Introduction

Online scams have become one of the most common forms of fraud in the Philippines. They may involve fake online sellers, investment schemes, phishing links, hacked accounts, romance scams, cryptocurrency fraud, job scams, loan scams, fake deliveries, identity theft, unauthorized bank transfers, e-wallet fraud, marketplace scams, and impersonation through social media or messaging platforms.

When the scam is committed through the internet, mobile applications, electronic communications, online banking, social media, e-wallets, or digital platforms, the victim may seek assistance from cybercrime authorities. In the Philippines, complaints may be brought to law enforcement cybercrime units such as the Philippine National Police Anti-Cybercrime Group, the National Bureau of Investigation Cybercrime Division, or other appropriate government offices, depending on the facts.

Filing a cybercrime complaint is not merely a matter of telling the authorities that money was lost. The complainant should preserve digital evidence, identify the relevant accounts, prepare a sworn statement, document the transaction trail, and act quickly before the scammer deletes accounts, withdraws money, changes numbers, or disappears.

This article explains the legal nature of online scams, where to file, what evidence to prepare, how to draft the complaint, what happens after filing, and what practical steps victims should take in the Philippine context.

I. What Is an Online Scam?

An online scam is a fraudulent scheme carried out through electronic means. It usually involves deceit, misrepresentation, impersonation, false promises, or unauthorized access to obtain money, property, personal information, account credentials, or other benefits from a victim.

Common online scams in the Philippines include:

Fake online selling;
Bogus investment schemes;
Cryptocurrency or forex scams;
Phishing and account takeover;
Fake job recruitment;
Work-from-home task scams;
Romance scams;
Sextortion;
Fake lending apps;
Fake charity solicitations;
Fake government assistance messages;
Social media impersonation;
Fake bank or e-wallet representatives;
Unauthorized online bank transfers;
SIM-swap or OTP scams;
Marketplace scams;
Fake delivery or parcel fee scams;
Fake raffle or prize scams;
Hacked account solicitation;
Identity theft using stolen photos or documents.

An online scam may involve several offenses at once, depending on how it was committed.

II. Legal Framework

Several Philippine laws may be relevant to an online scam complaint.

A. Cybercrime Prevention Act

The Cybercrime Prevention Act penalizes certain offenses committed through information and communication technologies. It also treats some traditional crimes as cybercrimes when committed using computer systems or the internet.

For online scams, the relevant theory is often computer-related fraud, identity theft, illegal access, misuse of devices, or a traditional offense committed through ICT.

B. Revised Penal Code

The Revised Penal Code may apply where the scam amounts to estafa, swindling, falsification, usurpation of authority, grave threats, unjust vexation, or other offenses.

Many online scam complaints are legally framed as estafa or fraud committed through online means.

C. Electronic Commerce Law

Electronic documents, electronic messages, emails, screenshots, transaction records, and other digital evidence may be relevant under rules recognizing electronic evidence.

D. Data Privacy Law

If the scam involves misuse of personal information, identity theft, unauthorized disclosure, or improper processing of personal data, data privacy concerns may arise.

E. Financial and Consumer Protection Rules

If the scam involves a bank, e-wallet, lending app, credit product, securities, insurance, or investment scheme, additional complaints may be filed with the proper financial regulator or consumer protection authority.

III. Online Scam Versus Ordinary Civil Dispute

Not every failed online transaction is automatically a cybercrime.

A scam generally involves deceit from the beginning or dishonest conduct intended to obtain money or property. A simple breach of contract, delayed delivery, poor service, or refund dispute may be civil or commercial in nature unless fraud can be shown.

The distinction matters because law enforcement agencies may look for evidence of criminal intent, such as:

Fake identity;
False name or business;
Use of stolen photos;
False tracking numbers;
Multiple victims;
Blocking the buyer after payment;
Refusal to deliver despite receiving money;
Fake receipts;
Fake business permits;
Impersonation of legitimate companies;
Use of mule accounts;
Repeated solicitation using the same scheme;
Misrepresentation that induced payment.

A complaint is stronger when the evidence shows deceit, not merely non-performance.

IV. Where to File a Complaint

A victim may file a complaint with cybercrime law enforcement offices such as:

PNP Anti-Cybercrime Group;
NBI Cybercrime Division;
Local police station, which may refer the matter to the appropriate cybercrime unit;
Prosecutor’s office, when the complaint is already prepared for preliminary investigation;
Other regulatory agencies, if the scam involves banking, e-wallets, securities, lending, insurance, or consumer transactions.

The choice depends on the circumstances. If the victim needs technical cybercrime investigation, tracing of accounts, or preservation of digital evidence, a cybercrime unit is usually appropriate. If the case is already well-documented and the suspect is identifiable, the matter may later proceed to the prosecutor’s office.

V. PNP Anti-Cybercrime Group and NBI Cybercrime Division

The PNP and NBI both handle cybercrime-related complaints, but their procedures and internal intake requirements may differ.

The PNP Anti-Cybercrime Group is commonly approached for online scams, account hacking, cyber libel, online threats, phishing, identity theft, and similar complaints.

The NBI Cybercrime Division also receives cybercrime complaints and may investigate more complex or multi-jurisdictional cases.

A complainant does not usually need to know the exact legal classification before going to the cybercrime unit. The important thing is to bring organized evidence and a clear statement of facts.

VI. Act Quickly

Speed matters in online scam cases.

Scammers often:

Delete social media accounts;
Change usernames;
Dispose of SIM cards;
Withdraw funds immediately;
Transfer funds to other accounts;
Use fake or stolen identities;
Block victims;
Delete messages;
Move to new platforms;
Use multiple accounts;
Use mule bank or e-wallet accounts.

The victim should preserve evidence immediately and report the incident as soon as possible. Delay may make tracing more difficult.

VII. Immediate Steps After Discovering the Scam

A victim should take the following steps as soon as possible:

Stop sending money;
Stop sharing OTPs, passwords, IDs, or personal information;
Take screenshots of all conversations;
Save links, usernames, profile URLs, account names, and phone numbers;
Download receipts, confirmations, and bank or e-wallet records;
Record the exact date and time of each transaction;
Contact the bank, e-wallet, or payment provider to report fraud;
Request freezing, reversal, or investigation if available;
Change passwords if account compromise is involved;
Enable two-factor authentication;
Report the scam account to the platform;
Prepare a written timeline;
File a complaint with the appropriate cybercrime unit.

Do not delete conversations, even if they are embarrassing or upsetting. The full conversation may be important evidence.

VIII. Evidence to Prepare

Cybercrime complaints depend heavily on evidence. The complainant should prepare both digital and printed copies where possible.

Important evidence includes:

A. Identity and Personal Documents

Valid government ID of the complainant;
Contact information;
Proof of address, if required;
Authorization letter, if filing for another person;
Special power of attorney, if needed.

B. Communication Records

Screenshots of chat conversations;
Emails;
SMS messages;
Social media private messages;
Messenger, Viber, Telegram, WhatsApp, Instagram, TikTok, or marketplace conversations;
Call logs;
Voice messages;
Video calls or screen recordings, if available.

C. Account Details of the Scammer

Name used by the scammer;
Social media account link;
Username or handle;
Profile URL;
Profile photo;
Phone number;
Email address;
Marketplace profile;
Group or page where the offer was posted;
Website URL;
IP-related details, if available;
Bank or e-wallet account name and number;
Crypto wallet address, if applicable.

D. Payment Evidence

Bank transfer receipt;
GCash, Maya, or e-wallet transaction receipt;
Remittance center receipt;
QR code used for payment;
Account number and account name paid;
Transaction reference number;
Amount paid;
Date and time of payment;
Proof of failed delivery or non-performance;
Credit card or debit card statement, if applicable.

E. Advertisement or Offer

Screenshot of listing or post;
Product or service description;
Investment promise;
Job offer;
Fake website;
Terms promised;
Payment instructions;
“Proof” or documents sent by the scammer;
Fake IDs, permits, certificates, or screenshots provided by the scammer.

F. Proof of Loss

Total amount lost;
Items not delivered;
Bank account debits;
Unauthorized transactions;
Loan obligations created;
Damage to accounts or identity;
Related expenses.

G. Preservation Evidence

Date screenshots were taken;
Device used;
Original files;
Links copied before deletion;
Screen recordings showing profile URL and conversation;
Exported chat history, where available.

The more organized the evidence, the easier it is for investigators to evaluate the complaint.

IX. Screenshots as Evidence

Screenshots are useful, but they should be taken properly.

A good screenshot should show:

The complete message;
The sender’s name, number, username, or profile;
Date and time;
Conversation context;
Payment instructions;
Admission or promise by the scammer;
The platform used;
URL or account link, if possible.

Avoid cropping too tightly. A cropped screenshot may be questioned because it removes context.

For social media profiles, take screenshots showing the profile page, URL, username, profile photo, posts, and linked pages.

For bank or e-wallet transfers, save the official transaction receipt, not just a cropped image.

X. Importance of the URL or Profile Link

A username can be changed, but a profile link or platform account identifier may help investigators.

When possible, copy and save:

Facebook profile URL;
Marketplace listing link;
Instagram profile link;
TikTok profile link;
Telegram username and user ID if visible;
Website URL;
Email headers, if available;
Account numbers;
Phone numbers;
QR code screenshots;
Cryptocurrency wallet addresses.

If the scammer deletes the account, saved links may still help establish what account was used.

XI. Do Not Alter Evidence

Do not edit screenshots, erase messages, add labels directly on original images, or manipulate files.

It is acceptable to organize evidence into folders or printouts, but preserve originals. If you want to annotate evidence, make a separate copy and label it clearly as an annotated copy.

Altered evidence may weaken the complaint.

XII. Preparing a Timeline

A timeline helps investigators understand the case.

The timeline should include:

When and where the victim first saw the offer;
How the scammer contacted the victim;
What was promised;
What representations were made;
When payment was requested;
How payment was made;
What happened after payment;
When the victim realized it was a scam;
Efforts made to contact the scammer;
Whether the scammer blocked the victim;
Whether other victims exist;
Total loss.

A clear timeline turns scattered screenshots into a coherent complaint.

XIII. The Complaint-Affidavit

A cybercrime complaint will usually require a written complaint or complaint-affidavit. This is a sworn statement narrating the facts.

The complaint-affidavit should be truthful, chronological, and specific. It should avoid exaggeration and legal conclusions that the complainant cannot support.

It should include:

Full name of the complainant;
Address and contact details;
Description of the scam;
Platform used;
Identity or known details of the suspect;
Dates of communication;
Amount lost;
Payment method;
Evidence attached;
Acts showing fraud;
Relief requested;
Statement that the complaint is true and based on personal knowledge and records.

A complaint-affidavit is executed under oath, so false statements may have legal consequences.

XIV. Sample Complaint-Affidavit

Republic of the Philippines [City/Municipality]

COMPLAINT-AFFIDAVIT

I, [Full Name], Filipino, of legal age, residing at [address], after being duly sworn, state:

I am filing this complaint for online scam/fraud committed through [platform, such as Facebook Marketplace, Messenger, Telegram, Instagram, website, email, or e-wallet transaction].
On or about [date], I saw or received an offer from a person using the name/account [name or username]. The said person represented that [describe representation: item for sale, investment opportunity, job offer, loan assistance, bank verification, etc.].
Relying on the said representation, I communicated with the person through [platform] using the account/number [details].
The person instructed me to pay [amount] through [bank/e-wallet/remittance/crypto] to the following account:

Account Name: [name] Account Number/Mobile Number/Wallet Address: [details] Date and Time of Transfer: [details] Transaction Reference Number: [details]
I paid the amount of [amount], as shown by the attached proof of payment.
After receiving the payment, the person [failed to deliver the item, blocked me, demanded more money, sent fake tracking details, stopped responding, or other conduct].
I later discovered that the representations were false because [explain facts showing scam].
Attached to this complaint are copies of the following documents:

a. Screenshots of the conversation; b. Profile/account details of the suspect; c. Proof of payment; d. Screenshot of the advertisement or offer; e. Other supporting documents.
I am executing this complaint-affidavit to request investigation and appropriate action against the person or persons responsible.

IN WITNESS WHEREOF, I have signed this affidavit on [date] at [place].

[Signature] [Full Name]

SUBSCRIBED AND SWORN to before me this [date], affiant exhibiting competent evidence of identity.

XV. Filing the Complaint in Person

When filing in person, the complainant should bring:

Valid ID;
Printed complaint-affidavit, if already prepared;
Printed screenshots;
Digital copies in a USB drive or device, if accepted;
Original phone or device containing the messages, if available;
Proof of payment;
Bank or e-wallet transaction records;
Suspect account details;
Written timeline;
List of witnesses or other victims, if any.

The cybercrime unit may interview the complainant, review the evidence, request additional documents, and advise on next steps.

XVI. Can Someone Else File on Behalf of the Victim?

A representative may physically assist or submit documents, but the victim is usually the proper complainant because the victim personally experienced the scam and suffered the loss.

If the victim cannot appear, a representative should bring:

Authorization letter or special power of attorney;
Victim’s valid ID;
Representative’s valid ID;
Complaint-affidavit signed by the victim;
Evidence and transaction records;
Proof of relationship or authority, if relevant.

For minors, parents or legal guardians may file. For incapacitated persons, a legal guardian or authorized representative may be necessary.

XVII. Filing When the Victim Is Abroad

If the victim is abroad, they may prepare a sworn complaint before the proper authority abroad and authorize a representative in the Philippines. They should preserve digital evidence and be available for communication with investigators.

The victim should consider executing:

Complaint-affidavit;
Special power of attorney authorizing a representative;
Copies of valid IDs;
Organized evidence folder;
Written timeline.

Depending on the requirements of the receiving office, documents executed abroad may need consular acknowledgment, apostille, or other authentication.

XVIII. Reporting to Banks and E-Wallets

A cybercrime complaint should often be accompanied by immediate reporting to the bank, e-wallet, remittance center, or payment platform.

The victim should request:

Fraud investigation;
Account freezing, if possible;
Chargeback, reversal, or dispute processing, if applicable;
Preservation of transaction records;
Blocking of recipient account, where allowed;
Written acknowledgment of the report;
Case reference number.

Time is critical because scammers often withdraw funds quickly.

The victim should keep copies of all bank or e-wallet reports.

XIX. Reporting to Social Media and Online Platforms

Victims should also report the scam account to the relevant platform, such as Facebook, Instagram, TikTok, Telegram, WhatsApp, Viber, marketplace apps, e-commerce sites, or email providers.

Platform reporting may result in account suspension or preservation of data, depending on platform policy and lawful requests from authorities.

Before reporting, save evidence. Once a platform removes the account, some visible information may disappear.

XX. Filing With the Prosecutor

After investigation, the complaint may be referred to the prosecutor’s office for preliminary investigation, or the complainant may file directly with the prosecutor if the suspect is identifiable and evidence is sufficient.

A prosecutor determines whether there is probable cause to charge a person in court.

The complaint before the prosecutor may require:

Complaint-affidavit;
Supporting affidavits;
Certified or printed evidence;
Proof of payment;
Digital evidence;
Identification of respondent;
Other documents showing fraud.

If the suspect is unknown, cybercrime investigators may first need to trace accounts, request records, or identify the person behind the account.

XXI. When the Scammer Is Unknown

Many online scam complaints start with an unknown suspect.

The victim may only know:

A fake name;
A phone number;
A bank account;
An e-wallet number;
A social media profile;
A crypto wallet address;
A delivery address;
A marketplace account.

This does not automatically defeat the complaint. Cybercrime units may investigate by tracing account information, payment trails, subscriber details, device information, platform records, and other leads, subject to legal processes.

However, identification is often one of the hardest parts of online scam cases.

XXII. The Role of Subpoenas and Data Requests

Cybercrime investigators may need records from banks, e-wallets, telecom companies, platforms, internet service providers, or online marketplaces.

These records may include:

Subscriber information;
Account registration data;
Transaction history;
IP logs;
Login history;
Device identifiers;
KYC documents;
Linked phone numbers or emails;
Withdrawal records.

Such information is not usually released casually to private individuals. It may require official law enforcement requests, subpoenas, court orders, or other lawful processes.

XXIII. Preservation of Computer Data

In cybercrime cases, preservation of data may be important. Digital evidence can disappear quickly.

Authorities may seek preservation of computer data from service providers, depending on the case and applicable legal procedures.

Victims should file promptly and provide exact account identifiers, URLs, phone numbers, email addresses, and transaction references so authorities can make targeted preservation requests.

XXIV. Common Online Scam Scenarios

A. Fake Online Seller

The scammer posts an item for sale, asks for payment or reservation fee, then blocks the buyer or sends fake tracking information.

Evidence needed:

Listing screenshot;
Chat;
Payment receipt;
Seller profile;
Delivery promises;
Proof of non-delivery.

B. Investment Scam

The scammer promises unusually high returns, often through crypto, forex, trading, casino platforms, or “task” investments.

Evidence needed:

Investment pitch;
Promised returns;
Payment transfers;
Platform screenshots;
Referral messages;
Withdrawal refusal;
Identity of recruiters.

C. Phishing or OTP Scam

The victim is tricked into clicking a fake link or giving an OTP, password, or account credentials. Money is then transferred out.

Evidence needed:

Phishing message;
URL;
Unauthorized transaction records;
Bank reports;
Device logs if available;
Screenshots of fake website;
Timeline of account compromise.

D. Romance Scam

The scammer creates a romantic relationship, then asks for money for emergencies, travel, customs fees, hospital bills, or investment opportunities.

Evidence needed:

Conversations;
Money requests;
Transfer receipts;
Fake identity details;
Photos used;
Promises and excuses.

E. Job Scam

The scammer offers a job, then requires payment for processing fees, training kits, medical exams, uniforms, visa processing, or task completion.

Evidence needed:

Job post;
Offer letter;
Payment instructions;
Recruiter profile;
Receipts;
False company details.

F. Loan Scam

The scammer promises fast loan approval but asks for advance processing fees, insurance fees, verification fees, or release fees.

Evidence needed:

Loan advertisement;
Chat;
Fake approval notice;
Payment receipts;
Account details;
Refusal to release loan.

XXV. Estafa in Online Scams

Many online scams may be treated as estafa when the victim was deceived into parting with money or property.

Common elements include:

False representation or deceit;
Reliance by the victim;
Delivery of money or property because of the deceit;
Damage or prejudice to the victim.

When committed online, the offense may involve cybercrime considerations or increased seriousness because information technology was used.

Evidence should show that the scammer’s misrepresentation caused the victim to pay.

XXVI. Computer-Related Fraud

Computer-related fraud may involve unauthorized input, alteration, deletion, or suppression of computer data, or interference with computer systems, resulting in damage or fraudulent benefit.

This may apply in cases involving:

Unauthorized online bank transfers;
Manipulation of accounts;
Fake digital platforms;
Use of hacked accounts;
Unauthorized access to e-wallets;
Fraudulent online transactions;
Use of computer systems to deceive.

The exact charge depends on the facts and how the conduct fits the law.

XXVII. Identity Theft

Identity theft may occur when a scammer uses another person’s identity, photo, name, account, documents, or personal information without authority.

This is common in:

Fake seller accounts using stolen IDs;
Impersonation of public officials;
Fake bank representatives;
Hacked social media accounts asking for money;
Use of stolen photos for romance scams;
Fake business pages mimicking legitimate companies;
Fraudulent loan applications using stolen data.

Victims whose identity was used may file a complaint even if they did not lose money directly, because their identity was misused to victimize others.

XXVIII. Hacked Account Used for Scam

If a victim’s account was hacked and used to scam friends or relatives, the account owner should report the hacking immediately.

Steps include:

Recover the account;
Change passwords;
Secure email and phone number;
Notify contacts not to send money;
Save evidence of unauthorized access;
Report to the platform;
File a cybercrime complaint if necessary;
Report unauthorized transactions, if any.

The account owner may be both a victim of unauthorized access and a person whose identity was misused.

XXIX. Fake Bank or E-Wallet Representative

Scammers often pretend to be bank, e-wallet, delivery, telecom, or government representatives. They may ask for OTPs, passwords, MPINs, card details, or remote access.

Victims should remember that legitimate institutions generally do not ask for passwords or OTPs.

Evidence should include:

Caller number;
SMS or chat;
Fake link;
Exact words used;
Unauthorized transaction details;
Time of call;
Bank report;
Device screenshots.

The victim should immediately contact the official bank or e-wallet hotline through verified channels.

XXX. Unauthorized Transactions

Unauthorized transactions may involve hacking, phishing, malware, stolen credentials, SIM swap, or social engineering.

The victim should:

Report to the bank or e-wallet immediately;
Request blocking of account or card;
Change credentials;
File dispute;
Preserve transaction records;
File cybercrime complaint;
Request investigation of recipient accounts;
Monitor credit and financial accounts.

The complaint should make clear whether the victim personally authorized any transaction or was deceived into providing credentials.

XXXI. If the Victim Voluntarily Sent the Money

Many victims worry that because they voluntarily sent money, they cannot file a complaint. That is not necessarily true.

If the money was sent because of fraud, deceit, false representation, or impersonation, a criminal complaint may still be possible.

The issue is not merely whether the victim clicked “send.” The issue is whether the victim was induced to send money by fraudulent representations.

XXXII. If the Amount Is Small

A small amount does not automatically mean no complaint can be filed. Online scammers often victimize many people in small amounts.

However, practical investigation priorities may vary. A stronger complaint may show:

Multiple victims;
Repeated scheme;
Identifiable account;
Clear evidence;
Pattern of fraud;
Use of the same bank or e-wallet account;
Organized operation.

Even for small amounts, reporting helps document scam patterns and may support broader investigations.

XXXIII. If There Are Multiple Victims

Multiple victims should coordinate.

They may prepare:

Individual complaint-affidavits;
Group timeline;
Common suspect profile;
Common bank or e-wallet accounts;
List of amounts lost;
Screenshots from each victim;
Joint request for investigation.

A group complaint may show a pattern of fraudulent intent and may help authorities prioritize the case.

Each victim should still preserve their own evidence.

XXXIV. If the Scammer Offers Refund After Complaint

A scammer may offer partial refund after being reported. The victim should be cautious.

Settlement or refund does not automatically erase criminal liability, especially if the offense has already been committed. However, restitution may affect practical resolution, willingness to pursue the case, or civil claims.

If accepting a refund, the victim should:

Use traceable payment channels;
Avoid giving more personal data;
Require full payment if possible;
Avoid signing broad waivers without legal advice;
Keep written records;
Inform the investigator if a complaint is pending.

Do not withdraw a complaint hastily if there are multiple victims or serious fraud.

XXXV. Civil Recovery of Money

A cybercrime complaint may lead to investigation and prosecution, but recovering money is a separate practical challenge.

Possible ways to recover money include:

Bank or e-wallet reversal, if timely and possible;
Freezing or blocking recipient account;
Restitution by suspect;
Civil action for sum of money or damages;
Civil liability in criminal case;
Settlement agreement;
Small claims action, if appropriate;
Claim against a platform, bank, or service provider only if there is legal basis.

Filing a cybercrime complaint does not guarantee immediate refund.

XXXVI. Complaints Involving Banks and E-Wallets

If the scam involves banks or e-wallets, the victim should document every report made to the financial institution.

Important details include:

Date and time of report;
Hotline reference number;
Name or identifier of agent, if provided;
Case number;
Action requested;
Response received;
Account blocking status;
Dispute decision;
Written confirmation.

If dissatisfied, the victim may consider regulatory or consumer channels, depending on the institution and transaction type.

XXXVII. Complaints Involving Investment Schemes

If the scam involves investments, securities, crypto returns, forex trading, staking, pooled funds, or guaranteed profits, the victim may also consider reporting to the appropriate financial or corporate regulator.

Indicators of investment fraud include:

Guaranteed high returns;
Referral commissions;
Pressure to recruit;
No legitimate registration;
Fake certificates;
Fake trading dashboards;
Refusal to allow withdrawals;
Sudden disappearance of administrators;
Use of influencers or group chats;
“Top-up before withdrawal” schemes.

Evidence should include investment contracts, dashboards, group chat messages, payment records, and names of recruiters or uplines.

XXXVIII. Complaints Involving Online Lending Apps

Some scams involve fake lending apps or abusive loan collection. Others involve identity theft using loan apps.

Victims should distinguish between:

Fake loan provider taking advance fees;
Legitimate but abusive lending app;
Unauthorized loan taken using stolen identity;
Harassment by collectors;
Data privacy violations.

Depending on the facts, cybercrime, consumer protection, data privacy, and lending regulation issues may arise.

XXXIX. Complaints Involving Cryptocurrency

Crypto scams are difficult because transactions may be irreversible and wallets may be pseudonymous.

Evidence should include:

Wallet address;
Transaction hash;
Exchange used;
Screenshots of platform;
Chat records;
Investment promise;
Withdrawal refusal;
KYC information if any;
Amount and date of transfer;
Blockchain transaction record.

Victims should report quickly to the exchange or platform involved, if any. If funds were sent directly to a wallet, recovery may be difficult but reporting remains important.

XL. Complaints Involving Sextortion or Blackmail

Some online scams involve threats to release intimate photos, videos, or conversations unless money is paid.

Victims should:

Stop paying;
Preserve evidence;
Do not send more images or videos;
Block only after evidence is saved;
Report to the platform;
File a cybercrime complaint;
Seek urgent help if minors are involved;
Inform trusted persons if safety is at risk.

Sextortion may involve serious criminal offenses beyond fraud, including threats, coercion, privacy violations, and exploitation.

XLI. Complaints Involving Minors

If the victim is a minor, parents or guardians should act quickly. Cases involving minors, exploitation, sexual content, grooming, blackmail, or harassment should be treated as urgent.

Authorities may apply special child protection laws in addition to cybercrime laws.

Evidence should be preserved carefully, but illegal sexual material involving minors should not be distributed or reposted. The matter should be reported to proper authorities immediately.

XLII. Avoid Public Shaming Without Legal Advice

Victims often want to post the scammer’s name, face, account number, or personal details online. While warning others may feel necessary, public accusations can create risks, especially if the identity is uncertain or the information belongs to a mule account or identity theft victim.

Possible risks include:

Defamation or cyber libel allegations;
Misidentification;
Harassment claims;
Interference with investigation;
Data privacy issues.

A safer approach is to file the complaint, report to platforms and financial institutions, and share warnings in factual, careful language without unsupported accusations.

XLIII. Demand Letter Before Filing

A demand letter is not always required before filing a cybercrime complaint. In some cases, sending a demand may alert the scammer and cause deletion of evidence or movement of funds.

However, in cases where the issue may be a civil dispute or delayed delivery, a demand letter can help show that the other party refused to perform or refund despite notice.

A demand letter should:

Identify the transaction;
State the amount paid;
Demand delivery or refund;
Set a reasonable deadline;
Preserve rights;
Avoid threats or defamatory language.

If the scam is obvious, immediate reporting may be better than prolonged negotiation.

XLIV. Sample Demand Message

Subject: Demand for Refund / Completion of Transaction

This refers to my payment of [amount] sent on [date] to [account name and number] for [item/service/investment/job processing/etc.].

Despite receipt of payment, you have failed to [deliver/refund/process/perform] as promised. I demand that you refund the amount of [amount] or complete the agreed transaction within [period].

This demand is made without prejudice to my right to file complaints with the proper authorities and pursue all legal remedies.

[Name]

XLV. What Happens After Filing?

After filing, authorities may:

Review the complaint;
Interview the complainant;
Examine digital evidence;
Request additional documents;
Identify the suspect;
Coordinate with banks, platforms, or telecoms;
Preserve electronic data;
Trace payment accounts;
Prepare investigation reports;
Refer the matter for inquest or preliminary investigation if a suspect is identified;
Assist in filing before the prosecutor.

The complainant may be asked to return for supplemental statements or to identify the suspect.

XLVI. Preliminary Investigation

If the case proceeds to preliminary investigation, the prosecutor will determine whether there is probable cause.

The respondent may be required to file a counter-affidavit. The complainant may submit a reply-affidavit. The prosecutor may then dismiss the complaint or file charges in court.

The complainant should attend hearings, submit required documents, and keep contact details updated.

XLVII. Arrest and Entrapment

In some cases, if the scammer is still communicating and demanding more money, authorities may consider lawful entrapment operations.

A victim should not conduct dangerous meetups or vigilante operations alone. Coordination with law enforcement is essential.

Entrapment is different from instigation. Law enforcement must follow legal procedures.

XLVIII. Jurisdiction and Venue

Cybercrime cases can involve victims, suspects, servers, platforms, and banks in different locations. The complaint may be filed where the victim resides, where the transaction occurred, where the money was sent, where the suspect may be located, or where the harmful effect occurred, depending on procedural rules and law enforcement practice.

Cybercrime units are familiar with cross-location issues. The victim should provide all known addresses and locations.

XLIX. If the Scammer Is Abroad

If the scammer appears to be outside the Philippines, the case becomes more difficult but not necessarily impossible.

Authorities may need to coordinate with foreign platforms, foreign law enforcement, or international channels. Practical recovery may be difficult, especially if funds were moved abroad or converted to crypto.

Victims should still report the incident, especially if the scam uses Philippine bank accounts, e-wallets, SIM cards, or local accomplices.

L. Mule Accounts

Many scammers use “mule accounts” belonging to other people. The named bank or e-wallet account holder may claim they were also deceived, paid to lend an account, or unaware of the scam.

However, receiving funds into an account is still an important investigative lead.

The complaint should identify the account used but avoid assuming too much without evidence. The account holder may be a suspect, accomplice, negligent participant, or another victim, depending on the facts.

LI. SIM Cards and Phone Numbers

Phone numbers used in scams are important evidence. Even prepaid numbers may be traceable through registration records, usage patterns, linked accounts, or transaction history, subject to lawful procedures.

Victims should save:

Phone number;
Call logs;
SMS messages;
Messaging app screenshots;
Date and time of calls;
Any voice recordings, if lawfully obtained;
Linked e-wallet or account details.

LII. Notarization of Complaint-Affidavit

A complaint-affidavit must usually be sworn before a notary public or authorized officer. The complainant should personally sign and swear to the truth of the affidavit.

The notary will usually require a valid ID. The affidavit should have attachments properly marked or described.

If the complaint is prepared at the cybercrime office, the authorities may guide the complainant on oath requirements.

LIII. Digital Evidence and the Rules on Electronic Evidence

Digital evidence may be accepted if properly presented and authenticated. The complainant should be prepared to explain:

How the screenshots were obtained;
What device was used;
Whether the account belongs to the complainant;
Whether the screenshots accurately reflect the messages received;
Whether the files were altered;
How payment records were obtained;
Whether original data remains available.

The original device may be useful, especially where authenticity is questioned.

LIV. Chain of Custody and Preservation

For serious cases, preserving the integrity of electronic evidence matters.

Practical preservation tips include:

Keep the original phone;
Do not reset the device;
Back up messages;
Export chats where possible;
Save screenshots in original format;
Save receipts as PDF where possible;
Keep emails with full headers if possible;
Do not delete scammer accounts from chat lists;
Record URLs and usernames;
Keep a separate evidence folder;
Make duplicate backups.

The goal is to show that the evidence is reliable.

LV. Witnesses

Other witnesses may strengthen the complaint.

Witnesses may include:

Other victims;
Person who introduced the scammer;
Bank or remittance personnel;
Family member who saw the transaction;
Marketplace group administrator;
Delivery personnel;
IT personnel who helped recover a hacked account;
Employer or coworker in job scam cases.

Witnesses may execute supporting affidavits if necessary.

LVI. Common Mistakes by Complainants

Victims should avoid:

Deleting conversations after being scammed;
Sending more money to “recover” previous money;
Negotiating endlessly while evidence disappears;
Posting accusations without filing a complaint;
Relying only on screenshots with no transaction proof;
Failing to save account URLs;
Losing transaction reference numbers;
Not reporting to the bank or e-wallet immediately;
Assuming the account name is the real mastermind;
Failing to attend follow-up proceedings;
Exaggerating facts in the affidavit;
Submitting altered screenshots;
Ignoring prosecutor notices;
Failing to coordinate with other victims;
Waiting too long before reporting.

LVII. What If the Cybercrime Unit Says It Is a Civil Matter?

Sometimes authorities may advise that the matter appears civil rather than criminal. This may happen when the evidence shows a business dispute, delayed delivery, or unclear fraudulent intent.

The complainant may still:

Provide additional evidence of deceit;
Show other victims;
Show fake identity or misrepresentation;
Show blocking after payment;
Show pattern of scam;
File a civil claim;
Seek legal advice;
File directly with the prosecutor if legally appropriate.

The key is to establish fraud, not merely non-payment or non-delivery.

LVIII. Small Claims as an Alternative or Additional Remedy

If the suspect is known and the issue is recovery of money, small claims may be considered for civil recovery, subject to jurisdictional rules and claim limits.

Small claims may be useful when:

The amount is within the allowable threshold;
The respondent is identifiable;
There is proof of payment;
The claim is primarily for money;
The victim wants recovery rather than criminal prosecution.

However, small claims may not be effective if the scammer used fake identity or cannot be located.

LIX. Data Privacy Complaint

If the scam involved misuse of personal data, unauthorized disclosure, identity theft, or unlawful processing of personal information, a data privacy complaint may also be considered.

Examples include:

Lending app harvesting contacts;
Unauthorized posting of ID photos;
Use of stolen identity documents;
Public shaming of debtors;
Fake accounts using personal information;
Phishing that collected sensitive data.

A data privacy remedy does not replace a cybercrime complaint but may supplement it.

LX. Consumer and Platform Complaints

For marketplace, e-commerce, delivery, or service-provider scams, the victim may also file complaints with the platform or relevant consumer agency.

This may help:

Suspend the seller account;
Preserve records;
Trigger internal investigation;
Recover payment under buyer protection policies;
Identify the seller;
Prevent more victims.

Victims should keep copies of all platform tickets and responses.

LXI. If the Scam Involved a Registered Business

If the scammer used a registered business name, corporation, or online store, the victim should gather business details:

Business name;
SEC or DTI registration, if any;
Business permit, if shown;
Official address;
Names of officers;
Website;
Social media pages;
Receipts or invoices;
Bank account names;
Delivery information.

A registered business does not automatically mean the transaction is legitimate. Fake registration documents may also be used.

LXII. If the Scammer Used Fake IDs or Documents

Scammers often send IDs, permits, passports, driver’s licenses, business registrations, or authorization letters to appear legitimate.

Victims should preserve these documents, but avoid publicly posting them because they may belong to identity theft victims.

Fake or stolen IDs may support charges involving identity theft, falsification, or fraud.

LXIII. Cyber Libel Concerns When Warning Others

Victims should be careful when posting public warnings.

Safer wording focuses on facts:

“I paid this account on this date for this item and did not receive the item.”
“I have filed a complaint and am looking for other victims.”
“Please verify before transacting.”

Riskier wording includes unsupported accusations, insults, or claims about persons whose identity is uncertain.

Because online statements can themselves lead to disputes, official reporting is safer than public retaliation.

LXIV. Settlement and Affidavit of Desistance

If the scammer refunds the money, the complainant may be asked to sign an affidavit of desistance. This should be handled carefully.

Before signing, consider:

Was full restitution made?
Are there other victims?
Is the case already filed with the prosecutor or court?
Does the affidavit contain false statements?
Are you being pressured?
Are you waiving civil claims?
Are you admitting something inaccurate?
Is legal advice needed?

An affidavit of desistance does not always automatically terminate criminal proceedings, especially if public interest is involved.

LXV. Prescription

Criminal offenses have prescriptive periods. Victims should not delay filing. The applicable period depends on the offense charged and the penalty provided by law.

Even if the victim is uncertain about the precise offense, early reporting helps preserve evidence and avoids prescription issues.

LXVI. Costs of Filing

Filing a complaint with law enforcement generally should not require payment to fixers or unofficial intermediaries.

Possible legitimate costs may include:

Photocopying;
Printing;
Notarization;
Transportation;
Authentication of documents;
Legal assistance, if privately hired.

Victims should not pay anyone who promises guaranteed arrest, guaranteed refund, or special processing.

LXVII. Legal Assistance

Victims may seek help from:

Private lawyers;
Public Attorney’s Office, if qualified;
Law school legal aid clinics;
Integrated Bar of the Philippines legal aid programs;
Consumer protection desks;
Barangay assistance for preliminary documentation, where appropriate;
Cybercrime help desks.

Legal assistance is especially useful when the amount is large, the case involves multiple victims, the scammer is known, the matter involves banks or businesses, or the victim receives counter-threats.

LXVIII. Practical Evidence Folder Format

A complainant may organize evidence as follows:

Folder 1: Identity and Complaint

Valid ID;
Complaint-affidavit;
Timeline;
Contact details.

Folder 2: Scammer Identity

Profile screenshots;
URLs;
Phone numbers;
Email addresses;
Account names;
Marketplace links.

Folder 3: Conversations

Chat screenshots in chronological order;
Exported chat files;
Call logs;
SMS screenshots.

Folder 4: Payment Records

Receipts;
Bank statements;
E-wallet confirmations;
Transaction reference numbers;
QR codes.

Folder 5: Scam Offer

Advertisement;
Product listing;
Investment pitch;
Job post;
Fake website;
Fake documents.

Folder 6: Follow-Up and Reports

Bank reports;
Platform reports;
Police or cybercrime acknowledgments;
Emails and ticket numbers;
Other victims’ information.

This organization makes the complaint easier to assess.

LXIX. Sample Evidence Index

Evidence Index

Annex “A” – Screenshot of Facebook Marketplace listing dated [date];
Annex “B” – Screenshot of conversation with account [name] dated [date];
Annex “C” – Payment instruction sent by suspect;
Annex “D” – GCash receipt showing payment of ₱[amount];
Annex “E” – Screenshot showing suspect blocked complainant;
Annex “F” – Screenshot of suspect profile and URL;
Annex “G” – Bank/e-wallet fraud report reference number;
Annex “H” – Timeline of events.

Marking evidence helps the investigator and prosecutor follow the story.

LXX. Sample Timeline

Timeline of Events

May 1, 2026, 9:00 AM – I saw a laptop for sale on Facebook Marketplace posted by account “Juan Shop.”
May 1, 2026, 10:15 AM – I messaged the seller and asked if the item was available.
May 1, 2026, 11:00 AM – Seller told me to pay ₱8,000 as full payment through GCash number [number].
May 1, 2026, 11:20 AM – I sent ₱8,000 to the GCash account under the name [name].
May 1, 2026, 2:00 PM – Seller sent a supposed tracking number.
May 2, 2026 – Tracking number could not be verified.
May 3, 2026 – Seller stopped replying.
May 4, 2026 – Seller blocked me.
May 5, 2026 – I reported the transaction to GCash and prepared this complaint.

LXXI. Sample Request to Bank or E-Wallet

Subject: Report of Fraudulent Transaction and Request for Assistance

Dear [Bank/E-Wallet Provider],

I am reporting a fraudulent transaction involving my account.

On [date and time], I transferred ₱[amount] to [recipient account name and number] with transaction reference number [reference number]. The transfer was made because I was deceived by a person using [platform/account] in connection with [brief description].

I request immediate investigation, preservation of records, and appropriate action, including blocking or freezing of the recipient account if allowed by law and your procedures. I also request written acknowledgment of this report and the assigned case/reference number.

Attached are copies of the transaction receipt and relevant screenshots.

Thank you.

[Name] [Contact Details]

LXXII. Sample Platform Report Text

Report Type: Scam / Fraud

This account appears to be involved in an online scam. I paid ₱[amount] on [date] for [item/service/investment] after communicating with this account. After receiving payment, the account failed to deliver, stopped responding, and blocked me. I have preserved screenshots and payment records and intend to file a complaint with the proper authorities.

Account URL: [URL] Payment account used: [details]

LXXIII. What Relief to Request

In the complaint, the victim may request:

Investigation of the online scam;
Identification of the suspect;
Preservation of digital evidence;
Coordination with banks, e-wallets, telecoms, and platforms;
Filing of appropriate charges;
Recovery or restitution, where possible;
Assistance in securing evidence for prosecution;
Protection if threats or harassment occurred.

The victim should understand that law enforcement cannot always guarantee recovery of money, but prompt action increases the chance of tracing funds.

LXXIV. Cybersecurity Steps After the Scam

The victim should also protect themselves from further harm.

Recommended steps:

Change passwords;
Enable two-factor authentication;
Check email recovery settings;
Log out of unknown devices;
Freeze or replace compromised cards;
Monitor bank and e-wallet accounts;
Report SIM or phone compromise;
Scan devices for malware;
Avoid clicking follow-up links;
Warn contacts if account was hacked;
Avoid communicating further with the scammer except under advice.

Scammers often retarget victims with “recovery scams,” pretending they can recover lost funds for another fee.

LXXV. Recovery Scams

After being scammed, victims may be contacted by people claiming they can recover the money, trace the scammer, hack the account, or guarantee refund for a fee. These are often additional scams.

Warning signs include:

Upfront recovery fee;
Claim of special access to police or banks;
Request for OTP or passwords;
Promise of guaranteed refund;
Use of fake lawyer or investigator identity;
Pressure to pay quickly;
Refusal to provide verifiable credentials.

Victims should rely on official law enforcement, banks, platforms, and legitimate legal counsel.

LXXVI. Checklist Before Going to the Cybercrime Unit

Bring or prepare:

Valid ID;
Complaint-affidavit or draft narrative;
Printed screenshots;
Digital copies of evidence;
Original device, if available;
Payment receipts;
Bank or e-wallet report reference number;
Scammer profile URL;
Phone numbers and account details;
Written timeline;
List of witnesses or other victims;
Authorization documents, if filing for someone else.

LXXVII. Key Principles

The following principles summarize online scam complaints in the Philippines:

Preserve evidence before reporting accounts.
Save URLs, usernames, account numbers, and transaction references.
Report immediately to banks or e-wallets.
File promptly with cybercrime authorities.
Prepare a clear complaint-affidavit.
Show deceit, not merely failed delivery or breach of contract.
Keep original digital evidence.
Avoid public accusations that may create legal risk.
Coordinate with other victims where possible.
Do not pay “recovery agents.”
Attend follow-up proceedings.
Recovery of money is not guaranteed, but early action helps.

Conclusion

Filing a complaint for an online scam with the cybercrime unit in the Philippines requires prompt action, organized evidence, and a clear sworn narrative. The victim should preserve conversations, screenshots, account links, payment receipts, transaction references, and platform details before the scammer deletes or changes them. The complaint should explain how the victim was deceived, how payment was made, what loss was suffered, and what online accounts or digital tools were used.

The proper authorities may include the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, local police offices, prosecutors, and relevant regulators depending on the nature of the scam. At the same time, the victim should immediately notify banks, e-wallets, platforms, and service providers to attempt blocking, preservation, reversal, or investigation.

An online scam case is strongest when the evidence shows fraudulent intent: fake identity, false representation, payment induced by deceit, blocking after payment, multiple victims, or use of fraudulent accounts. While filing a complaint does not guarantee immediate recovery of funds, it creates an official record, enables investigation, may help identify suspects, and supports criminal, civil, or regulatory remedies.