1) The Legal Idea: “Online Scam” as a Crime

In Philippine law, most “online scams” are not a single stand-alone offense called online scamming. They are usually prosecuted as Estafa (Swindling) under the Revised Penal Code (RPC)—often committed through electronic/online means, which can affect charging and penalties under the Cybercrime Prevention Act of 2012 (RA 10175).

The same scam incident can also trigger related offenses (identity theft, falsification, violations involving checks, illegal recruitment, securities violations), but Estafa is the core charge in many cases where:

the scammer lied or used fraudulent representations, and
the victim paid money or handed over property, and
the victim suffered damage or prejudice.

2) Estafa Under the Revised Penal Code: The Main Charging Paths

Estafa is found under Article 315 (RPC) (with other deceit provisions nearby, e.g., Art. 318). Online scams typically fall into one of these legal patterns:

A. Estafa by False Pretenses / Fraudulent Acts (Common in Online Selling Scams)

This is the classic situation:

The scammer pretends to be a legitimate seller/service provider.
The victim is persuaded to send payment (bank transfer, e-wallet, remittance).
The scammer disappears, blocks the victim, or never delivers.

Key feature: The deceit happens at or before the victim parts with money/property.

Typical examples:

Fake “for sale” posts (gadgets, concert tickets, rentals, pets).
Fake booking agents / travel packages.
Fake “supplier” deals requiring advance deposits.
Fake donation drives with fabricated stories.

B. Estafa by Misappropriation / Conversion (Common in “Entrusted Money” Scams)

This applies when the victim entrusts money/property for a specific purpose, and the recipient later misappropriates it or denies receiving it.

Typical examples:

“Pasabuy” or “pabili” where money is entrusted to purchase goods and the buyer is never served.
Investment/“paikot” schemes where money is given for a defined management purpose and is diverted.
Online “agent” collections where funds are collected for remittance/processing and are kept.

Key feature: There is a trust/entrustment relationship (commission, administration, obligation to return or deliver), then conversion.

C. Estafa Involving Checks (Sometimes Appears in Online Transactions)

Where payment is made with a check that is worthless or knowingly unfunded, Estafa theories can arise (separate from Batas Pambansa Blg. 22 concerns). In online settings, this is less common but appears in second-hand vehicle sales, high-value item sales, or “refund” scams using bad checks.

D. “Other Deceits” (Fallback, Usually for Minor/Unclassified Fraud)

Some dishonest conduct may be prosecuted under provisions on deceit that don’t neatly fit Art. 315, but most online scam complaints aim for Art. 315 if the fact pattern supports it.

3) The Core Elements the Complaint Must Establish

A prosecutor assessing an Estafa complaint is looking for deceit + reliance + damage, and the specific statutory elements depending on the variant.

A. For Estafa by False Pretenses (typical online seller scam)

You generally need facts showing:

A false pretense or fraudulent representation (e.g., “I have the item,” “I’m an authorized agent,” “Here’s a fake tracking number,” “here’s a fake ID/business”).
The false representation was made prior to or simultaneous with the victim’s payment/transfer.
The victim relied on the misrepresentation.
The victim suffered damage or prejudice (loss of money, lost opportunity, expenses).

B. For Estafa by Misappropriation/Conversion (entrusted funds)

Facts usually focus on:

Money/property was received in trust, on commission, for administration, or under an obligation to deliver/return.
The recipient misappropriated, converted, or denied receipt.
The owner suffered prejudice.
A demand and refusal is often strong evidence of conversion (commonly discussed in practice; the decisive point is proving conversion/intent, and demand helps show it).

4) “Breach of Contract” vs. “Estafa”: The Most Common Fault Line

Not every failed online transaction is automatically Estafa.

Civil breach tends to look like:

A seller intended to perform but failed due to logistics, supplier failure, force majeure, or honest mistake; and
There’s no solid indication of deceit at the start.

Criminal Estafa tends to look like:

The seller’s story is demonstrably false (fake identity, fake proofs, fake item photos reused from elsewhere, fake receipts, fake tracking numbers).
There is pattern behavior (multiple victims, repeated complaints, immediate blocking).
The seller never had the ability/intent to deliver and used the transaction to extract money.

Your narrative and attachments should highlight why the deceit existed at inception, not merely that delivery failed.

5) Cybercrime Angle: Why “Online” Matters (RA 10175)

Even when the underlying crime is Estafa under the RPC, the fact it was committed through online communications and electronic systems can matter in two ways:

A. “Estafa in Relation to RA 10175”

RA 10175 contains a rule that when crimes already punishable under the RPC are committed by, through, and with the use of information and communications technologies, the penalty may be imposed one degree higher (a significant sentencing consequence). In practice, many complaints are framed as Estafa (Art. 315) in relation to RA 10175 when the internet or electronic systems were essential to the commission.

B. Separate Cybercrime Offenses (Sometimes)

Depending on facts, prosecutors may also consider:

Identity theft (if the scammer used another person’s identity).
Computer-related fraud theories (more applicable where there is manipulation of data/systems, not just lies via chat).
Other cyber-related violations depending on the method.

Not all online scams fit a separate “computer-related fraud” definition; many rely primarily on traditional deceit plus the RA 10175 penalty enhancement concept.

6) Where and How to File: The Philippine Process (Criminal Route)

A. First Decision: Police/NBI Assistance vs. Direct Prosecutor Filing

You can:

Report to PNP Anti-Cybercrime Group or NBI Cybercrime Division for investigative assistance (useful when identity is unknown, or when preservation/subpoena steps are needed); and/or
File a complaint directly with the Office of the City/Provincial Prosecutor for preliminary investigation.

Law enforcement involvement is especially useful when:

The scammer’s real identity is unknown.
You need help linking the online account to a real person through bank/e-wallet KYC, SIM registration data, courier records, IP logs, etc.
There are multiple victims or an organized scheme.

B. Venue (Where to File)

In general criminal procedure, venue is tied to the place where the offense or any of its essential elements occurred. For online scams, common practical anchors include:

Where the victim was located when the deceit was communicated and relied upon;
Where payment was sent/received (bank branch/processing location can matter);
Where the victim suffered damage;
For cyber-related filing, additional venue concepts may apply because electronic communications can be accessed in various places.

Because online transactions blur geography, complaints often emphasize where the victim received and relied on the misrepresentations and where the loss was suffered, and attach proof of locality (address, payment records, logs).

C. Jurisdiction (Which Court Ultimately Tries the Case)

After preliminary investigation, if an Information is filed:

Cases with lower penalties generally go to Metropolitan/Municipal Trial Courts (MTC/MeTC/MCTC).
Higher-penalty cases go to the Regional Trial Court (RTC).
Cyber-related cases are often assigned to designated cybercrime courts (special RTC branches), depending on local assignments and how the charge is framed.

7) Building the Case: Evidence That Matters Most

A. Digital Communications (Chats, DMs, Emails, SMS)

Collect and preserve:

Full conversation threads (not just selected messages).
The scammer’s statements about identity, items, price, delivery, timelines.
Any admissions, threats, blocking messages, or refusal to refund.

Best practice for credibility:

Capture screenshots showing date/time stamps, usernames/handles, and the message sequence.
Export chat history when the platform allows it.
Keep the original files/devices. Printed screenshots are usually treated as representations of electronic documents and must be authenticated.

B. Proof of Payment and the Recipient Trail

This is often the strongest anchor of “damage”:

Bank transfer slips, transaction confirmations, reference numbers.
E-wallet transfer confirmation pages and IDs.
Remittance receipts and claim details.
If you paid via a platform checkout, keep order details and platform messages.

Where possible, obtain bank/e-wallet transaction history with any available certification (even a stamped/issued statement or official transaction record).

C. The Scammer’s Identity Signals

Even if the name is fake, preserve:

Profile URL/username/handle and profile screenshots.
Posted listings, photos, “proofs,” IDs they sent (even if forged).
Phone numbers, email addresses, delivery addresses, bank/e-wallet account name/number.
Courier waybills, tracking pages, rider chat logs (if any).

D. Pattern Evidence (Helps Show Intent)

If available:

Similar complaints from other victims.
Reused photos across multiple listings.
Multiple accounts funneling to the same payment channel.
“Vouch” posts that appear fabricated.

E. Electronic Evidence Admissibility (Rules on Electronic Evidence)

Philippine courts recognize electronic documents, but you must be ready to:

Authenticate the screenshots/printouts (testimony/affidavit that you captured them, what device/platform, and that they reflect the messages as received).
Show integrity (no tampering; keep originals).
Present context (complete relevant portions of the conversation).

8) Freezing / Recovering Funds: What’s Realistic

Victims often want immediate reversal. Realistically:

A. Immediate Platform/Bank/E-Wallet Action (Time-Critical)

Report the incident to the bank/e-wallet provider immediately with transaction references.
Some providers can place temporary holds or initiate internal fraud workflows, but outcomes vary and often depend on timing, available balances, and legal constraints.

B. Court Orders / Law Enforcement Assistance

For more formal restraints:

Freezing and compelled disclosures typically require law enforcement coordination and/or court orders (especially for content data, subscriber/account data, or restraint of funds depending on circumstances and the institution’s policies).

C. Civil Recovery vs. Criminal Case

The criminal case can include civil liability (restitution/damages), but collection still depends on the offender’s traceable assets. Parallel civil remedies are sometimes used, but the criminal case is the primary accountability route for scams.

9) Drafting the Complaint-Affidavit: What Prosecutors Expect

A well-structured Complaint-Affidavit is decisive. Typical components:

Caption and parties
- Your name, address, and personal circumstances.
- Respondent’s name/aliases/online handles and any known identifiers (bank account name/number, phone, email).
Chronological narrative
- How you encountered the listing or offer.
- Exactly what the respondent represented (quote or paraphrase key messages).
- When and how you paid (attach proof).
- What happened after payment (non-delivery, blocking, excuses, fake tracking).
Key points that establish deceit
- Why the representations were false (fake identity, inconsistent details, fake proofs, impossible claims).
- Why you relied on them.
Damage
- Exact amount lost and additional expenses (delivery fees, transfer fees).
- Attach computations if needed.
Demand and response (if applicable)
- Your attempts to contact and the respondent’s refusal or evasion.
- Especially useful in entrusted-funds scenarios.
Annexes
- Label attachments as Annex “A”, “B”, etc. (screenshots, receipts, IDs, URLs, logs).
- Provide a short description per annex.
Verification and signature
- Signed and subscribed (notarized), following prosecutor office requirements.

Practical tip: Prosecutors prefer attachments that are easy to follow—clear labeling, readable screenshots, and a timeline.

10) Preliminary Investigation: What Happens After Filing

Once filed with the Prosecutor’s Office:

Evaluation and subpoena
- If sufficient, the prosecutor issues a subpoena to the respondent for a Counter-Affidavit.
Counter-affidavit and rebuttal
- Respondent may deny, claim identity theft, claim civil dispute, or claim intent to deliver.
- You may be allowed to file a Reply/Rejoinder depending on office practice.
Resolution
- The prosecutor determines whether there is probable cause to file an Information in court.
Filing in court
- If probable cause is found, an Information is filed and the case proceeds to arraignment and trial stages.

Identity problem: If the respondent is initially unknown, law enforcement support is often crucial to connect online identifiers to a real person. Complaints sometimes begin with available identifiers (accounts, numbers) and are strengthened as identity is established.

11) Arrest, Bail, and the Reality of Enforcement

Estafa is generally bailable.
Warrants and arrest depend on the court’s findings and procedure after filing.
Many scammers evade, use dummy accounts, or operate across provinces, so investigative linkage (payment channels, SIM registration, KYC) is often the practical key.

12) Penalties: Why the Amount and “Cyber” Framing Matter

Estafa penalties depend heavily on:

The manner of committing estafa (false pretenses vs. misappropriation vs. checks), and
The amount involved, with thresholds updated over time by legislation (commonly referenced in practice in relation to amendments to property-value based penalties).

If prosecuted in relation to RA 10175, the penalty can be one degree higher than the base penalty under the RPC—so the cyber framing can materially affect exposure.

13) Related Charges That Sometimes Fit Online Scam Fact Patterns

Depending on what the scam involved, authorities may consider additional or alternative charges, such as:

Batas Pambansa Blg. 22 (Bouncing Checks Law) if payment/refund was made via a worthless check.
Illegal recruitment (often online) if the scam involved job placement for a fee with the required recruitment elements.
Falsification if fake documents/IDs/receipts were fabricated and used as part of the scheme.
Identity theft if a real person’s identity was used to open accounts or deceive victims.
Regulatory actions (e.g., securities-related issues) if the scheme is an “investment” solicitation pattern.

These are fact-dependent; Estafa remains the common backbone when deceit and loss are central.

14) Defenses You Should Expect—and How Evidence Counters Them

Common respondent claims include:

“It’s just a civil case / breach of contract.”

Counter with evidence of deceit at inception: fake identity, fake proofs, inconsistent claims, immediate disappearance, multiple victims.

“I intended to deliver, but something happened.”

Counter with timeline, evasive conduct, false updates, fake tracking, refusal to refund, and pattern evidence.

“That account wasn’t mine / I was hacked.”

Counter with the payment trail (who benefited), KYC linkage (if obtained), delivery address, phone/email linkage, and consistent use of identifiers.

“Refund was made / I offered a refund.”

A later refund does not automatically erase criminal liability if deceit existed and the crime was already consummated, though it may affect perceptions of intent and may be raised in defense.

15) Practical Mistakes That Weaken Estafa Complaints

Filing with only a short narrative and a few screenshots without a clear timeline.
Not anchoring the case on the payment trail.
Cropped screenshots that omit usernames, timestamps, or context.
Treating every delayed delivery as Estafa without showing deceit at the start.
Posting accusations publicly in ways that create separate legal risks (defamation-related exposure), instead of preserving evidence and filing properly.

16) A Compact “Checklist” of What to Prepare

Complaint-Affidavit with a clear timeline.
Full chat logs/screenshots with timestamps and usernames.
Profile screenshots + URLs/handles.
Proof of payment (reference numbers, receipts, statements).
Any IDs, “proofs,” tracking numbers sent (even if fake).
Demand messages and responses/refusals (especially for entrusted funds).
Notes on any other victims/pattern evidence if available.
Copies of your government ID and proof of address (often requested for filing).

17) What a Strong Estafa Theory Looks Like (Online Scam Version)

A strong prosecutable narrative usually reads like this:

The respondent represented a specific fact (identity/authority/possession of goods/service capacity).
The representation was false and made before or at the time you transferred money.
You relied on it and transferred the money.
The respondent failed to deliver, gave false updates, or disappeared/blocked you.
You suffered loss, proven by transaction records.
The surrounding circumstances show the respondent’s intent to defraud, not a mere performance failure.