With the rapid digitization of financial transactions in the Philippines, cyber-enabled crimes—ranging from phishing and investment scams to e-wallet fraud—have surged. For victims seeking justice and restitution, navigating the legal framework can be daunting.

Under Republic Act No. 10175, otherwise known as the Cybercrime Prevention Act of 2012, the Philippine National Police Anti-Cybercrime Group (PNP-ACG) is the primary specialized unit tasked with investigating cyber fraud.

This legal guide outlines the comprehensive, step-by-step process of reporting a cyber scam to the PNP, preserving evidence, and initiating criminal proceedings.

1. Immediate Action: Preservation of Digital Evidence

In cybercrime litigation, data integrity is paramount. Before approaching law enforcement, the victim must systematically gather and preserve all digital footprints of the fraudulent transaction. Do not delete messages or block the perpetrator immediately, as this might destroy vital metadata.

Essential Evidence Checklist:

Screenshots of Communications: Capture the entire conversation thread with the scammer (e.g., via Messenger, WhatsApp, Viber, or SMS). Ensure the scammer’s account names, phone numbers, or profile handles are clearly visible.
Unedited URLs and Profiles: Copy the exact web links (URLs) of the scammer's social media profiles, fraudulent websites, or marketplace listings.
Proof of Financial Transactions: Secure official receipts, transaction histories, transaction IDs, and reference numbers from banks (InstaPay/PESONet) or e-wallets (GCash, Maya).
E-mail Headers: If the scam occurred via email, preserve the raw message header, which contains the sender’s IP routing information.

Legal Note: Under the Rules on Electronic Evidence (A.M. No. 01-7-01-SC), electronic documents and communications are admissible in court as the functional equivalent of written documents, provided their integrity is properly authenticated.

2. Choosing the Reporting Channel

The PNP-ACG provides multiple avenues for victims to lodge complaints. Depending on the urgency and nature of the scam, victims may choose between in-person or digital reporting.

Option A: In-Person Filing (Highly Recommended for Criminal Prosecution)

For the immediate assignment of an investigator and the drafting of a formal complaint-affidavit, visiting a physical office is the most effective route.

Locate the Nearest Unit: Proceed to the PNP-ACG Headquarters at Camp Crame, Quezon City, or visit any of the Regional Anti-Cybercrime Units (RACUs) stationed across various provincial police offices nationwide.
Bring Required Identification: Present at least two valid government-issued IDs.
Submit Digital Evidence: Bring all preserved evidence printed out, alongside digital copies stored on a flash drive for forensic extraction if necessary.

Option B: Online Reporting and Hotlines

If a physical visit is not immediately possible, preliminary reports can be submitted digitally to flag fraudulent accounts and initiate intelligence gathering.

Official Website: Lodge a complaint through the PNP-ACG Cybercrime Incident Report Form on their official portal.
Social Media and Hotlines: Reach out via the verified Facebook page of the PNP Anti-Cybercrime Group or their dedicated hotlines.

3. The Investigation and Blotter Process

Once at the PNP-ACG office, the standard operating procedure involves the following legal steps:

Step 1: Preliminary Interview and Assessment

A duty investigator will interview you to determine jurisdiction and verify if the elements of a cybercrime are present. Generally, online scams are classified under Computer-related Fraud (Section 4(b)(2) of R.A. 10175) or Swindling (Estafa) committed by means of information and communications technology (ICT) under the Revised Penal Code, in relation to Section 6 of R.A. 10175.

Step 2: Police Blotter Entry

The details of the incident will be officially recorded in the police blotter. A copy of the Blotter Entry or Blotter Excerpt will be issued to you. This serves as an official government record that the crime was reported.

Step 3: Preparation of the Complaint-Affidavit

To initiate a formal criminal investigation that can lead to prosecution, you must execute a Complaint-Affidavit. This is a sworn written statement detailing the who, what, when, where, and how of the scam. The PNP-ACG legal officers or investigators will assist you in drafting this document, which must be sworn before a notary public or a prosecutor.

4. Transition to Criminal Prosecution

Reporting the scam to the PNP is the investigative phase; seeking justice requires transitioning to the prosecutorial phase.

Filing with the Prosecutor's Office: Once the PNP-ACG identifies the real-world identity of the perpetrator (often through bank account verification, sub-poenaed telecommunication logs, or digital profiling), the PNP, acting as the law enforcement wing, will refer the case to the Department of Justice (DOJ) or the local City/Provincial Prosecutor’s Office for Preliminary Investigation.
Probable Cause Determination: The prosecutor will evaluate the Complaint-Affidavit and the evidence submitted by the PNP. If probable cause is found, a formal Criminal Information will be filed in the appropriate Regional Trial Court (RTC) designated as a Special Cybercrime Court.
Warrant of Arrest: The court will subsequently issue a warrant of arrest against the perpetrator.

5. Parallel Remedies: Interventions with Financial Institutions

While the PNP-ACG handles the criminal investigation, victims should concurrently initiate administrative remedies to freeze stolen funds:

Bank/E-Wallet Reporting: Immediately submit the PNP Blotter Excerpt to the fraud department of the involved bank or e-wallet platform. Under Bangko Sentral ng Pilipinas (BSP) regulations, financial institutions have protocols to temporarily freeze or hold accounts suspected of handling illicit funds pending investigation.
National Telecommunications Commission (NTC): If the scam involved a specific mobile number, the PNP report can be used to request the NTC to block the SIM card and the international mobile equipment identity (IMEI) of the perpetrator's device under the SIM Registration Act.