I. Introduction

Cybercrime has become one of the most common forms of criminal activity in the Philippines. It affects individuals, businesses, government agencies, schools, banks, online sellers, professionals, minors, and ordinary internet users. Because many Filipinos use social media, mobile banking, online shopping platforms, e-wallets, messaging apps, and digital payment systems daily, cybercrime now often appears in ordinary situations: a hacked Facebook account, a fake GCash transaction, an online scam, a defamatory post, identity theft, phishing, sextortion, unauthorized access to private photos, or the use of fake accounts to deceive or harass another person.

In the Philippine legal context, reporting cybercrime is not merely a technical matter. It involves criminal law, evidence law, data privacy, electronic evidence, jurisdiction, law enforcement procedure, and sometimes civil or administrative remedies. A victim must know where to report, what evidence to preserve, what laws may apply, and what government agencies may act on the complaint.

This article explains how cybercrime is reported in the Philippines, the relevant laws, the institutions involved, the evidence usually required, the legal procedure, and the practical considerations victims should know.

II. Main Laws Governing Cybercrime in the Philippines

A. Cybercrime Prevention Act of 2012

The principal law is Republic Act No. 10175, also known as the Cybercrime Prevention Act of 2012. This law punishes offenses committed through or involving computer systems, internet communications, and information and communications technology.

It covers both purely cyber offenses and ordinary crimes committed through digital means.

B. Revised Penal Code

The Revised Penal Code remains important because many cyber-related acts are traditional crimes committed online. For example, fraud, threats, libel, unjust vexation, grave coercion, and identity-related deception may involve acts punishable under the Revised Penal Code, with the internet or electronic communications serving as the medium.

C. Rules on Electronic Evidence

The Rules on Electronic Evidence govern the admissibility and authentication of electronic documents, screenshots, emails, messages, digital records, metadata, and other electronic materials in Philippine proceedings.

D. Data Privacy Act of 2012

The Data Privacy Act of 2012, or Republic Act No. 10173, may apply when personal information is unlawfully collected, processed, disclosed, sold, or used. Complaints involving unauthorized disclosure of personal data, misuse of identity documents, leaks of private information, and certain doxxing-related conduct may raise data privacy issues.

E. Anti-Photo and Video Voyeurism Act

Republic Act No. 9995, or the Anti-Photo and Video Voyeurism Act of 2009, applies when intimate images or videos are taken, copied, reproduced, shared, published, sold, or distributed without consent.

F. Safe Spaces Act

Republic Act No. 11313, or the Safe Spaces Act, may apply to gender-based online sexual harassment, including misogynistic, homophobic, transphobic, sexist, or sexually harassing online conduct.

G. Anti-Child Pornography Act and Special Protection Laws for Minors

When the victim is a minor, additional laws may apply, including the Anti-Child Pornography Act, child protection laws, trafficking laws, and special rules involving online sexual abuse or exploitation of children.

H. E-Commerce Act

The Electronic Commerce Act, or Republic Act No. 8792, recognizes the legal effect of electronic documents, electronic signatures, and electronic transactions. It is relevant in proving online communications, digital contracts, online sales, and electronic records.

III. What Acts May Constitute Cybercrime?

Under Philippine law, cybercrime may include a wide range of acts. Some are expressly listed in the Cybercrime Prevention Act, while others are traditional crimes committed using a computer system or the internet.

A. Offenses Against Confidentiality, Integrity, and Availability of Computer Data and Systems

These include:

Illegal access Unauthorized access to a computer system, account, device, server, database, cloud storage, social media account, or email account.
Illegal interception Unauthorized interception of computer data, communications, or transmissions.
Data interference Unauthorized alteration, damaging, deletion, deterioration, or suppression of computer data.
System interference Serious hindering or interference with the functioning of a computer or computer network.
Misuse of devices Use, production, sale, procurement, importation, distribution, or possession of tools, programs, passwords, access codes, or similar data intended for committing cyber offenses.
Cyber-squatting Registration or acquisition of a domain name in bad faith, usually to profit from another person’s trademark, name, business name, or reputation.

B. Computer-Related Offenses

These include:

Computer-related forgery Inputting, altering, or deleting computer data resulting in inauthentic data with legal effect.
Computer-related fraud Unauthorized input, alteration, deletion, or suppression of computer data, or interference with a computer system, causing damage or deception.
Computer-related identity theft Unauthorized acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person.

C. Content-Related Offenses

These include:

Cybersex Wilful engagement, maintenance, control, or operation of sexual activity or exhibition through a computer system for favor or consideration.
Child pornography and online sexual exploitation of children Production, distribution, transmission, possession, or facilitation of child sexual abuse materials or exploitative content involving minors.
Unsolicited commercial communications Certain forms of spam or unsolicited commercial communications may be covered, subject to exceptions.
Cyberlibel Libel committed through a computer system or similar means. This includes defamatory statements published online, such as through social media posts, blogs, comments, online articles, videos, or other digital publications.

D. Other Crimes Committed Through ICT

The Cybercrime Prevention Act also covers crimes already punishable under the Revised Penal Code or special laws when committed through or with the use of information and communications technology. This means ordinary crimes may carry cybercrime implications when done online.

Examples include:

Online scams
Investment fraud through social media
Phishing
Romance scams
Sextortion
Online threats
Online harassment
Fake account impersonation
Online blackmail
Unauthorized disclosure of private photos or messages
Selling fake goods online
Fake job recruitment scams
Fake loan app harassment
Unauthorized bank or e-wallet transactions
Business email compromise
Hacking of business accounts
Ransomware attacks
Doxxing
Online stalking
Digital extortion

IV. Where to Report Cybercrime in the Philippines

A victim may report cybercrime to several agencies, depending on the nature of the offense.

A. Philippine National Police Anti-Cybercrime Group

The Philippine National Police Anti-Cybercrime Group, commonly known as PNP-ACG, is one of the primary law enforcement agencies handling cybercrime complaints.

Victims may report to the PNP-ACG for cases involving:

Hacking
Online scams
Identity theft
Cyberlibel
Online threats
Sextortion
Phishing
Unauthorized account access
Online fraud
Fake online sellers
E-wallet or bank-related cyber incidents
Harassment through digital platforms
Computer-related offenses
Illegal use of private images or videos
Other offenses involving computer systems or online platforms

Reports may be made at the PNP-ACG headquarters, regional anti-cybercrime units, or police stations that can refer the matter to the cybercrime unit.

B. National Bureau of Investigation Cybercrime Division

The National Bureau of Investigation Cybercrime Division, or NBI-CCD, also investigates cybercrime. Many victims report to the NBI because it has specialized cybercrime investigators and digital forensic capability.

The NBI may handle cases involving:

Online fraud
Cyberlibel
Identity theft
Hacking
Online extortion
Online sexual exploitation
Data breach complaints
Business email compromise
Digital financial fraud
Large-scale online scams
Cases requiring digital forensics

C. Local Police Station

A victim may also begin by reporting to a local police station, especially in urgent cases involving threats, extortion, stalking, harassment, violence, or risk to safety. The local police may prepare a blotter entry and refer the case to the proper cybercrime unit.

A police blotter is not, by itself, a criminal case. It is an official record of the incident. It may help establish that the victim promptly reported the matter.

D. Prosecutor’s Office

A victim may file a criminal complaint directly with the Office of the City Prosecutor or Office of the Provincial Prosecutor, depending on the place where the offense was committed, where the victim resides, where the offender may be found, or where jurisdiction may properly lie.

For cybercrime complaints, law enforcement investigation is often useful before filing with the prosecutor, especially when the suspect must still be identified. However, direct filing may be possible when the identity of the offender is known and evidence is already available.

E. National Privacy Commission

The National Privacy Commission, or NPC, is the proper agency for complaints involving violations of the Data Privacy Act.

A complaint to the NPC may be relevant where there is:

Unauthorized disclosure of personal information
Data breach involving personal data
Unauthorized processing of sensitive personal information
Misuse of identity documents
Unauthorized sharing of private records
Unlawful exposure of personal information by a company, school, employer, app, lender, online seller, or organization
Failure of a personal information controller to protect personal data

Not every cybercrime is a data privacy case. For example, a hacked social media account may be a cybercrime complaint with the PNP or NBI, while a company’s negligent exposure of customer records may be a data privacy matter with the NPC. Some cases may involve both.

F. Department of Justice Office of Cybercrime

The Department of Justice Office of Cybercrime, or DOJ-OOC, has a coordinating and policy role under the Cybercrime Prevention Act. It is involved in cybercrime-related legal cooperation, preservation requests, cybercrime policy, and coordination with law enforcement and international counterparts.

Ordinary complainants often report first to the PNP-ACG or NBI-CCD, but the DOJ-OOC is part of the broader cybercrime enforcement framework.

G. Bangko Sentral ng Pilipinas and Financial Institutions

For cyber incidents involving banks, e-wallets, remittance platforms, credit cards, debit cards, online transfers, or unauthorized financial transactions, the victim should immediately notify the bank or financial institution.

Examples include:

Unauthorized GCash, Maya, or online banking transfers
Credit card fraud
ATM-related account compromise
Phishing leading to bank account loss
SIM-related account takeover
Unauthorized loans or financial accounts opened using stolen identity

The victim should ask the bank or e-wallet provider to freeze suspicious transactions, block compromised accounts, issue a formal incident report, and preserve transaction logs.

Regulatory complaints may also be brought to the appropriate financial regulator when the issue involves the conduct of a regulated financial institution.

H. Social Media Platforms and Online Marketplaces

A report to law enforcement should often be accompanied by a report to the platform involved.

For example:

Facebook, Instagram, TikTok, X, YouTube, Telegram, or messaging apps for impersonation, harassment, hacked accounts, or harmful content
Shopee, Lazada, Carousell, or other marketplaces for fake sellers or fraudulent transactions
Banks, e-wallets, or payment platforms for fraudulent transfers
Domain registrars or hosting providers for phishing websites
Email providers for hacked accounts or phishing messages

Reporting to the platform may help preserve records, suspend fraudulent accounts, take down content, and prevent further harm. However, platform reporting does not replace reporting to Philippine law enforcement.

V. Immediate Steps Before Filing a Cybercrime Report

The first few hours after discovering a cybercrime matter can be crucial. Victims should preserve evidence carefully and avoid actions that may destroy digital traces.

A. Preserve Evidence Immediately

Evidence should be preserved before blocking, deleting, replying, or confronting the suspect.

Useful evidence may include:

Screenshots of posts, messages, profiles, comments, emails, transaction confirmations, account names, usernames, URLs, and timestamps
Screen recordings showing the account, conversation, or fraudulent page
Full URLs of social media profiles, websites, marketplace listings, and posts
Email headers, not merely screenshots of emails
Chat logs and exported conversations
Transaction receipts
Bank or e-wallet reference numbers
Contact numbers used by the suspect
Names, aliases, usernames, and account handles
Photos, videos, or documents sent by the suspect
IP logs or login alerts, where available
Device notifications of suspicious logins
Courier details for online shopping scams
Shipping labels, tracking numbers, and delivery records
Proof of payment
Links to fake websites or phishing pages
Calls, if lawfully recorded or documented
Copies of demand messages in extortion cases

Screenshots should show the date, time, username, profile link, and full context as much as possible. A screenshot of a single message may be less useful than a complete thread showing who sent it, when it was sent, and how it relates to the offense.

B. Do Not Delete the Conversation

Deleting the conversation can weaken the case. Law enforcement may need to examine the original thread, account, or device.

Victims should avoid:

Deleting messages
Deleting the app
Formatting the phone
Resetting accounts before preserving evidence
Removing the suspect’s profile from view before capturing identifying details
Editing screenshots
Cropping out timestamps or URLs
Sending altered files to investigators

C. Secure Accounts

After evidence is preserved, the victim should secure compromised accounts.

Steps may include:

Change passwords
Enable two-factor authentication
Log out of all devices
Check account recovery email and phone number
Review linked devices
Revoke suspicious third-party app access
Check forwarding rules in email accounts
Notify contacts not to transact with the compromised account
Freeze bank or e-wallet accounts, if necessary
Report the hacked account to the platform

D. Report Financial Loss Immediately

In financial cybercrime, speed matters. The victim should contact the bank, e-wallet, credit card issuer, remittance service, or payment platform as soon as possible.

The victim should request:

Blocking or freezing of the account
Reversal or hold of suspicious transactions, where possible
Investigation of the recipient account
Preservation of transaction logs
Written confirmation of the report
Case or ticket number
Copy of transaction history
Details needed for law enforcement reporting

E. Do Not Negotiate Recklessly with Extortionists

In sextortion, blackmail, ransomware, or online threats, victims often panic. They may be tempted to pay the offender. Payment does not guarantee that the offender will stop. It may encourage further demands.

Victims should preserve the demand messages, payment instructions, wallet addresses, bank details, phone numbers, and usernames, then report immediately.

VI. Documents Usually Needed to Report Cybercrime

Requirements may vary by agency and case type, but a complainant should generally prepare the following:

Valid government-issued ID
Written narrative or complaint-affidavit
Screenshots and printed copies of evidence
Soft copies of digital evidence in a USB drive or other storage device
URLs, usernames, account links, email addresses, and contact numbers
Proof of ownership of hacked accounts, where applicable
Proof of payment or financial loss
Bank statements, e-wallet transaction history, or payment receipts
Demand messages, threats, or extortion communications
Witness affidavits, where available
Barangay blotter or police blotter, if previously made
Platform reports or ticket numbers
Device used in the incident, when forensic examination is needed
Company authorization, board resolution, or secretary’s certificate, if the complainant is a corporation
Special power of attorney, if someone reports on behalf of the victim

For minors, the report should generally be made by a parent, guardian, social worker, school authority, or authorized representative, depending on the circumstances and urgency.

VII. How to File a Cybercrime Report

Step 1: Identify the Nature of the Offense

The victim should identify the main problem:

Was money taken?
Was an account hacked?
Was someone impersonated?
Was private information disclosed?
Was there defamation?
Was there a threat?
Was there sexual exploitation or sextortion?
Was a child involved?
Was a company system compromised?
Was there unauthorized access to data or accounts?

The classification affects where to report and what evidence is needed.

Step 2: Preserve and Organize Evidence

Evidence should be organized chronologically. It is helpful to prepare a folder containing:

Timeline of events
Screenshots labeled by date and time
Links and URLs
Transaction records
Names and contact details
Platform ticket numbers
Copies of IDs and relevant documents
A brief explanation of each file

A clear timeline helps investigators and prosecutors understand the case quickly.

Step 3: Go to the Proper Agency

The victim may file with:

PNP Anti-Cybercrime Group
NBI Cybercrime Division
Local police station for urgent matters
Prosecutor’s office, when ready for preliminary investigation
National Privacy Commission, for data privacy issues
Financial institution or platform, for preservation and internal investigation

For serious cases involving immediate danger, threats, extortion, minors, or ongoing financial loss, the victim should report urgently to law enforcement.

Step 4: Execute a Complaint-Affidavit

A complaint-affidavit is usually required in criminal complaints. It contains the facts of the case under oath.

It should state:

Full name and address of the complainant
Identity of the respondent, if known
Description of the incident
Dates and times of relevant events
The online platform or system used
How the complainant discovered the offense
Damage suffered
Evidence attached
Request for investigation or prosecution
Verification under oath

The affidavit should be truthful, specific, and supported by evidence. False statements may expose the complainant to legal liability.

Step 5: Submit Evidence for Evaluation

Law enforcement may evaluate the evidence and determine whether further investigation, digital forensic examination, coordination with platforms, or identification of the suspect is needed.

In some cases, investigators may request:

Original device
SIM card
Email header
Account login history
Certification from bank or e-wallet provider
Platform data preservation
Additional witnesses
Clarificatory affidavit

Step 6: Investigation

Law enforcement may conduct cyber investigation, which may include:

Tracing accounts
Requesting subscriber information through lawful means
Coordinating with service providers
Conducting digital forensic examination
Preserving computer data
Applying for warrants, when necessary
Identifying suspects
Preparing referral to the prosecutor

Step 7: Preliminary Investigation

For offenses requiring preliminary investigation, the complaint may be filed with the prosecutor. The respondent may be required to file a counter-affidavit. The prosecutor will determine whether probable cause exists.

If probable cause is found, an information may be filed in court.

Step 8: Court Proceedings

Once filed in court, the case proceeds under criminal procedure. Electronic evidence must be properly identified, authenticated, and presented.

The prosecution must prove guilt beyond reasonable doubt.

VIII. Cybercrime Evidence: What Makes It Strong?

Cybercrime cases often depend heavily on electronic evidence. The quality of evidence affects whether the case can proceed.

A. Screenshots Alone May Not Always Be Enough

Screenshots are useful, but they may be challenged because they can be edited or fabricated. Stronger evidence includes:

Screenshots with full context
Original device containing the messages
URLs and timestamps
Exported conversation files
Email headers
Platform account details
Transaction records from official sources
Certifications from banks, platforms, or service providers
Witness testimony
Digital forensic reports

B. Authentication Is Important

Electronic evidence must be authenticated. The person presenting it should be able to explain:

How it was obtained
When it was obtained
From what device or account
Whether it is a faithful reproduction
Whether the account or communication belongs to the person alleged
Whether there were changes, edits, or alterations

C. Chain of Custody May Matter

For devices, drives, phones, or forensic images, chain of custody may become important. This is especially true in hacking, malware, child exploitation, ransomware, and corporate data breach cases.

The device should be handled carefully. Unauthorized tampering may affect the evidentiary value.

D. Preserve Metadata When Possible

Metadata can show dates, times, file origins, sender details, and technical information. Cropping screenshots, converting files repeatedly, or forwarding images through messaging apps may strip metadata.

Whenever possible, preserve original files and not merely screenshots.

IX. Common Cybercrime Scenarios and How to Report Them

A. Online Scam or Fraud

Online scams include fake sellers, fake investment schemes, fake job offers, romance scams, fake loans, phishing, fake delivery notices, and fraudulent payment requests.

Evidence to gather:

Conversation with the scammer
Seller profile or account link
Advertisement or listing
Proof of payment
Bank or e-wallet recipient details
Shipping or courier information
Contact numbers
Receipts and reference numbers
Screenshots of promises or representations
Other victims, if known

Where to report:

PNP-ACG
NBI-CCD
Bank or e-wallet provider
Online marketplace or platform
Prosecutor’s office, when the suspect is known

B. Hacked Social Media Account

A hacked account may involve illegal access, identity theft, fraud, or harassment.

Evidence to gather:

Proof of ownership of the account
Email alerts of suspicious login
Screenshots of unauthorized posts or messages
Messages sent by the hacker
Reports from contacts who received scam messages
Account URL
Phone number or email linked to the account
Date and time of loss of access

Where to report:

Platform support
PNP-ACG
NBI-CCD
Bank or e-wallet provider, if money was solicited using the hacked account

C. Cyberlibel

Cyberlibel involves defamatory statements made online. The statement must generally identify a person, be published to others, be defamatory, and be made with the required legal elements of libel.

Evidence to gather:

Full screenshot of the post or comment
URL of the post
Name and profile link of the poster
Date and time of publication
Proof that others saw it
Screenshots of reactions, shares, or comments
Explanation of why the statement is false and defamatory
Proof of damage, where available

Where to report:

PNP-ACG
NBI-CCD
Prosecutor’s office

Cyberlibel cases require careful legal evaluation because issues of free speech, opinion, truth, privileged communication, public figures, and malice may arise.

D. Online Threats and Harassment

Threats made through messages, posts, emails, or calls may be punishable depending on the nature and seriousness of the threat.

Evidence to gather:

Complete conversation
Account profile of the sender
Date and time of threats
Any prior history of conflict
Voice recordings or call logs, where lawfully obtained
Witnesses who saw the threats
Safety concerns or actual harm suffered

Where to report:

Local police station, especially for urgent safety risks
PNP-ACG
NBI-CCD
Barangay or court remedies, depending on the case
Prosecutor’s office

E. Sextortion

Sextortion involves threats to publish intimate photos or videos unless the victim pays money, sends more images, performs acts, or obeys demands.

Evidence to gather:

Threat messages
Account profile of the offender
Intimate image or video reference, without unnecessarily spreading it
Payment demands
Bank, e-wallet, crypto wallet, or remittance details
Contact numbers
Links where content was posted, if already uploaded
Full timeline

Where to report:

PNP-ACG
NBI-CCD
Local police if urgent
Platform for takedown
Women and Children Protection Desk, especially where minors or sexual abuse are involved

Victims should not be blamed for being targeted. The offender’s threats, coercion, and unauthorized use of intimate content may be criminal.

F. Unauthorized Posting of Intimate Images

This may violate the Anti-Photo and Video Voyeurism Act, the Cybercrime Prevention Act, Safe Spaces Act, or other laws depending on the facts.

Evidence to gather:

Screenshot of the post
URL or platform link
Identity or account of uploader
Date and time of posting
Proof of lack of consent
Prior conversations with the uploader
Evidence of threats or coercion
Takedown reports to platforms

Where to report:

PNP-ACG
NBI-CCD
Platform for takedown
Prosecutor’s office
Local police for urgent protection

G. Identity Theft and Impersonation

Identity theft may involve fake accounts, use of another person’s name or photo, unauthorized use of IDs, fake loan applications, fake job applications, or fraudulent transactions.

Evidence to gather:

Fake account link
Screenshots of impersonation
Use of photos, name, signature, or ID
Fraudulent transactions
Messages sent using the fake identity
Witnesses who were deceived
Proof of actual identity of victim
Reports from third parties affected

Where to report:

PNP-ACG
NBI-CCD
National Privacy Commission, if personal data was misused
Financial institution, if accounts or loans were involved
Platform for takedown

H. Data Breach or Unauthorized Disclosure of Personal Data

This may involve companies, schools, employers, apps, online lenders, hospitals, clinics, organizations, or government offices.

Evidence to gather:

Copy or screenshot of the exposed personal information
Source of exposure
Notice from the organization, if any
Harm suffered
Communications with the organization
Proof of identity
Evidence of misuse of the data

Where to report:

National Privacy Commission
PNP-ACG or NBI-CCD, if criminal acts are involved
The organization’s data protection officer
Sector regulator, where applicable

I. Online Lending App Harassment

Some online lending apps may misuse contacts, shame borrowers, send threats, disclose debts, or harass third parties.

Evidence to gather:

Threatening messages
Screenshots sent to contacts
Names of lending app and agents
Loan documents
Proof of disclosure to third parties
Call logs
Contact numbers used
Privacy policy and app permissions, if available

Where to report:

National Privacy Commission
PNP-ACG or NBI-CCD for threats or cyber harassment
Securities and Exchange Commission, where the lending company is involved
Other financial regulators, depending on the entity

J. Business Email Compromise

Business email compromise involves fraud through compromised or spoofed business emails, often resulting in payment diversion.

Evidence to gather:

Full email headers
Original email files
Invoices
Bank instructions
Payment records
Internal approval trail
Vendor communications
Login records
IT incident report
Bank recall request

Where to report:

NBI-CCD
PNP-ACG
Bank or financial institution
Company counsel
Cybersecurity provider
Data protection officer, if personal data was affected

X. Cybercrime Involving Minors

Cybercrime involving minors must be treated with special urgency and care.

Cases may include:

Online sexual exploitation
Grooming
Sextortion of minors
Child sexual abuse materials
Cyberbullying
Impersonation
Threats
Exploitation through livestreaming
Coercion to send intimate photos
Trafficking-related online conduct

Reports may be made to:

PNP Women and Children Protection Center
PNP-ACG
NBI-CCD
Local police Women and Children Protection Desk
Department of Social Welfare and Development
School authorities, where applicable
Platform or app for immediate takedown

Evidence involving minors must be handled carefully. Intimate or exploitative images of minors should not be forwarded, reposted, or unnecessarily copied. The safest course is to preserve the existence of the material, document where it appears, and report immediately to authorities.

XI. Jurisdiction in Philippine Cybercrime Cases

Cybercrime jurisdiction can be complex because the offender, victim, server, platform, and evidence may be in different places or countries.

Philippine authorities may have jurisdiction when:

The offender is in the Philippines
The victim is in the Philippines
The harmful effects occurred in the Philippines
A Philippine computer system or account was affected
The criminal act was partly committed in the Philippines
Philippine law otherwise applies

For example, a scammer abroad who targets a Filipino victim may still be investigated, though enforcement may require international cooperation. If the suspect is outside the Philippines, law enforcement may need to coordinate through formal legal assistance channels, platform requests, or foreign counterparts.

XII. Preservation of Computer Data

Cybercrime cases often require urgent preservation of data because online platforms may delete logs or content after a certain period. Philippine authorities may issue or request preservation of computer data in accordance with law.

Preservation may involve:

Account records
Subscriber information
Login logs
IP addresses
Transaction records
Communications data
Uploaded files
Metadata
Server records

Victims cannot usually compel foreign platforms directly to disclose law enforcement data. However, victims can report the matter to the platform and to Philippine authorities, who may make lawful requests where appropriate.

XIII. Search, Seizure, and Warrants in Cybercrime Cases

Law enforcement must observe constitutional rights and procedural safeguards when searching devices, seizing computers, examining accounts, or obtaining private data.

Searches of devices, accounts, servers, or private communications may require appropriate legal authority. Evidence obtained unlawfully may be challenged.

Victims should cooperate with lawful requests, but they should also understand that handing over a personal device may expose private data unrelated to the case. In sensitive cases, it may be appropriate to ask how the device will be handled, whether forensic imaging will be done, and what data will be examined.

XIV. Cybercrime and Data Privacy

A cybercrime complaint may involve personal information. Victims should avoid committing further privacy violations while gathering evidence.

For example:

Do not publicly post the suspect’s personal information without legal basis.
Do not share private images, even to expose wrongdoing.
Do not upload sensitive evidence to public social media.
Do not circulate IDs, bank details, addresses, or phone numbers unnecessarily.
Do not access someone else’s account to obtain evidence.
Do not hack back.

The proper method is to preserve evidence and submit it to the proper agency.

XV. The Role of Barangay Proceedings

Not all cyber-related complaints are suitable for barangay conciliation. Many criminal offenses, especially those punishable by imprisonment beyond certain thresholds or involving parties from different cities or municipalities, may be outside the barangay conciliation process.

However, some minor disputes involving online insults, neighborhood conflicts, or personal disagreements may begin at the barangay level depending on the parties, residence, and offense. Cybercrime cases involving serious offenses, unknown offenders, minors, sexual exploitation, financial fraud, hacking, or threats are usually better reported directly to law enforcement.

XVI. Civil Remedies

Apart from criminal prosecution, victims may have civil remedies.

Possible civil claims include:

Damages for injury to reputation
Damages for emotional distress
Recovery of money lost through fraud
Injunction or takedown-related relief
Damages for privacy violations
Damages arising from breach of contract
Corporate or commercial claims arising from cyber incidents

Civil remedies may be pursued together with or separately from criminal proceedings, depending on the circumstances.

XVII. Administrative and Regulatory Remedies

Some cyber incidents involve regulated entities or professional conduct. Administrative complaints may be available against:

Banks
E-wallet providers
Lending companies
Schools
Employers
Government offices
Telecommunications providers
Data controllers
Licensed professionals
Corporations and online platforms operating under Philippine regulation

The appropriate regulator depends on the industry and the nature of the violation.

XVIII. Reporting Cybercrime by Businesses

Businesses face special risks because cybercrime may affect customers, employees, intellectual property, bank accounts, confidential records, trade secrets, and regulatory compliance.

When a business suffers a cyber incident, it should:

Activate incident response procedures
Preserve logs and affected devices
Isolate compromised systems
Notify bank partners, if financial fraud is involved
Determine whether personal data was affected
Notify the data protection officer
Assess whether breach notification to the National Privacy Commission and affected data subjects is required
Report criminal activity to PNP-ACG or NBI-CCD
Preserve internal communications and approvals
Obtain forensic assistance
Review contracts, insurance, and regulatory obligations
Avoid public statements that are inaccurate or premature

Businesses should document all actions taken because later proceedings may examine whether the company acted promptly and reasonably.

XIX. Common Mistakes Victims Should Avoid

Victims often weaken their cases unintentionally. Common mistakes include:

Deleting messages before taking screenshots
Cropping screenshots too much
Failing to capture URLs
Blocking the suspect before preserving profile details
Publicly accusing someone without enough evidence
Posting private information online
Forwarding intimate images as “proof”
Paying extortionists repeatedly
Waiting too long before reporting financial fraud
Formatting devices
Failing to request bank preservation
Sending edited or altered evidence
Using fake accounts to entrap or harass the suspect
Hacking back
Failing to make a clear timeline
Assuming a platform report is enough
Filing in the wrong agency without preserving evidence
Ignoring data privacy implications

XX. Sample Structure of a Cybercrime Complaint-Affidavit

A complaint-affidavit may follow this structure:

1. Personal Circumstances

State the complainant’s full name, age, civil status, nationality, address, and identification details.

2. Identity of Respondent

State the name, alias, username, account link, phone number, email address, or other identifying details of the offender, if known.

3. Facts of the Case

Narrate the events in chronological order.

Include:

When the incident started
How the complainant encountered the suspect
What platform was used
What the suspect said or did
What loss, damage, fear, or injury resulted
How the evidence was preserved
Whether the matter was reported to a bank, platform, barangay, or police

4. Evidence

List and attach evidence as annexes.

Example:

Annex “A” — Screenshot of respondent’s profile
Annex “B” — Conversation dated March 1, 2026
Annex “C” — Proof of payment
Annex “D” — Bank transaction record
Annex “E” — Platform report confirmation
Annex “F” — Demand message
Annex “G” — URL of defamatory post

5. Legal Basis

State that the acts may constitute violations of applicable laws, such as the Cybercrime Prevention Act, Revised Penal Code, Data Privacy Act, Anti-Photo and Video Voyeurism Act, Safe Spaces Act, or other relevant laws.

6. Prayer or Request

Request the agency or prosecutor to investigate and prosecute the offender.

7. Verification and Oath

The affidavit must be signed and sworn before a prosecutor, notary public, or authorized officer.

XXI. Sample Incident Timeline Format

Date and Time	Event	Evidence
January 5, 2026, 8:00 PM	Victim received message from account “ABC Seller” offering a phone for sale	Screenshot, Annex A
January 5, 2026, 8:30 PM	Victim sent ₱10,000 to e-wallet number	Receipt, Annex B
January 6, 2026, 9:00 AM	Seller stopped replying and blocked victim	Screenshot, Annex C
January 6, 2026, 10:00 AM	Victim reported to e-wallet provider	Ticket confirmation, Annex D
January 7, 2026, 2:00 PM	Victim filed report with cybercrime unit	Complaint receipt, Annex E

A timeline helps show the sequence of events and connects each factual allegation to evidence.

XXII. Special Considerations for Cyberlibel

Cyberlibel is one of the most legally sensitive cybercrime complaints. Not every offensive, insulting, or negative online statement is automatically cyberlibel.

The following issues may arise:

Whether the statement identifies the complainant
Whether the statement is defamatory
Whether it is a statement of fact or opinion
Whether the statement is true or false
Whether malice is presumed or must be proven
Whether the complainant is a public figure
Whether the communication is privileged
Whether the post was actually published
Whether the accused authored, shared, reposted, or merely reacted to the content
Whether the case was filed within the applicable prescriptive period

Victims considering cyberlibel complaints should preserve the post, URL, comments, shares, reactions, and evidence that third persons saw or understood the defamatory statement.

XXIII. Special Considerations for Online Scams

In online scam cases, the identity of the scammer is often hidden. The visible account may be fake, stolen, or operated by a mule. Bank accounts and e-wallets used to receive money may belong to another person, may be fraudulently opened, or may be controlled by a syndicate.

Victims should report quickly because:

Funds may still be frozen or traced
Recipient accounts may still contain balances
Transaction logs may be preserved
Similar complaints may be linked
The same account may be used against other victims
Law enforcement may identify patterns

Victims should also report fake sellers or accounts to the platform to prevent further victimization.

XXIV. Special Considerations for Hacking Cases

A hacking complaint should distinguish between:

Loss of access due to forgotten password
Unauthorized login by another person
Malware infection
Phishing compromise
SIM swap or account recovery attack
Insider access
Device theft
Cloud account compromise
Business server compromise

The victim should preserve login alerts, IP information, suspicious email rules, account recovery changes, device history, and system logs.

In corporate cases, forensic preservation is especially important. Turning devices on and off, reinstalling systems, or deleting malware without imaging may destroy evidence.

XXV. Special Considerations for Sextortion and Intimate Images

Victims of sextortion often experience fear, shame, and urgency. Legally, the important points are:

The victim’s consent to create an image does not necessarily mean consent to distribute it.
Threatening to distribute intimate images may be criminal.
Demanding money, sexual acts, or more images may constitute extortion or coercion.
Distribution of intimate content without consent may violate special laws.
If a minor is involved, the case becomes more serious and must be handled with child protection safeguards.
The victim should avoid further circulating the image.
Reports to platforms should be made for takedown.
Reports to law enforcement should be made immediately.

XXVI. Can Anonymous Reports Be Made?

Some agencies or platforms may receive tips or reports even if the reporting person does not immediately disclose full details. However, a formal criminal complaint usually requires an identified complainant or witness willing to execute an affidavit.

Anonymous reporting may help alert authorities, especially in cases involving child exploitation, large-scale scams, or public threats, but prosecution generally requires admissible evidence and witnesses.

XXVII. Can a Representative File the Report?

A representative may assist the victim, especially when the victim is a minor, elderly, abroad, incapacitated, or otherwise unable to appear personally. However, the victim’s own affidavit may still be required if the victim has personal knowledge of the facts.

For corporations, the complaint should be filed by an authorized officer or representative, usually supported by proof of authority.

XXVIII. Reporting When the Victim Is Overseas

A Filipino victim abroad, or a foreign victim affected by a person in the Philippines, may still report to Philippine authorities when there is a sufficient Philippine connection.

The victim may prepare:

Affidavit executed before a Philippine consulate, notary, or authorized officer
Electronic evidence
Proof of identity
Proof of loss
Authorization for a Philippine representative
Contact details for follow-up

The case may involve jurisdictional and evidentiary issues, especially where the suspect, platform, bank, or server is in another country.

XXIX. Reporting When the Suspect Is Unknown

Many cybercrime complaints begin with an unknown suspect. The complaint may identify the suspect by username, account link, email address, phone number, bank account, e-wallet number, IP address, or other digital identifier.

The complainant may state that the true name and personal circumstances of the offender are unknown and request investigation to identify the person responsible.

XXX. What Happens After Reporting?

After a report is filed, possible outcomes include:

Case evaluation
Request for more evidence
Digital forensic examination
Issuance of preservation requests
Coordination with platforms, banks, or telcos
Identification of suspects
Referral to prosecutor
Filing of criminal complaint
Preliminary investigation
Dismissal for insufficient evidence
Filing of information in court
Arrest, where legally authorized
Settlement in civil aspects, where lawful and appropriate
Trial

Not every report immediately becomes a criminal case in court. Law enforcement and prosecutors must determine whether evidence supports the filing of charges.

XXXI. Time Limits and Prescription

Cybercrime complaints may be subject to prescriptive periods depending on the offense charged. The applicable period can vary based on the law violated and penalty imposed.

Victims should report promptly because:

Evidence may disappear
Accounts may be deleted
Logs may expire
Witnesses may become unavailable
Financial recovery becomes harder
Delay may affect credibility
prescription may become an issue

Prompt reporting is particularly important in cyberlibel, online fraud, threats, hacking, and intimate image cases.

XXXII. Legal Risks in Making a Cybercrime Report

A complainant must act in good faith. False, malicious, or reckless accusations may expose the complainant to possible liability.

Risks include:

Perjury, for false sworn statements
Malicious prosecution, in appropriate cases
Civil liability for damages
Counterclaims for defamation
Data privacy violations from public exposure of personal data
Liability for unauthorized access if the complainant hacks or intrudes into accounts
Evidence exclusion if evidence was obtained unlawfully

Victims should report facts accurately and avoid exaggeration.

XXXIII. Practical Checklist Before Going to PNP-ACG or NBI-CCD

Prepare the following:

Valid ID
Printed screenshots
Soft copies of screenshots and files
Full URLs
Username and account profile links
Contact numbers and email addresses used by suspect
Proof of payment or financial loss
Bank or e-wallet reference numbers
Device used in the incident
Timeline of events
Draft narrative of what happened
Platform report ticket number
Bank report ticket number
Witness names and contact details
Copies of threats, demands, or defamatory posts
Proof of ownership of hacked account
Company authorization, for business complainants
Parent or guardian documents, for minors

XXXIV. Practical Checklist for Financial Cybercrime

For unauthorized transfers, phishing, fake sellers, or online banking fraud:

Call the bank or e-wallet provider immediately
Request account freeze or transaction hold
Ask for a case number
Preserve SMS and email alerts
Screenshot transaction history
Save reference numbers
Preserve the scammer’s messages
Save recipient account details
File a report with cybercrime authorities
Follow up with written documentation
Avoid sending more money
Warn contacts if impersonation was involved

XXXV. Practical Checklist for Hacked Accounts

For hacked social media, email, or cloud accounts:

Screenshot login alerts
Preserve unauthorized posts or messages
Recover the account through official channels
Change password
Enable two-factor authentication
Remove unknown devices
Check recovery email and phone number
Notify contacts
Report fraudulent messages sent through the account
Report to platform
Report to PNP-ACG or NBI-CCD if damage occurred
Check linked financial accounts

XXXVI. Practical Checklist for Sextortion

For sextortion or intimate image threats:

Do not panic-delete the conversation
Screenshot threats and demands
Save account links and usernames
Preserve payment details demanded by offender
Do not send more intimate material
Report the account to the platform
Report to PNP-ACG or NBI-CCD
Report urgently if the victim is a minor
Ask trusted persons for support
Avoid reposting the intimate content as evidence
Preserve links if content was uploaded
Seek takedown through platform mechanisms

XXXVII. Practical Checklist for Cyberlibel

For defamatory online posts:

Screenshot the full post
Capture URL
Capture date and time
Preserve comments, shares, and reactions
Identify the author or account
Preserve context before the post is deleted
Document how the statement refers to the complainant
Document falsity and damage
Avoid retaliatory defamatory posts
Consult legal counsel before filing where facts are complex

XXXVIII. Important Distinctions

A. Reporting Is Not the Same as Filing a Case

A report to PNP, NBI, or a platform starts documentation or investigation. A criminal case generally proceeds through a complaint, prosecutor evaluation, and court filing.

B. A Blotter Is Not a Conviction

A blotter records an incident. It does not prove guilt.

C. A Screenshot Is Not Automatically Conclusive

Screenshots must be authenticated and supported by context.

D. A Fake Account Does Not Always Identify the Real Offender

The person shown in the profile photo may not be the person operating the account.

E. Platform Takedown Is Different from Criminal Liability

A platform may remove content for violating its rules even before a court determines criminal liability.

F. Civil Settlement Does Not Always End Criminal Liability

Some offenses may involve public interest, and settlement may not automatically terminate criminal proceedings.

XXXIX. Rights of the Complainant

A complainant generally has the right to:

Report a crime
Be treated with dignity
Submit evidence
Request investigation
Receive complaint or case reference information
Be informed of procedural requirements
Seek protection in urgent cases
Obtain counsel
Pursue civil remedies
Protect personal data and privacy
Request lawful takedown or preservation assistance
Participate in preliminary investigation when required

XL. Rights of the Accused or Respondent

The accused or respondent also has rights, including:

Presumption of innocence
Due process
Right against unreasonable searches and seizures
Right to counsel
Right to be informed of accusations
Right to respond in preliminary investigation
Right against self-incrimination
Right to challenge electronic evidence
Right to confront witnesses in court
Right to fair trial

Cybercrime enforcement must balance victim protection with constitutional rights.

XLI. Conclusion

Reporting cybercrime in the Philippines requires prompt action, careful preservation of evidence, and filing with the proper agency. The main agencies are the PNP Anti-Cybercrime Group and the NBI Cybercrime Division, while the National Privacy Commission handles data privacy concerns and financial institutions must be notified immediately in bank or e-wallet fraud cases.

The most important practical step is evidence preservation. Victims should save screenshots, URLs, timestamps, transaction records, account links, email headers, and full conversations before deleting, blocking, or confronting the offender. For financial fraud, banks and e-wallet providers should be notified immediately. For sextortion, child exploitation, serious threats, hacking, or ongoing harm, urgent law enforcement reporting is necessary.

Philippine cybercrime law covers hacking, identity theft, cyber fraud, cyberlibel, cybersex, child exploitation, data interference, system interference, online scams, unauthorized access, and traditional crimes committed through digital means. Depending on the facts, other laws may apply, including the Revised Penal Code, Data Privacy Act, Anti-Photo and Video Voyeurism Act, Safe Spaces Act, and child protection laws.

A cybercrime report is strongest when it is factual, organized, supported by reliable electronic evidence, and filed promptly with the correct authority.