the complainant generally needs a complaint-affidavit and supporting evidence filed with the proper law enforcement unit or prosecutor.

XXIV. How Long Does a Cybercrime Case Take?

The timeline varies.

Factors include:

Whether the offender is known;
Complexity of technical evidence;
Need for platform records;
Number of respondents;
Availability of witnesses;
Prosecutor workload;
Court docket;
Whether the respondent contests the case;
Whether settlement is possible;
Whether urgent relief is needed.

Simple cyberlibel or online scam complaints with known respondents may proceed faster than hacking, phishing, or anonymous account cases requiring technical tracing.

XXV. Settlement and Affidavit of Desistance

Some cybercrime disputes are settled. Settlement may include:

Apology;
Takedown;
Payment;
Return of money;
Agreement not to repost;
Undertaking not to contact;
Confidentiality terms;
Civil compromise.

However, a criminal offense is an offense against the State. An affidavit of desistance does not automatically dismiss a criminal case, especially once it has progressed. The prosecutor or court may still proceed if evidence supports prosecution.

Settlement should be handled carefully, particularly in serious cases, child cases, sextortion, repeated harassment, or large-scale fraud.

XXVI. Defenses Commonly Raised by Respondents

Respondents in cybercrime complaints may argue:

They did not own or control the account.
Their account was hacked.
The screenshots are fake or edited.
The complainant omitted context.
The statement was true.
The statement was opinion or fair comment.
There was no publication.
The complainant is not identifiable.
There was no malice.
There was no intent to defraud.
The transaction was a civil dispute, not a scam.
The complainant voluntarily sent money.
The messages are inadmissible.
The complaint was filed in the wrong venue.
The offense has prescribed.
The evidence does not connect the respondent to the account.

A strong complaint anticipates these defenses by showing identity, authenticity, context, intent, damage, and legal elements.

XXVII. Common Mistakes by Complainants

Avoid these mistakes:

Filing with only one cropped screenshot.
Deleting the original conversation.
Blocking the offender before preserving evidence.
Confronting the offender too early.
Posting about the dispute online.
Threatening the offender with unlawful harm.
Editing screenshots.
Failing to save URLs.
Losing transaction reference numbers.
Failing to identify witnesses.
Filing the wrong offense.
Treating every insult as cyberlibel.
Treating every failed transaction as estafa.
Ignoring prescription periods.
Failing to prove that the respondent owns the account.
Sending more money to a scammer.
Sharing intimate images further while trying to prove the case.
Waiting too long before reporting financial fraud.

XXVIII. Checklist Before Filing a Cybercrime Complaint

Before filing, prepare:

Government-issued ID;
Complaint-affidavit;
Screenshots;
Screen recordings;
URLs or links;
Full chat logs;
Profile links;
Usernames and account IDs;
Phone numbers and emails;
Proof of payment;
Bank or e-wallet records;
Delivery records, if any;
Witness affidavits;
Device used, if relevant;
Original files;
Demand letter, if any;
Platform reports, if any;
Proof of damage;
Authority to file, if filing for a company or another person;
Copies of all documents for filing and service.

XXIX. Sample Structure of a Cybercrime Complaint-Affidavit

A complaint-affidavit may follow this structure:

Personal circumstances of complainant;
Identity of respondent;
Relationship between complainant and respondent, if any;
Chronology of events;
Description of online act;
Identification of platform, account, link, or number used;
Explanation of why the act is criminal;
Explanation of how respondent is connected to the act;
Description of damage suffered;
List of attached evidence;
Request for investigation and prosecution;
Verification and oath.

Example paragraph style:

“I am filing this complaint against Respondent for using the Facebook account under the name ______ to post false and malicious accusations against me on ______. The post is attached as Annex ‘A.’ It was publicly accessible through the link ______. The post identifies me by name and photograph. The accusations are false and have caused damage to my reputation, business, and family.”

XXX. What to Do After Filing

After filing, the complainant should:

Keep copies of all documents submitted.
Get receiving copies with date stamps.
Save the docket number or reference number.
Monitor communications from investigators or prosecutors.
Attend scheduled hearings or clarificatory conferences.
Submit additional evidence promptly.
Preserve original devices and files.
Avoid posting about the case online.
Avoid direct confrontation with the respondent.
Inform authorities if threats continue.
Update law enforcement if new posts, accounts, or transactions appear.

XXXI. Cybercrime Complaint Versus Civil Case

A cybercrime complaint seeks criminal prosecution.

A civil case seeks private remedies such as damages, injunction, recovery of money, or protection of rights.

Some cases require both.

Examples:

Online scam: criminal complaint plus civil recovery of money.
Cyberlibel: criminal complaint plus damages.
Intimate image leak: criminal complaint plus injunction and damages.
Business hacking: criminal complaint plus civil action for damages and injunction.
Identity theft: criminal complaint plus takedown and data privacy remedies.

XXXII. Practical Tips for Specific Cybercrime Scenarios

A. If you are a victim of an online selling scam

Preserve the product listing.
Preserve chats.
Save proof of payment.
Save the seller’s bank, e-wallet, or delivery details.
Report to the platform.
Report to bank or e-wallet.
File complaint with cybercrime authorities or prosecutor.

B. If someone posted defamatory content about you

Screenshot the entire post.
Save the URL.
Capture comments showing people understood it referred to you.
Identify who posted it.
Preserve evidence before asking for takedown.
Consider whether the statement is factual, false, defamatory, and identifiable.
File complaint if elements are present.

C. If your account was hacked

Secure your email first.
Change passwords.
Enable two-factor authentication.
Save login alerts.
Screenshot unauthorized activities.
Report to the platform.
Warn contacts.
File complaint if unauthorized access or fraud occurred.

D. If someone is threatening to leak intimate images

Preserve threats.
Do not send more images.
Do not pay without legal advice.
Report the account.
File urgently with cybercrime authorities.
Seek protection orders if the offender is an intimate partner.
Ask trusted support persons for help.

E. If your identity is being used in a fake account

Screenshot the fake profile.
Save the profile link.
Screenshot posts, messages, and scams using the profile.
Report the profile.
Notify affected contacts.
File complaint for identity theft or related offenses.

XXXIII. Conclusion

Filing a cybercrime complaint in the Philippines requires more than simply telling authorities that something bad happened online. The complainant must preserve digital evidence, identify the platform or account used, connect the online act to a real person, prepare a sworn complaint-affidavit, attach supporting documents, and file with the appropriate cybercrime unit or prosecutor.

The most important step is evidence preservation. Screenshots, URLs, chat logs, transaction records, device logs, and witness affidavits should be secured before the offender is alerted. Once the evidence is preserved, the complainant may proceed to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the proper prosecutor’s office.

Cybercrime cases can involve both criminal and civil remedies. A victim may seek prosecution, damages, takedown, account recovery, injunction, protection orders, data privacy remedies, and recovery of money depending on the facts. Because cybercrime cases often depend on technical evidence and proper authentication, careful preparation is essential.