How to Report Online Scammers in the Philippines

A practical legal guide for victims, counsel, and incident responders

1) Why reporting matters

Online fraud thrives on speed, anonymity, and cross-platform reach. Reporting early preserves digital traces (IP logs, device fingerprints, account histories) that are routinely purged by platforms and intermediaries. In the Philippines, timely complaints also help toll prescription, trigger asset freezes where available, and enable parallel administrative action (platform/account takedowns) even before a criminal case matures.

2) What laws typically apply

Most online swindles engage multiple statutes at once. Common hooks include:

Revised Penal Code (RPC) – Estafa (Art. 315) and related deceit offenses. Classic “paid but no delivery,” marketplace baiting, fake booking, and advance-fee schemes.
Cybercrime Prevention Act (Republic Act No. 10175). Adds:
- Computer-related fraud (Sec. 4(b)(2)) and computer-related identity theft (Sec. 4(b)(3));
- Illegal access, data interference, device misuse (Sec. 4(a)). Cyber circumstances generally increase penalties and enable specialized procedures and jurisdiction.
Access Devices Regulation Act (RA 8484). Credit/debit card and account-takeover fraud, including phishing that results in unauthorized card use.
E-Commerce Act (RA 8792). Recognizes the legal validity of electronic documents and signatures; relevant to proving online transactions.
Rules on Electronic Evidence (A.M. No. 01-7-01-SC). Controls admissibility, integrity, and authentication of digital proof.
Data Privacy Act (RA 10173). For doxxing, unauthorized disclosure, scraping or illegal processing of personal data (often implicated in scammy “loan apps,” SIM-swap, and smishing campaigns).
Financial Products and Services Consumer Protection Act (RA 11765). Streamlines complaints and redress against banks, e-money issuers, and other financial service providers (FSPs) through their regulators (e.g., BSP, SEC, Insurance Commission).
Special statutes for subject-matter scams, as applicable:
- Securities Regulation Code & SEC rules (investment/“crypto” offerings, unregistered lending);
- Anti-Photo and Video Voyeurism Act (RA 9995) and Anti-Child Pornography Act (RA 9775) (sextortion cases);
- SIM Registration Act (RA 11934) and NTC directives (SIM-based spam/smishing).

Key idea: One incident can support criminal (estafa/cybercrime), administrative (platform/regulator), and civil (damages, injunction, recovery) tracks—often pursued in parallel.

3) Which authority to approach (and when)

Think in layers. Start with the fastest containment while preparing the formal complaint.

A. Immediate containment and records hold

Your bank/e-wallet (e.g., GCash, Maya) or card issuer: Report unauthorized transfers; request transaction holds/chargeback review; ask for a dispute case number and written acknowledgment.
The platform used by the scammer (marketplace, social media, courier app, domain host, email provider): Report the account/page/post for takedown and ask for data preservation under applicable terms and cybercrime cooperation policies.
Your telco and the NTC space (as applicable): For smishing/voice phishing/SPAM numbers—report to telco fraud desks and request blocking.

B. Criminal investigation and prosecution

Philippine National Police – Anti-Cybercrime Group (PNP-ACG): For swift field response, device seizure support, on-site coordination with platforms, and case build-up.
National Bureau of Investigation – Cybercrime Division (NBI-CCD): For complex or multi-jurisdictional investigations, digital forensics, MLAT coordination, and expert affidavits.
City/Provincial Prosecutor’s Office: Filing of a sworn complaint for estafa and/or cybercrime offenses; issuance of subpoenas; inquest (if suspect is arrested), or regular preliminary investigation.

Venue & jurisdiction: Cybercrime cases may be filed where any element occurred (e.g., where the victim sent money, where the deceiving message was received, where the device was used). Regional Trial Courts specially designated as Cybercrime Courts have jurisdiction.

C. Sector regulators (parallel complaints)

Bangko Sentral ng Pilipinas (BSP): If a bank or e-money process failed (e.g., rejected dispute without basis, poor fraud controls).
Securities and Exchange Commission (SEC): Investment or lending scams; report unregistered entities, Ponzi structures, or abusive online lenders (also cite Data Privacy Act breaches).
Insurance Commission (IC): Insurance/health plan mis-selling.
Department of Trade and Industry (DTI): E-commerce consumer complaints (non-delivery, defective goods, unfair practices) and mediation.
National Privacy Commission (NPC): Doxxing, illegal personal-data processing, and privacy violations (e.g., “shaming” by loan apps).

4) Evidence: what to gather and how to preserve it

A. Golden rules

Do not delete chats, emails, posts, or accounts—even if humiliating.
Capture and export: full-page screenshots, chat exports (with timestamps), email headers (.eml), and original files (photos, PDFs, voice notes).
Save money trails: receipts, transfer confirmations, reference numbers, account names/numbers, and exact timestamps (with timezone).
Link the identities: profile URLs/handles, phone numbers, device IDs, IMEI if relevant, courier waybills, IP notices from platforms.
Keep a chronology: short timeline with date/time, action taken, and counterpart’s response.
Preserve devices: if malware or remote access is suspected, stop using the device, label and store it; avoid altering logs.

B. For admissibility (Rules on Electronic Evidence)

Authenticity & integrity: Prefer original digital exports over screenshots; keep hash values if available; avoid editing/markups on the originals.
Identification: Note the person who captured the evidence and the method/tool used (for affidavit foundation).
Chain of custody: Record where and how files were stored, and who had access.

C. Banking and e-wallet specifics

Submit dispute forms within issuer deadlines; attach proof of fraud (phishing messages, spoofed pages).
Ask for transaction logs, merchant descriptors, and merchant acquirer details (if card-present/online card use is involved).

5) Step-by-step: filing a criminal complaint

Draft an Affidavit-Complaint stating:
- Your identity and contact details;
- Clear narration of facts in chronological order;
- The false representations (who, what, where, when, how you relied);
- The loss (amount, property, data);
- The laws violated (e.g., Art. 315 RPC; Sec. 4(b)(2) & 4(b)(3), RA 10175; RA 8484 as applicable);
- Requests for subpoena duces tecum to platforms/banks and preservation orders.
Attach evidence: numbered annexes, with a simple Evidence Index.
Notarize/Jurat: sign before a notary or administering officer; keep government-ID copies.
File with PNP-ACG/NBI-CCD (for investigation) and/or directly with the Prosecutor’s Office (for preliminary investigation). Get receiving copies with date/time stamps.
Monitor subpoenas: Respond to clarificatory hearings; provide additional evidence promptly.
Coordinate for possible arrest/search: For in-flagrante or time-sensitive cases, agents may seek warrants (search, seizure, data disclosure) from cybercrime courts.

Tip: In cross-border scenarios, investigators may request mutual legal assistance and platform disclosures; early, well-documented complaints improve cooperation turnaround.

6) Civil and administrative remedies

Civil action for damages (moral, exemplary, actual) and rescission of contracts induced by fraud under the Civil Code.
Small Claims (no lawyers required): monetary claims up to the current threshold (check the latest Supreme Court circular) for straightforward “paid but undelivered” disputes.
DTI mediation/adjudication for consumer issues with domestic online sellers.
BSP/SEC/IC complaints to compel regulated entities to resolve disputes, correct processes, or sanction bad actors.
Injunctions and asset freezes: In limited cases and where statutes allow, counsel may seek interim relief to restrain transfers or preserve assets/accounts.

7) Special scenarios

A. Investment/“crypto” offerings

Red flags: guaranteed returns, unregistered solicitations, multi-level “affiliate” payouts.
Action: File with SEC (Enforcement/Investor Protection), plus criminal estafa/cybercrime; request platform/page takedown and wallet tracing leads (TXIDs, exchange identifiers).

B. Phishing, vishing, smishing, and SIM-swap

Preserve full message headers, call logs, SIM change notifications, and device events.
Report to bank/e-wallet, telco, and law enforcement; consider Data Privacy and Access Devices angles.

C. Sextortion

Do not pay. Collect chat logs and payment demands, report to ACG/NBI; consider RA 9995 and Data Privacy violations; request urgent takedown from platforms and hosting providers.

D. Merchant/marketplace disputes

Use the platform’s in-app dispute process first to preserve refund eligibility; then escalate to DTI (for Philippine sellers) or civil action if needed.

8) Template: Affidavit-Complaint (outline)

Affiant: Name, age, civil status, address, ID details Respondent/s: (Known name/aliases/handles/phone numbers) Offenses: Estafa (Art. 315 RPC); Computer-Related Fraud & Identity Theft (Sec. 4(b), RA 10175); other applicable laws

Narration of Facts:

On [date/time], I saw/responded to [post/ad/message] at [URL/app].

Respondent represented that […]. I relied by […].

I transferred [amount/reference numbers] via [bank/e-wallet].

Thereafter, [non-delivery/blocked/ghosted/further demands].

I later discovered [false identity/blocked number/others].

Evidence: Annex “A” (screenshots/export), Annex “B” (receipts), Annex “C” (headers), Annex “D” (timeline), etc.

Prayer: Issue subpoenas to [platforms/banks/telcos]; hold and disclose logs/registrations; recommend filing of Informations; other just reliefs.

Verification & Jurat/Notarization

9) Practical checklists

A. “First 24 hours” checklist

Freeze and dispute transfers with your bank/e-wallet; get case/incident number.
Report and request data preservation from the platform/telco.
Export chats/emails with timestamps; save original files.
Write a timeline (who/what/when/where/how much).
Change passwords; enable MFA on all relevant accounts.
If malware suspected: disconnect, image the device if possible, and avoid altering logs.

B. “File the case” packet

Affidavit-Complaint (notarized)
Government ID copies
Evidence Index with labeled annexes
Proof of loss (receipts, bank statements)
Copies of platform and bank complaint acknowledgments
Contact details for follow-ups

10) Timelines, prescription, and strategy

Act quickly. Digital evidence (IP/session logs, ad archives, prepaid account KYC) is ephemeral.
Prescription depends on the charged offense and penalty under the RPC or special law. When in doubt, file immediately to avoid time-bar issues.
Parallel tracks help: Administrative platform actions (takedowns, blocks) and regulator complaints can stop ongoing harm even while criminal prosecution takes time.
Settlement vs. prosecution: Restitution does not erase criminal liability, but may influence prosecutorial and judicial discretion; obtain written settlement agreements if restitution is accepted.

11) Protect yourself going forward

Use strong unique passwords and MFA, especially on email, e-wallets, and socials.
Verify sellers/investments via official registries (SEC, DTI, BIR registration).
Assume zero trust on direct messages and QR links; independently navigate to official websites/apps.
Segregate funds: keep small balances in transactional e-wallets; use spending limits and transaction alerts.
Educate family and staff; scams often pivot through trusted contacts.

12) Frequently asked practical questions

Q: Can I get my money back? Maybe. Banks and e-money issuers have dispute/chargeback processes; rapid reporting materially improves odds. Civil actions (including Small Claims) can compel repayment; criminal courts may order restitution upon conviction.

Q: The scammer is abroad. Is it still worth filing? Yes. Local reports enable platform/account takedowns, intelligence sharing, and cross-border requests. Many scams have local cash-out points or mules who can be traced.

Q: Are screenshots enough? Screenshots help, but export original data (chat/email archives, headers, CSV/PDF statements). Follow the Rules on Electronic Evidence to strengthen admissibility.

13) Ethical note for counsel and handlers

Avoid contacting suspects directly beyond controlled, documented engagement; do not entrap. If you must interact (e.g., to confirm pickup details), do so with legal oversight and preserve all communications.

14) Bottom line

Report fast, preserve everything, and pursue parallel remedies: (1) platform/telco/bank containment, (2) criminal investigation and prosecution (PNP-ACG/NBI-CCD → Prosecutor), and (3) regulator and civil tracks for restitution and deterrence. The Philippine legal framework provides multiple levers; results turn on speed, evidence quality, and coordination.