I. Introduction

Cybercrime has become one of the most common and disruptive forms of criminal activity in the Philippines. It affects individuals, businesses, government agencies, professionals, students, overseas Filipinos, and ordinary consumers who rely on digital platforms for communication, banking, work, education, commerce, and social interaction.

In the Philippine setting, cybercrime may involve online scams, hacked accounts, identity theft, phishing, unauthorized access to computer systems, online threats, cyberlibel, extortion, sextortion, online sexual exploitation, investment fraud, fake online sellers, malware attacks, data breaches, and misuse of social media accounts. Because these offenses are committed through computers, mobile phones, internet platforms, electronic communications, and digital payment systems, victims often need to act quickly to preserve evidence and report the incident to the proper authorities.

The Philippine National Police, through its Anti-Cybercrime Group, commonly known as the PNP-ACG, is one of the principal law enforcement bodies tasked with receiving, investigating, and assisting in cybercrime complaints.

This article explains how to report cybercrime to the PNP in the Philippines, what evidence to prepare, what laws may apply, what victims should expect, and what practical steps should be taken before, during, and after filing a complaint.

II. Legal Framework on Cybercrime in the Philippines

The primary Philippine law governing cybercrime is Republic Act No. 10175, also known as the Cybercrime Prevention Act of 2012. This law penalizes crimes committed through information and communications technology and also recognizes certain traditional crimes when committed by means of a computer system.

Cybercrime cases may also involve other laws depending on the facts, such as:

Revised Penal Code Traditional crimes such as threats, unjust vexation, estafa, identity-related fraud, libel, coercion, and extortion may still apply when the criminal act is committed online.

Republic Act No. 10173, or the Data Privacy Act of 2012 This may apply when there is unauthorized processing, disclosure, breach, or misuse of personal information.

Republic Act No. 9995, or the Anti-Photo and Video Voyeurism Act of 2009 This may apply to the recording, sharing, or distribution of private sexual images or videos without consent.

Republic Act No. 11934, or the SIM Registration Act This may become relevant when cybercrime involves mobile numbers, text scams, anonymous calls, or SIM-based fraud.

Republic Act No. 9775, as amended, or the Anti-Child Pornography Act This applies to online child sexual abuse and exploitation material.

Republic Act No. 11862, or the Expanded Anti-Trafficking in Persons Act amendments This may apply where online platforms are used for exploitation, recruitment, coercion, or trafficking-related conduct.

Republic Act No. 8792, or the Electronic Commerce Act This may be relevant to electronic documents, electronic signatures, and admissibility of digital records.

Rules on Electronic Evidence These rules are important because cybercrime complaints often rely on screenshots, chat logs, emails, transaction records, metadata, device records, and other electronic documents.

Cybercrime investigation is therefore not limited to one statute. The exact offense depends on the act committed, the intent of the offender, the platform used, the harm caused, and the available evidence.

III. The Role of the PNP Anti-Cybercrime Group

The PNP Anti-Cybercrime Group is the specialized unit of the Philippine National Police that handles cybercrime-related complaints and investigations. Its functions generally include:

Receiving cybercrime complaints from victims.
Conducting initial assessment of cyber-related incidents.
Assisting in the preservation and collection of digital evidence.
Investigating online scams, hacking, identity theft, phishing, cyberlibel, online threats, sextortion, and other cyber-related offenses.
Coordinating with prosecutors, courts, service providers, banks, e-wallet companies, telecommunications companies, and other government agencies when legally required.
Implementing lawful cybercrime operations, subject to constitutional and procedural safeguards.

The PNP-ACG is not the only government body involved in cybercrime response. Depending on the nature of the incident, other agencies may also become relevant, such as the National Bureau of Investigation Cybercrime Division, the Department of Justice Office of Cybercrime, the National Privacy Commission, the Bangko Sentral ng Pilipinas, financial institutions, telecommunications companies, and social media or technology platforms.

However, for many ordinary victims, the PNP-ACG is one of the most accessible places to begin.

IV. Common Cybercrimes Reported to the PNP

1. Online Scams

Online scams are among the most common complaints. These include fake online sellers, fake investment schemes, romance scams, job scams, rental scams, fake loan offers, fake delivery notices, fake government assistance messages, and fraudulent marketplace transactions.

A typical online scam involves deception, payment through bank transfer or e-wallet, and disappearance of the seller or scammer after money is sent.

Possible offenses may include estafa, computer-related fraud, identity theft, or other cybercrime-related violations.

2. Hacking or Unauthorized Access

This occurs when someone gains access to a victim’s account, device, email, social media profile, online banking account, business page, cloud storage, or computer system without authority.

Examples include:

Facebook account takeover
Gmail or email compromise
hacked business pages
unauthorized access to online wallets
unauthorized login to company systems
changed passwords and recovery details
stolen authentication codes

Possible offenses may include illegal access, misuse of devices, identity theft, computer-related fraud, or data privacy violations.

3. Phishing

Phishing involves fake links, websites, emails, text messages, or calls designed to trick victims into revealing passwords, OTPs, card details, banking information, or personal information.

Phishing commonly appears as messages pretending to come from banks, delivery companies, telecom providers, e-wallets, government agencies, or social media platforms.

4. Identity Theft

Identity theft occurs when another person uses someone’s name, photo, account, identification details, documents, or other personal information without consent, often to deceive others, borrow money, open accounts, conduct scams, or damage reputation.

5. Cyberlibel

Cyberlibel involves defamatory statements made online or through a computer system. It usually involves a public and malicious imputation that tends to dishonor, discredit, or cause contempt against a person.

Cyberlibel is a serious matter because it intersects with constitutional free speech, reputation, public interest, fair comment, truth, malice, and criminal procedure. Not every offensive post is cyberlibel. The facts, wording, publication, identification of the person, and presence of malice must be evaluated carefully.

6. Online Threats, Harassment, and Extortion

Threats sent through chat, email, social media, SMS, or calls may be reportable, especially when accompanied by intimidation, demands for money, threats to expose private information, threats of violence, or threats to publish intimate content.

Extortion and sextortion are particularly urgent because offenders may pressure victims to pay quickly.

7. Sextortion and Non-Consensual Sharing of Intimate Images

Sextortion occurs when a person threatens to release intimate images, videos, or conversations unless the victim pays money, sends more content, performs acts, or complies with demands.

This may involve multiple laws, including cybercrime law, anti-photo and video voyeurism law, grave threats, coercion, unjust vexation, extortion, or laws protecting minors if a child is involved.

8. Fake Accounts and Impersonation

Fake accounts may be used to scam others, defame a person, harass a victim, solicit money, spread false information, or collect sensitive information.

The victim should document the fake account before it is deleted or renamed.

9. Online Banking, E-Wallet, and Card Fraud

These incidents include unauthorized transfers, OTP scams, account takeover, unauthorized purchases, fake customer support accounts, SIM swap-related fraud, and phishing-based withdrawals.

Victims should immediately report to their bank or e-wallet provider in addition to filing a police complaint.

10. Business Email Compromise

Businesses may suffer losses when criminals compromise email accounts and send fraudulent payment instructions, fake invoices, or altered bank details.

These cases require prompt preservation of emails, headers, payment documents, and coordination with banks.

V. Where to Report Cybercrime to the PNP

A victim may report cybercrime to the PNP Anti-Cybercrime Group or to the nearest police station, which may refer the matter to the appropriate cybercrime unit.

In practice, a complainant may go to:

The PNP Anti-Cybercrime Group headquarters.
A regional or provincial PNP-ACG office, if available.
The nearest police station for initial assistance or blotter entry.
Other law enforcement cybercrime desks depending on location and availability.

For urgent threats to life, physical safety, kidnapping, violence, or ongoing extortion, the victim should treat the matter as an emergency and contact emergency police assistance immediately, not merely rely on online reporting.

For financial fraud, the victim should report both to law enforcement and to the bank, e-wallet provider, card issuer, remittance company, or payment platform used in the transaction.

VI. Step-by-Step Guide: How to Report Cybercrime to the PNP

Step 1: Secure Yourself and Stop Further Damage

Before filing the complaint, the victim should first reduce immediate harm.

For hacked accounts:

Change passwords on unaffected accounts.
Log out of all sessions where possible.
Enable two-factor authentication.
Secure the email address connected to the hacked account.
Check recovery email, recovery phone, and linked devices.
Warn close contacts not to send money or respond to suspicious messages.

For online banking or e-wallet fraud:

Call the bank or e-wallet provider immediately.
Request temporary account freezing, card blocking, or transaction review.
Change passwords and PINs.
Preserve transaction reference numbers.

For sextortion:

Do not send more images or videos.
Avoid paying if payment only encourages further demands.
Preserve all messages and account details.
Report the account to the platform.
Seek immediate help if the victim is a minor or at risk of self-harm.

For threats:

Preserve the messages.
Avoid escalating the conversation.
Inform trusted persons.
Report urgent threats to police immediately.

Step 2: Preserve Digital Evidence

Cybercrime cases depend heavily on evidence. Many victims accidentally weaken their case by deleting messages, blocking the offender too early, resetting devices, unsending messages, wiping phones, or relying only on cropped screenshots.

Preserve evidence before making major changes.

Important evidence may include:

screenshots of messages, posts, profiles, comments, and transactions
full URLs or links to profiles, posts, pages, websites, and listings
usernames, account names, display names, and profile IDs
phone numbers and email addresses used by the suspect
bank account names and account numbers
e-wallet numbers and transaction reference numbers
receipts, deposit slips, transfer confirmations, and payment screenshots
chat logs from Messenger, Viber, WhatsApp, Telegram, Instagram, TikTok, email, SMS, or other platforms
call logs
emails with full headers, where available
website links and domain names
IP addresses, if legitimately available
device logs, login alerts, and security notifications
names of witnesses or other victims
copy of advertisements, online listings, product posts, or investment offers
proof of ownership of the hacked account, page, device, or system

Screenshots should show the full context, including the account name, date, time, URL, and conversation flow. A series of screenshots is often better than one isolated image.

Step 3: Prepare a Written Narrative

A written narrative helps investigators understand the complaint clearly. It should be chronological and factual.

A good complaint narrative includes:

The complainant’s full name, address, contact number, and email.
The date and time the incident started.
The platform used.
The identity or account details of the suspect, if known.
What the suspect did.
What the complainant did in response.
The amount of money lost, if any.
The bank, e-wallet, or platform involved.
The evidence attached.
The relief or action requested.

The narrative should avoid exaggeration. It should state facts plainly and attach proof.

Step 4: Bring Identification and Supporting Documents

When going to the PNP, the complainant should bring:

a valid government-issued ID
printed screenshots and digital copies
mobile phone, laptop, or device containing the original evidence
proof of account ownership
transaction receipts or bank records
notarized affidavit, if already prepared
authorization or board secretary’s certificate, if reporting for a company
special power of attorney, if reporting on behalf of another person, where applicable

The original device may be important because screenshots can be challenged. Investigators may want to inspect the actual conversation, account, email, or logs.

Step 5: File the Complaint with the PNP-ACG or Police Station

At the PNP-ACG or police station, the complainant will usually be asked to explain the incident and submit evidence. The officer may conduct an initial assessment to determine whether the case is cybercrime-related and what offense may be involved.

The complainant may be asked to execute a sworn statement or complaint-affidavit. In some situations, the complaint may be entered into the police blotter.

For cybercrime cases, the report should ideally include complete digital identifiers, not merely nicknames. A fake name is not enough; investigators need links, numbers, accounts, transaction records, and other traceable details.

Step 6: Execute an Affidavit

A complaint-affidavit is often required for formal investigation or referral to the prosecutor. It should be based on personal knowledge and supported by attachments.

The affidavit usually states:

who the complainant is
what happened
when and where it happened
how the suspect used a computer system or electronic communication
what damage or prejudice resulted
what evidence supports the complaint

Attachments should be marked properly, such as Annex “A,” Annex “B,” and so on.

Step 7: Cooperate with Investigation

After filing, the complainant may need to cooperate with further investigation. This may include:

submitting additional evidence
clarifying facts
identifying witnesses
providing device access for inspection
coordinating with banks or platforms
attending hearings or inquest/preliminary investigation
executing supplemental affidavits

The PNP may coordinate with service providers, platforms, financial institutions, or other agencies, but access to subscriber information, logs, bank records, and private communications is subject to legal processes and privacy safeguards.

VII. Evidence: What to Submit and How to Preserve It

A. Screenshots

Screenshots are useful but must be clear, complete, and contextual. They should show:

the suspect’s account name
profile photo
profile link or URL
date and time
message content
sequence of conversation
transaction references
group name or page name, if applicable

Avoid editing screenshots except for making readable copies. Do not crop out important details.

B. URLs and Profile Links

Cybercrime investigators often need exact URLs. A screenshot of a profile may not be enough because account names can be changed. Links help preserve the specific location of the online content.

For social media posts, copy the post link, not just the profile link.

C. Transaction Records

For scams and online fraud, financial records are critical. Preserve:

sender account
recipient account
account name
amount
date and time
reference number
bank or e-wallet provider
confirmation message
receipts
screenshots of payment instructions

Immediately report unauthorized transactions to the bank or e-wallet provider because internal investigation timelines may be short.

D. Emails and Headers

For email scams, phishing, or business email compromise, preserve the email. Do not merely screenshot it. Email headers may contain routing information useful for investigation.

E. Devices

The device used may contain original evidence. Do not wipe, factory reset, or discard it. Do not delete apps used in the incident unless necessary for safety.

F. Witnesses

If other people received messages from a hacked account, saw the defamatory post, were asked for money, or were also victimized, get their names and contact details. They may execute affidavits.

VIII. Reporting Specific Types of Cybercrime

A. Reporting Online Scam or Fraud

For online scams, the complainant should gather:

seller’s name or account name
profile link
marketplace listing link
screenshots of the offer
screenshots of conversations
payment instructions
proof of payment
delivery promises
tracking numbers, if any
proof that the seller stopped responding
names of other victims, if known

The complaint may allege that the offender deceived the victim into parting with money through false pretenses. Depending on the facts, the case may involve estafa, computer-related fraud, or other offenses.

The victim should also report the scammer’s account to the platform and the receiving account to the bank or e-wallet provider.

B. Reporting a Hacked Account

For hacked accounts, the complainant should gather:

proof of ownership of the account
login alerts
password reset notices
changed recovery email or number
screenshots of unauthorized posts or messages
messages sent by the hacker
reports from contacts who were scammed
date and time of account takeover
device and location alerts, if available

The complainant should also use the platform’s official account recovery process. The police report can support the recovery request but does not automatically restore the account.

C. Reporting Cyberlibel

For cyberlibel, the complainant should gather:

exact post, comment, article, video, or message
date and time of publication
URL or link
screenshots showing the defamatory statement
proof that the complainant is identifiable
proof of publication to third persons
evidence of damage, reputational harm, or malice where applicable
names of persons who saw the post

Cyberlibel complaints should be carefully evaluated because not all insults, opinions, criticisms, or negative reviews are criminally actionable. Truth, privileged communication, fair comment, public interest, and lack of malice may become relevant issues.

Because cyberlibel has prescription-period considerations and procedural requirements, complainants should act promptly.

D. Reporting Sextortion

For sextortion, the victim should preserve:

all threats
account links
payment demands
images or videos threatened to be released
proof of relationship or initial contact
money transfer requests
screenshots of the suspect’s profile
names of people the suspect threatened to send the material to

Victims should not send more material. They should not rely on the offender’s promise to delete content after payment. If the victim is a minor, the matter should be treated as especially urgent and may involve child protection laws.

E. Reporting Fake Accounts

For fake accounts, gather:

profile link
screenshots of the fake profile
photos or personal details used without consent
messages sent by the fake account
posts made by the fake account
people contacted by the fake account
proof that the real person did not create or authorize the account

The platform should also be notified through its impersonation or fake account reporting system.

F. Reporting Phishing

For phishing, gather:

SMS or email received
sender number or email address
phishing link
fake website screenshots
information entered, if any
unauthorized transactions that followed
OTP messages
bank or e-wallet notifications

The victim should immediately change passwords and notify affected financial institutions.

G. Reporting Online Threats

For online threats, gather:

exact threatening messages
sender account details
date and time
context of the threat
screenshots
recordings, if lawfully obtained
information showing why the threat is credible
prior incidents, if any

If there is imminent danger, the victim should seek immediate police assistance.

IX. Police Blotter vs. Formal Cybercrime Complaint

A police blotter is an official record that an incident was reported to the police. It may be useful as proof that the victim promptly reported the matter. However, a blotter entry alone does not necessarily mean that a criminal case has already been filed in court or that the prosecutor has found probable cause.

A formal complaint usually requires a complaint-affidavit, supporting evidence, and referral for investigation or preliminary investigation. For criminal prosecution, the matter may eventually be brought before the prosecutor’s office, where probable cause is evaluated.

Victims should understand that reporting to the PNP is often the beginning of the legal process, not the end.

X. What Happens After Filing the Report

After a report is filed, several things may happen:

The police may evaluate whether the complaint falls under cybercrime jurisdiction.
The complainant may be asked to submit additional documents.
Investigators may coordinate with banks, e-wallets, platforms, or telcos.
A suspect may be identified through account records, financial trails, device information, witness statements, or other evidence.
The complaint may be referred to the prosecutor.
The prosecutor may conduct preliminary investigation.
The respondent may be required to submit a counter-affidavit.
If probable cause exists, an information may be filed in court.
The case may proceed to arraignment, pre-trial, trial, and judgment.

Not every report results in immediate arrest. Cybercrime investigations can require legal requests, technical analysis, coordination with private companies, and court processes. Anonymous or foreign-based offenders may be harder to identify, but evidence preservation still matters.

XI. Jurisdiction and Venue in Cybercrime Cases

Cybercrime may involve multiple locations: the victim’s residence, the place where the device was used, the location of the server, the place where the money was received, the location of the suspect, and the place where the harmful content was accessed.

In the Philippines, cybercrime jurisdiction may depend on where the offense was committed, where its effects were felt, where the complainant resides or accessed the content, and where the relevant acts occurred. For online defamation, fraud, threats, and account compromise, venue can be legally sensitive.

Victims should report to the nearest appropriate cybercrime office or police station, but they should also be prepared for possible referral to another office depending on venue and investigative jurisdiction.

XII. Reporting Cybercrime Involving Money

When money is lost through online fraud, time is critical.

The victim should immediately:

Contact the bank, e-wallet, card issuer, or remittance provider.
Request freezing, reversal, investigation, or hold if still possible.
Get the reference number of the report.
Preserve all transaction details.
File a report with the PNP-ACG.
Submit the police report to the financial institution if requested.
Monitor accounts for further unauthorized transactions.

Police reporting and bank reporting should happen in parallel. A criminal complaint does not automatically reverse a transaction. Banks and e-wallet providers have their own investigation procedures, deadlines, and documentation requirements.

XIII. Reporting Cybercrime Involving Social Media Platforms

When the incident involves Facebook, Messenger, Instagram, TikTok, X, YouTube, Telegram, WhatsApp, Viber, or other platforms, the victim should both:

Report the incident to the platform through its official reporting tools.
Report the incident to law enforcement if a crime was committed.

The victim should not rely only on platform reporting. Platforms may remove content or disable accounts, but law enforcement may be needed for criminal investigation.

Before reporting the content for takedown, preserve evidence first. Once a post, message, profile, or account is removed, it may become harder for the victim to document it.

XIV. Reporting Cybercrime Against Minors

Cybercrime involving minors requires urgent handling. Cases may include:

online sexual exploitation
grooming
sextortion
cyberbullying
threats
non-consensual sharing of intimate images
identity theft
online trafficking
exposure to child sexual abuse material

Parents, guardians, teachers, and responsible adults should preserve evidence and report promptly. The welfare and safety of the child should come first. Avoid repeatedly making the child narrate traumatic events to multiple people. Where possible, child-sensitive procedures should be observed.

If intimate images of a minor are involved, the images must be handled carefully and should not be circulated, forwarded, or stored unnecessarily. The matter should be brought to competent authorities immediately.

XV. Reporting Cybercrime for Businesses

Businesses may report cybercrime when they experience:

ransomware
data breach
unauthorized system access
business email compromise
fake invoices
fraudulent payment redirection
website defacement
customer data theft
impersonation of company officers
fake business pages
phishing using the company’s name
insider misuse of systems

A company complainant should prepare:

secretary’s certificate or board authority, if needed
authorization for the representative
incident report
system logs
access logs
email headers
affected accounts
timeline
financial loss records
screenshots
contracts or invoices
IT forensic report, if available
data breach notifications, if applicable

If personal data is compromised, the company may also need to assess whether notification to the National Privacy Commission and affected data subjects is required under data privacy rules.

XVI. Practical Template for a Cybercrime Complaint Narrative

A complaint narrative may follow this structure:

1. Introduction

“I am [name], of legal age, Filipino, residing at [address]. I am filing this complaint in relation to a cybercrime incident involving [brief description].”

2. Background

“On or about [date], I encountered/contacted/received a message from [account name, number, email, or person] through [platform].”

3. Facts

“The person represented that [statement or offer]. Relying on this, I [sent money/provided information/responded].”

4. Payment or Damage

“I sent the amount of [amount] through [bank/e-wallet] to [account name/number] on [date/time], with reference number [reference number].”

5. Discovery of Fraud or Harm

“After payment, the person [blocked me/stopped replying/failed to deliver/used my account/threatened me/published defamatory statements].”

6. Evidence

“I have attached screenshots of the conversation, profile link, proof of payment, transaction receipt, and other relevant documents.”

7. Request

“I respectfully request the appropriate investigation and filing of charges against the person or persons responsible.”

This template should be adapted to the actual facts. False statements in an affidavit can expose the complainant to legal consequences.

XVII. Checklist Before Going to the PNP

Before going to the PNP-ACG or police station, prepare the following:

Valid ID
Written timeline of events
Name, username, number, or email of suspect
Profile links and URLs
Screenshots with date and time
Full chat history, where available
Payment receipts
Bank or e-wallet details
Device used
Proof of account ownership
Witness details
Copies of prior reports to bank, platform, or telco
Printed and digital copies of evidence
USB drive or organized folder, if appropriate
Draft complaint-affidavit, if available

Organizing evidence before reporting helps investigators understand the case faster.

XVIII. Mistakes Victims Should Avoid

Victims should avoid the following:

Deleting conversations.
Blocking the suspect before preserving evidence.
Cropping screenshots too tightly.
Posting accusations online without legal advice.
Threatening the suspect in return.
Paying sextortion demands repeatedly.
Sharing intimate material further to “show proof.”
Factory resetting devices without backup.
Sending original evidence to random pages claiming to help.
Relying only on social media reports.
Waiting too long before reporting financial fraud.
Ignoring bank or platform deadlines.
Making false or exaggerated claims.
Attempting to hack back.
Hiring unverified “account recovery” services.

Victims should act quickly but carefully.

XIX. Can a Victim Report Cybercrime Online?

Some cybercrime units and agencies may provide online contact channels, hotlines, email addresses, or social media pages for initial reporting or inquiries. However, serious complaints often still require sworn statements, evidence submission, and personal appearance or formal coordination.

Online reporting may be useful for initial contact, but it may not replace formal complaint filing, especially when prosecution is intended.

Victims should be careful to contact only official government channels. Scammers may create fake “cybercrime assistance” pages and ask for fees, passwords, OTPs, or remote access.

No legitimate investigator should ask for a victim’s password or OTP for personal use.

XX. Can the PNP Trace a Scammer?

Tracing is possible in some cases, but it depends on available evidence and legal cooperation.

Investigators may examine:

account identifiers
phone numbers
bank or e-wallet accounts
transaction trails
IP logs, where lawfully obtained
device identifiers, where available
platform records
telco records
witness accounts
reused names, photos, or numbers
related complaints from other victims

However, tracing can be difficult if the suspect used fake names, stolen SIMs, mule accounts, VPNs, foreign platforms, compromised accounts, or cryptocurrency. Even then, preserving evidence and reporting remains important because multiple complaints may help establish patterns and identify networks.

XXI. Can the Victim Recover the Money?

Recovery is not guaranteed. It depends on how quickly the incident is reported, whether funds remain in the recipient account, whether the financial institution can freeze or reverse the transaction, and whether the suspect can be identified and made to return the money.

A criminal case may punish the offender, but restitution or civil recovery may require additional legal steps. In some cases, restitution may be ordered or settlement may occur, but victims should not assume that filing a police report automatically restores lost funds.

Immediate reporting to the financial institution is often the best chance for recovery.

XXII. Cybercrime and Data Privacy

Cybercrime often involves personal data. If a person’s personal information is stolen, leaked, sold, or misused, the Data Privacy Act may become relevant.

Examples include:

unauthorized disclosure of personal records
doxxing
leaking IDs or documents
misuse of customer databases
unauthorized access to personal data systems
public posting of private contact details
identity theft using personal information

For organizations handling personal data, a cyber incident may also trigger duties to investigate, contain, document, and possibly notify the National Privacy Commission and affected individuals.

XXIII. Cyberlibel: Special Considerations

Cyberlibel deserves careful discussion because many online disputes are wrongly assumed to be cyberlibel.

For a cyberlibel case, the following concepts are often important:

There must be an imputation.
The imputation must be defamatory.
The complainant must be identifiable.
There must be publication to a third person.
Malice may be presumed or must be proven depending on the circumstances.
Defenses such as truth, fair comment, privileged communication, or lack of malice may be relevant.
Public figures and matters of public concern may involve heightened free speech considerations.

A mere negative opinion, insult, rant, or consumer complaint is not automatically cyberlibel. Conversely, a false factual accusation posted online that damages reputation may be actionable.

Because criminal libel involves constitutional and procedural issues, legal advice is strongly recommended before filing or responding to a cyberlibel complaint.

XXIV. What to Do If You Are Accused of Cybercrime

A person accused of cybercrime should not ignore notices from police or prosecutors. The respondent should:

preserve their own evidence
avoid contacting or intimidating the complainant
avoid deleting posts or messages without legal advice
consult counsel
prepare a counter-affidavit if required
gather screenshots, witnesses, and context
comply with lawful notices
avoid making public statements that worsen the case

Being accused does not mean guilt. The prosecution must still establish the elements of the offense and probable cause before the case proceeds.

XXV. Rights of the Complainant and Respondent

Cybercrime investigations must still respect constitutional rights.

The complainant has the right to report a crime, submit evidence, seek protection, and participate in legal proceedings.

The respondent has the right to due process, presumption of innocence, counsel, protection against unreasonable searches and seizures, and protection against compelled self-incrimination.

Digital evidence should be obtained lawfully. Private communications, devices, accounts, and records cannot simply be accessed without legal authority.

XXVI. Search, Seizure, and Digital Devices

In cybercrime cases, computers, phones, drives, and accounts may contain evidence. However, law enforcement access to devices and private data is governed by constitutional and procedural rules.

A person should distinguish between voluntarily showing evidence as a complainant and being compelled to provide access as a respondent. Search warrants, court orders, consent, and forensic procedures may become important.

Improper handling of digital evidence may create issues on admissibility, authenticity, and chain of custody.

XXVII. Admissibility of Electronic Evidence

Electronic evidence may be admissible in Philippine proceedings if properly authenticated and relevant.

Examples include:

emails
text messages
chat messages
screenshots
electronic documents
transaction records
logs
recordings
digital photographs
metadata

The party presenting electronic evidence may need to show that it is authentic, reliable, and connected to the case. This is why original devices, full conversations, URLs, and corroborating records are important.

XXVIII. Importance of Chain of Custody

Chain of custody refers to the documentation of how evidence was collected, stored, transferred, and preserved.

In cybercrime cases, chain of custody helps prevent claims that evidence was altered, fabricated, or taken out of context.

Victims can help by:

keeping original files
avoiding edits
preserving devices
saving full conversations
recording dates and times
backing up evidence safely
submitting copies in an organized way
identifying who collected the evidence

XXIX. Coordination with Banks, Telcos, and Platforms

Cybercrime cases often require information from private entities. For example:

banks may hold account ownership and transaction records
e-wallet providers may hold KYC information
telcos may hold SIM registration and call/SMS records
social media platforms may hold account records and login data
email providers may hold account recovery and security logs
marketplace platforms may hold seller records

These entities generally require formal legal processes before releasing protected information. A police report alone may not always be enough. Depending on the information sought, subpoenas, court orders, warrants, or lawful requests may be needed.

XXX. Special Concerns for OFWs and Filipinos Abroad

Filipinos abroad may still be victims of cybercrime involving persons or accounts in the Philippines. They may preserve evidence and seek assistance through Philippine law enforcement, family representatives, counsel, or consular channels depending on the circumstances.

If the complainant cannot personally appear, a special power of attorney or properly executed affidavit may be needed. Requirements may vary depending on the agency handling the matter.

XXXI. When to Report to Agencies Other Than the PNP

Although the PNP-ACG is a key agency, other agencies may be relevant.

Report to the bank or e-wallet provider for unauthorized transactions, scams, or account compromise.

Report to the platform for fake accounts, hacked profiles, impersonation, non-consensual intimate images, harassment, or scam pages.

Report to the National Privacy Commission for personal data breaches or misuse of personal information.

Report to the NBI Cybercrime Division as an alternative or parallel law enforcement option.

Report to school authorities if the incident involves students, cyberbullying, or campus-related online harassment.

Report to employers or company IT/security teams if corporate accounts, systems, or data are involved.

Report to child protection authorities when minors are victims of online sexual exploitation, grooming, or abuse.

XXXII. Practical Sample Evidence Index

A complainant may organize attachments like this:

Annex A – Screenshot of suspect’s profile Annex B – URL of suspect’s account or post Annex C – Screenshots of conversation dated [date] Annex D – Proof of payment or transfer receipt Annex E – Bank or e-wallet confirmation Annex F – Screenshot showing suspect blocked complainant Annex G – Copy of report to bank or platform Annex H – Witness statement or screenshot from witness Annex I – Login alert or security notification Annex J – Other supporting documents

A clean evidence index makes the complaint easier to evaluate.

XXXIII. Legal and Practical Timeliness

Victims should report promptly. Delay may result in:

deleted accounts
changed usernames
withdrawn funds
lost logs
expired platform retention periods
unavailable witnesses
weakened credibility
missed bank dispute deadlines
prescription issues in criminal cases

Speed is particularly important for financial fraud, account takeovers, sextortion, and threats.

XXXIV. Do You Need a Lawyer to Report Cybercrime?

A lawyer is not always required to make an initial police report. A victim can approach the PNP-ACG or police station directly.

However, legal assistance is advisable when:

the case involves large financial loss
the case involves cyberlibel
the complainant is a company
the incident involves intimate images
the respondent is known and may countersue
the evidence is complex
data privacy issues are involved
the victim wants to file a formal complaint-affidavit
the case is already before the prosecutor
the victim receives a subpoena
the victim is also at risk of liability

A well-prepared affidavit can make a significant difference.

XXXV. Frequently Asked Questions

1. Is a screenshot enough to file a cybercrime complaint?

A screenshot may be enough to start reporting, but it is usually better to provide full context, URLs, original messages, transaction records, and the device containing the evidence.

2. Should I delete embarrassing or sensitive messages before reporting?

No. Deleting messages may weaken the case. Sensitive evidence should be handled carefully and shared only with proper authorities.

3. Can I post the scammer’s face or account online?

Doing so may create legal risks, especially if the accusation is disputed or the wrong person is identified. It may also alert the suspect and cause evidence destruction.

4. Can the police immediately arrest the cybercriminal?

Not always. Arrest generally requires lawful grounds, such as a warrant or valid warrantless arrest circumstances. Many cybercrime cases require investigation first.

5. Can I report even if I only lost a small amount?

Yes. Small-value scams may still be criminal. Multiple small complaints can also reveal a larger scam network.

6. What if the scammer used a fake name?

Report anyway. Fake names can sometimes be linked to phone numbers, bank accounts, e-wallets, devices, or other victims.

7. What if the suspect is abroad?

Reporting may still be useful. Cross-border cases are more complex, but evidence preservation and official reporting remain important.

8. Can I report a hacked Facebook or email account?

Yes. Also use the platform’s official account recovery tools.

9. Can I report a fake account pretending to be me?

Yes. Preserve the profile link, screenshots, and evidence that your identity was used without permission.

10. Should I pay a sextortionist?

Payment does not guarantee deletion and often leads to more demands. Preserve evidence and report.

XXXVI. Practical Cybercrime Reporting Checklist

For all cybercrime reports:

Valid ID
Written timeline
Full name and contact details of complainant
Platform involved
Suspect’s account name, number, email, or link
Screenshots
URLs
Original messages
Device used
Witnesses
Prior reports to platform, bank, or telco

For financial scams:

Amount lost
Payment method
Account name and number of recipient
Transaction reference number
Bank or e-wallet report number
Receipts
Screenshots of offer and payment instructions

For hacking:

Proof of account ownership
Login alerts
Unauthorized messages or posts
Recovery attempts
Linked email or phone number
Reports from affected contacts

For cyberlibel:

Exact defamatory statement
URL
Date and time of publication
Proof of identification
Proof of publication
Witnesses who saw it
Evidence of harm

For sextortion:

Threats
Account links
Demands
Payment instructions
Proof of coercion
Platform reports
Immediate safety concerns

XXXVII. Best Practices After Reporting

After filing a complaint, the victim should:

Keep copies of all submitted documents.
Get the name or contact details of the handling office, where appropriate.
Record the date of filing.
Ask what additional documents may be needed.
Follow up professionally.
Continue preserving new evidence.
Avoid direct confrontation with the suspect.
Monitor accounts and financial activity.
Strengthen passwords and security settings.
Inform banks, platforms, employers, or schools when relevant.

XXXVIII. Preventive Measures Against Cybercrime

Reporting is important, but prevention is equally important.

Individuals should:

use strong and unique passwords
enable two-factor authentication
avoid sharing OTPs
verify sellers and businesses
avoid clicking suspicious links
check URLs carefully
use official apps and websites
update devices and apps
avoid public Wi-Fi for banking
review privacy settings
be cautious with online relationships asking for money
verify investment offers with regulators
avoid sending intimate images to untrusted persons
keep backup copies of important files

Businesses should:

train employees on phishing
implement multi-factor authentication
restrict administrative privileges
maintain backups
monitor unusual logins
adopt incident response plans
secure customer data
review vendor access
use endpoint protection
document security incidents
comply with data privacy obligations

XXXIX. Key Legal Takeaways

Cybercrime in the Philippines is primarily governed by the Cybercrime Prevention Act, but other laws may also apply.
The PNP Anti-Cybercrime Group is a principal law enforcement body for cybercrime complaints.
Victims should preserve digital evidence before deleting, blocking, or reporting content for takedown.
Screenshots are useful, but full links, original messages, transaction records, and devices are stronger evidence.
Financial fraud should be reported immediately to both law enforcement and the financial institution.
Cyberlibel requires careful legal analysis and should not be assumed from every offensive online post.
Sextortion, threats, and cases involving minors require urgent action.
A police blotter is not the same as a filed criminal case.
Formal prosecution usually requires affidavits, evidence, investigation, and prosecutor evaluation.
Timely reporting improves the chance of preserving evidence and identifying offenders.

XL. Conclusion

Reporting cybercrime to the PNP in the Philippines requires both urgency and careful preparation. The victim should first secure accounts and prevent further damage, then preserve digital evidence, organize the facts, prepare identification and supporting documents, and file the complaint with the PNP Anti-Cybercrime Group or the appropriate police office.

Cybercrime cases are evidence-driven. The strength of a complaint often depends on whether the victim preserved full conversations, links, transaction records, account identifiers, device records, and other digital traces before they disappeared. While reporting does not guarantee immediate arrest, account recovery, or money recovery, it creates an official record, allows investigation to begin, and may support further legal action before prosecutors and courts.

In the Philippine context, the most effective response is usually coordinated: report to the PNP, notify the bank or e-wallet provider, use the platform’s official reporting tools, preserve all evidence, and seek legal assistance when the case involves serious financial loss, cyberlibel, sextortion, minors, business systems, or sensitive personal data.