When someone is harassing, threatening, shaming, impersonating, or sexually targeting you online, your first instinct may be to block, delete, or report the account immediately. That can feel emotionally safer, but it can also erase the very proof needed for a cyber harassment complaint in the Philippines. The goal is to preserve the evidence in a way that helps investigators, prosecutors, and courts answer four basic questions: What happened? Who did it? When did it happen? How can we trust that the evidence is authentic?

What “cyber harassment” can mean under Philippine law

“Cyber harassment” is a practical term, not always the exact name of one criminal offense. In the Philippines, the correct legal route depends on the facts.

Online harassment may involve:

repeated threatening messages;
sexual comments, stalking, or unwanted sexual advances online;
spreading private photos, videos, or personal information;
creating fake accounts using your name or photos;
posting defamatory accusations;
extortion, blackmail, or “sextortion”;
harassment by a former partner, spouse, coworker, schoolmate, customer, creditor, or stranger.

That is why evidence preservation matters. The same screenshot may support different possible complaints: cyber libel, online gender-based sexual harassment, threats, unjust vexation, identity theft, data privacy violations, VAWC, or civil damages.

Legal basis: why digital evidence matters

Philippine law recognizes that electronic records can be used as evidence, but they must be presented in a reliable and understandable way. Republic Act No. 8792, or the Electronic Commerce Act of 2000, provides that an electronic document can be the functional equivalent of a written document for evidentiary purposes, provided the legal requirements on authentication and best evidence are met. (Supreme Court E-Library)

The Rules on Electronic Evidence under A.M. No. 01-7-01-SC govern how electronic documents and electronic data messages are offered and authenticated in Philippine proceedings. (Lawphil) In criminal cases, the Supreme Court has also recognized the use of chat logs, videos, and online messages as evidence, depending on how they were obtained, authenticated, and connected to the offense. (Supreme Court of the Philippines)

For cybercrime investigations, the Rule on Cybercrime Warrants under A.M. No. 17-11-03-SC covers warrants and related court orders involving preservation, disclosure, interception, search, seizure, examination, custody, and destruction of computer data under the Cybercrime Prevention Act. This is important because ordinary complainants can preserve what they can see, but law enforcement may need a court-backed process to obtain subscriber information, IP logs, account records, or device data from platforms and service providers.

Common legal bases include:

Situation	Possible Philippine legal basis
Harassing posts, fake accounts, account misuse, cyber libel, identity-related acts	RA 10175, Cybercrime Prevention Act of 2012 (Lawphil)
Online sexual harassment, cyberstalking, sexist or sexual abuse online	RA 11313, Safe Spaces Act of 2019 (Lawphil)
Non-consensual intimate photos or videos of adults	RA 9995, Anti-Photo and Video Voyeurism Act of 2009 (Lawphil)
Online abuse involving minors or child sexual abuse/exploitation materials	RA 11930, Anti-OSAEC and Anti-CSAEM Act of 2022 (Lawphil)
Doxing, unauthorized use or disclosure of personal data	RA 10173, Data Privacy Act of 2012 (Lawphil)
Threats, coercion, unjust vexation, libel, or other traditional crimes committed online	Revised Penal Code, including provisions on threats, coercions, unjust vexation, and libel (Lawphil)
Harassment by a spouse, former spouse, or dating/sexual partner against a woman or her child	RA 9262, Anti-Violence Against Women and Their Children Act of 2004 (Lawphil)
Civil damages for abusive, bad-faith, or harmful conduct	Civil Code, especially Articles 19, 20, and 21

What investigators and prosecutors usually look for

A good evidence file does not just contain screenshots. It tells a clear story.

For a cyber harassment complaint, the evidence should show:

Identity or link to the offender This may be the account name, profile URL, phone number, email address, payment account, previous conversations, admissions, shared photos, mutual contacts, or patterns showing the same person controls multiple accounts.
The exact content of the harassment Save the message, post, comment, image, video, caption, username, timestamp, and surrounding conversation.
Dates and sequence of events A single screenshot may look isolated. A chronological evidence log shows repetition, escalation, threats, demands, and the effect on the victim.
Authenticity The person presenting the evidence must be able to explain where it came from, how it was captured, whether it was edited, and who had access to it.
Impact on the victim Preserve related proof such as missed work or school, medical or counseling records, reports to platforms, barangay blotters, HR complaints, school complaints, or messages from people who saw the post.

Step-by-step guide to preserving cyber harassment evidence

1. Do not delete, edit, or “clean up” the evidence

Avoid deleting the conversation, unsending your replies, cropping screenshots too tightly, renaming files repeatedly, or editing images to highlight parts of the message.

If the content is painful to look at, move copies to a secure folder, but keep the original conversation, email, SMS thread, or social media notification intact as much as possible.

For intimate images or videos, do not forward them casually to friends or group chats. Store them securely and share them only through proper reporting channels. If a minor is involved, be extra careful: child sexual abuse or exploitation materials are highly sensitive under Philippine law, and unnecessary redistribution can create additional legal and safety risks.

2. Capture screenshots with full context

Take screenshots that show:

the offender’s profile name and handle;
the full message, post, comment, caption, or threat;
the date and time displayed by the app;
the platform name or browser address bar, if visible;
the victim’s account or chat context;
earlier and later messages that explain the conversation.

For long conversations, take overlapping screenshots. Each screenshot should show a portion of the previous screenshot so the sequence is easier to verify.

For public posts, capture:

the post itself;
comments and replies;
reactions if relevant;
the profile page of the poster;
the URL of the post;
the date and time;
any shares, tags, or mentions.

3. Record the screen for disappearing or dynamic content

Some harassment happens through Stories, live videos, disappearing messages, edited posts, or accounts that block you after sending threats.

Use screen recording when content may disappear. Start the recording from the profile or chat list, then open the message or post, scroll slowly, and show the date, time, username, and URL if possible.

Do not add music, captions, filters, stickers, or annotations. The purpose is to capture what was actually on the screen.

4. Save the links, not just the images

Screenshots are helpful, but investigators may also need the exact online location.

Save:

profile URL;
post URL;
comment URL, if available;
message thread identifiers, if visible;
group/page URL;
email headers;
phone number or sender ID;
transaction reference numbers, if blackmail or extortion is involved.

Put these links in your evidence log. Even if the content is later deleted, the URL can help law enforcement or the platform locate records.

5. Download or export what the platform allows

Where available, download copies of:

emails as .eml or PDF;
chat exports;
photos and videos in original quality;
voicemail or audio files;
account data from the platform’s “download your information” feature;
SMS backups;
call logs;
cloud files showing upload dates.

Keep the original file where possible. Messaging apps sometimes compress images and strip metadata, so the original file may be more useful than a forwarded copy.

6. Create a simple evidence log

A chronological log helps prosecutors understand the case quickly. It also helps you avoid confusion when the harassment happens over weeks or months.

Use a table like this:

Date and time	Platform/account	What happened	Evidence file	Notes
12 Jan 2026, 9:42 PM	Facebook profile “Juan X”	Sent threat: “I will post your photos”	Screenshot 001, screen recording 001	Profile URL saved
13 Jan 2026, 8:10 AM	Messenger	Asked for ₱10,000 to stop posting	Screenshot 002	GCash number included
14 Jan 2026, 7:30 PM	Public post	Posted edited photo and tagged coworkers	Screenshot 003, URL saved	Two coworkers saw it

Use the time zone where you were located when you captured the evidence. If you are an OFW or foreigner abroad, note both local time and Philippine time if it helps avoid confusion.

7. Preserve your device and account

Your phone, laptop, email, and social media account may become important sources of evidence.

Do these as soon as possible:

change passwords if your account may be compromised;
enable two-factor authentication;
save login alerts and security emails;
preserve the SIM card or phone number that received threats;
keep the device used to receive the messages;
avoid factory reset until important data has been backed up;
save cloud backups before they are overwritten;
keep proof of account ownership, such as recovery emails or phone numbers.

If hacking, unauthorized access, or impersonation is involved, do not attempt to “hack back.” Unauthorized access can create a separate legal problem and may weaken your complaint.

8. Make a working copy and a clean master copy

Keep at least two sets:

Master copy: untouched screenshots, recordings, downloads, and original files.
Working copy: printed copies, labeled PDFs, and annotated summaries for easier review.

Store the master copy in at least two secure places, such as an encrypted drive and a reputable cloud account. Do not rely only on one phone, because phones get lost, replaced, damaged, or remotely wiped.

9. Prepare a complaint-affidavit and attachments

A complaint-affidavit is a sworn written statement explaining what happened and attaching evidence. It is usually needed for a formal criminal complaint before law enforcement or the prosecutor.

A strong complaint-affidavit usually includes:

your full name, address, contact details, and government ID;
the offender’s known name, alias, account, phone number, email, or other identifiers;
a clear timeline;
exact quotes from threats or abusive messages;
explanation of how you obtained each screenshot or recording;
statement that the attached files are faithful copies of what you saw or received;
names of witnesses, if any;
attachments marked as Annex “A,” “B,” “C,” and so on.

Printouts should be readable. Do not shrink screenshots so much that the date, username, or content becomes impossible to read.

Where to report cyber harassment in the Philippines

The right office depends on the facts, your location, and the urgency.

Office or route	When it is commonly used	Practical notes
PNP Anti-Cybercrime Group (PNP-ACG) or Regional Anti-Cybercrime Unit	Cybercrime reports, fake accounts, threats, extortion, hacking, online harassment	Bring ID, complaint-affidavit if available, screenshots, links, device, and evidence log.
NBI Cybercrime Division / Regional Cybercrime Center	Cybercrime investigation, digital forensics, more technical complaints	NBI’s Citizen’s Charter for computer crime assistance lists no filing fee for the initial CCD process and includes complaint sheet, interview, sworn statements, and device examination steps. (National Bureau of Investigation)
Office of the City or Provincial Prosecutor	Formal criminal complaint for preliminary investigation	Often requires a complaint-affidavit, affidavits of witnesses, IDs, and evidence attachments.
DOJ Office of Cybercrime	Cybercrime coordination, international cybercrime matters, preservation/disclosure concerns	RA 10175 created the DOJ Office of Cybercrime and designated it as central authority for international mutual assistance and extradition in cybercrime and cyber-related matters. (Department of Justice)
Barangay	VAWC barangay protection order, blotter, local safety intervention	Barangay conciliation is not a substitute for cybercrime investigation. For VAWC, barangay protection measures may be urgent.
School, employer, or training institution	Online sexual harassment connected with school or workplace	RA 11313 covers gender-based sexual harassment in online spaces, workplaces, and educational or training institutions. (Lawphil)
National Privacy Commission	Personal data misuse, doxing, unauthorized disclosure, data privacy complaints	Useful where the issue is unlawful processing or disclosure of personal information.

Special scenarios and practical tips

If the harasser deletes the post

Deleted content can still be useful if you preserved screenshots, URLs, notifications, witness statements, and timestamps. Do not assume the case is hopeless. Platforms may retain logs for a limited period, and law enforcement may seek preservation or disclosure through proper channels.

If the account is anonymous or fake

Do not focus only on the display name. Preserve every clue:

profile URL and username changes;
profile photos;
mutual friends;
writing style;
phone numbers or payment accounts used;
email addresses;
recovery hints;
links sent by the account;
admissions from other conversations;
other accounts posting the same content.

Cyber harassment cases often rely on a combination of technical records and ordinary evidence showing that a real person controlled the account.

If the harassment involves intimate images

Preserve the evidence, but limit circulation. Save the original file, screenshots of threats, URLs, captions, account details, and proof of non-consent. If the image or video is sexual and was taken or shared without consent, RA 9995 may apply for adult victims. (Lawphil) If the victim is a child, RA 11930 may apply, and the material should be handled with extreme care. (Lawphil)

If the harasser is an ex-partner

For women and their children, online harassment by a spouse, former spouse, or person with whom the victim has or had a sexual or dating relationship may also fall under RA 9262 if it causes or threatens physical, sexual, psychological, or economic abuse. (Lawphil) Preserve not only the cyber evidence but also prior incidents, medical records, witness statements, barangay records, and proof of relationship.

If you are abroad

Filipinos abroad and foreigners dealing with Philippine-based offenders can still organize evidence for a Philippine complaint.

Practical points:

note your country and time zone when the evidence was captured;
keep passport or ID copies ready;
prepare a sworn affidavit with attachments;
documents signed abroad may need consular notarization or apostille, depending on where they are executed and where they will be used;
Philippine Embassies and Consulates can notarize private documents such as affidavits for use in the Philippines, with the notarized document bearing a consular notarial certificate. (Philippine Embassy)

If the offender, platform, witnesses, or victim are in different countries, timelines may be longer because investigators may need international cooperation or platform disclosure.

Common mistakes that weaken cyber harassment complaints

Avoid these pitfalls:

Taking cropped screenshots only. Cropped images may hide the username, URL, date, or context.
Deleting the conversation after printing screenshots. The original thread may later be needed.
Reporting the account before preserving evidence. Reporting can cause removal before you finish documenting.
Editing screenshots with arrows, highlights, or stickers. Use a working copy for annotations; keep the original clean.
Posting the evidence publicly. This can trigger privacy, defamation, or safety issues, especially with intimate images or minors.
Using friends to threaten the harasser back. Retaliation can complicate the case.
Relying only on one device. Phones break, chats auto-delete, and cloud backups overwrite.
Forgetting witnesses. People who saw the post before deletion can execute affidavits.
Ignoring platform links. URLs and profile identifiers help trace content.
Waiting too long. Digital records can disappear quickly, especially for anonymous accounts and disappearing-message apps.

Frequently Asked Questions

Are screenshots enough for a cyber harassment complaint in the Philippines?

Screenshots can be enough to start a complaint, but they are stronger when supported by URLs, screen recordings, original files, witness affidavits, device access, and a clear explanation of how they were captured. Courts and investigators usually care about authenticity, context, and whether the screenshot can be connected to the offender.

Should I block the harasser immediately?

If you are in danger or the messages are causing severe distress, blocking may be necessary for safety. Before blocking, preserve the profile, messages, URLs, timestamps, and account details if you can do so safely. You may also use privacy settings, mute functions, or trusted contacts to help capture evidence.

Can deleted messages or deleted posts still be recovered?

Sometimes. If you saved screenshots, recordings, notifications, URLs, or backups, those may still help. Platforms or service providers may also retain some records for a period, but ordinary users cannot usually access those records directly. Law enforcement may need to use proper legal processes, including cybercrime warrants or preservation/disclosure requests.

Is a screen recording better than screenshots?

Both are useful. Screenshots are easier to print and attach to a complaint-affidavit. Screen recordings are helpful for disappearing content, long threads, fake profiles, live videos, Stories, or posts that may be edited quickly. Ideally, preserve both.

Can private Facebook Messenger chats be used as evidence?

Yes, depending on how they were obtained and authenticated. The Supreme Court has recognized that photos and messages from Facebook Messenger obtained by private individuals may be admissible in court under the circumstances of the case. (Supreme Court of the Philippines) Chat logs and videos may also be used in criminal cases when presented to determine whether a crime was committed. (Supreme Court of the Philippines)

Do I need a lawyer before going to the NBI or PNP?

A complainant may report directly to the PNP-ACG, NBI Cybercrime Division, or prosecutor’s office. In practice, a well-organized complaint-affidavit and evidence packet can make the intake process smoother. For complex cases involving anonymity, cross-border platforms, intimate images, minors, or multiple possible offenses, careful preparation is especially important.

What if I only know the harasser’s username, not their real name?

You can still report. Preserve the username, profile URL, photos, posts, messages, phone numbers, emails, transaction details, and any clues connecting the account to a real person. Investigators may use technical and non-technical evidence to identify the account holder.

Can I use notarized screenshots?

A notary does not magically prove that a screenshot is true. Notarization usually confirms the identity of the person signing a sworn statement, not the truth of the digital content itself. What helps is a sworn statement explaining how the screenshots were captured, plus original files, device access, URLs, timestamps, and corroborating evidence.

Should I report the account to Facebook, TikTok, Instagram, X, or the platform?

Yes, but preserve evidence first. Platform reports can remove harmful content, but removal may also make later documentation harder. Capture screenshots, screen recordings, URLs, and account details before submitting a platform report, unless immediate removal is necessary for safety.

How long does a cyber harassment complaint take?

Initial intake may be done within the same day if documents are complete and the office can accommodate you. The NBI’s listed process for investigative assistance for victims of computer crimes includes complaint intake, interview, sworn statements, and device examination steps with no filing fee for that initial process. (National Bureau of Investigation) Full investigation, platform coordination, subpoena or warrant processes, and preliminary investigation can take weeks to months, especially when fake accounts, foreign platforms, or multiple witnesses are involved.

Key Takeaways

Preserve evidence before blocking, deleting, or reporting the account whenever safely possible.
Capture full-context screenshots: username, URL, date, time, profile, message, and surrounding conversation.
Use screen recordings for disappearing, live, edited, or fast-changing content.
Keep original files and create a separate working copy for printing, labeling, and organizing.
Maintain a chronological evidence log showing what happened, where, when, and what file proves it.
Do not edit screenshots, hack accounts, publicly repost intimate materials, or retaliate against the harasser.
Prepare a complaint-affidavit with annexes, IDs, witness statements, and readable copies of evidence.
Report to the proper office: PNP-ACG, NBI Cybercrime Division, prosecutor, DOJ Office of Cybercrime, barangay for urgent VAWC protection, school or employer for institutional harassment, or the National Privacy Commission for data privacy issues.