I. Introduction

Online investment scams have become one of the most common forms of cyber-enabled fraud in the Philippines. They usually appear as cryptocurrency schemes, forex trading groups, “tasking” platforms, fake investment apps, Ponzi-style businesses, online lending-investment hybrids, social media solicitations, or impersonations of legitimate financial institutions. Victims are often promised unusually high returns, guaranteed profits, referral bonuses, or quick withdrawals, only to discover later that the platform is fake, the account manager has disappeared, or additional “tax,” “clearance,” or “unlocking” fees are being demanded before funds can supposedly be released.

Filing a cybercrime complaint is the first formal step toward law enforcement action. In the Philippines, an online investment scam may involve several overlapping offenses: cybercrime, estafa or swindling, securities violations, identity theft, computer-related fraud, and violations of financial regulations. Because of this overlap, victims should understand where to file, what evidence to preserve, what facts to include, and what government agencies may be involved.

This article explains the legal framework, practical steps, documentary requirements, and procedural considerations for filing a cybercrime complaint for online investment scams in the Philippine setting.

II. What Is an Online Investment Scam?

An online investment scam is a fraudulent scheme conducted through the internet or digital communication channels where a person or group induces another to part with money or property by falsely representing that the money will be invested, traded, multiplied, or used in a legitimate income-generating activity.

Common examples include:

Fake cryptocurrency investments Fraudsters claim to trade crypto assets for the victim or operate a fake crypto exchange or wallet.
Forex or stock trading scams Victims are told that professional traders will manage their funds, often through fabricated dashboards showing fake profits.
Ponzi or pyramid-style schemes Earlier investors are paid using money from later investors, while the scheme is marketed as a legitimate business.
Tasking or commission scams Victims are instructed to deposit money to receive commissions from completing online tasks, product ratings, or merchant orders.
Romance-investment or “pig butchering” scams The scammer builds trust or a romantic relationship before persuading the victim to invest in a fake platform.
Impersonation of legitimate companies or brokers Scammers use the name, logo, website design, or registration details of legitimate entities to mislead victims.
Fake investment apps and websites Victims see fake account balances and supposed profits but cannot withdraw without paying additional charges.
Social media investment groups Fraudulent offers are made through Facebook, Telegram, WhatsApp, Viber, Instagram, TikTok, or other platforms.

The key element is deceit. The victim parts with money because of false representations, concealment of material facts, or fraudulent promises.

III. Legal Bases in the Philippines

An online investment scam may give rise to criminal, civil, administrative, and regulatory liability.

A. Cybercrime Prevention Act of 2012

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, is the primary law governing cybercrime in the Philippines. Online investment scams may fall under cybercrime when the fraudulent act is committed through or with the use of information and communications technology.

Relevant cybercrime-related offenses may include:

Computer-related fraud This may apply when computer data, systems, or online platforms are used to cause damage or economic loss through fraudulent means.
Computer-related identity theft This may apply when scammers use another person’s identity, credentials, profile, corporate name, or personal information without authority.
Cyber-squatting or misuse of domain names This may be relevant where fake websites are created using names confusingly similar to legitimate businesses.
Aiding or abetting cybercrime Persons who knowingly assist in the commission of cybercrime may also be liable.
Attempted cybercrime Even attempted fraudulent cyber activities may be punishable in appropriate cases.

When the internet is used as the means of committing fraud, the complaint may be filed as a cybercrime complaint before appropriate law enforcement agencies.

B. Estafa Under the Revised Penal Code

Many investment scams also constitute estafa under Article 315 of the Revised Penal Code. Estafa generally involves defrauding another person by abuse of confidence, deceit, false pretenses, fraudulent acts, or misrepresentation.

In online investment scams, estafa may be present where the offender falsely represents that:

an investment opportunity is legitimate;
funds will be traded or invested;
profits are guaranteed;
withdrawals are possible;
the company is registered or authorized;
the victim’s money is safe;
additional payments are necessary to release funds.

If the fraudulent representations induced the victim to transfer money, estafa may be charged. When committed through information and communications technology, the penalty may be affected by cybercrime law provisions.

C. Securities Regulation Code

If the scam involves the offer or sale of investment contracts, shares, securities, or similar financial products to the public, the Securities Regulation Code may be relevant.

The Securities and Exchange Commission has jurisdiction over entities that solicit investments from the public. A scheme may involve an “investment contract” when a person invests money in a common enterprise and expects profits primarily from the efforts of others.

An entity may be violating securities laws if it:

solicits investments from the public without registration;
sells unregistered securities;
operates a Ponzi scheme;
falsely claims SEC registration as authority to solicit investments;
uses fake certificates or documents;
misrepresents corporate registration as a license to sell investments.

A corporation’s registration with the SEC does not automatically authorize it to solicit investments from the public. Separate authority may be required depending on the nature of the offering.

D. Consumer and Financial Regulations

Depending on the facts, other agencies may become relevant:

Bangko Sentral ng Pilipinas, for scams involving banks, e-money issuers, payment platforms, remittance companies, or virtual asset service providers;
Department of Trade and Industry, for deceptive online commercial practices;
National Privacy Commission, for misuse of personal data;
Anti-Money Laundering Council, where proceeds of crime may be involved;
Insurance Commission, if the scheme is disguised as insurance or investment-linked insurance;
Cooperative Development Authority, if the scam uses a cooperative structure.

The proper forum depends on the nature of the scam.

IV. Where to File a Cybercrime Complaint

A victim may file with law enforcement, prosecutors, and regulatory agencies. These are not always mutually exclusive.

A. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group investigates cybercrime complaints, including online fraud and investment scams committed through digital platforms. Victims may file a complaint with the nearest cybercrime office or appropriate PNP unit.

The PNP may assist in:

receiving the complaint;
preserving digital evidence;
identifying suspects;
tracing online accounts;
coordinating with platforms, banks, and payment channels;
preparing documents for inquest or preliminary investigation;
referring the matter to prosecutors.

B. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division also handles cybercrime complaints. Victims may file complaints involving online investment fraud, phishing, identity theft, fake websites, or organized cyber fraud.

The NBI may conduct technical investigation, cyber tracing, digital forensic work, and coordination with other agencies.

C. Office of the City or Provincial Prosecutor

A criminal complaint for estafa, cybercrime, or related offenses may be filed before the Office of the City Prosecutor or Provincial Prosecutor having jurisdiction. The prosecutor determines whether there is probable cause to file an information in court.

A victim may file directly with the prosecutor, especially when sufficient evidence has already been gathered. However, many victims first approach the PNP or NBI for investigation and assistance in preparing the complaint.

D. Securities and Exchange Commission

If the scam involves solicitation of investments from the public, the victim should also consider filing a report or complaint with the SEC.

The SEC may issue advisories, cease and desist orders, revocation actions, administrative penalties, and referrals for criminal prosecution. SEC action is especially relevant where the scheme involves corporations, partnerships, online investment platforms, agents, promoters, or public solicitation.

E. Banks, E-Wallets, Crypto Platforms, and Payment Channels

Victims should immediately report the fraudulent transaction to the bank, e-wallet provider, remittance center, payment processor, or crypto exchange used in the transfer.

The purpose is to:

request account freezing or hold, if still possible;
preserve transaction records;
report unauthorized or fraudulent activity;
obtain official transaction confirmations;
identify recipient account details;
support law enforcement requests.

Time is critical. Funds are often moved quickly after receipt.

V. Immediate Steps Before Filing

Before filing the complaint, the victim should act quickly to preserve evidence and reduce further losses.

1. Stop sending money

Scammers often demand “withdrawal fees,” “tax,” “anti-money laundering clearance,” “activation fees,” “security deposits,” or “account unlocking charges.” These are usually additional layers of fraud.

2. Preserve all evidence

Do not delete messages, accounts, apps, screenshots, or emails. Do not uninstall the scam app until relevant data has been captured.

3. Take screenshots and screen recordings

Capture:

profile names and usernames;
URLs and domain names;
chat conversations;
investment offers;
fake dashboards;
payment instructions;
account numbers;
QR codes;
transaction confirmations;
withdrawal denial messages;
demands for additional fees;
group chat announcements;
promotional posts;
names of agents and recruiters.

Screenshots should show dates, timestamps, usernames, phone numbers, and URLs where possible.

4. Export chat histories

Where possible, export chat histories from messaging apps. Full exports are better than selected screenshots because they show continuity and context.

5. Secure transaction documents

Collect:

bank deposit slips;
online banking confirmations;
e-wallet receipts;
remittance receipts;
crypto transaction hashes;
wallet addresses;
invoices;
payment requests;
account statements;
proof of transfers;
recipient account details.

6. Write a chronology

Prepare a clear timeline of events from the first contact to the latest communication. This helps investigators and prosecutors understand the case.

7. Report accounts and pages, but not too early if evidence is incomplete

Reporting scam accounts to platforms may result in deletion or suspension. Capture evidence first before reporting, unless immediate reporting is necessary to prevent further harm.

8. Avoid confronting the scammer

Confronting the scammer may cause them to delete accounts, destroy evidence, or move funds faster.

VI. Evidence Needed for a Cybercrime Complaint

A strong complaint should be supported by documentary, digital, and testimonial evidence.

A. Personal Information of the Complainant

The complainant should prepare:

full name;
address;
contact number;
email address;
valid government-issued ID;
occupation, if relevant;
proof of ownership of the sending bank or e-wallet account.

B. Information About the Suspect

Provide all known details, such as:

real name, if known;
aliases;
social media names;
usernames;
phone numbers;
email addresses;
wallet addresses;
bank account names;
bank account numbers;
e-wallet numbers;
company name;
website;
app name;
group chat name;
recruiter or upline details;
photos or profile images;
location, if known.

Even if the suspect’s identity is unknown, the complaint may still be filed. Law enforcement may attempt to identify the suspect through digital traces and financial records.

C. Proof of Misrepresentation

Evidence should show what the scammer promised or represented. Examples include:

guaranteed returns;
profit projections;
claims of SEC or government registration;
fake certificates;
testimonials;
screenshots of advertisements;
statements that the investment is risk-free;
promises of daily, weekly, or monthly payouts;
instructions to recruit others;
claims that withdrawals are guaranteed;
messages from account managers or agents.

D. Proof of Payment

The complaint must show that money was actually transferred. Attach:

receipts;
bank confirmations;
transaction reference numbers;
e-wallet history;
remittance slips;
crypto transaction hashes;
screenshots of successful payments;
account statements.

E. Proof of Loss or Damage

Show the amount lost and how it was computed. Include a table listing:

date of transfer;
amount;
sending account;
receiving account;
transaction reference number;
purpose stated by the scammer;
supporting document.

F. Proof of Non-Withdrawal or Continued Deception

Evidence that the victim could not recover the money may include:

rejected withdrawal requests;
frozen dashboard;
blocked account;
deleted group chat;
“pay more to withdraw” demands;
disappearance of the agent;
inaccessible website;
fake customer service replies;
shutdown of the platform.

G. Digital Authentication

Digital evidence should be organized and preserved in original form. Screenshots are useful, but investigators may ask for the actual device, original files, links, emails, or metadata.

Where appropriate, evidence may be supported by an affidavit explaining how the screenshots were taken, from what device, on what date, and from what account.

VII. Preparing the Complaint-Affidavit

A criminal complaint is usually supported by a complaint-affidavit. The affidavit should be factual, chronological, and supported by attachments.

A. Contents of the Complaint-Affidavit

A well-prepared complaint-affidavit should contain:

Identity of the complainant State the complainant’s full name, address, age, civil status, and other basic information.
Identity of the respondent State the name or known aliases of the person or entity complained of. If unknown, state all available identifiers.
How the complainant encountered the scam Explain whether the scam began through social media, messaging apps, a website, referral, online ad, or personal introduction.
Representations made by the scammer Describe the promises, claims, guarantees, or false statements.
Reason the complainant relied on the representations Explain what made the offer appear legitimate, such as documents, registration claims, endorsements, dashboards, or previous small payouts.
Payments made List every transfer with dates, amounts, channels, and recipient accounts.
Subsequent events Explain what happened after payment: fake profits, withdrawal problems, additional payment demands, blocked accounts, or disappearance of the scammer.
Damage suffered State the total amount lost and other consequences.
Offenses complained of Identify possible offenses, such as estafa and violations of the Cybercrime Prevention Act, subject to evaluation by authorities.
Prayer or request for action Request investigation, prosecution, preservation of digital evidence, and appropriate legal action.

B. Attachments

The affidavit should attach:

valid ID of complainant;
screenshots of conversations;
screenshots of posts or ads;
transaction receipts;
bank or e-wallet records;
URLs and website screenshots;
app screenshots;
SEC advisory or registration search results, if available;
list of other victims, if any;
proof of group chat membership;
exported chat files;
demand letters, if any;
notarized affidavits of witnesses.

C. Sample Structure

A simple structure may be:

Personal circumstances of complainant
Background of the scam
False representations
Payments made
Failure to return money or allow withdrawal
Discovery of fraud
Evidence attached
Request for criminal investigation and prosecution

VIII. Filing Procedure

Step 1: Gather and organize evidence

Before going to law enforcement, compile documents in both printed and digital form. Bring the phone, laptop, or device used in the transaction if available.

Organize evidence into folders:

Chats;
Payment proofs;
Website/app screenshots;
Suspect details;
Victim affidavit;
Other victims/witnesses.

Step 2: Go to the appropriate agency

The victim may file with the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or prosecutor’s office. If securities or public investment solicitation is involved, also report to the SEC.

Step 3: Execute a complaint-affidavit

The complainant may be asked to execute a sworn complaint-affidavit. This may be prepared in advance or with assistance.

Step 4: Submit evidence

Submit printed copies and digital copies. Keep originals and backups. Request receiving copies or proof that the complaint was filed.

Step 5: Cooperate with investigation

Investigators may ask for:

access to the device;
original chat accounts;
additional screenshots;
bank coordination;
affidavits from other victims;
confirmation of transactions;
follow-up statements.

Step 6: Referral for preliminary investigation

If law enforcement finds sufficient basis, the matter may be referred to the prosecutor for preliminary investigation.

Step 7: Preliminary investigation

The prosecutor evaluates whether probable cause exists. The respondent may be required to submit a counter-affidavit. The complainant may submit a reply-affidavit.

Step 8: Filing in court

If probable cause is found, the prosecutor may file an information in court. The criminal case then proceeds according to the Rules of Criminal Procedure.

IX. Jurisdiction and Venue

Cybercrime cases raise practical questions about where to file because the victim, offender, server, bank, and platform may be in different locations.

In general, a complaint may be filed where:

the victim resides;
the victim accessed the fraudulent communication;
the payment was made;
the damage was suffered;
the offender operated;
the bank or account was located;
any essential element of the offense occurred.

For practical purposes, victims often file with the nearest cybercrime unit or prosecutor’s office. Investigators or prosecutors may later determine the proper venue.

X. Role of the SEC in Investment Scams

The SEC plays a significant role when the scheme involves investment solicitation.

Victims should understand that SEC corporate registration merely gives an entity juridical personality. It does not automatically authorize the entity to sell securities, solicit investments, or promise passive income to the public.

A report to the SEC is useful where:

the scam used a corporation or business name;
the scam promised profits from investments;
agents recruited the public;
the scheme used investment contracts;
the entity claimed to be SEC-registered;
the scheme operated through seminars, group chats, or social media;
the company issued certificates, contracts, or membership packages.

SEC reports may support criminal complaints because they help establish whether the entity was authorized to solicit investments.

XI. Bank, E-Wallet, and Crypto Tracing Issues

Many victims ask whether transferred funds can still be recovered. Recovery is possible in some cases, but it is difficult if funds were immediately withdrawn, transferred to mule accounts, converted into crypto, or moved overseas.

A. Bank and E-Wallet Transfers

For bank or e-wallet transfers, victims should immediately report to the service provider and request assistance. The report should include transaction numbers, account names, dates, amounts, and screenshots.

The provider may not always disclose recipient information directly due to privacy and banking rules. However, law enforcement, prosecutors, and courts may request records through proper legal processes.

B. Crypto Transactions

For cryptocurrency, victims should preserve:

wallet addresses;
transaction hashes;
exchange names;
screenshots of wallet transfers;
blockchain explorer links;
communications giving wallet instructions.

Crypto transactions are often traceable on-chain, but identifying the person behind a wallet may require exchange records, know-your-customer data, and international cooperation.

C. Mule Accounts

Investment scams often use mule accounts. These are bank or e-wallet accounts used to receive scam proceeds, sometimes under the name of persons who were recruited, deceived, paid, or knowingly involved.

Even if the account holder claims not to be the mastermind, the account holder may still be investigated depending on participation, knowledge, and benefit.

XII. Group Complaints and Multiple Victims

Where several victims were defrauded by the same scheme, a coordinated complaint may be stronger. Multiple complainants can show pattern, scale, common representations, and organized fraud.

However, each victim should still prepare individual proof of payment and individual affidavits. A group complaint may include:

master chronology;
list of victims;
total amount lost;
common suspect details;
common advertisements;
common bank accounts;
common group chats;
individual transaction schedules;
affidavits from each victim.

Group coordination may also help establish that the scam involved public solicitation, which may be relevant to SEC-related violations.

XIII. Common Defenses Raised by Scammers

Victims should anticipate possible defenses.

1. “It was a legitimate investment that failed.”

The complainant should show deception from the beginning, such as fake registration claims, fabricated profits, inability to withdraw, false identity, or Ponzi-style payments.

2. “The victim voluntarily invested.”

Consent obtained through fraud is not a defense. The issue is whether the victim was induced by false representations.

3. “There was investment risk.”

Ordinary investment risk is different from fraud. A legitimate investment may lose money, but a scam involves deceit, misappropriation, false promises, or fake operations.

4. “I was only an agent or recruiter.”

Agents, promoters, uplines, influencers, or account managers may still be liable if they knowingly participated in the fraudulent solicitation.

5. “The company is SEC-registered.”

SEC registration as a corporation does not necessarily authorize investment solicitation or sale of securities.

6. “The complainant already received payouts.”

Small payouts do not necessarily negate fraud. In Ponzi schemes, early payouts are often used to build trust and encourage larger deposits.

XIV. Civil Remedies and Recovery of Money

A criminal complaint aims to prosecute the offender. Recovery of money may be pursued through restitution, civil liability in the criminal case, settlement, or separate civil action.

When a criminal action is instituted, the civil action for recovery of civil liability is generally deemed instituted with it unless reserved, waived, or separately filed under procedural rules.

Victims should document all losses carefully, including principal amounts, fees paid, and related expenses. Claims for moral damages, exemplary damages, attorney’s fees, and costs may depend on the facts and applicable law.

XV. Prescription and Urgency

Victims should file as soon as possible. Delay can result in loss of evidence, deletion of accounts, dissipation of funds, difficulty locating suspects, and prescription issues.

Digital evidence is fragile. Websites disappear, platforms delete accounts, group chats are closed, and scammers change names. Immediate action improves the chance of preservation and tracing.

XVI. Practical Checklist for Victims

Before filing, prepare the following:

Valid government ID;
Complaint-affidavit;
Chronology of events;
Total amount lost;
List of all payments;
Bank, e-wallet, remittance, or crypto receipts;
Screenshots of conversations;
Exported chat histories;
Screenshots of the investment platform;
URLs, usernames, phone numbers, and emails;
Names and details of recruiters or agents;
Screenshots of advertisements and posts;
Proof of fake profits or account dashboard;
Proof that withdrawal was denied;
Demands for additional payment;
Copies of contracts, certificates, or membership documents;
List of other victims, if any;
Device used in the transactions;
Digital backups of all evidence.

XVII. Sample Complaint-Affidavit Outline

Republic of the Philippines [City/Province]

AFFIDAVIT-COMPLAINT

I, [Name], of legal age, [civil status], Filipino, and residing at [address], after being duly sworn, state:

I am the complainant in this case.
I am filing this complaint for online investment scam, estafa, and violation of the Cybercrime Prevention Act, and other applicable laws, against [name/alias/company], whose details are as follows: [details].
On or about [date], I was contacted by / I encountered [respondent/platform] through [Facebook/Telegram/website/referral/etc.].
Respondent represented that [state investment offer, promised returns, guarantees, withdrawal terms, and other claims].
Relying on these representations, I transferred the following amounts:

Date	Amount	Channel	Recipient Account	Reference No.
[Date]	[Amount]	[Bank/e-wallet/crypto]	[Details]	[Reference]

After payment, respondent showed me alleged profits through [dashboard/messages/screenshots].
When I attempted to withdraw my money, respondent refused, delayed, blocked me, or demanded additional payments for [tax/clearance/activation/etc.].
I later discovered that the investment was fraudulent because [state facts: fake website, deleted account, SEC advisory, other victims, blocked withdrawals, false identity, etc.].
My total loss is [amount], exclusive of other damages.
Attached are copies of screenshots, payment confirmations, conversations, website records, and other evidence.
I respectfully request that the authorities investigate respondent and file the appropriate criminal charges for estafa, cybercrime, and other offenses warranted by the evidence.

IN WITNESS WHEREOF, I have signed this affidavit on [date] at [place].

[Signature] [Name]

SUBSCRIBED AND SWORN to before me this [date] at [place], affiant exhibiting competent proof of identity.

XVIII. Special Considerations for Overseas Scammers

Many online investment scams are operated by persons outside the Philippines or by syndicates using foreign servers, foreign phone numbers, or foreign crypto wallets. A complaint may still be filed locally if the victim is in the Philippines or the damage was suffered in the Philippines.

Cross-border investigation may require coordination among law enforcement agencies, service providers, foreign exchanges, platform operators, and international counterparts. This can make recovery and prosecution more difficult, but filing a complaint remains important for documentation, possible tracing, and coordinated action.

XIX. Data Privacy and Evidence Gathering

Victims should be careful when gathering and sharing evidence. While it is important to preserve proof, public posting of personal information, bank details, private conversations, or accusations may create separate legal risks.

Victims should provide complete evidence to law enforcement and regulatory agencies but should avoid unnecessary online exposure of sensitive data. Public warnings may be understandable, but they should be factual and avoid doxxing, threats, or defamatory statements.

XX. Mistakes to Avoid

Victims should avoid the following:

Paying additional withdrawal fees;
Deleting conversations or uninstalling apps before preserving evidence;
Posting incomplete accusations online instead of filing formally;
Sending threats to suspects;
Relying only on screenshots without saving original data;
Waiting too long before reporting to banks or e-wallets;
Assuming SEC corporate registration means authority to solicit investments;
Failing to document each payment separately;
Filing vague complaints without dates, amounts, and proof;
Ignoring recruiters or local agents who may have induced the investment.

XXI. Conclusion

Filing a cybercrime complaint for an online investment scam in the Philippines requires prompt action, organized evidence, and a clear factual narrative. The victim should preserve all digital communications, document every payment, report immediately to financial channels, and file with the appropriate law enforcement agency, prosecutor, and regulatory body.

An online investment scam is not merely a failed investment. When money is obtained through false promises, fake platforms, identity misuse, unauthorized solicitation, or deceptive online representations, the conduct may give rise to criminal liability for estafa, cybercrime, securities violations, and related offenses.

The strength of a complaint depends heavily on evidence. A well-prepared complaint-affidavit, supported by screenshots, transaction records, chat histories, platform details, and witness statements, gives investigators and prosecutors a clearer basis to act. Prompt filing also increases the chance of preserving digital traces and financial records before they disappear.