Online extortion and grave threats committed through digital platforms have proliferated in the Philippines alongside the widespread use of social media, messaging applications, email, and other information and communications technology (ICT) tools. These acts are criminalized primarily under the Revised Penal Code of the Philippines (Act No. 3815, as amended) and are subject to heightened penalties and special procedural rules when committed by, through, or with the use of ICT under Republic Act No. 10175, otherwise known as the Cybercrime Prevention Act of 2012.

Legal Framework and Definitions

Grave Threats (Article 282, Revised Penal Code)
Any person who threatens another with the infliction upon the person, honor, or property of the latter or of his family of any wrong amounting to a crime shall be liable. The threat may be verbal, written, or conveyed through a middleman or electronic means.

The elements are:

The offender makes a threat.
The threat is to inflict a wrong amounting to a crime on the person, honor, or property of the offended party or his family.
The threat is serious and not merely a joke or idle remark.

Special rules apply when the threat demands money or imposes any other condition (even if not unlawful). If the offender attains his purpose, the penalty is higher; if not attained, a lower but still correctional penalty applies.

When the same threat is made using a computer system, network, or any ICT facility, Section 6 of R.A. 10175 automatically applies: the penalty provided in the Revised Penal Code is increased by one degree. Thus, a base penalty of arresto mayor becomes prision correccional in its minimum period, and a base penalty of prision correccional becomes prision mayor in its minimum period, with corresponding increases in fines where applicable. This elevation also lengthens the prescriptive period of the offense.

Online Extortion
Extortion in the digital context typically involves demanding money, property, sexual favors, or any other valuable consideration under threat of harm. Common modalities include:

Sextortion (threat to release intimate images or videos).
Threat to expose alleged compromising information or to harm the victim’s reputation or family.
Ransomware-style demands after alleged hacking or data theft.
“Love scam” or investment frauds that escalate into threats.

These acts are prosecuted as grave threats under Article 282 in relation to Section 6 of R.A. 10175. Where money or property has already been obtained through the threat, prosecutors may also charge the underlying felony of robbery (Articles 293–294) or estafa (Article 315) in relation to the Cybercrime Prevention Act, depending on the facts. If the threat involves the actual commission of another cyber offense (e.g., illegal access under Section 4(a)(1) of R.A. 10175), multiple charges may be filed.

Other Related Laws

R.A. 9995 (Anti-Photo and Video Voyeurism Act of 2009) – when intimate images obtained without consent are threatened to be released.
R.A. 11313 (The Safe Spaces Act) – for gender-based online sexual harassment that may accompany threats.
R.A. 9775 (Anti-Child Pornography Act) and R.A. 11930 (Anti-Online Sexual Abuse or Exploitation of Children Act) – when minors are involved.
Civil liability for damages (actual, moral, exemplary) may be claimed under Articles 19, 20, 21, and 2176 of the Civil Code, either in the criminal action or in a separate civil suit.

Penalties

After the one-degree increase under R.A. 10175:

Base arresto mayor (1 month and 1 day to 6 months) becomes prision correccional minimum (6 months and 1 day to 2 years and 4 months).
Base prision correccional becomes prision mayor minimum (6 years and 1 day to 8 years).
Fines are likewise increased. Aggravating circumstances (e.g., threat against a minor, threat made by a public officer, or threat accompanied by actual harm) further increase the penalty. Accessory penalties such as perpetual or temporary disqualification may also attach.

Prescription periods are governed by Article 90 of the Revised Penal Code as modified by the increased penalty. Offenses punishable by prision mayor prescribe in 15 years; those punishable by prision correccional prescribe in 10 years. Prompt filing is essential because digital evidence can disappear and accounts can be deactivated.

Evidence Requirements

Digital evidence is crucial. Acceptable forms include:

Screenshots of chat conversations, direct messages, emails, or posts showing the threat and demand (include visible timestamps, usernames/handles, profile pictures, and full context).
Original chat logs or exported conversation histories from messaging apps.
Call detail records or voice messages.
Bank or e-wallet transaction receipts, deposit slips, or blockchain records if money was paid.
IP addresses, device identifiers, or metadata (EXIF data) when obtainable.
Affidavits of witnesses who saw the messages or were present during incidents.
Expert forensic reports from the PNP or NBI Digital Forensic Laboratory (hash values, chain-of-custody documentation).

Preservation Rules
Under R.A. 10175, law enforcement authorities may issue a preservation request to service providers (social media platforms, telecoms, banks) requiring them to retain traffic data and subscriber information for up to six months (extendable). Victims should immediately report to the PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division so that formal preservation orders can be issued before data is deleted.

Step-by-Step Procedure to File a Case

Step 1: Secure and Preserve Evidence
Do not delete messages, block the account prematurely (unless safety requires it), or engage further with the suspect in a way that destroys evidence. Take multiple screenshots and back them up on different devices or cloud storage with timestamps. Label each piece of evidence (Annex “A”, Annex “B”, etc.). Prepare a chronological narrative of events.

Step 2: Report to Law Enforcement
File a complaint at any PNP station, preferably the nearest Anti-Cybercrime Group unit or the PNP ACG headquarters. Alternatively, file directly with the NBI Cybercrime Division.
Bring: valid ID, printed and digital copies of all evidence, and a draft narrative.
The police will:

Record the incident in the police blotter.
Issue a referral or endorsement for further investigation.
Coordinate with service providers for subscriber information and data preservation.
Conduct digital forensics if needed.

For complex or cross-border cases, the NBI or the Department of Justice Office of Cybercrime may assume lead investigation.

Step 3: Execute a Complaint-Affidavit
Prepare a sworn Complaint-Affidavit containing:

Complete personal circumstances of the complainant.
Detailed narration of facts (dates, times, platforms used, exact words of the threat and demand, how the threat was received).
Identification of the respondent (username, profile link, any known real name or address).
List of annexed evidence.
Prayer for the conduct of preliminary investigation and filing of appropriate charges.

The affidavit must be subscribed and sworn to before a prosecutor, notary public, or authorized police officer.

Step 4: File with the Office of the Prosecutor
Submit the Complaint-Affidavit and evidence to the Office of the City or Provincial Prosecutor having jurisdiction. Venue lies where the offense was committed or where any essential element occurred (e.g., where the threatening message was received or where the complainant resides and suffered damage). For cybercrimes, R.A. 10175 and Supreme Court circulars allow filing in the place where the computer system used by the offender is located, where data was sent or received, or where damage was sustained.

The prosecutor dockets the case and conducts preliminary investigation under Rule 112 of the Revised Rules of Criminal Procedure.

Step 5: Preliminary Investigation
The prosecutor issues a subpoena to the respondent together with a copy of the complaint and evidence. The respondent has ten (10) days (extendable) to file a counter-affidavit and supporting evidence.
The prosecutor may:

Dismiss the complaint for lack of probable cause.
Find probable cause and file an Information in the Regional Trial Court (RTC) designated to handle cybercrime cases.
In cases involving bailable offenses, recommend bail; for non-bailable or when flight risk exists, recommend no bail or issuance of a warrant of arrest.

Step 6: Court Proceedings
Once the Information is filed and raffled to an RTC cybercrime court:

Arraignment and pre-trial.
Trial on the merits (presentation of evidence, cross-examination, digital forensic testimony).
Judgment. Conviction requires proof beyond reasonable doubt.
Appeal to the Court of Appeals and, ultimately, the Supreme Court on questions of law.

Special Considerations in Online Cases

Anonymity and Identification of Offenders
Perpetrators often use fake accounts, VPNs, or foreign SIM cards. Law enforcement can obtain subscriber information and traffic data through court orders or warrants served on platforms and telecom providers. International cooperation is available through mutual legal assistance treaties (MLATs) and ASEAN mechanisms when the offender is abroad.

Data Privacy and Chain of Custody
All digital evidence must maintain integrity. Forensic examiners use write-blockers and generate cryptographic hash values. Complainants should avoid altering original files.

Protection of the Victim
If the victim fears for personal safety or that of family members, immediate police assistance for security measures may be requested. In appropriate cases involving women or children, remedies under R.A. 9262 (Anti-Violence Against Women and Their Children Act) or R.A. 7610 may be explored in addition to the cybercrime charge.

Civil Action
The offended party may file a separate civil action for damages or reserve the right to do so in the criminal case. Actual damages include money extorted; moral damages cover mental anguish, fright, and serious anxiety; exemplary damages may be awarded to deter similar conduct.

Practical Tips for Victims and Practitioners

Act immediately—digital footprints fade quickly.
Avoid negotiating or paying the extortionist unless advised by counsel and coordinated with law enforcement (payment can sometimes be used as evidence of the threat’s gravity).
Report the account to the platform’s abuse or safety center for possible suspension or takedown.
If indigent, avail of free legal assistance from the Public Attorney’s Office (PAO).
Keep all communications with law enforcement and prosecutors documented.
For cases involving minors or large-scale operations, coordinate early with the DOJ Office of Cybercrime or specialized units.

Filing a case for online extortion and grave threats requires meticulous evidence preservation, prompt reporting to specialized cybercrime units, and strict adherence to the procedural rules of preliminary investigation and trial. The combination of the Revised Penal Code’s substantive provisions with the procedural and penalty enhancements of R.A. 10175 provides victims with effective legal remedies when the proper steps are followed. Success depends heavily on the quality and integrity of digital evidence and the timely involvement of trained cybercrime investigators and prosecutors.