Cybercrime scams are now among the most common forms of fraud in the Philippines. They may involve fake online sellers, phishing links, hacked accounts, fake investment platforms, e-wallet fraud, romance scams, job scams, loan scams, cryptocurrency schemes, impersonation, unauthorized bank transfers, fake customer service pages, SIM-related scams, online blackmail, marketplace fraud, and identity theft.

A victim of a cybercrime scam should act quickly. Digital evidence can disappear, fake accounts can be deleted, funds can be transferred through multiple accounts, and scammers may continue targeting other victims. The strongest complaints are those supported by screenshots, transaction receipts, account links, URLs, phone numbers, bank or e-wallet records, chat logs, and a clear timeline.

In the Philippines, a cybercrime scam complaint may be reported to cybercrime law enforcement units, the National Bureau of Investigation, the Philippine National Police, the prosecutor’s office, banks, e-wallet providers, telecommunications companies, online platforms, the National Privacy Commission, the Securities and Exchange Commission, the Department of Trade and Industry, or other agencies depending on the scam.

This article explains what qualifies as a cybercrime scam, what laws may apply, what evidence to gather, where to file, how to prepare a complaint-affidavit, what happens after filing, and what practical steps victims should take.

1. What Is a Cybercrime Scam?

A cybercrime scam is a fraudulent scheme committed through, using, or involving a computer system, internet platform, mobile phone, digital account, electronic payment system, website, social media account, messaging app, e-wallet, online marketplace, email, or other information and communications technology.

It usually involves deceit for financial gain or unlawful advantage.

Common scam methods include:

pretending to be a seller and collecting payment without delivering goods;
pretending to be a buyer and using fake payment proof;
sending phishing links to steal account credentials;
hacking or taking over social media or e-wallet accounts;
impersonating relatives, friends, banks, government agencies, or companies;
offering fake jobs or work-from-home schemes;
promoting fake investments;
offering fake loans and collecting advance fees;
running romance scams;
extorting victims through private photos or videos;
selling fake travel tickets, gadgets, rentals, or services;
asking for OTP, MPIN, password, or verification codes;
using fake customer support pages;
collecting payments through mule bank accounts or e-wallets;
using fake IDs, fake receipts, or fake tracking numbers.

The legal classification depends on the specific acts and evidence.

2. Common Types of Cybercrime Scams

Cybercrime scams can appear in many forms.

A. Online Selling Scam

A seller posts goods online, accepts payment, and does not deliver. The seller may block the buyer afterward or send fake tracking information.

Examples:

fake gadget seller;
fake concert ticket seller;
fake clothing shop;
fake appliance seller;
fake car parts seller;
fake preorder page;
fake live selling account;
fake marketplace listing;
fake rental listing;
fake courier or shipping fee demand.

B. Fake Buyer Scam

A scammer pretends to buy an item and sends fake payment confirmation, fake bank transfer screenshots, or fake escrow links.

Examples:

fake deposit receipt;
fake payment email;
overpayment scam;
fake courier pickup;
phishing link disguised as payment claim;
fake marketplace protection page.

C. Phishing

Phishing uses fake links, pages, messages, or emails to steal credentials.

Examples:

fake bank login page;
fake e-wallet verification page;
fake delivery tracking link;
fake account recovery page;
fake government aid form;
fake promo or raffle registration;
fake security alert;
fake “account will be suspended” message.

D. Account Takeover

A scammer gains access to a victim’s account and uses it to steal money or scam contacts.

Examples:

hacked Facebook account asks friends for loans;
compromised e-wallet sends money out;
hacked email resets bank credentials;
social media account used to sell fake goods;
messaging app used to solicit emergency funds.

E. E-Wallet and Bank Transfer Scam

The scam involves unauthorized transfers, fake payment links, or manipulation of digital finance accounts.

Examples:

unauthorized GCash, Maya, bank, or e-wallet transfer;
scammer tricks victim into sending money;
victim shares OTP after fake support call;
SIM swap leads to account takeover;
fake QR code diverts payment;
scammer uses mule accounts.

F. Investment Scam

The scammer offers high returns, guaranteed profit, crypto trading, forex trading, online tasks, franchising, lending investment, or pooled funds.

Red flags include:

guaranteed daily or monthly returns;
referral commissions;
pressure to invest quickly;
no SEC registration or authority;
fake certificates;
returns paid from new investors;
refusal to disclose business model;
sudden withdrawal restrictions.

G. Job Scam

A fake employer or recruiter collects money or personal information.

Examples:

payment for processing fee;
payment for training kit;
fake overseas job placement;
fake work-from-home task platform;
advance fee for equipment;
fake interview link used for phishing;
money mule recruitment.

H. Loan Scam

A fake lender promises fast approval but demands upfront fees.

Examples:

processing fee;
insurance fee;
anti-money laundering clearance fee;
release fee;
notarial fee;
account activation fee;
borrower pays but no loan is released.

I. Romance Scam

A scammer builds an online relationship and later asks for money.

Common excuses include:

emergency hospital bills;
customs fees;
plane ticket;
visa processing;
business problem;
frozen account;
package delivery;
military deployment problem.

J. Sextortion and Online Blackmail

The scammer threatens to release private images, videos, or fabricated sexual content unless money is paid.

This may involve:

private video call recording;
intimate photo threat;
fake edited image;
threat to send content to family or employer;
repeated money demands.

If the victim is a minor, child protection laws and special handling are critical.

3. Laws That May Apply

A cybercrime scam may involve several laws, depending on the facts.

A. Cybercrime Prevention Law

This may apply to computer-related fraud, identity theft, illegal access, cyberlibel, data interference, system interference, misuse of devices, and other offenses committed through computer systems.

B. Revised Penal Code

Traditional crimes may also apply, including estafa, theft, falsification, threats, coercion, unjust vexation, libel, and other offenses.

C. Access Device and Financial Fraud Laws

If the scam involves credit cards, debit cards, account credentials, online banking, ATM cards, or access devices, special laws may apply.

D. Data Privacy Law

If personal data, IDs, selfies, contact lists, addresses, financial records, or sensitive personal information were collected, used, shared, or exposed unlawfully, data privacy remedies may apply.

E. Securities Laws

If the scam involves investments, securities, pooled funds, crypto investment schemes, lending investments, or guaranteed returns, securities regulation may apply.

F. Consumer Protection Laws

If the scam involves online selling, defective products, false advertising, deceptive sales, or merchant misconduct, consumer protection remedies may apply.

G. Anti-Trafficking, Child Protection, and Anti-Voyeurism Laws

If the scam involves sexual exploitation, minors, intimate images, grooming, trafficking, or online sexual abuse, special laws may apply.

A complainant does not need to perfectly identify every legal offense at the start. The important task is to present the facts and evidence clearly.

4. Is It Cybercrime, Estafa, or Both?

Many online scams are both cybercrime-related and estafa-related.

Estafa

Estafa generally involves deceit or abuse of confidence causing damage. In an online scam, estafa may occur when the scammer deceives the victim into sending money.

Cybercrime

Cybercrime may apply because the fraud was committed through a computer system, online account, mobile app, or digital platform.

Example:

A fake seller uses Facebook Marketplace, sends false representations through Messenger, receives GCash payment, and blocks the buyer. This may involve estafa and cybercrime-related fraud.

The prosecutor or investigator may determine the precise charges.

5. First Rule: Preserve Evidence Immediately

Before confronting the scammer, preserve evidence. Scammers often delete accounts, unsend messages, change usernames, remove posts, or block victims.

Save:

screenshots of the scammer’s profile;
account username, handle, URL, or link;
screenshots of posts or listings;
full chat conversation;
payment receipts;
bank or e-wallet transaction reference numbers;
QR codes used;
phone numbers;
email addresses;
website URLs;
order confirmation;
fake receipts;
shipping labels;
tracking numbers;
calls and SMS logs;
photos or videos sent by the scammer;
names of other victims;
group chat records;
platform reports;
customer support ticket numbers.

Do not rely only on memory.

6. How to Take Useful Screenshots

Screenshots should show context. Capture:

full name or account name;
username or handle;
profile photo;
profile URL;
date and time of messages;
complete messages, not just selected lines;
payment instructions;
account numbers;
e-wallet or bank names;
promises made by scammer;
proof of payment;
scammer’s acknowledgment of payment;
failure to deliver;
blocking or deletion, if visible;
comments from other victims.

For long conversations, take screenshots in sequence. Avoid cropping out identifying information.

7. Save URLs and Account Links

A screenshot of a profile is useful, but the actual link is often more useful.

Save links to:

social media profile;
marketplace listing;
group post;
comment thread;
website;
phishing page;
fake customer support page;
video or livestream;
product listing;
online investment page.

Copy and paste the URL into a document together with the date and time accessed.

8. Download Account Data Where Possible

Some platforms allow users to download chat or account data. This may help preserve messages in a more complete form.

Examples of useful exports include:

Facebook data download;
Messenger conversation export;
email headers;
bank statement export;
e-wallet transaction history;
marketplace order records;
website order records;
call logs;
cloud backups.

Keep original files when possible.

9. Do Not Delete the Conversation

Victims sometimes delete conversations out of anger, shame, or fear. This weakens the case.

Keep:

chat thread;
payment receipts;
scammer profile;
emails;
SMS;
call logs;
app notifications;
fake documents.

If the scam involves intimate images or minors, preserve evidence privately and securely. Do not repost or share publicly.

10. Secure Your Accounts

If the scam involved hacking, phishing, or account takeover, secure all related accounts immediately.

Steps include:

change passwords;
enable two-factor authentication;
log out unknown devices;
remove unknown recovery emails or phone numbers;
check linked accounts;
remove suspicious app permissions;
change email password;
secure e-wallet and banking apps;
freeze or temporarily restrict accounts if needed;
report lost SIM or device;
check for unauthorized loans or transfers;
warn contacts if your account was used to scam others.

Use a clean device if you suspect malware.

11. Report to Bank or E-Wallet Provider Immediately

If money was sent through a bank, e-wallet, remittance center, crypto exchange, or payment platform, report immediately.

Ask for:

transaction hold or freeze, if possible;
dispute filing;
fraud report ticket number;
recipient account review;
transaction tracing;
written acknowledgment;
reversal process, if available;
preservation of account logs;
confirmation whether funds were withdrawn;
instructions for law enforcement coordination.

Time is critical. Funds may be moved quickly through mule accounts.

12. What to Send to the Bank or E-Wallet

Provide:

your full name;
your account or mobile number;
transaction date and time;
amount;
recipient account name;
recipient account number or mobile number;
reference number;
screenshots of scam conversation;
explanation of fraud;
police or cybercrime report, if already available;
request to freeze or investigate recipient account;
your contact details.

Always ask for a case or ticket number.

13. Report to the Platform

Report the scam account or listing to the platform, such as Facebook, Instagram, TikTok, X, YouTube, Shopee, Lazada, Carousell, Telegram, Viber, WhatsApp, or other service.

Report categories may include:

scam or fraud;
impersonation;
fake account;
phishing;
hacked account;
harassment;
non-consensual intimate content;
child exploitation;
counterfeit goods;
intellectual property violation.

Platform reporting may result in takedown, account restriction, or preservation of evidence. But do not rely only on platform reporting if money was lost.

14. Report to Cybercrime Authorities

A cybercrime scam complaint may be reported to law enforcement cybercrime units.

Common options include:

Philippine National Police Anti-Cybercrime Group;
National Bureau of Investigation Cybercrime Division;
local police station for initial blotter or referral;
prosecutor’s office for filing a criminal complaint;
specialized agencies depending on scam type.

For serious fraud, account takeover, extortion, or large losses, report as soon as possible.

15. PNP Anti-Cybercrime Group

The PNP Anti-Cybercrime Group handles cybercrime reports, investigation, digital evidence, online fraud, hacking, phishing, identity theft, cyber harassment, and related offenses.

When reporting, bring:

valid government ID;
printed screenshots;
digital copies of evidence;
transaction receipts;
bank or e-wallet records;
scammer account links;
phone numbers and emails;
written timeline;
affidavit or complaint narrative;
platform report details;
names of witnesses or other victims.

The PNP may evaluate the evidence and advise on next steps.

16. NBI Cybercrime Division

The NBI Cybercrime Division also receives complaints involving online fraud, account hacking, phishing, identity theft, online scams, sextortion, cyberlibel, and related cyber offenses.

Bring:

valid ID;
complaint narrative;
screenshots;
URLs;
transaction records;
scammer details;
bank or e-wallet reports;
device or account information;
printed and digital evidence;
other supporting documents.

The NBI may conduct technical investigation or refer the matter for appropriate legal action.

17. Filing With the Prosecutor’s Office

A criminal complaint may be filed with the Office of the City or Provincial Prosecutor.

A prosecutor’s complaint usually requires:

complaint-affidavit;
supporting affidavits;
screenshots and printouts;
transaction records;
identity documents;
proof of scam;
proof of payment;
proof of damage;
evidence linking respondent to the scam;
certification or authentication of electronic evidence where needed.

If the respondent is unknown, law enforcement investigation may be needed first to identify the person behind the account.

18. Unknown Scammer: Can You Still File?

Yes. A victim may report even if the real identity of the scammer is unknown.

Many scammers use:

fake names;
stolen photos;
mule accounts;
prepaid SIMs;
hacked accounts;
fake IDs;
VPNs;
disposable emails;
multiple e-wallets;
foreign platforms.

Authorities may use lawful processes to trace accounts, phone numbers, payment records, IP logs, KYC records, or recipient account details.

However, identifying an anonymous scammer can be difficult, especially if evidence is incomplete or funds were quickly withdrawn.

19. Known Scammer: What If You Know the Person?

If the scammer is known, the complaint should include:

full name;
address, if known;
phone number;
social media accounts;
bank or e-wallet account details;
proof connecting that person to the scam account;
proof of payment to their account;
screenshots of admissions;
witness statements;
prior transactions.

Do not rely on assumptions. The complaint must link the person to the fraudulent act.

20. Evidence Linking the Scammer to the Account

This is often the hardest part. Useful linking evidence includes:

bank or e-wallet account registered name;
phone number used in chat and payment;
same name across accounts;
delivery address;
ID sent by scammer;
video call or voice call;
admissions;
account recovery data from platform, through lawful process;
IP logs, through lawful process;
witness identification;
other victims identifying the same person;
screenshots showing the person controlling the account;
transaction recipient records.

A fake name alone may not be enough.

21. Complaint-Affidavit

A complaint-affidavit is a sworn statement narrating what happened and attaching evidence.

It should be:

clear;
chronological;
factual;
specific;
supported by attachments;
free of exaggeration;
signed and sworn before an authorized officer.

A well-prepared affidavit helps investigators and prosecutors understand the case quickly.

22. Contents of a Complaint-Affidavit

A complaint-affidavit should include:

complainant’s name, age, address, and contact details;
respondent’s identity, if known;
platform used;
account name and URL;
date and time of first contact;
representations made by scammer;
amount paid;
payment method;
recipient account details;
transaction reference number;
what the scammer promised;
what actually happened;
steps taken after discovering the scam;
reports made to bank, e-wallet, or platform;
damage suffered;
list of attached evidence;
request for investigation and prosecution.

23. Sample Complaint-Affidavit Structure

A basic structure may be:

Introduction – Identify the complainant.
Background – Explain how contact with the scammer began.
Fraudulent Representation – State what the scammer promised or claimed.
Payment – State how much was paid, when, and to whom.
Failure or Deceit – Explain non-delivery, blocking, false receipts, or other fraud.
Evidence – Identify screenshots, receipts, URLs, and transaction records.
Damage – State financial loss and other harm.
Action Taken – State reports to bank, platform, or authorities.
Prayer – Request investigation and filing of appropriate charges.

24. Sample Complaint-Affidavit Language

A simplified affidavit may state:

I, [name], of legal age, Filipino, and residing at [address], after being sworn, state:

On [date], I saw an online post by [account name/profile link] offering [item/service/investment].

I contacted the said account through [platform], and the person represented that [specific promise].

Relying on those representations, I sent PHP [amount] on [date/time] through [bank/e-wallet] to [recipient name/account number/mobile number], with transaction reference number [number].

After receiving payment, the person failed to deliver [item/service/return], gave false excuses, and later [blocked me/deleted the account/stopped replying].

I later discovered that the representations were false and that I was defrauded.

Attached are screenshots of the conversation, the account profile, the online post, payment receipt, and other evidence.

I respectfully request investigation and the filing of appropriate charges against the person or persons responsible.

This should be customized to the actual facts.

25. Evidence Index

Organize evidence into annexes.

Example:

Annex A – Screenshot of scammer profile.
Annex B – Screenshot of online listing.
Annex C – Chat conversation, pages 1 to 10.
Annex D – Payment receipt.
Annex E – Bank or e-wallet transaction history.
Annex F – Screenshot showing scammer blocked complainant.
Annex G – Platform report confirmation.
Annex H – Bank or e-wallet fraud ticket.
Annex I – Written demand or follow-up messages.
Annex J – Affidavit of witness or other victim.

A clean evidence file makes the complaint more credible.

26. Timeline of Events

Prepare a timeline.

Example:

March 1, 2026 – Saw Facebook listing for iPhone.
March 1, 2026, 8:00 PM – Messaged seller.
March 1, 2026, 9:00 PM – Seller promised delivery after payment.
March 2, 2026, 10:15 AM – Sent PHP 18,000 to GCash number.
March 2, 2026, 11:00 AM – Seller confirmed receipt.
March 3, 2026 – Seller sent fake tracking number.
March 4, 2026 – Seller stopped replying.
March 5, 2026 – Account blocked me.
March 5, 2026 – Reported to e-wallet provider and platform.
March 6, 2026 – Prepared complaint.

Investigators appreciate precise dates.

27. Amount of Loss

State the exact amount lost. Include:

principal amount paid;
transfer fees;
additional shipping fees;
repeated payments;
penalty or loan charges caused by scam;
bank charges;
other directly related losses.

For criminal purposes, the amount may affect penalties or case handling.

28. What If the Amount Is Small?

Even small scams may be reported. Small amounts may be part of a larger pattern affecting many victims.

However, practical enforcement may depend on evidence, identification of scammer, and agency resources.

For small amounts, victims may also consider:

platform report;
bank or e-wallet dispute;
small claims, if the scammer is known;
group complaint with other victims;
barangay documentation if the person is local and known;
demand letter.

29. What If Many Victims Are Involved?

A group complaint may be stronger.

Group evidence may show:

same scammer;
same account;
same payment account;
repeated fraudulent pattern;
larger total amount;
organized scheme;
multiple witnesses;
common modus.

Each victim should still prepare individual proof of payment and communication.

30. Demand Letter Before Filing

A demand letter is not always required before filing a cybercrime scam complaint. However, it may help in some cases, especially when the scammer is known and may settle.

A demand letter may state:

transaction details;
false representations;
amount paid;
demand for refund;
deadline;
warning that legal remedies will be pursued;
request to preserve evidence.

Avoid threats, insults, or defamatory statements.

31. Sample Demand Letter

I demand the immediate return of PHP [amount], which I sent to you on [date] through [payment method] for [item/service/investment]. You represented that [promise], but you failed to deliver and have not provided a valid refund.

Please return the amount within [number] days from receipt of this demand. This demand is without prejudice to my right to file criminal, civil, cybercrime, consumer protection, and other appropriate complaints.

If the scammer is unknown or dangerous, reporting directly may be better than warning them.

32. Should You Confront the Scammer?

Be careful. Confronting the scammer may cause them to delete evidence, move funds, or threaten you.

Before confrontation:

preserve all evidence;
save URLs and account links;
report to payment provider;
consider filing with authorities;
avoid threats or insults;
avoid revealing your strategy.

If the scam involves extortion, threats, or intimate images, avoid negotiating alone.

33. Do Not Pay More Money

Scammers often demand additional fees after the first payment.

Common follow-up demands include:

shipping fee;
customs fee;
tax clearance;
withdrawal fee;
anti-money laundering clearance;
lawyer fee;
account activation fee;
refund processing fee;
courier insurance fee;
platform unlock fee.

Do not send more money just to recover the first payment.

34. Do Not Share OTP or Password

No legitimate bank, e-wallet, government agency, or platform should ask for your OTP, MPIN, password, or full security credentials.

If you shared credentials, secure accounts immediately and report account compromise.

35. If the Scam Involves Bank or E-Wallet Mule Accounts

Scammers often use mule accounts, meaning accounts owned by people who receive scam funds for a commission or under false pretenses.

The recipient account holder may claim:

account was borrowed;
they were also scammed;
they sold their SIM or account;
they acted as cash-out agent;
they did not know the source of funds.

Even if the real mastermind is unknown, the mule account is an important investigative lead.

36. Request to Freeze Funds

Victims should ask the bank or e-wallet provider to freeze or hold funds if still available.

However:

providers may need legal basis;
funds may already be withdrawn;
bank secrecy and privacy rules apply;
law enforcement may need to coordinate;
timely report increases chances of recovery.

Ask for written confirmation of your report.

37. Can the Money Be Recovered?

Recovery depends on:

speed of reporting;
whether funds remain in recipient account;
cooperation of bank or e-wallet;
identification of recipient;
legal process;
whether scammer has assets;
whether civil action is filed;
whether restitution is ordered;
whether settlement occurs;
whether transaction was reversible.

Criminal filing does not automatically guarantee immediate refund. Restitution or civil recovery may require separate steps.

38. Civil Remedies

A victim may pursue civil remedies, especially if the scammer is known.

Possible civil remedies include:

small claims action;
civil action for sum of money;
damages;
recovery based on fraud;
restitution;
attachment, where legally available;
claim within criminal case;
settlement agreement.

Small claims may be useful for straightforward money claims when the respondent is identifiable and within jurisdiction.

39. Small Claims for Online Scam

Small claims may be considered if:

the amount is within the covered threshold;
the scammer’s real identity and address are known;
the claim is for payment or refund of money;
evidence is documentary;
the victim wants a simplified civil remedy.

Small claims do not replace criminal reporting if fraud or cybercrime occurred.

40. Criminal Case Versus Civil Recovery

A criminal case punishes the offender and may include civil liability. A civil case focuses on recovering money or damages.

A victim may pursue both depending on procedure and strategy.

Important distinction:

criminal case requires proof beyond reasonable doubt;
civil claim generally requires lower proof;
criminal case may take time;
civil recovery depends on locating the respondent and assets;
settlement may affect civil claims but not always criminal liability.

41. Reporting Investment Scams

If the scam involves investments, report to the appropriate securities regulator or enforcement office in addition to cybercrime authorities.

Evidence should include:

investment offer;
promised returns;
SEC registration claims;
contracts;
payment receipts;
referral system;
website or app;
names of promoters;
group chats;
payout records;
withdrawal refusal;
public posts or advertisements.

Investment scams often involve securities violations, estafa, cybercrime, and money laundering concerns.

42. Reporting Fake Online Sellers

If the scam involves online selling, report to:

platform marketplace;
payment provider;
cybercrime authorities;
consumer protection office if a registered merchant is involved;
local police or prosecutor if seller is known.

Evidence should show:

product listing;
seller identity;
agreement to sell;
payment;
failure to deliver;
excuses or blocking;
fake tracking, if any.

43. Reporting Fake Loan Apps or Lenders

If the scam involves fake loans or abusive online lending, report to relevant regulators, privacy authorities, and cybercrime units.

Evidence should include:

app name;
website;
lender name;
SEC registration claims;
permissions requested;
fees paid;
loan agreement, if any;
harassment messages;
contact list misuse;
payment account;
screenshots of app and messages.

If the app collected personal data and harassed contacts, data privacy complaint may also be appropriate.

44. Reporting Romance Scams

Romance scam complaints should include:

dating profile;
social media accounts;
photos used;
chat history;
promises and emotional manipulation;
requests for money;
payment receipts;
recipient accounts;
fake documents;
travel or package claims;
video call screenshots, if any.

Victims should not feel ashamed. Romance scams are designed to manipulate trust.

45. Reporting Sextortion

If the scam involves threats to release intimate images or videos:

preserve all threats;
do not send more images;
do not pay more money;
report the account to the platform;
report to cybercrime authorities;
if a minor is involved, seek urgent child protection assistance;
warn close contacts only if necessary and safely;
request platform takedown if content is posted.

Do not publicly repost the content as evidence.

46. If the Victim Is a Minor

If the victim is a child, the case should be handled with special care.

Report to:

parent or guardian, unless unsafe;
Women and Children Protection Desk;
cybercrime authorities;
social welfare office;
school child protection officer, if school-related;
prosecutor, where needed.

Protect the child’s identity. Do not share screenshots publicly. If sexual content is involved, preserve evidence securely and report immediately.

47. Identity Theft in Scams

A scam may involve identity theft when the scammer uses another person’s name, photo, ID, account, or business identity.

The victim of identity theft should report:

fake account;
unauthorized use of photo;
fake ID;
fake business page;
unauthorized loan application;
fake seller using victim’s name;
scam messages sent under victim’s account.

Identity theft complaints may involve cybercrime and data privacy issues.

48. Fake Government or Bank Messages

Scammers often impersonate:

banks;
e-wallets;
BIR;
SSS;
PhilHealth;
Pag-IBIG;
PSA;
DSWD;
LTO;
immigration;
police;
courts;
delivery companies.

Report impersonation to the real institution and cybercrime authorities. Do not click links or call numbers in the suspicious message.

49. SIM Registration and Scam Calls

SIM registration does not eliminate scams. Scammers may use registered SIMs under fake, stolen, borrowed, or mule identities.

If you have the scammer’s number:

screenshot SMS and call logs;
report to telecom provider;
include number in cybercrime complaint;
avoid calling repeatedly or threatening the person;
preserve the SIM-related evidence.

Telecom records may require lawful process.

50. Cryptocurrency Scam

Crypto scams may involve fake exchanges, fake wallets, fake traders, Ponzi schemes, pig-butchering scams, fake mining, or fake recovery services.

Evidence should include:

wallet addresses;
transaction hashes;
exchange account records;
chat logs;
website URLs;
investment promises;
screenshots of dashboard balances;
withdrawal refusal;
names of promoters;
bank or e-wallet funding records.

Crypto transactions may be hard to reverse, but blockchain records can help trace movement.

51. Fake Recovery Scam

After a victim is scammed, another scammer may offer to recover the funds for a fee.

Red flags include:

guaranteed recovery;
upfront fee;
claim of hacker access;
fake law enforcement identity;
request for wallet seed phrase;
request for bank credentials;
pressure to act fast.

Do not pay recovery scammers. Report through official channels.

52. What If the Scammer Returns the Money?

If the scammer refunds the full amount, the victim may decide whether to pursue the case further. However, refund does not automatically erase criminal liability if a crime was committed.

A settlement should be documented in writing.

The victim should be cautious if the scammer asks for withdrawal of complaint before payment is actually received and cleared.

53. Settlement Agreement

If settlement occurs, the agreement should state:

names of parties;
amount to be refunded;
payment deadline;
payment method;
acknowledgment of receipt;
whether claims are released;
confidentiality, if any;
no further harassment;
consequences of nonpayment;
reservation of rights if partial payment.

Do not sign broad waivers without understanding them.

54. Retraction of Complaint

A victim may submit a desistance or withdrawal in some cases, but criminal cases may still proceed depending on the offense and public interest.

Authorities are not always bound by private settlement, especially in serious or repeated fraud.

55. Barangay Blotter

A barangay blotter may document the incident if the scammer is local or known. However, a barangay blotter is not a substitute for cybercrime reporting.

Barangay officials generally cannot fully investigate anonymous online accounts, bank records, IP logs, or platform data.

Use barangay blotter only as supplementary documentation.

56. Police Blotter

A police blotter records the complaint at a police station. It may be useful, but it is not the same as a full criminal complaint or cybercrime investigation.

Ask whether the case will be referred to a cybercrime unit or investigator.

57. Authentication of Electronic Evidence

Electronic evidence may need to be authenticated.

Helpful practices include:

preserve original device;
keep original chat thread;
save URLs;
print screenshots;
execute affidavit explaining how screenshots were taken;
ask witnesses to execute affidavits;
keep metadata where possible;
preserve email headers;
avoid editing screenshots;
submit digital copies along with printed copies.

The goal is to show that the evidence is genuine and unaltered.

58. Should Screenshots Be Notarized?

Screenshots themselves are not usually notarized as documents in the same way affidavits are. Instead, the complainant may execute an affidavit identifying and explaining the screenshots.

In some cases, a lawyer or notary may help prepare sworn statements and certified printouts.

59. Email Header Evidence

If the scam was through email, preserve full email headers. Headers may show technical routing information useful for investigation.

Do not merely screenshot the email body. Save the original email.

60. Website Evidence

If the scam used a website:

screenshot the homepage;
screenshot terms and payment instructions;
save URL;
note date and time accessed;
save WHOIS or domain information if available;
preserve emails from the website;
save payment page;
report domain to hosting provider or platform;
include website in cybercrime complaint.

Websites can disappear quickly.

61. Fake Documents Sent by Scammer

Scammers may send fake IDs, permits, SEC certificates, DTI certificates, business permits, courier receipts, bank receipts, or court documents.

Preserve them. Do not assume they are real.

Authorities may verify:

document number;
issuing office;
name on document;
photo;
signature;
QR code;
formatting;
date;
seal;
whether document was altered.

Using fake documents may support falsification-related charges.

62. If the Scammer Used Someone Else’s ID

Scammers often send stolen IDs to gain trust. The person on the ID may also be a victim.

Do not automatically accuse the ID owner unless there is evidence that they controlled the scam.

Provide the ID to authorities and explain how it was used.

63. Avoid Public Accusations Without Proof

Posting the scammer’s name, photo, or ID online may expose the victim to defamation, privacy, or harassment claims if the identification is wrong.

A safer public warning is:

I was scammed by an account using the name [account name] and payment details [limited details]. I have reported the matter to authorities. Please verify carefully before transacting.

Avoid posting full IDs, addresses, account numbers, or private data.

64. Public Warning Posts

Public warnings can help others, but should be factual.

A careful post may include:

platform account name;
general description of scam;
date of incident;
instruction to avoid transacting;
statement that matter has been reported;
no threats;
no unsupported accusations;
no unnecessary private information.

Avoid statements like “this person is a criminal” unless legally established.

65. If the Scammer Threatens You

Threats may create additional offenses.

Preserve:

threatening messages;
call recordings, if lawfully obtained;
screenshots;
phone numbers;
names;
threats to family;
threats to release images;
threats of violence;
threats of fake cases.

Report immediately, especially if there is risk of physical harm or sextortion.

66. If Your Account Was Used to Scam Others

If your account was hacked and used to scam people:

secure the account;
warn contacts;
report hacking to platform;
report to cybercrime authorities;
preserve login alerts;
save messages sent by hacker;
file identity theft or account takeover report;
coordinate with victims;
request platform logs through proper process;
avoid deleting evidence before saving it.

You may need to prove you were also a victim, not the scammer.

67. If Your Name or Photo Was Used

If your identity was used in a scam:

screenshot fake account;
save profile URL;
report impersonation to platform;
file cybercrime report;
file data privacy complaint if personal data was misused;
issue factual advisory through official account;
notify contacts;
preserve messages from victims;
gather proof of your real identity;
request takedown.

Identity theft can damage reputation and may expose you to wrongful accusations.

68. If the Scam Involves a Business

A business victim should preserve:

invoices;
purchase orders;
emails;
supplier messages;
bank transfer records;
delivery documents;
corporate approvals;
employee communications;
fake vendor documents;
internal incident report.

Business email compromise should be handled urgently because funds may be large.

69. Business Email Compromise

Business email compromise occurs when scammers impersonate executives, suppliers, clients, or finance officers to redirect payments.

Signs include:

sudden change in bank details;
urgent payment request;
similar but fake email domain;
hacked supplier email;
invoice with altered account number;
pressure to bypass approval;
confidentiality request;
unusual grammar or formatting.

Report to bank, cybercrime authorities, and affected business partners immediately.

70. Internal Employee Involvement

If an employee assisted the scam, the business may pursue:

internal investigation;
administrative discipline;
criminal complaint;
civil recovery;
data privacy breach response;
audit of controls;
freezing of access;
preservation of logs and devices.

Observe labor due process before imposing discipline.

71. What Happens After Filing a Complaint?

After filing, possible steps include:

evaluation of complaint;
interview of complainant;
request for additional documents;
preservation requests to platforms or providers;
tracing of payment accounts;
coordination with banks or e-wallets;
identification of suspect;
subpoena or lawful requests for records;
preliminary investigation;
filing of information in court if probable cause exists;
trial;
judgment and civil liability.

The process may take time, especially if the scammer used fake identities.

72. Preliminary Investigation

In cases requiring preliminary investigation, the respondent may be asked to submit a counter-affidavit. The prosecutor determines whether probable cause exists.

The complainant should attend proceedings, submit additional evidence when required, and update contact information.

73. Court Case

If charges are filed, the case proceeds in court. The victim may need to testify and authenticate evidence.

The victim should preserve original devices and records throughout the case.

74. Restitution and Civil Liability in Criminal Case

If the accused is convicted, the court may order civil liability such as restitution, indemnity, or damages.

However, recovery depends on the accused’s ability to pay and available assets.

75. Prescription and Timeliness

Cybercrime and fraud complaints are subject to legal time limits depending on the offense. Victims should not delay.

Even if a complaint is still legally possible, delay may make evidence harder to obtain.

Report as soon as possible.

76. Jurisdiction and Venue

Cybercrime cases may involve complex venue issues because the victim, scammer, platform, server, and payment account may be in different locations.

A complaint may be filed where the victim resides, where the offense was accessed or consummated, where payment was sent or received, or where authorities have jurisdiction depending on the facts and law.

Law enforcement or prosecutors may advise on proper venue.

77. If the Scammer Is Abroad

If the scammer is outside the Philippines, reporting is still useful, but enforcement may be more difficult.

Issues include:

foreign platform data;
international bank accounts;
extradition limits;
mutual legal assistance;
fake identities;
cryptocurrency transfers;
foreign law enforcement coordination.

Even when recovery is difficult, reports help document the crime and may support platform takedown or financial investigation.

78. If the Victim Is Abroad

A Filipino abroad who was scammed by someone in the Philippines may still report. They may coordinate with:

Philippine cybercrime authorities;
Philippine embassy or consulate for document notarization or authentication;
Philippine counsel;
local law enforcement abroad;
bank or e-wallet provider;
platform.

Affidavits executed abroad may need proper consular or apostille formalities depending on use.

79. If the Scam Uses a Foreign Platform

Many scams occur on foreign platforms. Philippine authorities may still investigate, but platform records may require formal requests.

Victims should provide:

exact URLs;
account IDs;
usernames;
screenshots;
dates and times;
report confirmation numbers;
email headers or technical data.

80. Data Privacy Complaint

A data privacy complaint may be appropriate when scammers or abusive lenders misuse personal data.

Examples:

posting IDs online;
using stolen selfies;
opening accounts using victim’s data;
harvesting contact lists;
messaging contacts to shame borrower;
leaking private information;
unauthorized processing by a company;
failure of a company to secure data.

A data privacy complaint may be filed separately from cybercrime and fraud complaints.

81. Consumer Complaint

If the scammer is a registered business or merchant, consumer remedies may apply.

Examples:

paid product not delivered;
deceptive online selling;
false advertising;
defective product;
refusal to refund;
misrepresentation by seller;
fake warranty;
misleading promo.

Consumer remedies may be useful when the dispute is with a real business rather than an anonymous scammer.

82. SEC Complaint for Investment Scam

If the scam involves investment solicitation, the securities regulator may investigate.

Report when there are:

investment contracts;
pooled funds;
guaranteed returns;
referral commissions;
unregistered securities;
crypto investment platform;
fake corporation;
lending investment program;
farm, franchise, or trading scheme promising returns;
Ponzi-like structure.

Include advertisements, group chats, payment records, and names of promoters.

83. DOLE or POEA/DMW-Related Job Scams

For employment scams, especially overseas job scams, report to labor or migrant worker authorities where appropriate.

Evidence includes:

job post;
recruiter name;
agency name;
placement fee demand;
payment receipts;
fake contract;
fake visa;
interview messages;
promised country and employer;
license claims.

Illegal recruitment may be involved.

84. What If the Scammer Is a Minor?

If the alleged scammer is a minor, juvenile justice rules may apply. The victim may still report, but handling differs.

Authorities may involve:

social welfare officer;
barangay child protection mechanisms;
diversion processes;
parents or guardians;
prosecutor or court where required.

The victim’s right to restitution may still be considered.

85. What If the Victim Accidentally Participated as a Money Mule?

Some victims are tricked into receiving and forwarding money.

If you suspect you were used as a mule:

stop transactions immediately;
preserve all communications;
report to your bank;
report to authorities;
do not spend the funds;
identify who instructed you;
cooperate with investigation;
seek legal advice.

Continuing to move funds after suspicion may create legal risk.

86. Money Mule Recruitment

Scammers recruit people to receive funds by offering:

commission per transfer;
“payment processor” job;
use of e-wallet account;
rental of bank account;
SIM registration for others;
crypto conversion job;
online task work involving transfers.

Do not lend or sell bank accounts, e-wallets, SIMs, or IDs.

87. Protecting Yourself After Filing

After filing, protect yourself from further harm:

block scammer after preserving evidence;
secure accounts;
alert contacts;
monitor bank and e-wallet accounts;
check credit records where applicable;
replace compromised SIM or card;
change passwords;
report fake accounts;
avoid responding to threats alone;
keep all new messages from scammer.

88. Emotional and Practical Impact

Scam victims often feel shame, anger, or fear. These reactions are normal. Scams are designed to manipulate urgency, trust, fear, greed, romance, or confusion.

Do not let embarrassment prevent reporting. Early reporting helps protect both the victim and others.

89. Prevention Tips

To avoid cybercrime scams:

verify seller identity;
avoid paying full amount upfront to unknown sellers;
use platform escrow where available;
check reviews but beware fake reviews;
do reverse image search for product photos;
verify business registration;
call official numbers from official websites;
never share OTP or MPIN;
do not click suspicious links;
enable two-factor authentication;
use strong passwords;
verify investment registration and authority;
avoid guaranteed-return offers;
avoid advance fee loan offers;
inspect URLs carefully;
do not use public Wi-Fi for financial transactions;
keep devices updated;
avoid installing unknown APKs;
monitor account activity;
trust caution over urgency.

90. Red Flags of Cybercrime Scams

Common red flags include:

deal is too good to be true;
seller refuses meet-up or video verification;
payment must be sent immediately;
name on payment account differs from seller;
seller uses newly created account;
no legitimate business address;
poor grammar in official messages;
fake urgency;
request for OTP or password;
investment guarantees high returns;
loan requires upfront fee;
buyer sends suspicious payment link;
customer support contacts you from personal account;
seller blocks questions;
website URL is misspelled;
seller asks to continue outside official platform;
account uses stolen photos;
demand for secrecy;
repeated additional fees;
refusal to provide official receipt.

91. Practical Checklist: Before Filing

Before filing, gather:

valid ID;
written timeline;
screenshots of scam account;
screenshots of conversation;
account links and URLs;
payment receipts;
bank or e-wallet statement;
recipient account details;
phone numbers and emails;
platform report confirmation;
bank or e-wallet ticket number;
fake documents;
witness names;
other victim details, if any;
affidavit draft.

92. Practical Checklist: What to Ask Authorities

When reporting, ask:

what offense may apply;
what additional evidence is needed;
whether a complaint-affidavit is required;
whether original device must be preserved;
whether bank or e-wallet records should be requested;
whether they can send preservation requests;
where to file if venue is an issue;
whether other victims can join;
whether civil recovery is possible;
what reference number proves the report.

93. Practical Checklist: Bank or E-Wallet Report

Provide:

sender account;
recipient account;
transaction date and time;
amount;
reference number;
fraud explanation;
police or cybercrime report if available;
screenshots;
request for freeze or investigation;
contact details.

94. Practical Checklist: Platform Report

Report and preserve:

profile link;
listing link;
group link;
message thread;
fake page;
transaction details;
scam category;
impersonation proof, if any;
request for takedown;
report confirmation.

95. Common Mistakes by Victims

Victims often weaken cases by:

deleting chats;
failing to save URLs;
saving only cropped screenshots;
waiting too long to report;
sending more money;
confronting scammer before preserving evidence;
posting private data online;
threatening the scammer;
relying only on platform report;
not reporting to payment provider;
failing to get ticket numbers;
using unofficial recovery services;
losing access to hacked accounts;
not preparing a timeline;
assuming small scams cannot be reported.

96. Common Defenses of Accused Scammers

An accused person may claim:

transaction was legitimate;
delivery was delayed, not fraudulent;
payment was for another purpose;
account was hacked;
they were only a payment receiver;
they were also scammed;
they refunded the money;
screenshots are incomplete;
complainant edited messages;
complainant assumed risks;
no deceit was used;
wrong person was identified.

Complete evidence helps overcome these defenses.

97. What Makes a Complaint Strong?

A strong cybercrime scam complaint usually has:

clear false representation;
proof victim relied on it;
proof of payment;
proof of failure to deliver or perform;
scammer account link;
recipient payment details;
complete chat history;
prompt report;
evidence linking respondent to account;
organized timeline and annexes.

98. What Makes a Complaint Weak?

A complaint may be weak if:

no proof of payment;
no scammer account link;
only cropped screenshots;
no evidence of false promise;
respondent is unknown and untraceable;
payment was made to a different person without explanation;
complainant deleted messages;
transaction appears to be ordinary civil dispute;
complainant cannot show damage;
evidence was edited.

Weakness does not always mean no case, but more supporting evidence may be needed.

99. Civil Dispute Versus Scam

Not every failed online transaction is a crime. Some are civil disputes.

A case may be civil if:

seller intended to deliver but failed due to genuine issue;
parties disagree about quality or terms;
refund is delayed but merchant is identifiable and communicating;
there was no deceit at the start;
business failure occurred after a genuine transaction.

A case is more likely a scam if:

seller used fake identity;
seller never had the item;
same account scammed many victims;
seller blocked after payment;
payment account differs suspiciously;
fake receipts or fake tracking were used;
false documents were sent;
promises were impossible or deceptive from the start.

100. Conclusion

Filing a cybercrime scam complaint in the Philippines requires speed, documentation, and the correct reporting channels. The victim should first preserve evidence, save screenshots and URLs, secure accounts, report to the bank or e-wallet provider, report the account to the platform, and file with cybercrime authorities where appropriate.

The complaint should clearly show what the scammer represented, how the victim relied on it, how much was paid, where the payment went, what evidence links the scammer to the account, and what damage resulted. A well-prepared complaint includes a sworn affidavit, organized annexes, transaction receipts, complete chat history, account links, and a clear timeline.

Cybercrime scam cases may involve estafa, computer-related fraud, identity theft, phishing, illegal access, data privacy violations, securities violations, consumer fraud, or other offenses. The exact charge depends on the facts. Victims do not need to solve every legal classification before reporting; they need to present complete and truthful evidence.

The most important practical rule is to act quickly. Report to payment providers before funds disappear, preserve digital evidence before accounts are deleted, and avoid sending more money. Cybercrime complaints are strongest when the victim responds promptly, documents carefully, and uses official legal channels rather than threats, public shaming, or unverified recovery services.