How to File a Case Against an Online Scammer Impersonating a Foreigner (Philippine Guide)

This practical guide is written for victims, counsel, and investigators operating in the Philippines. It outlines the laws, evidence rules, jurisdiction, and step-by-step procedure to bring a case when a scammer “catfishes” or pretends to be a foreign national.

1) What conduct is punishable?

Typical fact patterns:

Romance/relationship scams using photos of a foreigner and promises of marriage, gifts, or “emergency” remittances.
Investment/job/parcel scams where a fake foreign CEO, engineer, soldier, or oil-rig worker asks for fees, taxes, or “clearance” payments.
Account takeovers (e.g., messaging apps) pretending to be your foreign friend or boss to request urgent money.
Impostor domains and pages (e.g., “firstname-lastname-global.com”) used to solicit funds or private data.

Key legal angles:

Deceit to obtain money or property (estafa).
Use of a real person’s identity or likeness (computer-related identity theft).
Fake online profiles, spoofed emails, and forged e-receipts (computer-related fraud/forgery).
Domains or pages built around someone’s name to profit or mislead (cybersquatting).

Note: The fact that the persona is a “foreigner” is legally incidental; what matters is the deceit and use of ICT. The real person whose identity was hijacked may also be a separate complainant.

2) Governing laws (Philippine context)

Revised Penal Code (RPC)
- Estafa (Art. 315) – swindling through deceit, causing damage (e.g., sending money).
- Use of fictitious/assumed name (Art. 178) and falsification provisions may apply depending on acts.
Cybercrime Prevention Act of 2012 (RA 10175)
- Penalizes computer-related identity theft, computer-related fraud, illegal access, computer-related forgery, and cybersquatting.
- Penalty uplift: crimes committed through ICT (e.g., online estafa) are generally punished one degree higher than their RPC counterparts.
- Jurisdiction: broad—covers offenses when any element occurs in the Philippines, when a Philippine computer system is used, when damage is suffered in the Philippines, or when committed by a Filipino even abroad.
- Data preservation: service providers must preserve traffic data for a limited period upon lawful request—move quickly.
Rules on Electronic Evidence (A.M. No. 01-7-01-SC)
- Electronic documents and printouts (screenshots, chats, emails, website captures) are admissible if properly authenticated.
Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC)
- Courts may issue preservation, disclosure, search, seizure, and examination orders for computer data (often called “cyber warrants”).
Data Privacy Act of 2012 (RA 10173)
- For unauthorized processing or misuse of personal data (useful when your identity was hijacked). The National Privacy Commission (NPC) can investigate and direct compliance/sanctions.
Access Devices Regulation Act (RA 8484)
- If credit/debit cards or similar access devices are involved.
Special laws (situational)
- Anti-Photo and Video Voyeurism (RA 9995) or OSAEC (RA 11930) if sexual extortion or minors are involved.
- Anti-Cyber Libel may protect the real person being defamed; it’s separate from your fraud case.

3) Where and how to report (criminal track)

Primary agencies:

PNP Anti-Cybercrime Group (PNP-ACG) – police investigations, preservation requests, entrapment operations when feasible.
NBI Cybercrime Division – parallel national investigative authority.
Department of Justice (DOJ–Office of Cybercrime) – coordination, prosecutions, and international legal assistance.
Office of the City/Provincial Prosecutor (OCP/OPP) – files the criminal case in court after preliminary investigation.

Venue/Jurisdiction tips

You may file with law enforcement where you reside, where the deceit was received, or where payment was sent/received.
Cybercrime cases go to designated Cybercrime courts (RTC) after the prosecutor files the Information.

4) Evidence you should preserve (immediately)

Create a read-only archive and keep the chain of custody clear.

Identity artifacts: profile URL/handle, display name, bio, phone numbers, email addresses, wallet IDs, domain WHOIS, IPs (if available).
Conversation logs: entire chat/email threads, including headers and timestamps. Export originals (HTML/JSON/EML) if you can; also take date-stamped screenshots.
Money trail: deposit slips, bank/e-wallet (GCash/Maya/etc.) transaction history, remittance receipts, tracking numbers, courier waybills, QR codes, crypto tx hashes.
Devices & links: links to posts, groups, pages; any files they sent (PDF invoices, images, voice notes).
Your notes: a short timeline—who said what, when you sent money, amounts, and how you discovered the impersonation.

Authenticating e-evidence

Capture full-page screenshots (with URL bar and system time visible).
Export platform data downloads (e.g., “Download your information”).
Keep original files; store hashes (optional but helpful).
Be ready to testify that the screenshots/exports are faithful copies from your device/account.

5) Freezing the funds (time-critical)

Immediately notify your bank/e-wallet via their fraud desk; request a hold/freeze on the beneficiary account and file a transaction dispute.
Provide your police/NBI reference number and all supporting evidence.
Ask law enforcement to issue letters to the financial institution and, where needed, to coordinate with the AMLC for possible freeze orders on suspect/mule accounts.

The sooner you act, the higher the chance of recovery. Money mules may be separately criminally liable even if “not the mastermind.”

6) Step-by-step: Building and filing your case

A) Takedown & preservation (parallel to criminal filing)

Report the fake profile/domain to the platform or registrar (identity theft/impersonation).
Request preservation of logs/content. Law enforcement can send formal preservation orders; don’t delay.

B) Law-enforcement report

Go to PNP-ACG or NBI. Bring valid ID and your evidence pack.
Give a succinct narrative: (a) how the impostor presented themself as a foreigner, (b) what you were told, (c) amounts sent, (d) where and when.
Obtain a blotter/acknowledgment and case reference.

C) Complaint-Affidavit (for the Prosecutor)

Prepare and notarize a Complaint-Affidavit with annexes. Core contents:

Your identity & capacity.
Chronology of facts (dates, platforms, messages, payments).
Offenses charged (e.g., Estafa under RPC; Computer-Related Identity Theft/Fraud under RA 10175; other applicable laws).
Elements satisfied (point facts to each element).
Damages (total loss + incidental expenses).
Prayer (issuance of subpoenas; filing of Informations; restitution; further investigation as needed).

Filing with the OCP/OPP starts preliminary investigation. The respondent gets a subpoena and may file a Counter-Affidavit. The prosecutor will issue a Resolution; if probable cause is found, an Information is filed in the RTC (Cybercrime Court).

7) Civil remedies (recover the money)

Independent civil action for damages (Civil Code Arts. 19/20/21) or attach civil liability to the criminal case.
Small Claims may be available if your total is within the current threshold (ask the clerk of court for the latest limit and requirements). Small claims are document-driven and no lawyers are required.
You can sue mule account holders who received/withdrew your funds—even if they claim they were “just asked to help.”

8) If the scammer is overseas

You can still file in the Philippines if any element occurred here or damage was suffered here.
DOJ, NBI, and PNP can pursue mutual legal assistance and cooperate with foreign LE for data, service of process, or arrests (subject to treaties and local laws).
Expect longer timelines; strong evidence and quick preservation requests are crucial.

9) Common defenses & how to counter them

“It was a gift/loan.” → Keep messages showing inducement and deceit (promises, fabricated emergencies).
“I wasn’t the user of that account.” → Seek subscriber info, login logs, and CCTV/withdrawal evidence against mule accounts via cyber warrants.
“No intent to defraud.” → Highlight pattern (multiple victims, scripted pitches, fake docs, immediate cash-outs).

10) Practical do’s and don’ts

Act within weeks, not months—data retention windows are short.
Keep all originals and a clean, numbered annex file.
Coordinate bank/e-wallet freezes the same day you discover the fraud.

Don’t

Pay more to “unlock/refund” funds—classic double-dip.
Doxx or hack back (you could commit crimes yourself).
Destroy or overwrite devices used to communicate.

11) Simple evidence checklist (clip & use)

Valid ID (complainant)
Timeline (1–2 pages)
Screenshots/exports of the impostor profile/page
Full chat/email threads (raw exports + screenshots)
Proof of payments (receipts, bank/e-wallet statements)
List of accounts/phones/emails used by scammer
Any witness statements
Platform takedown reports / reference numbers
Bank dispute or case numbers
Notarized Complaint-Affidavit + Annexes

12) Template: Complaint-Affidavit (sample language)

REPUBLIC OF THE PHILIPPINES [City/Province]

COMPLAINT-AFFIDAVIT

I, [Name], Filipino, of legal age, with address at [address], after having been duly sworn, depose and state:

I am the complainant in this case for Estafa under Article 315 of the RPC and violations of RA 10175 (Computer-Related Identity Theft and Fraud).

On [dates], a person using the name [Impostor Name] represented themself online as [describe “foreigner” persona], and induced me to send money/items through [platforms] on the false pretense of [romance/investment/parcel/job].

Relying on such misrepresentations, I sent ₱[amount] via [bank/e-wallet/remittance] on [dates] to [account details].

I later discovered that the persona and documents were false and that I was defrauded.

Attached as Annexes “A” to “__” are true and faithful copies of the impostor’s profile, chats/emails, payment proofs, and other corroborating evidence.

The acts constitute deceit causing damage (elements of Estafa), committed through ICT (penalty one degree higher), and include computer-related identity theft/fraud under RA 10175. PRAYER: I respectfully pray that subpoenas be issued, the case be filed in court, and the accused be held criminally liable with restitution of my losses.

[Signature over Printed Name] Affiant

SUBSCRIBED AND SWORN to before me this [date] at [city]. [Notary Public]

13) Costs, timing, and expectations

Filing a criminal complaint is generally free; you’ll spend for notarization, certified copies, and optional private counsel.
Asset recovery is uncertain; results improve with fast freezes, identifiable mule accounts, and platform cooperation.
Timelines vary widely; cross-border cases take longer.

14) When the foreigner’s identity is the one hijacked

The real foreigner can file their own complaint (identity theft, defamation), or issue an Apostilled affidavit/Special Power of Attorney if abroad to authorize a Philippine lawyer/representative.
Platforms often act faster on impersonation reports from the person being impersonated—coordinate with them.

15) Quick FAQ

Q: Do I need to confront the scammer or set up a sting? A: No. Work with PNP-ACG/NBI; civilians should not run entrapments.

Q: The account holder is a “money mule”—do I still file? A: Yes. Mules are often charged and can lead investigators up the chain.

Q: Can I sue even if I only sent a small amount? A: Yes. Criminal liability does not depend on size, though penalties scale; small amounts may fit Small Claims for civil recovery.

16) Final pointers (to maximize your chances)

Speed + Documentation win cyber cases.
File bank freezes and LEO reports the same day you confirm the scam.
Build your case around elements of the offense; don’t just narrate—prove deceit, reliance, damage, and ICT use.
Keep everything organized (Annex tabs, index, and timeline).
If unsure, consult counsel—especially for cross-border aspects and to push for cyber warrants.

Disclaimer: This is general information for the Philippine setting and not a substitute for tailored legal advice. If you’d like, I can turn this into a printable checklist pack (timeline template + annex index + affidavit in editable form).