Online scams have become one of the most common cybercrime concerns in the Philippines. Victims may lose money through fake sellers, phishing links, investment fraud, romance scams, job scams, identity theft, hacked accounts, unauthorized fund transfers, cryptocurrency schemes, or impersonation through social media and messaging apps. Because these acts are often committed through computers, mobile phones, online platforms, e-wallets, bank accounts, and electronic communications, they may fall under Philippine cybercrime laws as well as the Revised Penal Code and special laws on fraud, consumer protection, data privacy, banking, electronic commerce, and financial regulation.

This article explains the legal basis, evidence requirements, reporting channels, and practical steps for filing a cybercrime complaint for an online scam in the Philippines.

I. What Is an Online Scam?

An online scam is a fraudulent scheme committed through the internet or electronic means. It usually involves deception, misrepresentation, impersonation, manipulation, or unauthorized access to induce a person to part with money, property, personal data, account credentials, or other valuable information.

Common examples include:

Fake online selling, where a seller receives payment but never delivers the item.
Phishing, where a victim is tricked into giving passwords, OTPs, card details, or banking credentials.
Investment scams, including fake trading platforms, cryptocurrency schemes, Ponzi-style programs, and unrealistic “guaranteed return” offers.
Job scams, where victims are asked to pay placement fees, training fees, account verification fees, or task-based deposits.
Romance scams, where a scammer builds emotional trust and later asks for money.
Impersonation scams, where a person pretends to be a government officer, bank employee, delivery rider, relative, business owner, or public figure.
Account takeover scams, where hacked social media or messaging accounts are used to borrow money or solicit payments.
Unauthorized e-wallet or bank transfers, often following phishing, SIM compromise, malware, or identity theft.
Fake loan or lending apps, especially where personal data is harvested and later used for harassment.
Marketplace and delivery scams, including fake payment confirmations, fake escrow services, or courier-related fraud.

An online scam may be simple or sophisticated. The important point is that the use of digital technology can make the offense both a traditional fraud case and a cybercrime matter.

II. Legal Bases in the Philippines

A. Cybercrime Prevention Act of 2012

The principal law is Republic Act No. 10175, known as the Cybercrime Prevention Act of 2012. It punishes offenses committed through or against computer systems and recognizes certain crimes when committed using information and communications technology.

Online scams may involve several cybercrime-related offenses, depending on the facts. These may include:

Computer-related fraud This may apply when a person uses a computer system or digital means to cause damage, gain, loss, or deception through fraudulent input, alteration, deletion, suppression, or manipulation of data or system processes.
Computer-related identity theft This may apply when a person wrongfully acquires, uses, misuses, transfers, possesses, alters, or deletes identifying information belonging to another.
Illegal access This may apply when a person accesses an account, computer system, email, social media profile, e-wallet, online banking account, or other protected system without authorization.
Misuse of devices or access credentials This may apply when tools, passwords, access codes, or credentials are used or distributed for cybercrime purposes.
Cyber-squatting or impersonation-related conduct In some cases, fake pages, domains, or profiles may be relevant to proving fraudulent identity or misrepresentation, although not every fake page automatically constitutes cyber-squatting.
Cyber libel or harassment-related conduct These are not usually the main offenses in a scam case, but they may arise if the scammer posts defamatory accusations, threats, or abusive content online.

A key feature of cybercrime law is that the use of information and communications technology may increase the penalty for certain offenses that are already punishable under existing laws.

B. Revised Penal Code: Estafa and Other Fraud Offenses

Many online scam complaints are also based on estafa under the Revised Penal Code. Estafa generally involves defrauding another person by abuse of confidence, deceit, false pretenses, fraudulent acts, or misrepresentation, resulting in damage.

In an online selling scam, for example, estafa may be alleged if the supposed seller falsely represented that an item existed, accepted payment, and then failed to deliver because the seller never intended to perform. In an investment scam, estafa may be alleged if the accused induced victims to invest through false promises, fake licenses, fabricated profits, or deceptive representations.

Not every failed transaction is automatically estafa. A mere breach of contract, delay in delivery, or inability to pay is not always a criminal offense. The complainant must show fraudulent intent, deceit, or misrepresentation at the time of the transaction, or facts showing that the accused never intended to comply.

C. Access Devices Regulation Act

If the scam involves credit cards, debit cards, ATM cards, online banking credentials, account numbers, or other access devices, Republic Act No. 8484, as amended, may be relevant. This law covers fraudulent use, possession, production, trafficking, or unauthorized use of access devices.

D. E-Commerce Act

The Electronic Commerce Act recognizes electronic documents, electronic signatures, and electronic transactions. This is important because screenshots, emails, chat logs, online receipts, electronic confirmations, and digital payment records may be used as evidence, subject to authentication and admissibility rules.

E. Data Privacy Act

If the scam involves unauthorized collection, use, disclosure, sale, or misuse of personal information, the Data Privacy Act of 2012 may also be relevant. This is common in phishing, fake lending app harassment, identity theft, doxxing, account takeover, or unauthorized use of IDs and selfies.

F. Consumer, Banking, Securities, and Financial Laws

Depending on the nature of the scam, other agencies or laws may become relevant:

Bangko Sentral ng Pilipinas for banks, e-wallets, payment systems, unauthorized fund transfers, and financial consumer complaints.
Securities and Exchange Commission for investment scams, fake corporations, unauthorized securities offerings, and Ponzi-style schemes.
Department of Trade and Industry for consumer complaints involving online sellers or businesses.
National Privacy Commission for personal data misuse.
Insurance Commission for fake insurance or investment-linked insurance schemes.
Cooperative Development Authority for scams involving cooperatives.
Local government business permit offices if a registered business is involved.

A criminal complaint may proceed separately from administrative or regulatory complaints.

III. Where to File a Cybercrime Complaint

Victims in the Philippines may report online scams to the following authorities:

A. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group is a primary law enforcement unit for cybercrime complaints. Victims may report online scams involving fake sellers, identity theft, phishing, hacked accounts, online threats, unauthorized access, and similar digital offenses.

A complaint may be filed at the appropriate cybercrime office or police station. The complainant should bring identification, evidence, and a written narrative.

B. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division also investigates cybercrime complaints. It may receive complaints involving online fraud, phishing, hacking, identity theft, cyber extortion, online impersonation, and other cyber-enabled offenses.

The NBI may require the complainant to submit a sworn complaint-affidavit and supporting evidence.

C. Prosecutor’s Office

A criminal complaint may be filed with the Office of the City or Provincial Prosecutor for preliminary investigation. In practice, many victims first go to the PNP or NBI for investigation and evidence-gathering before filing with the prosecutor.

A prosecutor evaluates whether there is probable cause to charge the respondent in court.

D. Barangay or Local Police Station

For urgent situations, victims may also report to the nearest police station or barangay. However, cybercrime cases generally require specialized handling, especially for tracing accounts, preserving electronic evidence, and coordinating with platforms or financial institutions.

E. Banks, E-Wallets, and Payment Providers

If money was transferred through a bank, e-wallet, remittance center, payment gateway, or cryptocurrency platform, the victim should immediately report the transaction to the financial institution. This is urgent because some institutions may freeze suspicious accounts, flag transactions, investigate account holders, or assist law enforcement.

Victims should ask for a written acknowledgment, ticket number, reference number, or case number.

F. Online Platforms

Victims should also report the fraudulent account, listing, page, or advertisement to the platform involved, such as Facebook, Messenger, Instagram, TikTok, Shopee, Lazada, Telegram, Viber, WhatsApp, email providers, domain hosts, or marketplace platforms. Platform reports do not replace criminal complaints, but they may help preserve evidence and prevent further victimization.

IV. What Evidence Should Be Prepared?

Evidence is critical in cybercrime complaints. The complainant should preserve both the content of the scam and the transaction trail.

Important evidence includes:

Screenshots of conversations Include the full chat history, profile name, profile link, username, account ID, timestamps, phone numbers, email addresses, and any promises or representations made by the scammer.
Proof of payment Keep bank transfer receipts, e-wallet confirmations, remittance slips, QR code records, transaction reference numbers, account names, account numbers, payment links, cryptocurrency wallet addresses, and screenshots of payment confirmations.
URLs and profile links Save the exact links to social media profiles, marketplace listings, websites, pages, groups, posts, ads, or product listings.
Identity details used by the scammer Save names, aliases, mobile numbers, email addresses, social media handles, bank account names, e-wallet names, IDs sent by the scammer, business permits, and supposed company names.
Advertisements and posts Preserve the post, product listing, sponsored ad, group post, or website page that induced the transaction.
Delivery or logistics records If applicable, save tracking numbers, delivery receipts, courier messages, and fake delivery confirmations.
Call logs and SMS messages Save phone numbers, call timestamps, text messages, OTP requests, and suspicious links.
Emails and headers For phishing emails, preserve the original email and, where possible, full email headers.
Device and account evidence If an account was hacked, preserve login alerts, security emails, password reset notices, device login history, IP alerts, and recovery attempts.
Victim’s narrative Prepare a clear written timeline: when the victim saw the offer, how communication started, what representations were made, when payment was sent, what happened after payment, and what loss was suffered.

The complainant should avoid deleting conversations, blocking the scammer too early, resetting devices without backup, or altering screenshots. Evidence should be preserved in original form whenever possible.

V. Screenshots as Evidence

Screenshots are useful but may be challenged. To strengthen screenshots:

Capture the entire conversation, not only selected messages.
Include timestamps and account identifiers.
Capture the profile page of the scammer.
Save links, not just images.
Export chat history when the platform allows it.
Keep the original device where the conversation occurred.
Back up files to cloud storage or an external drive.
Print screenshots only after saving digital copies.
Do not edit, crop, highlight, or annotate the only copy.
Prepare to explain how and when the screenshots were taken.

For stronger evidentiary value, the complainant may execute an affidavit identifying the screenshots and explaining that they are faithful reproductions of the online communications.

VI. Immediate Steps After Discovering the Scam

A victim should act quickly. The first hours matter, especially when money has just been transferred.

Step 1: Stop further communication that may expose more information

Do not send additional payments, IDs, selfies, passwords, OTPs, PINs, or account details. Scammers often demand “release fees,” “taxes,” “verification deposits,” “unlocking fees,” or “refund processing charges.” These are usually part of the same scam.

Step 2: Preserve all evidence

Take screenshots, save links, download receipts, export chats, and record the transaction timeline. Evidence may disappear if the scammer deletes accounts, blocks the victim, or changes usernames.

Step 3: Contact the bank or e-wallet immediately

Report the transaction as fraudulent. Request account freezing, transaction review, chargeback if applicable, or assistance under the institution’s fraud process. Ask for a case number.

Step 4: Change passwords and secure accounts

If phishing, hacking, or identity theft is involved, change passwords, enable two-factor authentication, log out of all devices, revoke suspicious app permissions, and secure email accounts first because email controls password recovery.

Step 5: Report to law enforcement

File a complaint with the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the prosecutor’s office, depending on the urgency and available evidence.

Step 6: Report to relevant regulators

For investment scams, report to the SEC. For banking or e-wallet concerns, report to the financial institution and, where appropriate, the BSP’s consumer assistance channels. For personal data misuse, report to the National Privacy Commission. For online consumer transactions, report to DTI if a business or seller is involved.

VII. Preparing the Complaint-Affidavit

A cybercrime complaint usually requires a written complaint-affidavit. This document should be clear, factual, chronological, and supported by attachments.

A complaint-affidavit typically includes:

The complainant’s full name, address, contact details, and identification.
The respondent’s known name, alias, phone number, email, account name, profile link, bank account, e-wallet account, or other identifying details.
A clear timeline of events.
The false representations or deceit used by the scammer.
The amount of money or property lost.
The mode of payment.
The online platform or system used.
The steps taken after discovering the scam.
A list of attached evidence.
A statement that the facts are true based on personal knowledge or authentic records.

The affidavit should avoid speculation. It should distinguish between facts personally known to the complainant and information inferred from records.

VIII. Sample Structure of a Complaint-Affidavit

A basic complaint-affidavit may follow this structure:

Republic of the Philippines City/Province of ________

Complaint-Affidavit

I, [Name], of legal age, Filipino, residing at [address], after being sworn in accordance with law, state:

I am the complainant in this case.
On [date], I saw an online post/listing/message from [name/account/profile] offering [item/service/investment].
The respondent represented that [state the promise or misrepresentation].
Relying on these representations, I paid the amount of PHP [amount] through [bank/e-wallet/remittance] to [account name/account number] on [date and time].
Attached as Annex “A” is a copy of the conversation; Annex “B” is the proof of payment; Annex “C” is the profile or account used by the respondent; and Annex “D” is the online listing or post.
After payment, the respondent [failed to deliver/blocked me/deleted the account/demanded additional payment/gave false tracking information].
I later discovered that the transaction was fraudulent because [state facts].
I suffered damage in the amount of PHP [amount], exclusive of other costs and damages.
I am filing this complaint for online scam, estafa, computer-related fraud, identity theft, and/or other offenses that may be applicable under Philippine law.
I execute this affidavit to attest to the truth of the foregoing and to support the filing of appropriate criminal, civil, and administrative actions.

[Signature] [Name] [Date]

Subscribed and sworn to before me this ___ day of ______, 20.

This is only a simplified format. The actual affidavit should be tailored to the facts of the case.

IX. Filing with the PNP Anti-Cybercrime Group or NBI Cybercrime Division

When filing with law enforcement, the complainant should bring:

One or more valid government-issued IDs.
Printed copies of screenshots and receipts.
Digital copies stored in a USB drive or accessible cloud folder.
The original phone or device used in the transaction, if available.
A written timeline.
Names, aliases, phone numbers, emails, URLs, account numbers, and bank or e-wallet details of the scammer.
Any acknowledgment or case number from the bank, e-wallet, or platform.
A notarized complaint-affidavit, if already prepared.

The investigator may interview the complainant, request additional documents, require a sworn statement, or refer the case for further investigation. In some cases, law enforcement may coordinate with banks, platforms, telecommunications providers, or other agencies through proper legal processes.

X. Filing with the Prosecutor’s Office

A criminal complaint may also be filed directly with the prosecutor. The prosecutor may require:

Complaint-affidavit.
Supporting affidavits from witnesses.
Documentary evidence.
Proof of payment.
Screenshots and electronic evidence.
Certification or authentication, where necessary.
Copies of respondent’s known identifying information.

If the prosecutor finds probable cause, an information may be filed in court. If the prosecutor finds the evidence insufficient, the complaint may be dismissed, subject to available remedies such as motion for reconsideration or appeal, depending on the rules and circumstances.

XI. Jurisdiction and Venue

Cybercrime cases may raise questions about where to file because the victim, scammer, server, platform, bank, and payment account may be in different places. In general, a complaint may be filed where the offense was committed, where its essential elements occurred, where the victim suffered damage, or where the unlawful online act had effects, subject to applicable rules on criminal procedure and cybercrime jurisdiction.

For practical purposes, victims often report to the cybercrime office nearest to their residence or where they made the payment. Law enforcement or prosecutors may later determine the proper venue.

XII. Can the Victim Recover the Money?

Filing a cybercrime complaint does not automatically guarantee recovery of money. Recovery depends on how quickly the funds are reported, whether the receiving account can be frozen, whether the scammer is identified, whether assets remain traceable, and whether a court or institution orders restitution or refund.

Possible recovery routes include:

Bank or e-wallet dispute process
Account freezing or fraud hold
Chargeback, where applicable
Criminal restitution
Civil action for damages
Settlement, if lawful and voluntary
Regulatory intervention, depending on the institution involved

Victims should be cautious of “recovery agents” who promise to retrieve stolen money for a fee. Many are secondary scammers.

XIII. What If the Scammer Used a Fake Name?

A complaint may still be filed even if the scammer used a fake name. The complainant should provide all available identifiers, including:

Profile links
Usernames
Phone numbers
Email addresses
Bank or e-wallet account names
Account numbers
QR codes
IP-related alerts, if available
Device login notices
Courier or delivery details
Cryptocurrency wallet addresses
Screenshots of IDs or business permits sent by the scammer

Law enforcement may use legal processes to request subscriber information, account records, transaction trails, CCTV records from cash-out points, or other investigative leads.

XIV. What If the Bank Account Name Is Different from the Scammer’s Profile?

This is common. Scammers often use mule accounts, rented e-wallets, stolen accounts, or accounts opened under other people’s names. The bank or e-wallet account holder may become an important lead. Depending on the evidence, the account holder may be a suspect, witness, mule, or victim of identity theft.

The complainant should not assume without evidence that the account holder personally committed the scam, but the account details should be included in the complaint.

XV. What If the Amount Is Small?

A complaint may still be filed even for a small amount. However, practical enforcement may depend on evidence, available leads, number of victims, and investigative resources. If many victims are involved, it is useful to coordinate evidence and file related complaints. Multiple small transactions may show a larger fraudulent scheme.

XVI. What If the Scam Happened on Facebook Marketplace, Messenger, Telegram, or Viber?

The platform used does not prevent filing. The complainant should preserve:

Profile URL or user ID
Chat history
Group or page name
Listing or post link
Screenshots showing timestamps
Phone numbers or emails connected to the account
Any changes in username or profile picture
Evidence of blocking, deletion, or disappearance

If the scammer deletes the account, existing screenshots and URLs may still be helpful.

XVII. What If the Scam Involves Cryptocurrency?

Cryptocurrency scams can still be reported. The complainant should preserve:

Wallet addresses
Transaction hashes
Exchange account details
Screenshots of the platform used
Chat logs
Payment receipts used to buy the cryptocurrency
Names of exchanges or wallets involved
Links to blockchain transactions

Cryptocurrency transactions are often difficult to reverse, but the transaction trail may still help identify exchanges, wallets, and cash-out points.

XVIII. What If the Scam Is an Investment Scheme?

Investment scams should be reported not only to law enforcement but also to the SEC if the scheme involves securities, investment contracts, pooled funds, profit-sharing, trading programs, or public solicitation of investments.

Warning signs include:

Guaranteed high returns
No risk claims
Referral commissions
Pressure to recruit others
Fake SEC registration claims
Use of celebrity images without authorization
Promises of daily or weekly profits
Lack of understandable business model
Refusal to disclose company officers
Payment to personal bank or e-wallet accounts

A company’s mere registration as a corporation does not automatically authorize it to solicit investments from the public.

XIX. What If the Scam Involves Personal Data or Harassment?

If the scammer collected IDs, selfies, contact lists, private photos, or other personal data, the victim should also consider reporting to the National Privacy Commission, especially if the data is used for threats, harassment, extortion, doxxing, or unauthorized disclosure.

Victims should also secure accounts, warn contacts if necessary, and document any misuse of personal data.

XX. Cybercrime Evidence and Authentication

Electronic evidence must be presented in a manner that shows reliability and authenticity. A complainant should be prepared to explain:

Who took the screenshots
When they were taken
What device was used
Whether the screenshots are complete and unaltered
How the files were stored
How the online account was identified
How the payment was made
How the evidence links the respondent to the scam

Where possible, preserve metadata, original files, links, emails, receipts, and device records.

XXI. Prescription Periods and Delay

Victims should not delay. Delay may make it harder to trace accounts, freeze funds, obtain platform records, identify suspects, or preserve electronic evidence. Even if legal prescription periods may allow later filing, practical recovery and investigation are strongest when the complaint is made quickly.

XXII. Civil Remedies

A victim may also consider civil remedies to recover money or damages. Depending on the amount and facts, this may include:

A civil action for sum of money
A civil action for damages
Small claims, if appropriate
Restitution in a criminal case
Settlement negotiations

A civil case focuses on recovery of money or damages, while a criminal case focuses on prosecution and punishment. The same facts may give rise to both criminal and civil liability.

XXIII. Practical Checklist for Victims

Before filing, prepare the following:

Valid ID of the complainant
Written timeline of events
Full name and contact details of the complainant
Scammer’s name, alias, phone number, email, profile link, username, and other identifiers
Screenshots of chats
Screenshots of profile, post, listing, page, or website
Proof of payment
Bank, e-wallet, remittance, or crypto transaction details
Copies of reports filed with bank, e-wallet, platform, or regulator
Device used in the transaction, if available
Complaint-affidavit
USB drive or digital folder containing evidence
Printed copies of key documents

XXIV. Common Mistakes to Avoid

Victims should avoid:

Deleting conversations out of anger or embarrassment.
Posting accusations online without careful wording, as this may create legal risks.
Sending more money to recover the first payment.
Giving OTPs, passwords, or IDs to supposed investigators online.
Trusting private “hackers” or “recovery specialists.”
Cropping screenshots in a way that removes timestamps or account identifiers.
Filing a complaint with only a name but no transaction records.
Waiting too long before contacting the bank or e-wallet.
Assuming that a business registration means the investment is lawful.
Failing to secure email and social media accounts after phishing.

XXV. Sample Demand Message Before Filing

In some cases, a victim may send a final demand message before filing, especially where the facts may involve a failed transaction rather than a clear scam. However, this is not required in every criminal case.

A simple demand may state:

“Please return the amount of PHP [amount] sent on [date] through [payment channel] for [transaction]. You represented that [item/service] would be delivered, but you have failed to deliver despite repeated follow-ups. Unless the amount is returned or the matter is resolved by [deadline], I will file the appropriate complaint with law enforcement and other agencies.”

The message should be professional and should avoid threats, insults, or defamatory statements.

XXVI. When to Consult a Lawyer

A lawyer is especially helpful when:

The amount involved is substantial.
The scam involves multiple victims.
The suspect is known and has assets.
The case involves investment solicitation.
The scam involves business partners, contracts, or corporate entities.
The victim’s personal data or private images are being used for extortion.
The victim wants to file both criminal and civil cases.
The prosecutor dismissed the complaint.
The victim received a counterclaim or legal threat.
The evidence is complex or technical.

A lawyer can help draft the complaint-affidavit, identify the proper offenses, organize evidence, and represent the complainant during preliminary investigation or court proceedings.

XXVII. Frequently Asked Questions

1. Is an online scam automatically a cybercrime?

Not always, but many online scams may qualify as cybercrime or cyber-enabled offenses if computers, mobile phones, digital platforms, electronic communications, or online payment systems were used as part of the fraudulent act.

2. Can I file even if I only know the scammer’s Facebook name?

Yes. Provide the profile link, screenshots, payment account, phone number, and any other identifying details. Law enforcement may use these as investigative leads.

3. Can I file if the scammer blocked me?

Yes. Blocking after payment may support the allegation of fraud, especially when combined with proof of misrepresentation and non-delivery.

4. Is failure to deliver an item always estafa?

No. A mere delay or breach of contract is not automatically estafa. There must be evidence of deceit, fraudulent intent, or false representation.

5. Should I report to the bank first or police first?

Do both, but report to the bank or e-wallet immediately if money was transferred. Time is critical for possible freezing, tracing, or recovery.

6. Can the police force the bank to reveal the account holder?

Banks and financial institutions generally require proper legal process before releasing protected information. Law enforcement may coordinate through official procedures.

7. Can I recover my money after filing?

Possibly, but not guaranteed. Recovery depends on tracing the funds, freezing accounts, identifying suspects, and available legal or institutional remedies.

8. Can I post the scammer’s name online?

Be careful. Public accusations may expose the victim to defamation, privacy, or harassment claims if the post is excessive, inaccurate, or unsupported. Reporting to authorities is safer.

9. What if the scammer is outside the Philippines?

A complaint may still be filed. Cross-border cases are more difficult but may be investigated through platform records, payment trails, international cooperation, and local intermediaries.

10. What if many people were scammed by the same person?

Victims may coordinate, gather evidence, and file individual or related complaints. Multiple complaints may help show a pattern or scheme.

XXVIII. Conclusion

Filing a cybercrime complaint for an online scam in the Philippines requires quick action, organized evidence, and proper reporting. The victim should preserve all digital records, immediately notify the bank or e-wallet, report the fraudulent account to the platform, and file a complaint with the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or prosecutor’s office.

The strongest complaints are those supported by complete chat records, payment proof, profile links, transaction details, and a clear sworn narrative showing deceit, reliance, payment, damage, and the use of electronic means. While recovery of money is not guaranteed, prompt reporting increases the chances of tracing funds, identifying suspects, stopping further scams, and pursuing criminal, civil, or administrative remedies.

Because online scam cases may involve several overlapping laws, victims should consider legal assistance when the amount is significant, the scheme is complex, or the case involves identity theft, investment solicitation, account hacking, personal data misuse, or multiple victims.