How to Report Scam Operations on Telegram in the Philippines
A comprehensive legal-practice guide (updated to mid-2025)
Quick take-away:
- Secure evidence immediately (screenshots, screen-recordings, chat exports, transaction records).
- Block and report in-app through Telegram’s “⋯ → Report” menu and by e-mail (abuse@telegram.org / dmca@telegram.org).
- File a complaint with either PNP-ACG (e-Report, 24 × 7 hotlines) or NBI-CCD (online or walk-in).
- When money or personal data is involved, notify your bank/e-wallet, the NPC, and the SEC (for investment scams) without delay—fund freezes are time-critical.
- Prepare for possible search-and-seizure of electronic evidence under the Supreme Court’s 2019 Rules on Cybercrime Warrants.
1. Why Telegram scams thrive—and why the Philippine legal toolkit is still effective
Telegram’s anonymity features, large group sizes, and end-to-end encryption make it attractive to:
| Common scam types | Statutes most often invoked | Typical penalty* |
|---|---|---|
| Investment / “trading bot” rooms | Secs. 8 & 26 Securities Regulation Code (RA 8799); Art. 315 Revised Penal Code (estafa) | 12-20 yrs + ₱2 M–5 M fine |
| Phishing links, fake OTP resets | Cybercrime Prevention Act (RA 10175, s. 4 (a)(1) & (3)) | 6-12 yrs + ₱200 k-₱1 M |
| Credit-card misuse, GCash/PayMaya theft | Access Devices Regulation Act (RA 8484) | 6-20 yrs + fine double the amount |
| Sextortion / non-consensual images | RA 9995 & RA 9775 | 6-20 yrs + ₱500 k-₱5 M |
| SIM-swap fraud | SIM Registration Act (RA 11934) + RA 10175 | 6-12 yrs + ₱300 k-₱1 M |
*Penalties listed are those most commonly imposed; specific sentences depend on the court.
2. Legal foundations you will cite in a complaint
| Law | Key provisions relevant to Telegram scams |
|---|---|
| Revised Penal Code (RPC) | Art. 315 (estafa), Art. 318 (other deceit) |
| RA 10175 – Cybercrime Prevention Act | Sec. 4(a) (computer-related offenses); Sec. 6 (increases penalty by one degree if the felony is already punishable under the RPC) |
| RA 8484 – Access Devices Regulation | Sec. 9 (use of unauthorized access devices); Sec. 10 (penalty enhancements) |
| RA 11934 – SIM Registration Act (2022) | Sec. 10 empowers the NTC to deactivate SIMs used to commit fraud; Sec. 11 penalizes the use of a false identity to register |
| RA 8799 – Securities Regulation Code | Secs. 8, 26, 28 on unregistered securities, fraudulent transactions |
| RA 10173 – Data Privacy Act | For breaches that expose personal information (complaints lodged with the National Privacy Commission) |
| A.M. No. 17-11-03-SC – Rules on Cybercrime Warrants | Art. II allows Warrant to Disclose (WDTO), Warrant to Inspect (WITO), and Warrant to Intercept (WIR) electronic data; indispensable when Telegram refuses voluntary cooperation |
3. Evidence: what to preserve and how to make it admissible
- Screenshots of the entire chat, including the scammer’s username, date/time stamps, and pinned messages.
- Chat export (
Settings → Export Telegram Data) to obtain a JSON or HTML log with SHA-1 hashes—valuable for authentication. - Transaction records: bank statements, GCash/PayMaya receipts, crypto-wallet TxIDs.
- Device forensics: keep the phone intact; do not uninstall Telegram—this preserves metadata for law-enforcement cloning.
- Self-executed Affidavit of Preservation: a short notarised statement describing how you captured the evidence (to satisfy Rule 5, Sec. 2 Rules on Electronic Evidence).
4. Step-by-step procedure for victims or counsel
4.1 In-app and direct report to Telegram
| Channel | How to use | Expected Telegram action |
|---|---|---|
| In-chat “Report” (⋯ menu) | Choose reason: Scam, Fake Account, or Violence. | Automatic forwarding to Telegram’s moderators; scam account usually limited within hours. |
| Send complete screenshots to abuse@telegram.org; for IPR or images, copy dmca@telegram.org. | You receive bot confirmation; law-enforcement portal details are provided for subpoenas. | |
| Law-enforcement portal | Philippines-based prosecutors/agents may request metadata via legal@telegram.org on official letterhead. | Telegram reviews request for territory and proportionality. |
4.2 Police or NBI reporting
| Forum | How to file | Tips |
|---|---|---|
| PNP-ACG (Anti-Cybercrime Group) | • Walk-in: Camp Crame HQ or any RPSB cybercrime desk | |
| • E-Complaint System (https://acg.pnp.gov.ph/ecomplaint) | ||
| • Hotline: (02) 8414-1560 / 0926-638-9051 (Viber) | Prepare Affidavit of Complaint and Intent to Preserve Electronic Evidence; attach USB/DVD of exports. | |
| NBI-CCD (Cybercrime Division) | • NBI Online Complaint System (https://complaint.nbi.gov.ph) | |
| • Walk-in: Taft Ave. HQ, Manila | NBI prefers duplicate-original prints of screenshots and a signed Data Privacy Waiver so they can request subscriber information. |
Jurisdiction note: For cybercrimes, venue is where any element occurred or where the offended party resides (Sec. 21, RA 10175). This is crucial when the scammer is offshore.
4.3 Notifying other regulators
| Situation | Agency | Purpose |
|---|---|---|
| Investment, “trading” rooms | Securities and Exchange Commission – Enforcement & Investor Protection Dept. (EIPD) | Issue cease-and-desist orders; warn public. |
| Credit/debit card, bank transfer | BSP Financial Consumer Protection Dept. + your bank’s FCP Unit | Freezes recipient account; facilitates chargeback. |
| E-wallet (GCash/PayMaya) | Bangko Sentral Circular 1163 quick-freeze mechanism (72-hour hold) | Requires police blotter or official request. |
| Personal data leaked | National Privacy Commission | May penalize the platform for insufficient security measures. |
| SIM used in scam | National Telecommunications Commission | NTC can order telco to deactivate SIM under RA 11934. |
5. Drafting the Affidavit of Complaint
Mandatory allegations:
Personal/Corporate Information of complainant.
Statement of Facts (chronology, timestamps in PHT/UTC).
Specific violated provisions (cite Art. 315, Sec. 4(a)(1) & Sec. 6, RA 10175, etc.).
Jurisdictional paragraph (residence of complainant or place where money was lost).
Prayer asking for:
- Issuance of Warrant to Disclose Computer Data (WDTO) to Telegram.
- Freezing of assets under Rule 7, Sec. 10, 2021 AMLC IRR if laundering suspected.
- Indictment and trial.
Verification & Certification of Non-Forum Shopping.
Annexes should be indexed and labeled (Annex “A” = chat export; “B” = bank receipt; etc.).
6. Law-enforcement tools at a glance
| Tool | Basis | What it does |
|---|---|---|
| WDTO / WITO / WCDO | Rules on Cybercrime Warrants | Compels Telegram, telcos, banks to turn over logs, IP addresses, subscriber data. |
| Subpoena Duces Tecum / Ad Testificandum | Rule 113, Rules of Court | Forces local witnesses (e-wallet officers) to testify or produce records. |
| Freeze Order | AMLC under RA 9160 (as amended) | 20-day freeze of suspected laundered funds; extendable by court. |
| NTC Blocking Order | RA 11934 & NTC M.C. 01-02-2023 | Blocks specific Telegram channels or numbers on the Philippine internet backbone. |
7. Civil and administrative remedies
- Civil action for damages (Art. 33, Civil Code) can be filed simultaneously with the criminal case; no need to reserve.
- Payment card / e-wallet chargeback: supply police reference number within 15 days (per your provider’s charter) to reverse unauthorized send-outs.
- Small Claims (A.M. 08-8-7-SC, as amended) for ≤ ₱400 000; faster if the scam amount is modest.
- Consumer redress through DTI for deceptive acts tied to pseudo-online stores on Telegram.
8. Cross-border hurdles & mutual legal assistance
- Telegram’s servers are distributed; primary data localization is outside PH. A WDTO served via MLAT (Mutual Legal Assistance Treaty) through the Department of Justice’s OFLD may be required when Telegram insists on a foreign court order.
- For crypto wallets, Chainalysis or TRM Labs tracing results strengthen probable cause for MLAT requests.
- ASEAN Desk-to-Desk mechanism (2019 e-commerce MoU) expedites takedown of regional scam call centers.
9. Preventive & enterprise-grade measures
| For individuals | For companies & law firms |
|---|---|
| Enable 2-Factor Authentication & Passcode Lock in Telegram. | Draft an Incident Response Plan enumerating: (a) evidence collection SOP, (b) counsel-of-record escalation, (c) Data Breach Notification within 72 h (NPC Circular 16-03). |
| Check t.me/durov for verified announcements; look for the blue check on channels. | Maintain a Law-Enforcement Contact Matrix (PNP-ACG, NBI-CCD, AMLC, NTC). |
| Never send OTPs or “GCash Reference Codes” via chat. | Integrate SIM-swap hooks in HR exit processes (mandatory post-employment SIM deactivation). |
10. Common pitfalls to avoid
- Deleting the chat thread—eradicates essential message IDs used in WDTOs.
- Not notarising screenshots—courts may disregard unauthenticated JPEGs.
- Waiting more than 24 hours to call the bank/e-wallet—funds usually “chain-hopped” by then.
- Relying solely on Telegram’s takedown—this helps prevent further harm but does not get your money back or jail the perpetrator.
11. Future directions (legislative watch-list)
| Pending bill (status as of July 2025) | Relevance |
|---|---|
| House Bill 7425 – Online Consumer Protection Act | Would create a single-window “cyber fraud desk” consolidating PNP-ACG, NPC, and SEC hotlines. |
| Senate Bill 2219 – Anti-Financial Account Scamming Act | Imposes command responsibility on e-wallet officers for delayed freezes; anticipated to amend RA 10175 Sec. 5. |
| DICT Circular on Voluntary KYC for Messaging Apps (draft) | Would require large platforms, including Telegram, to provide an API for verifying Philippine SIM registration data upon lawful request. |
12. Conclusion
Even with Telegram’s formidable privacy architecture, Philippine law provides a multi-layered enforcement ladder: platform takedown, police/NBI criminal prosecution, asset-freeze by AMLC or BSP-supervised institutions, and civil restitution. The key is speedy evidence preservation and simultaneous reporting to both the platform and Philippine authorities. Counsel should integrate cyber-warrant strategy early, cite the correct penal provisions, and leverage the SIM Registration Act’s new deactivation powers.
Disclaimer: This article reflects statutory and procedural rules up to August 2 , 2025 and omits any later issuances. Always verify whether new IRRs or circulars have been released after this date.