Cybercrime complaints in the Philippines are primarily handled by two specialized law enforcement agencies: the Philippine National Police Anti-Cybercrime Group (PNP-ACG) and the National Bureau of Investigation Cybercrime Division (NBI Cybercrime Division). These agencies derive their authority from Republic Act No. 10175, otherwise known as the Cybercrime Prevention Act of 2012, which establishes the legal framework for investigating and prosecuting offenses committed through information and communications technology.

Legal Framework

RA 10175 defines and penalizes a wide range of cybercrimes, categorized into three main groups:

Offenses against the confidentiality, integrity, and availability of computer data and systems: Illegal access (hacking), illegal interception, data interference, system interference, and misuse of devices.
Computer-related offenses: Computer-related forgery, computer-related fraud, and computer-related identity theft.
Content-related offenses: Cyber libel, child pornography (cross-referenced with RA 9775 or the Anti-Child Pornography Act of 2009), and unsolicited commercial communications (subject to constitutional limitations).

The Supreme Court in Disini, Jr. v. Secretary of Justice (G.R. No. 203335, February 18, 2014) upheld the constitutionality of the core provisions of RA 10175 while declaring certain clauses unconstitutional, including aspects of aiding or abetting libel and unrestricted real-time collection of traffic data without judicial warrant. The remaining provisions remain fully enforceable.

Related statutes frequently invoked alongside RA 10175 include:

Provisions of the Revised Penal Code on estafa, libel, and other crimes when committed via digital means.
Republic Act No. 10173 (Data Privacy Act of 2012) for willful violations involving personal data.
Republic Act No. 8792 (Electronic Commerce Act of 2000) for electronic transactions and signatures.
Special laws on online sexual exploitation, financial fraud, and threats.

The Cybercrime Investigation and Coordinating Center (CICC), created under RA 10175 and placed under the Department of Information and Communications Technology, coordinates policy and inter-agency efforts but does not directly investigate individual complaints. Actual investigative work rests with the PNP-ACG and NBI.

Who May File

Any aggrieved party or person with personal knowledge of the commission of a cybercrime may file a complaint. This includes:

Individual victims.
Authorized representatives of corporations or entities (with board resolution or special power of attorney).
Parents, guardians, or legal representatives acting on behalf of minors or persons with disabilities.
Law enforcement officers or concerned citizens in appropriate cases.

Complaints must generally be filed in good faith. Malicious or false filings may expose the complainant to counter-charges such as perjury or unjust vexation.

Preparing the Complaint

Thorough preparation significantly strengthens a complaint and facilitates investigation.

Evidence Preservation

Digital evidence is highly perishable. Complainants must:

Immediately capture and preserve screenshots, screen recordings, chat logs, emails, transaction histories, and metadata in their original format.
Record exact dates, times, URLs, usernames, profile links, IP addresses (if known), and platform details.
Avoid editing, cropping, or altering any files.
Export full conversation threads or email headers where possible.
For financial losses, compile bank statements, e-wallet transaction records (GCash, Maya, etc.), receipts, and communications with financial institutions.
Maintain a clear chain of custody by noting how and when evidence was obtained.

Digital evidence submitted to Philippine courts must comply with the Rules on Electronic Evidence (A.M. No. 01-7-01-SC). While initial complaints may be supported by printouts and digital copies, investigators or prosecutors may later require forensic authentication, hash verification, or expert testimony to establish integrity and authenticity.

Drafting the Complaint-Affidavit

The core document is a sworn Complaint-Affidavit (Sinumpaang Salaysay). It must contain:

Complete personal details of the complainant (full name, address, date of birth, civil status, occupation, government-issued ID number, and contact information).
If filed through a representative, the basis of authority (special power of attorney or board resolution, attached as annex).
A clear, chronological narration of facts: nature of the cybercrime, date and time of discovery or commission, manner of commission, online platforms or channels used, and identity or description of the suspect(s) (usernames, email addresses, phone numbers, profile links, or any known aliases).
Description of harm or damage suffered (financial loss, emotional distress, reputational harm, etc.).
List of attached evidence with brief descriptions.
Prayer for relief: conduct of investigation, preservation of evidence from service providers, identification and arrest of perpetrators, and filing of appropriate criminal charges.

The affidavit must be subscribed and sworn to before a notary public or any officer authorized by law to administer oaths. Notarization fees are minimal and standard.

Supporting Documents

Attach:

Clear photocopies of valid government-issued identification.
Printed and digital copies of all evidence (organized and labeled).
Any existing police blotter or prior reports.
Medical or psychological reports if claiming harm to health.
Proof of financial transactions and losses.
Power of attorney or corporate authorization, if applicable.

Filing with the Philippine National Police (PNP)

The PNP Anti-Cybercrime Group (ACG) serves as the primary cybercrime investigation unit of the police force and maintains nationwide presence through its headquarters and regional units.

Where and How to File

In-person filing at the PNP-ACG Headquarters, Camp Crame, EDSA, Quezon City, or at designated regional or provincial ACG units. Local police stations may accept initial reports and refer them to ACG via the PNP e-blotter system.
Online or electronic channels: The PNP maintains official mechanisms for initial cybercrime reporting through its website and dedicated portals. Electronic submission of the complaint-affidavit and scanned evidence is accepted, although original documents and in-person verification may still be required for formal docketing.

Step-by-Step Process

Submit the Complaint-Affidavit and supporting evidence to the receiving officer or through the online portal.
The complaint is logged, and an acknowledgment receipt or reference/case number is issued.
The complaint undergoes initial evaluation for sufficiency and jurisdiction.
If accepted, the case is assigned to an investigator or team.
Investigators may require additional statements, clarification, or original evidence.
For time-sensitive matters (ongoing threats, active child exploitation, or imminent harm), request immediate action, including urgent requests to service providers for data preservation.

Filing with the National Bureau of Investigation (NBI)

The NBI Cybercrime Division possesses advanced digital forensic laboratories and typically handles complex, high-value, or technically sophisticated cases.

Where and How to File

In-person filing at the NBI Cybercrime Division, NBI Main Office, Taft Avenue, Manila, or at NBI regional offices with cybercrime capability (e.g., Cebu, Davao, and other major centers).
NBI also accepts walk-in complaints and may accommodate initial electronic submissions, subject to verification.

Step-by-Step Process

Present the Complaint-Affidavit and complete set of evidence to the Cybercrime Division.
The division conducts a preliminary assessment.
Upon acceptance, a case number is assigned.
Investigators perform digital forensics, coordinate with internet service providers and online platforms (subject to appropriate legal processes such as subpoenas or court orders), and may engage international counterparts through Interpol or mutual legal assistance mechanisms when perpetrators or servers are located abroad.
Additional documents or device submissions may be requested for forensic examination.

Choosing Between PNP and NBI

Both agencies have concurrent jurisdiction. Practical considerations include:

PNP-ACG is generally more accessible for straightforward cases such as online scams, cyber libel, identity theft, and harassment. Local police stations can serve as entry points.
NBI Cybercrime Division is often preferred for intricate technical investigations, large-scale fraud, hacking incidents, ransomware, or cases requiring sophisticated forensic analysis.

Complainants may file with one primary agency. Filing with both is possible but may lead to coordination between the agencies. In practice, many victims start with PNP-ACG and escalate to NBI if initial action is insufficient.

Post-Filing Procedure

Upon acceptance:

The assigned agency issues a case reference number for status inquiries.
Investigators gather further evidence, including subscriber information and content from social media platforms, email providers, and telecommunications companies (often requiring judicial authorization).
Coordination may occur with the CICC, Department of Justice, National Privacy Commission, banks, and foreign law enforcement.
Upon completion of the investigation or when sufficient evidence exists, the case is referred to the Office of the Prosecutor for preliminary investigation to determine probable cause.
If probable cause is found, an Information is filed before the appropriate Regional Trial Court (cybercrime courts or designated branches exercise jurisdiction).
Complainants are entitled to periodic updates and may request status reports using the case number.

Investigation timelines vary widely—from several weeks for simple cases to many months or over a year for complex, cross-border matters—depending on evidence volume, international cooperation, and court dockets.

Special Categories and Additional Procedures

Crimes involving minors or child sexual exploitation: Immediate reporting is essential. Both PNP-ACG and NBI maintain specialized units. Parallel reporting to the Department of Social Welfare and Development or dedicated hotlines may be appropriate.
Financial cybercrimes and scams: File simultaneously with the affected bank or e-wallet provider for possible transaction reversal or fraud dispute. The police report supports insurance claims or chargeback requests.
Cross-border or transnational crimes: Agencies utilize mutual legal assistance treaties and Interpol channels. These cases inherently take longer.
Threats, harassment, or ongoing harm: Request protective measures where available under applicable laws (e.g., RA 9262 for violence against women and children if elements are present).
Platform-level reporting: Independently report offending content to the social media platform, website host, or service provider for takedown or account suspension. This complements but does not replace a formal complaint with Philippine authorities.

Prescription Periods and Timeliness

Offenses prescribe according to applicable laws. Cyber libel generally prescribes one year from commission or discovery. Other cybercrimes follow periods under the Revised Penal Code or special laws (commonly five to fifteen years or longer for grave offenses). Prompt filing is strongly advised to avoid extinguishment of criminal liability and to enable timely evidence preservation by service providers.

Costs and Accessibility

Filing a criminal complaint with the PNP or NBI is free of charge. Notarization of the affidavit involves standard notarial fees. No filing fees apply to criminal complaints in the Philippines. Both agencies maintain offices in major urban centers, and online channels improve accessibility for those outside Metro Manila.

Key Practical Considerations

Digital evidence must remain unaltered to preserve admissibility. Complainants should avoid further direct contact with suspects that could compromise evidence or personal safety. Technical explanations in the affidavit should be clear and factual. High caseloads exist in both agencies; consistent follow-up using the official case number is necessary. Engaging a lawyer for affidavit preparation, evidence organization, and case monitoring is advisable, particularly for complex or high-stakes matters, although not legally required for the initial filing.

Parallel civil actions for damages may be pursued independently or reserved. The criminal complaint does not bar recovery of civil liability.

This comprehensive process ensures that victims of cybercrime can effectively engage the Philippine justice system under RA 10175 and related laws through the PNP or NBI. Accurate documentation, timely action, and cooperation with investigators form the foundation for successful investigation and prosecution.