The rapid digitization of Philippine society has brought with it an exponential rise in cybercrimes, ranging from online scams and hacking to identity theft, cyber libel, and data breaches. Republic Act No. 10175, otherwise known as the Cybercrime Prevention Act of 2012, remains the cornerstone legislation that criminalizes these acts and establishes the institutional framework for their investigation and prosecution. Under this law, the National Bureau of Investigation (NBI) Cybercrime Division and the Philippine National Police Anti-Cybercrime Group (PNP-ACG) serve as the two principal law enforcement agencies authorized to receive, investigate, and act upon cybercrime complaints. This article provides an exhaustive, step-by-step exposition of the legal and procedural requirements for filing such complaints, the governing legal framework, the respective roles of the NBI and PNP-ACG, the evidentiary and jurisdictional considerations, and all ancillary matters necessary for a complainant to navigate the process effectively.

I. Legal Framework Governing Cybercrime Complaints

Republic Act No. 10175 defines cybercrime as any offense committed through or facilitated by the use of information and communications technologies (ICT). The Act enumerates three broad categories of offenses:

Offenses against the confidentiality, integrity, and availability of computer data and systems – including illegal access, illegal interception, data interference, system interference, misuse of devices, and cyber-squatting.
Computer-related offenses – such as computer-related forgery, fraud, and identity theft.
Content-related offenses – including cybersex, child pornography, and libel committed through ICT.

The Implementing Rules and Regulations (IRR) of RA 10175, promulgated by the Department of Justice (DOJ), Department of Information and Communications Technology (DICT), and the National Privacy Commission (NPC), further operationalize these provisions. Complementary laws include Republic Act No. 10173 (Data Privacy Act of 2012), which imposes additional obligations in cases involving personal data breaches, and Republic Act No. 10844, which created the DICT and strengthened the institutional response to cyber threats.

The Cybercrime Investigation and Coordinating Center (CICC), an inter-agency body attached to the Office of the President, coordinates the efforts of all law enforcement agencies, including the NBI and PNP-ACG. While the CICC does not directly receive complaints, it ensures that cases filed with either agency are properly monitored and escalated when necessary. Jurisdiction over cybercrimes is concurrent among the NBI and PNP-ACG; the choice of agency is generally at the complainant’s discretion, subject to the principle of venue under Rule 110 of the Revised Rules of Criminal Procedure.

II. Role and Mandate of the NBI Cybercrime Division versus the PNP-ACG

The NBI Cybercrime Division operates under the National Bureau of Investigation, an agency of the DOJ. It possesses nationwide jurisdiction, highly specialized forensic laboratories, and authority to conduct undercover operations, serve search warrants, and execute arrests in coordination with the courts. The NBI is particularly suited for complex, multi-jurisdictional, or high-value cases involving sophisticated hacking, transnational cyber fraud, or cases requiring deep digital forensics.

The PNP-ACG, on the other hand, is the specialized unit of the Philippine National Police under the PNP Directorate for Intelligence. It maintains regional offices across the country, enabling faster local response. The ACG is the primary frontline agency for most day-to-day cybercrime complaints, especially those involving ordinary citizens victimized by online scams, phishing, or social media-related offenses. It maintains dedicated cybercrime laboratories and works closely with private sector partners such as internet service providers and financial institutions.

Both agencies are empowered under Section 10 of RA 10175 to receive complaints, conduct investigations, and file cases before the prosecutor’s office or the Office of the Ombudsman (for public officials). There is no legal hierarchy between the two; a complaint filed with one does not preclude referral to the other if the expertise or resources of the second agency become necessary.

III. Prerequisites Before Filing a Complaint

Before approaching either agency, a prospective complainant must:

Preserve digital evidence in its original form. This includes taking screenshots, recording URLs, saving email headers, chat logs, transaction receipts, and IP addresses without alteration. Any modification may render evidence inadmissible under the Rules on Electronic Evidence (A.M. No. 01-7-01-SC).
Document the timeline of events with precise dates, times, and descriptions of the offense.
Secure a copy of any police blotter if the incident was first reported to the nearest PNP station.
Determine the proper venue. Cybercrimes may be filed where the offense was committed, where any of its elements occurred, or where the victim resides (Section 21, RA 10175 and Rule 110, Rules of Court).
Prepare a Complaint-Affidavit in the form prescribed by the Rules of Court, sworn before a notary public, prosecutor, or authorized officer of the chosen agency. The affidavit must state the personal circumstances of the complainant, the facts constituting the offense, the identity of the perpetrator (if known), and the relief sought.

False statements in the complaint-affidavit may expose the affiant to prosecution for perjury under Article 183 of the Revised Penal Code.

IV. Step-by-Step Procedure for Filing with the PNP-ACG

Option A – In-Person Filing (Recommended for Most Cases):
Proceed to the PNP-ACG headquarters at Camp BGen Rafael T. Crame, Quezon City, or any of its regional or provincial offices. Present a valid government-issued identification (passport, driver’s license, or SSS/GSIS ID). Submit the notarized Complaint-Affidavit together with all supporting evidence in hard copy and digital format (preferably on a write-protected USB device). The duty officer will issue an acknowledgment receipt and assign a case number.
Option B – Referral from Local PNP Station:
If the offense is first reported to any police station, the station commander is required under PNP operational procedures to immediately forward the complaint to the nearest ACG unit or the national ACG for technical evaluation.
Option C – Online or Electronic Submission (When Available):
The PNP-ACG maintains an online complaint portal linked to its official website. Complainants may upload a scanned Complaint-Affidavit and digital evidence. However, physical appearance is still required for the oath-taking and formal acceptance of the complaint.
Post-Filing:
The ACG conducts an initial technical investigation, which may include issuing preservation orders to service providers under Section 13 of RA 10175. A preliminary investigation is thereafter conducted, and the case is forwarded to the prosecutor’s office for the filing of an Information in court if probable cause is found.

V. Step-by-Step Procedure for Filing with the NBI Cybercrime Division

In-Person Filing:
Proceed to the NBI main office at Taft Avenue, Manila, or any NBI regional or district office equipped with a cybercrime unit. Present valid identification and submit the notarized Complaint-Affidavit together with evidence. NBI agents will conduct an immediate intake interview to assess the technical complexity of the case.
Request for Investigative Assistance:
If the case involves national security, large-scale financial loss, or requires NBI’s forensic expertise, the complainant may request that the NBI assume primary jurisdiction. The NBI may issue a formal “Take-Over” request to the PNP-ACG if the case has already been filed with the latter.
Electronic or Mailed Complaints:
While the NBI prefers physical filing, certain regional offices accept complaints sent through registered mail or secure email channels, provided that the original notarized affidavit is subsequently presented for verification.
Post-Filing:
The NBI Cybercrime Division conducts a full technical and criminal investigation, which may include the issuance of search warrants, subpoenas to internet service providers, and coordination with foreign law enforcement through mutual legal assistance treaties (MLATs) where the perpetrator is overseas. The Division forwards the case to the DOJ for inquest or regular preliminary investigation.

VI. Required Documents and Evidence (Common to Both Agencies)

Duly notarized Complaint-Affidavit (original and at least two copies).
Valid government-issued photo ID of the complainant.
Proof of residency or business registration (if a juridical person).
Digital evidence in its native format (e.g., .eml files for emails, raw log files, unedited screenshots with metadata).
Certification from a service provider (if applicable) confirming the transaction or account details.
Medical certificate or psychological evaluation (in cases of cybersex or child pornography involving victims).
Any prior communication with the perpetrator (demand letters, settlement offers).

All evidence must be marked, identified, and authenticated during the preliminary investigation.

VII. Investigation Process and Timeline

Upon acceptance of the complaint, both agencies are mandated to act with reasonable dispatch. Section 15 of RA 10175 requires law enforcement to act within 24 hours on requests for preservation of computer data. The preliminary investigation before the prosecutor must be completed within 60 days from the filing of the complaint (extendible for justifiable reasons). Once an Information is filed in court, the case proceeds under the Rules of Court, with cybercrime cases often raffled to specialized commercial or regional trial courts designated by the Supreme Court.

VIII. Possible Outcomes, Remedies, and Civil Liability

A successful prosecution may result in imprisonment, fines, and the imposition of accessory penalties such as forfeiture of devices or proceeds of the crime. Independently of the criminal action, the victim may file a separate civil complaint for damages under Article 100 of the Revised Penal Code and the Civil Code provisions on torts. In data breach cases, an administrative complaint may also be lodged with the National Privacy Commission for enforcement of RA 10173 penalties.

IX. Common Pitfalls and Best Practices

Do not delete or alter digital evidence.
Avoid public disclosure of case details that may compromise the investigation.
File promptly; prescription periods for cybercrimes generally follow the general rules under the Revised Penal Code (15 years for grave felonies, 10 years for less grave).
Engage the services of a lawyer experienced in cyber law for the drafting of the affidavit and representation during preliminary investigation.
Cooperate fully with investigators and preserve chain of custody of evidence at all times.

X. Conclusion

Filing a cybercrime complaint with either the NBI Cybercrime Division or the PNP-ACG is a straightforward yet technically demanding process that demands meticulous preparation of evidence and strict adherence to the procedural requirements of RA 10175 and the Rules of Court. The choice between the two agencies should be guided by the nature of the offense, the geographical convenience, and the level of forensic sophistication required. By understanding the full legal and operational landscape, victims of cybercrime can effectively invoke the protective machinery of the State, contribute to the deterrence of future offenses, and secure the justice to which they are entitled under Philippine law.