If you were scammed online, threatened through social media, impersonated, hacked, blackmailed with intimate photos, or harassed by someone using a phone number or online account, you can report the incident to the Philippine National Police Anti-Cybercrime Group (PNP ACG). The strongest complaints are not just emotional narratives; they are organized, evidence-backed reports that help investigators identify the account, device, transaction trail, platform, or person behind the cybercrime. This guide explains what the PNP Cybercrime Group handles, what laws may apply, what documents to prepare, how to file the complaint, and what usually happens after you report.

What the PNP Cybercrime Group Does

The PNP Anti-Cybercrime Group is the specialized police unit that investigates cybercrimes and cyber-related offenses in the Philippines. Under the Cybercrime Prevention Act of 2012, the PNP and the National Bureau of Investigation (NBI) are the main law enforcement authorities responsible for cybercrime enforcement, and each is expected to have cybercrime units handled by trained investigators. (Supreme Court E-Library)

The PNP ACG commonly handles complaints involving:

Online selling scams
Investment scams promoted through Facebook, Telegram, WhatsApp, Viber, TikTok, or websites
Hacking or unauthorized access to accounts
Identity theft or fake accounts using your name, photos, or business identity
Phishing, smishing, and fraudulent links
GCash, Maya, bank, crypto, or remittance-related scams
Sextortion or blackmail using intimate photos or videos
Online threats, stalking, harassment, and doxxing
Cyberlibel or defamatory posts made online
Unauthorized posting or sharing of private images
Child online sexual abuse or exploitation materials
Use of mule accounts, fake SIMs, and social engineering schemes

For urgent scams where money may still be recoverable, reporting to the PNP ACG should be done together with immediate reports to the bank, e-wallet provider, or payment platform. The Cybercrime Investigation and Coordinating Center (CICC) also operates the government anti-scam hotline 1326, with alternate mobile numbers published for Smart, Globe, and DITO users. (ScamWatch Pilipinas)

Legal Basis for Cybercrime Complaints in the Philippines

The main law is Republic Act No. 10175, or the Cybercrime Prevention Act of 2012. It penalizes cybercrime offenses such as illegal access, illegal interception, data interference, system interference, misuse of devices, cybersquatting, computer-related forgery, computer-related fraud, computer-related identity theft, cybersex, child pornography committed through a computer system, and online libel. (Lawphil)

RA 10175 also covers crimes under the Revised Penal Code and special penal laws when committed “by, through, and with the use of” information and communications technology. In practical terms, an ordinary offense like estafa, grave threats, unjust vexation, coercion, or libel may become cyber-related when the internet, a mobile phone, social media, email, online banking, or a computer system is used. The law generally imposes a penalty one degree higher for covered crimes committed through ICT, subject to constitutional limits and Supreme Court rulings. (Supreme Court E-Library)

Other laws may also apply depending on the facts:

Situation	Possible Philippine law involved
Online scam, fake seller, fake investment, phishing, account takeover	RA 10175; Revised Penal Code Article 315 on estafa; RA 12010 or the Anti-Financial Account Scamming Act
Mule accounts, social engineering, buying or selling financial accounts	RA 12010, the Anti-Financial Account Scamming Act
Fake account using your identity	RA 10175 on computer-related identity theft; Civil Code Articles 26 and 32 may also support civil claims in proper cases
Defamatory Facebook post, TikTok video, blog post, or online article	RA 10175 cyberlibel in relation to Revised Penal Code Articles 353 and 355
Threats through Messenger, SMS, email, or chat	Revised Penal Code provisions on threats or coercions, in relation to RA 10175 if ICT was used
Unauthorized sharing of intimate images	RA 9995, the Anti-Photo and Video Voyeurism Act; RA 11313 Safe Spaces Act; RA 10175 if committed online
Online sexual harassment	RA 11313, the Safe Spaces Act, and possibly RA 10175
Child sexual abuse or exploitation online	RA 11930 and RA 9775, as applicable, plus RA 10175
Fraudulent SMS or calls using SIMs	RA 11934, the SIM Registration Act, plus RA 10175 or RA 12010 depending on the scam

For online libel, the Supreme Court in Disini v. Secretary of Justice upheld cyberlibel only as applied to the original author of the post, not to people who merely receive, react to, or share without being the original author in the sense punished by the law. (Lawphil) The Court has also clarified in later rulings that cyberlibel prescribes in one year from discovery, not 12 or 15 years, which makes delay especially risky in online defamation complaints. (Supreme Court of the Philippines)

What to Do Immediately Before Filing

Before going to the PNP ACG, secure yourself and preserve evidence. Many cybercrime cases become harder to investigate because the victim deleted messages, blocked the suspect too early, lost URLs, reset the phone without backup, or waited until platform records disappeared.

1. Stop the continuing damage

If money was taken:

Call your bank, e-wallet, remittance company, or payment app immediately.
Ask for a case number or ticket number.
Request freezing, reversal, chargeback, or temporary holding of funds if available.
Save the name of the agent, date, time, and reference number of your report.
Report to CICC hotline 1326 if the scam is active or funds may still move.

RA 12010, the Anti-Financial Account Scamming Act, specifically targets financial account scamming, including money muling and social engineering schemes involving financial accounts. This is important for victims of phishing, fake bank calls, e-wallet takeovers, and mule-account scams. (Lawphil)

If your account was hacked:

Change passwords from a clean device.
Enable two-factor authentication.
Log out of all sessions.
Save security emails from Facebook, Google, Apple, Microsoft, banks, or e-wallets.
Do not delete the hacked messages or login alerts.

If there are threats of physical harm, stalking, extortion, or sexual blackmail, consider also reporting to the nearest police station or calling emergency services. The PNP ACG can investigate the online component, but immediate safety may require local police assistance.

2. Preserve digital evidence properly

Screenshots are helpful, but they are often not enough. Investigators need details that connect the incident to a person, account, phone number, device, transaction, or platform record.

Save:

Full screenshots showing the sender’s name, username, profile photo, date, and time
The URL or link to the account, post, marketplace listing, group, page, or website
Chat exports where available
Email headers for phishing emails
Transaction receipts, reference numbers, QR codes, bank account numbers, e-wallet numbers, crypto wallet addresses, and remittance tracking numbers
Delivery waybills, courier tracking numbers, and seller details
Caller ID screenshots and SMS logs
Screen recordings showing how the profile, post, or conversation is accessed
Photos of product listings, advertisements, fake IDs, or fake permits sent to you
Any admission by the suspect
Names and contact details of witnesses or other victims

Do not crop screenshots if the missing parts show the date, time, URL, or account name. Do not annotate the only copy. Keep the original files and make separate copies for printing.

3. Do not “hack back” or threaten the suspect

Victims sometimes try to recover money by threatening to expose the suspect, accessing the suspect’s account, pretending to be someone else, or sending malware. This can weaken the complaint and may create legal exposure for the victim. Preserve evidence, report promptly, and let investigators handle lawful tracing and requests to platforms or service providers.

Where to File a Complaint with the PNP Cybercrime Group

You may file or initiate a report through the following routes:

Filing route	Best for	Practical notes
PNP ACG headquarters or regional anti-cybercrime unit	Formal complaints with documents and evidence	Bring printed and digital copies. You may be interviewed and asked to execute a sworn statement.
Nearest police station	Urgent threats, safety concerns, or victims far from an ACG office	Ask if they can refer or coordinate with the PNP ACG or cybercrime desk.
PNP ACG email or official online complaint channel	Initial reporting, OFWs, foreigners abroad, or victims needing guidance	The PNP ACG contact email commonly published by government sources is acg@pnp.gov.ph; the official e-complaint page has also been referenced in government responses. (www.foi.gov.ph)
CICC hotline 1326	Active scams, phishing, suspicious SMS, or fast-moving cyber fraud	Useful for immediate coordination and anti-scam reporting, but it does not replace a full complaint-affidavit when prosecution is needed.
NBI Cybercrime Division	Complex, syndicated, high-value, or transnational cases	The NBI’s citizen charter describes walk-in cybercrime complaint intake, interview, sworn statements, and no filing fee for that service. (National Bureau of Investigation)

Government-published contact references list the PNP ACG through Camp Crame, Quezon City, email acg@pnp.gov.ph, and telephone/mobile contact channels, although numbers and local assignments may change. Always verify through official government pages before sending sensitive documents. (Philippine Competition Commission)

Documents to Prepare

Bring both printed copies and digital copies. A clean folder makes the investigator’s work easier and reduces repeated follow-ups.

Requirement	What to prepare
Valid ID	Government ID, passport, driver’s license, UMID, national ID, PRC ID, or other accepted identification
Complaint-affidavit or sworn statement	A detailed narration of what happened, signed and sworn before a notary public, prosecutor, or authorized officer
Evidence index	A numbered list of screenshots, receipts, links, and files
Screenshots and printouts	Include URLs, timestamps, usernames, account IDs, and full conversation context
Digital files	Save in USB, external drive, or cloud folder; keep original files on your device
Proof of payment or loss	Bank statements, GCash/Maya receipts, Instapay/PESONet confirmations, remittance slips, crypto transaction hashes
Platform details	Facebook profile link, Telegram username, TikTok handle, email address, website domain, phone number
Prior reports	Bank ticket number, e-wallet complaint number, platform report, barangay/police blotter if any
Authority to represent	SPA, board secretary’s certificate, or authorization letter if filing for a company or another person
For minors	Birth certificate or proof of guardianship; parent or legal guardian should usually assist

A complaint-affidavit should answer:

Who are you?
Who is the suspect, if known?
What happened?
When and where did each important event happen?
What account, phone number, email, website, or device was used?
How much money was lost, or what harm was suffered?
What evidence supports each fact?
What immediate actions did you take?
What do you want investigated?

Use simple language. Avoid guessing. If you do not know the suspect’s real name, say so and identify the account, phone number, link, or transaction trail instead.

Step-by-Step Process for Filing with the PNP ACG

1. Organize your evidence before going

Prepare a folder with:

Valid ID photocopy
Draft complaint-affidavit or written narrative
Printed screenshots
Printed receipts and transaction records
USB or digital folder with original files
List of suspect accounts, links, phone numbers, and bank/e-wallet details
Timeline of events

A timeline is especially useful. For example:

Date and time	Event	Evidence
March 3, 8:12 p.m.	Seller posted iPhone listing on Facebook Marketplace	Annex A
March 3, 8:30 p.m.	Victim chatted with seller	Annex B
March 4, 9:10 a.m.	Victim sent ₱18,000 via GCash	Annex C
March 4, 9:30 a.m.	Seller blocked victim	Annex D
March 4, 10:00 a.m.	Victim reported to GCash	Annex E

2. Go to the appropriate PNP ACG office or initiate contact online

For a formal complaint, personal appearance is often needed because investigators may interview you, verify identity, inspect evidence, and require a sworn statement. If you are far from Metro Manila, ask for the nearest Regional Anti-Cybercrime Unit or coordinate through your local police station.

For OFWs, foreigners abroad, or victims outside the Philippines, initial contact by email may help preserve details and get instructions. However, formal use of affidavits in Philippine proceedings may require proper notarization, consular acknowledgment, apostille, or a special power of attorney if someone in the Philippines will file or follow up for you.

3. Undergo intake interview and evaluation

The duty investigator will usually ask:

What happened?
When did you discover the incident?
What platform or device was used?
Do you know the suspect personally?
How did you send money or information?
What evidence do you have?
Did you already report to the bank, e-wallet, platform, barangay, or another police unit?
Is the account, post, website, or phone number still active?

Be direct. Do not exaggerate. Investigators are looking for facts that can be verified.

4. Execute or submit your complaint-affidavit

If your complaint appears actionable, you may be asked to execute a complaint-affidavit or sworn statement. If you already prepared one, bring it in editable and printed form because the investigator may ask you to clarify dates, add account links, attach annexes, or correct legal descriptions.

A sworn statement is important because cybercrime complaints usually proceed to a prosecutor for preliminary investigation. The prosecutor will not rely only on angry messages or screenshots; they need affidavits that identify the complainant, authenticate the evidence, and explain why the suspect’s acts satisfy the elements of an offense.

5. Submit evidence and allow proper examination if needed

If your phone, laptop, email account, or social media account contains important evidence, investigators may inspect it. In more technical cases, they may coordinate digital forensic examination.

For evidence to be useful later, chain of custody matters. The Philippines recognizes electronic documents and electronic evidence under the E-Commerce Act and the Rules on Electronic Evidence, but authenticity and integrity still matter. Electronic documents can be treated as functional equivalents of written documents, and electronic evidence may be admissible when properly authenticated. (Supreme Court E-Library)

6. Ask for a receiving copy or reference details

Before leaving, ask for proof that your complaint was received, such as:

Complaint reference number
Name or designation of investigator on case
Date and time received
List of documents submitted
Next step or follow-up instruction

Keep your own copy of everything. Do not surrender the only copy of your evidence.

7. Cooperate with investigation and case build-up

The investigator may need additional evidence, witness statements, certifications from banks or platforms, or clarification from you. In some cases, law enforcement may seek preservation, disclosure, search, seizure, or examination of computer data through the proper legal process.

The Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, governs special warrants involving preservation, disclosure, interception, search, seizure, examination, custody, and destruction of computer data in cybercrime cases. (Office of the Court Administrator) This is why victims should understand that the PNP cannot simply force Facebook, Google, banks, telcos, or foreign platforms to disclose private account data just because a complaint was filed. Legal process is usually required.

8. Prosecutor’s office and court proceedings

The PNP ACG investigates and builds the case, but criminal prosecution is handled through the prosecutor’s office. If there is enough evidence, the case may be referred for preliminary investigation. The respondent may be required to submit a counter-affidavit. The prosecutor then determines whether there is probable cause to file an Information in court.

A cybercrime complaint may also be filed directly with the prosecutor’s office in proper cases, especially when the evidence is already complete, but many complainants still go to PNP ACG or NBI first because they need technical assistance, tracing, preservation, or forensic support.

Practical Timelines

Timelines vary heavily depending on the platform, bank, amount involved, number of victims, whether the suspect is known, and whether foreign service providers are involved.

Stage	Usual practical timing
Emergency bank/e-wallet report	Same day, ideally within minutes or hours
PNP ACG intake	Same day if walk-in capacity is available; longer if office is crowded or documents are incomplete
Evidence review and supplemental documents	Several days to weeks
Requests to banks, telcos, platforms, or service providers	Weeks or longer, depending on legal process and responsiveness
Prosecutor preliminary investigation	Often months, depending on docket, complexity, and respondent participation
Court case after filing of Information	Months to years, depending on court calendar and evidence issues

The biggest bottlenecks are usually incomplete evidence, missing URLs, fake or mule accounts, delayed reporting, foreign platforms, and victims who cannot return to execute affidavits or attend hearings.

Fees and Costs

Filing a cybercrime complaint with law enforcement generally does not require a filing fee. However, expect possible out-of-pocket costs for:

Printing screenshots and documents
Photocopying IDs and annexes
Notarization if you prepare the affidavit outside the agency
Transportation or courier costs
Certified bank records, if required
Consular notarization, apostille, or special power of attorney for documents executed abroad

Do not pay fixers. Do not send money to anyone claiming they can “fast-track” a cybercrime complaint or guarantee recovery of funds.

Common Mistakes That Weaken Cybercrime Complaints

Only saving the suspect’s display name

A Facebook name like “Maria Shoppe Legit Seller” is not enough. Save the profile link, page link, group link, username, user ID if visible, phone number, email address, and transaction details.

Cropping out dates and URLs

Investigators need date, time, and source. A cropped screenshot may look cleaner but can be less useful as evidence.

Waiting too long

Online records can disappear. Posts are deleted. Accounts are renamed. SIMs are abandoned. Mule accounts are emptied. Report immediately, especially for scams, sextortion, hacking, and cyberlibel.

Deleting the conversation after printing screenshots

Keep the original conversation on the device or account. Screenshots are useful, but original access may help verify authenticity.

Sending public accusations before filing

Posting “scammer reveal” content can create a separate defamation issue, especially if you name the wrong person or include unverified personal details. Report first. Share warnings carefully and factually.

Assuming the police can instantly recover money

The PNP ACG investigates crimes. Recovery of money often depends on how fast the bank or e-wallet can hold the funds, whether the account still contains money, and whether the money moved through mule accounts or cash-out channels.

Treating a barangay blotter as a cybercrime complaint

A barangay or police blotter may document that you reported an incident, but it is not the same as a complete cybercrime complaint supported by affidavits and digital evidence.

Special Notes for Foreigners, OFWs, and Filipinos Abroad

Foreigners can file cybercrime complaints in the Philippines if the incident has a Philippine connection, such as a suspect in the Philippines, a Philippine bank or e-wallet account, a Philippine phone number, a Philippine victim, or damage suffered in the Philippines.

If you are abroad:

Email or contact the PNP ACG first for instructions.
Prepare a detailed affidavit and evidence folder.
If someone in the Philippines will file for you, execute a Special Power of Attorney.
Documents signed abroad may need consular notarization or apostille, depending on where they are executed and how they will be used.
Attach a clear copy of your passport or government ID.
Be ready to attend interviews or hearings online or in person if required later.

For companies, the complainant should usually bring a board secretary’s certificate, authorization letter, or SPA showing authority to file for the company, plus proof of the company’s loss or affected account.

Frequently Asked Questions

Can I file a PNP cybercrime complaint online?

You may initiate a report online or by email, and government sources have referenced the PNP ACG e-complaint channel and acg@pnp.gov.ph. For a formal criminal complaint, however, you may still be required to appear, verify your identity, submit evidence, and execute a sworn statement.

Should I report to PNP ACG or NBI Cybercrime Division?

You may report to either. The PNP ACG is commonly approached for police investigation, regional access, immediate threats, and many ordinary online scam complaints. The NBI Cybercrime Division is also authorized to investigate cybercrime and may be preferred for complex, syndicated, high-profile, or transnational matters. The agencies may refer or coordinate depending on the case.

What if I only know the scammer’s phone number or GCash number?

You can still report. Provide the phone number, account name, transaction reference number, date and time of transfer, amount, screenshots of the conversation, and proof that you reported to the e-wallet or bank. Do not expect the provider to disclose subscriber details directly to you; investigators may need legal process.

Can the PNP ACG recover my money from an online scam?

Sometimes, but not always. Recovery is more likely if you report immediately and the bank, e-wallet, or payment provider can still hold or trace the funds. If the money has already been withdrawn, transferred, or moved through several mule accounts, the case may continue as a criminal investigation even if immediate recovery is not possible.

Do I need a lawyer to file a complaint with the PNP Cybercrime Group?

A lawyer is not required just to report to the PNP ACG. Many victims file on their own. A lawyer may help if the case involves a large amount, cyberlibel, company losses, multiple victims, sensitive sexual images, foreign documents, or a need to coordinate civil, criminal, and platform remedies.

Is a screenshot enough evidence for cybercrime?

A screenshot is a starting point, not the whole case. Stronger evidence includes URLs, full chat history, transaction receipts, email headers, account IDs, phone numbers, bank or e-wallet reference numbers, witness affidavits, and original files preserved on the device or account.

Can I file a complaint if the suspect is outside the Philippines?

Yes, if there is a sufficient Philippine connection, but expect a more complicated investigation. The DOJ Office of Cybercrime is the Philippine central authority for international cooperation in cybercrime matters, and the Cybercrime Prevention Act’s framework includes international cooperation for investigation and prosecution. (Supreme Court E-Library)

What if someone is threatening to leak my private photos?

Preserve the threats, usernames, links, phone numbers, and payment demands. Do not send more images or money. Report immediately to the PNP ACG or nearest police station, especially if there is sextortion, stalking, or risk of physical harm. Depending on the facts, RA 9995, RA 11313, RA 10175, and other criminal laws may apply.

Can I report cyberbullying to the PNP ACG?

Yes, if the conduct involves threats, identity theft, sexual harassment, unlawful sharing of images, cyberlibel, coercion, stalking, or other punishable acts. “Cyberbullying” is a common term, but the complaint should identify the specific acts and evidence rather than relying only on the label.

What happens if the suspect apologizes or returns the money?

Keep proof of the apology, settlement, or repayment. Some cases may still proceed because crimes are offenses against the State, not just private disputes. In practice, repayment or settlement may affect the complainant’s interest, civil liability, or prosecutor’s evaluation, but it does not automatically erase criminal exposure.

Key Takeaways

File with the PNP Anti-Cybercrime Group as soon as possible when the incident involves online scams, hacking, identity theft, cyberlibel, threats, sextortion, or other cyber-related offenses.
Preserve original digital evidence, not just cropped screenshots.
For financial scams, report immediately to the bank, e-wallet, payment provider, and CICC hotline 1326 while preparing your PNP ACG complaint.
A strong complaint usually includes a sworn statement, valid ID, screenshots with URLs and timestamps, transaction records, and a clear timeline.
The PNP ACG investigates, but prosecutors decide whether criminal charges should be filed in court.
Cybercrime investigations can take time because banks, telcos, platforms, and foreign service providers usually require proper legal process before disclosing data.
For OFWs, foreigners, and complainants abroad, formal affidavits and authority documents may need consular notarization, apostille, or a special power of attorney.
The sooner you report, the better the chance of preserving digital traces, identifying accounts, and preventing further loss.