Online scams often look “civil” at first—missed deliveries, broken promises, “processing fees,” vanishing sellers—but many are criminal under Philippine law, especially when deceit or fraudulent abuse of trust is used to obtain money or property. The centerpiece charge is usually Estafa (Swindling) under the Revised Penal Code, frequently paired (when computers, messaging apps, or the internet are used) with offenses under the Cybercrime Prevention Act.

This article explains (1) what “estafa” covers in common online scams, (2) what complaints to file and where, (3) how to preserve evidence so it remains usable in court, and (4) what to expect procedurally from reporting to case filing.

1) The Legal Landscape for Online Scam Cases in the Philippines

A. Estafa (Revised Penal Code, Article 315): the usual criminal backbone

“Estafa” generally punishes defrauding another by:

False pretenses / deceit (e.g., pretending to sell goods, using fake identities, misrepresenting legitimacy);
Fraudulent acts done to induce payment (e.g., “reservation fees,” “release fees,” “tax clearance fees” that are invented); or
Abuse of confidence (e.g., money given in trust for a purpose, then misappropriated).

Core idea: If you can show (1) deception or abuse of trust, (2) a victim relied on it, and (3) money/property was handed over and lost, you are in estafa territory.

B. Cybercrime angle (RA 10175) when ICT is used

Even if the underlying fraud is “classic” estafa, using:

social media,
messaging apps,
online marketplaces,
email,
websites,
e-wallets or online banking, can trigger cybercrime-related charges or procedural tools (like preservation of computer data). This also helps investigators legally obtain digital records from platforms and service providers.

C. Other charges that may also fit (depending on facts)

Many scams overlap with other crimes. Examples:

Identity-related offenses (impersonation, use of another’s name/accounts),
Falsification (fake documents, fake receipts),
Theft/Unauthorized access (account takeovers, phishing leading to transfers),
Violations involving illegal investments/securities (for “guaranteed returns” schemes).

The correct labels matter, but your first goal is to preserve evidence and trigger the right investigative path.

2) Common Online Scam Patterns and the Legal Theory Behind Them

A. “Pay first, no delivery” (online selling scam)

Typical facts:

Seller posts item, demands full payment/deposit,
Provides excuses, then blocks the buyer.

Common legal framing:

Estafa by deceit (false pretenses of having genuine intent/ability to deliver).

B. “Overpayment / refund / courier fee / release fee” scams

Typical facts:

Scammer invents extra charges: delivery insurance, customs, “account verification,” “tax,” etc.
Victim pays multiple times.

Legal framing:

Estafa by fraudulent means; repeated payments help show a continuing pattern of deceit.

C. Fake investment / “double your money” / crypto or forex schemes

Typical facts:

Guaranteed returns, referral rewards,
Pressure to reinvest, difficulty withdrawing,
Use of screenshots/“testimonies” to appear legitimate.

Legal framing:

Estafa plus potential securities/investment violations (especially if solicitation to the public and unregistered schemes).

D. Account takeover / phishing leading to unauthorized transfers

Typical facts:

Victim clicks link, gives OTP, or gets SIM swapped,
Funds transferred out.

Legal framing:

Often unauthorized access / computer-related fraud plus estafa-like theories depending on how the offender obtained control and induced transfers.

3) Immediate Actions After You Realize You’ve Been Scammed

Speed matters. Do these as soon as possible, in order:

Stop further payments and communication
- Do not “negotiate” by sending more money for “release,” “unblocking,” or “verification.”
Secure your accounts and devices
- Change passwords, enable multi-factor authentication, revoke unknown sessions, reset email security.
- If phishing occurred, scan devices and secure your email first (email often controls password resets).
Notify the money channel immediately
- If you paid via bank transfer, card, e-wallet, remittance, or crypto exchange: report as fraud and request internal review/freeze if possible.
- Preserve the transaction identifiers (reference number, trace number, wallet ID, account number, timestamps).
Start a written timeline
- Date/time of first contact, offers made, payments, promises, delivery deadlines, threats, and blocking.
Preserve evidence properly (see Section 5)
- Don’t rely on “I have screenshots” alone; do it systematically.

4) Where to Report and Where to File the Criminal Complaint

You generally have two tracks:

Law enforcement reporting (for investigation, assistance in data requests, suspect identification), and
Prosecutor filing (for the criminal case itself).

A. Report to cybercrime-capable law enforcement (recommended early)

These units commonly handle online scam reports:

PNP Anti-Cybercrime Group
NBI Cybercrime Division

Why report early:

They can guide evidence handling,
They can help identify suspects using records from banks/e-wallets/platforms (through legal process),
They can help prepare your complaint package.

B. File the criminal complaint with the Prosecutor’s Office (key step)

To initiate prosecution, you file an Affidavit-Complaint and attachments with the Office of the City/Provincial Prosecutor (usually where:

you transacted/paid,
you received the deceitful communications,
or where the effects of the offense were felt).

What happens next (typical):

Preliminary investigation (for offenses requiring it): the respondent is asked to answer.
The prosecutor decides whether there is probable cause to file in court.
If filed, the case proceeds to court; warrants may issue depending on circumstances.

C. Parallel administrative/consumer reporting (helpful, but not a substitute for criminal filing)

Depending on the scam:

Marketplaces may have complaint channels.
For broad consumer issues, Department of Trade and Industry complaint mechanisms can help in certain transactions (especially merchant-related), but scams using fake identities often exceed what consumer mediation can fix.

If the scam involves investments or solicitation to the public, reporting to Securities and Exchange Commission can be useful, especially if there is a pattern or entity involved.

For e-money, banks, and payment service providers, escalations may involve Bangko Sentral ng Pilipinas consumer assistance processes.

For data privacy harms (doxxing, misuse of personal data, leaked IDs), National Privacy Commission may be relevant.

5) Evidence Preservation: How to Make Digital Proof Usable in a Case

Golden rule: Preserve evidence in a way that keeps it authentic, complete, and traceable.

A. What evidence matters most in online scam/estafa cases

Identity and contact points
- Profile URLs/usernames, phone numbers, email addresses, wallet IDs, bank account details.
Communications
- Chat threads (full conversation, not selective screenshots),
- Emails (including full headers),
- SMS messages.
Representations / deceit
- Ads, listings, posts, “guarantee” messages, fake invoices, “proof of legitimacy,” promises of returns.
Payment proof
- Official receipts, transfer confirmations, reference numbers, timestamps, bank/e-wallet statements.
Post-payment conduct
- Excuses, refusal to deliver/refund, threats, blocking, deletion of messages.

B. Best practices for screenshots (so they’re persuasive, not flimsy)

Screenshots are common—but courts and investigators look for context.

Do:

Capture the entire screen including:
- account name/handle,
- date/time stamps,
- conversation context (scroll up to show how the offer started),
- payment instructions.
Take series screenshots that show continuity (not just the scammer’s “promise”).
Keep original image files (don’t only keep copies pasted into chat or compressed apps).
Backup immediately to at least two locations (e.g., phone + external drive).

Avoid:

Editing/cropping in ways that remove timestamps or handles.
Using apps that overwrite originals without keeping the first version.

C. Preserve chat logs beyond screenshots

Whenever possible:

Export chat history (some apps allow export or “download your data”).
Record the profile link/ID (not just display name—names can change).
Preserve any voice notes or call logs if they relate to deceit or instructions.

D. Preserve webpages and listings

For marketplace posts, profiles, or websites:

Save the URL and capture screenshots showing URL bar.
Use “Save page” or print-to-PDF (if available).
Take a screen recording scrolling through the page to show it wasn’t a one-line capture.

E. Preserve payment data properly

Gather:

Transaction reference numbers,
Date/time,
Sender and recipient account details,
Screenshots of confirmation pages,
Statements (PDF or app screenshots),
Any messages from the payment provider.

If you used cash-in/cash-out channels, preserve:

Remittance control numbers,
Agent receipts,
CCTV requests may exist but are time-limited—report quickly.

F. Chain-of-custody mindset (simple version)

You don’t need forensic tools to be careful:

Create an Evidence Log (a table in a notebook or document):
- Item number,
- What it is (e.g., “Screenshot of chat re: payment instructions”),
- Date/time captured,
- Device used,
- Where it’s stored (folder name, drive),
- Notes (e.g., “includes username + timestamp”).
Keep originals unchanged; if you must annotate, make a copy and annotate the copy.

G. Affidavits and witness support

Your complaint is stronger when you have:

Your Affidavit-Complaint (narrative + attachments),
Affidavits of anyone who:
- witnessed payment,
- helped communicate,
- received related messages,
- also got scammed by the same suspect (pattern evidence can be powerful).

6) How to Prepare the Affidavit-Complaint Package

A clean complaint package makes prosecutors and investigators take the case faster.

A. What to include

Affidavit-Complaint (notarized)
- Who you are, how you met the suspect online, what was promised, what was paid, what was delivered (usually nothing), and how you were deceived.
Chronology / timeline (1–2 pages)
Annexes (labeled)
- Annex “A”: screenshots of listing/profile
- Annex “B”: chat excerpts (with continuity)
- Annex “C”: payment proofs
- Annex “D”: demand/refund attempts and blocking evidence
IDs
- Government ID copies and contact details
Computation of damage
- Total amount lost (principal), plus other provable expenses directly caused by the scam (be conservative and accurate).

B. Writing the narrative: facts first, not conclusions

Focus on:

Exact representations made (“item is available,” “guaranteed 10% weekly,” “delivery tomorrow”),
Your reliance (why you believed it),
The transfer (how/when you paid),
The loss (non-delivery, refusal to refund, disappearance),
Indicators of fraud (fake names, multiple accounts, repeated excuses, blocked you).

7) Filing Steps: From Report to Case

Step 1: Make a report and request documentation

Law enforcement may issue a blotter entry or similar proof of report.
This can help when coordinating with banks/e-wallets and platforms.

Step 2: File with the Prosecutor’s Office

Submit affidavit-complaint + annexes.
Keep stamped receiving copies.

Step 3: Preliminary investigation (common in estafa)

The respondent may file a counter-affidavit.
You may be required to reply.
The prosecutor resolves probable cause.

Step 4: Court filing and next stages

If probable cause is found, an information is filed in court.
The court process includes arraignment, pre-trial, trial, and judgment.
Restitution may be pursued via civil action aspects (often implied with criminal action, unless reserved/waived, depending on how filed and counsel strategy).

8) Practical Tips That Help Real Cases Succeed

A. Identify the “money endpoint”

Even if the scammer used fake names, the payment trail can lead to:

account holders,
cash-out patterns,
linked numbers/devices,
repeat victims.

Preserve every payment detail—small details often crack the identity.

B. Join with other victims (if applicable)

If multiple victims exist:

It supports a pattern of deceit,
Helps show intent to defraud,
Strengthens investigative priority.

C. Don’t “settle” in a way that destroys evidence

Sometimes scammers offer partial refunds to stop complaints. If you accept any amount:

Document it,
Preserve the conversations,
Keep the ability to prove the original fraud.

D. Be careful with public posting

Posting can warn others, but can also:

tip off suspects to delete accounts,
complicate evidence gathering,
expose you to counter-accusations if you publish unverified personal information.

For case-building, prioritize formal channels and preservation first.

9) Evidence Checklist (Quick Reference)

Identity

Profile URL/handle, phone number, email, wallet ID, bank account number, delivery address given (if any)

Deceit

Listing screenshots, promises, “proofs,” return guarantees, fabricated documents

Communications

Full chat thread continuity, timestamps, screen recordings, exported chat logs, call logs/voice notes

Payments

Receipts, reference numbers, statements, cash-in/cash-out proofs, timestamps

Aftermath

Blocking evidence, refusal to refund, new demands for fees, threats

Your documentation

Timeline, evidence log, notarized affidavit-complaint, annex labels

10) Key Takeaways

Online scams commonly qualify as estafa when there is deceit that induces payment and causes loss.
A strong case depends less on anger and more on organized evidence: complete chats, clear payment trails, and a clean timeline.
Reporting to cybercrime-capable units helps preserve trails, but the criminal case typically moves when you file an affidavit-complaint with the prosecutor.
Treat your phone and files like evidence: preserve originals, log what you captured, and avoid edits that strip context.