How to Report Harassing Unknown Calls: NTC and PNP Cybercrime Procedures (Philippines)

I. Overview

Harassing or threatening phone calls—whether through a traditional mobile number, VoIP, or spoofed caller ID—may constitute crimes under Philippine law and administrative violations subject to regulatory action. Victims have parallel avenues: (1) criminal and protective remedies via the Philippine National Police–Anti-Cybercrime Group (PNP-ACG), and (2) regulatory and consumer-protection remedies via the National Telecommunications Commission (NTC) and the concerned public telecommunications entity (PTE). These tracks can proceed simultaneously.

This article explains the legal bases, preservation of evidence, step-by-step reporting to the PNP-ACG and NTC, coordination with telcos, and practical do’s and don’ts—written for lay readers yet detailed enough for counsel to use when preparing a case.

II. Legal Bases (Selected)

Revised Penal Code (RPC)
- Grave Threats (Art. 282), Light Threats (Art. 283), Grave Coercion (Art. 286), Unjust Vexation (Art. 287), Libel/Slander (Arts. 353–362) where applicable.
- Jurisdiction attaches where any element occurs, including the place where the call is received.
Cybercrime Prevention Act of 2012 (R.A. 10175)
- Applies when the act is committed through information and communications technologies (including phone/VoIP networks).
- Provides data preservation obligations for service providers (initial six months, extendible by court order) and authorizes specialized cybercrime warrants (see Supreme Court’s Rules on Cybercrime Warrants, A.M. No. 17-11-03-SC).
Safe Spaces Act (R.A. 11313)
- Penalizes gender-based online sexual harassment, including persistent unwanted sexual remarks made via calls or messages.
Anti-Violence Against Women and Their Children Act (R.A. 9262)
- Covers harassment, intimidation, or coercive communications by intimate partners/ex-partners; enables Protection Orders (BPO/TPO/PPO).
Data Privacy Act of 2012 (R.A. 10173)
- Governs lawful processing of personal data; relevant to handling victims’ evidence and to requests for subscriber information via proper legal process.
SIM Registration Act (R.A. 11934) and its IRR
- Requires SIM registration; provides for deactivation of SIMs used in fraudulent or unlawful activities and imposes penalties for false registration, spoofing, or misuse.
NTC Charter and Regulations
- NTC has authority over PTEs for consumer protection, investigation of network abuse, and enforcement (including directives to block numbers, ranges, or traffic patterns implicated in harassment/scams, subject to due process).
Anti-Wiretapping Act (R.A. 4200)
- Generally prohibits recording private communications without the consent of all parties (save narrow, court-authorized exceptions). Seek legal advice before recording live calls. Evidence such as call logs, screenshots, voicemails, and text messages kept in the ordinary course of business/use are not “secret recordings” by the victim and are commonly used.

III. Evidence and Preservation (Before You Report)

Document each incident
- Date/time, duration, number (or “Unknown/No Caller ID”), short narrative of what was said/done, and immediate impact (fear, disruption, etc.).
- Save call logs, screenshots, voicemails, and any related messages (SMS/MMS/OTT apps).
Do not delete or overwrite device data. If possible, export logs. Keep the SIM/device used to receive the calls—this anchors forensic timelines.
Preservation request (optional but helpful).
- Through counsel or when filing with PNP-ACG/NBI, ask that preservation letters be issued to the PTE/OTT provider under R.A. 10175 to retain traffic and subscriber-related data pending a warrant/subpoena.
Avoid engaging the caller. Do not retaliate, threaten, or bait; it can complicate the case.
Safety first. If threats are imminent (e.g., harm, stalking), contact local police immediately and consider temporary relocation or workplace/HOA security coordination.

IV. Where and How to Report

A. Criminal/Protective Track — PNP-ACG (and/or NBI-CCD)

Who handles it:

PNP Anti-Cybercrime Group (headquarters and Regional Cybercrime Units) for cyber-enabled offenses, including harassing calls, doxxing, extortion, or threats perpetrated through ICT.
NBI Cybercrime Division is an alternative investigative body; you may choose either or both.

What to bring:

Government ID; device/SIM used; printed and soft copies (USB) of evidence; a Sworn Statement/Affidavit-Complaint narrating the incidents; and any witness affidavits.
If you fear ongoing harm, mention this to request immediate risk assessment and endorsement for protective measures (e.g., patrol, security advisory, or protective order coordination if applicable).

What happens next:

Intake & blotter entry. Your complaint is logged.
Case building. Investigators evaluate applicable offenses (RPC threats/coercion, R.A. 11313, R.A. 9262, etc.).
Legal process for data. Investigators procure Cybercrime Warrants (Disclosure, Interception, Search/Seizure), or subpoenas duces tecum to PTEs/OTT providers for subscriber information, CDRs, and relevant traffic data.
Case filing. Upon identification of the perpetrator, an inquest or filing with the prosecutor’s office follows. For R.A. 9262, you may also be referred to file for Protection Orders.
Victim support. Where available, referral to psychosocial services, especially for GBV cases.

Venue: A complaint may be filed where any element occurred—commonly the place where the harassing call was received. For cybercrime warrants, courts designated under the Rules on Cybercrime Warrants have nationwide effect once issued.

B. Regulatory/Consumer Track — NTC & Your Telco (PTE)

Goal: Stop the harassment at the network level, initiate traceback, and enforce telco/NTC measures (e.g., blocking, account action under SIM Registration rules).

Steps:

Report to your PTE (Globe/Smart/DITO, etc.).
- Request number blocking and flagging, and note that the calls form part of a criminal complaint. Provide your incident log and proof.
- Ask the PTE to annotate your account and to preserve relevant data (they typically require a formal preservation order/subpoena to disclose data to you, but they can flag the incident internally).
File a Complaint with the NTC.
- Prepare: (a) Complaint-Affidavit with facts, (b) evidence annexes, (c) copy of your report to the PTE, and (d) ID.
- Reliefs to request: (i) directive to the PTE to block the number or call source consistent with due process, (ii) enforcement of SIM Registration Act sanctions if false/forged registration is found, (iii) coordination support with law enforcement for traceback, and (iv) consumer assistance/mediation.
NTC Proceedings.
- NTC may call the PTE to show cause, require reports, and facilitate technical measures (e.g., blocking campaigns against identified spam/harassment vectors), without prejudicing criminal action.

Note on Spoofed/VoIP Calls: Even if the displayed number is spoofed, reports help your PTE and NTC identify signaling anomalies and apply pattern-based blocking or traceback through interconnect partners.

V. Step-by-Step Playbook (Checklist)

Secure evidence (Section III).
Immediate Telco Report: request blocking; get a ticket/reference number.
Draft a Sworn Statement (see template below).
File with PNP-ACG (or NBI-CCD): submit affidavit and evidence; obtain blotter/reference number.
Request preservation measures to PTE/OTT via investigators.
File with NTC: attach telco ticket, PNP blotter, and evidence; seek regulatory action.
If threats/GBV/partner-related: pursue Protection Orders under R.A. 9262 or relief under R.A. 11313.
Follow up periodically with case officers; keep logs of all follow-ups.
Consider civil remedies (damages, injunction) if identity is known and conduct persists.
Workplace/School: notify security or administrators if calls target you on campus or at work.

VI. Affidavit-Complaint (Outline)

Title/Captions: Identify the forum (PNP-ACG/NBI/NTC). Affiant’s Details: Name, age, address, contact, ID no. Narrative:

Describe the first call: date/time, number shown, exact words (as close as memory allows), location when received.
Describe subsequent calls (chronology).
Impact: fear, disruption, threats to safety.
Steps already taken (telco report, blocking).
Request for investigation, preservation of data, and prosecution under specific laws (cite RPC provisions; R.A. 10175; R.A. 11313; R.A. 9262 if applicable). Attachments: Call logs/screenshots (mark as Annex “A”, “B”, …), copy of telco ticket, any witness statements. Jurat: Sworn before a notary/public officer, with ID presented.

VII. What Authorities Can Compel

Subscriber Info & Traffic Data: Through Cybercrime Disclosure Warrants or subpoenas; service providers must preserve for at least six months and disclose upon lawful order.
Interception/Real-Time Collection: Requires Interception Warrants—a higher threshold and strict judicial oversight.
Search, Seizure & Examination of Computer Data: Via dedicated cybercrime warrants; includes forensics of devices/accounts tied to the harassing calls.
SIM Registration Enforcement: NTC and DICT-aligned enforcement with PTEs can deactivate or penalize SIMs registered through fraud or used for illegal activities.

VIII. Practical Do’s and Don’ts

Keep a running incident log.
Back up your evidence to a secure drive.
Ask for your case number and investigator’s name; schedule follow-ups.
Consider changing voicemail settings to save messages and avoid personal greetings that reveal identity.
For minors or students, involve a parent/guardian and school admin early.

Don’t

Secretly record a live call without legal advice (R.A. 4200 risk).
Share screenshots publicly if they contain sensitive identifiers (DPA compliance).
Engage or threaten the caller.
Rely solely on third-party “reverse lookup” sites; proofs must withstand prosecutorial scrutiny.

IX. Special Situations

Domestic/Intimate-Partner Harassment: Use R.A. 9262 channels for protection orders alongside criminal/regulatory actions.
Sexual Harassment Content: Invoke R.A. 11313; ask investigators to categorize the case accordingly for survivor-centered handling.
Corporate Phones/Employees: Employers should preserve enterprise call logs, issue legal hold notices, and coordinate with counsel for company-assisted complaints.
OFWs/Abroad when calls are received in PH line: Philippine jurisdiction may still attach if elements occur in the Philippines (receipt of call), but coordination with foreign carriers may be necessary.

X. Possible Case Outcomes

Network-level mitigation: number blocked, patterns filtered, SIM deactivated (post-due process).
Identification & prosecution of the caller for applicable offenses.
Protective orders where warranted (especially for GBV and domestic cases).
Civil damages upon successful identification and litigation against the perpetrator.

XI. Sample One-Page Reporting Kit

Incident Log (per call):
- Date/Time — Duration — Caller ID shown — Location — Summary of content — Emotional/operational impact — Evidence file name(s)
Evidence Folder Structure:
- /01 Logs (CSV/PDF exports)
- /02 Screenshots (labelled chronologically)
- /03 Audio (voicemails only; avoid illegal recordings)
- /04 Telco & NTC (tickets, letters)
- /05 Police/NBI (blotter, affidavits, orders)
Preservation Letter (through investigators): Request retention of traffic data, CDRs, and subscriber information related to [numbers/time window], per R.A. 10175 and Rules on Cybercrime Warrants.

XII. Final Notes

Parallel filing (PNP-ACG/NBI + NTC + telco) increases both speed of mitigation and likelihood of identification.
Handle all data in compliance with the Data Privacy Act; redact non-essential personal data when submitting to offices that don’t require it.
Laws cited are complementary; prosecutors choose charges after fact-evaluation. Maintain cooperation and attend required proceedings.

This article is intended for general information in the Philippine context and is not a substitute for personalized legal advice. For urgent threats, contact local authorities immediately.