How to Report Scam Websites in the Philippines
A practitioner‑level guide for consumers, lawyers, compliance teams, and IT security professionals.
1. Why Reporting Matters
Online scams siphon billions of pesos each year, erode public trust in e‑commerce, and expose personal data. Reporting a fraudulent site:
- Triggers takedown or blocking, limiting further victimization.
- Preserves digital evidence before scammers wipe servers.
- Launches criminal or administrative action, opening the door for asset freezes, restitution, and prosecution.
2. Legal Framework at a Glance
| Law | Key Sections for Website Scams | Max. Penalties* |
|---|---|---|
| RA 10175 – Cybercrime Prevention Act 2012 | §4(a)(2) Computer‑related fraud; §5 Aiding/Abetting; §14 Preservation of computer data; §19 Restricting/blocking access | 6–12 yrs + ₱200k–₱1,000,000 per offense |
| RA 8792 – E‑Commerce Act 2000 | §33(a) Hacking/Unauthorized access; §33(b) Computer‑related fraud; §35 Liability of service providers | 3 yrs + ₱500k |
| Revised Penal Code Art. 315 – Estafa/Swindling | False pretenses, fraudulent means | 6 mos + 1 day to 20 yrs + fine |
| RA 7394 – Consumer Act | Art. 50 Unfair/Deceptive sales acts | Admin fines up to ₱300k + closure |
| RA 10173 – Data Privacy Act | §25–§32 Unauthorized processing, data breach | 1–6 yrs + ₱500k–₱5 M |
| RA 11765 – Financial Products & Services Consumer Protection Act 2022 | §6 Deceptive practices online | Admin fines up to ₱2 M per day + disgorgement |
| SEC Rules (2019) | Unregistered online investment offerings | Cease‑and‑desist, asset freeze |
*Several laws impose penalties one degree higher when the crime is committed through ICT (Art. 6, RA 10175).
3. Agencies and Their Jurisdictions
| Agency | Typical Website Scams Handled | Where/How to File |
|---|---|---|
| NBI – Cybercrime Division (CCD) | General online fraud, phishing, identity theft | Walk‑in complaint, e‑mail (ccd@nbi.gov.ph), or NBI Online Complaints Portal |
| PNP – Anti‑Cybercrime Group (ACG) | Same as NBI, plus law‑enforcement raids | e-Sumbong portal, 0998‑598‑8116 (Smart), 0917‑596‑8116 (Globe), Facebook: @PNPACG |
| DICT & CERT‑PH | Malware‑infected sites, defacement, domain blocking under §19 RA 10175 | incident@cert.ph, (02) 8920‑0101 loc 1708 |
| DTI – Fair Trade Enforcement Bureau | Counterfeit goods, deceptive e‑commerce, non‑delivery | 1‑DTI (1‑384), consumercare@dti.gov.ph |
| SEC – Enforcement & Investor Protection Department | Online investment schemes, crypto “double‑your‑money” sites | EIPD@sec.gov.ph, MS Teams portal |
| BSP – Financial Consumer Protection Department | Fake banking/payment sites, e‑wallet fraud | consumeraffairs@bsp.gov.ph, chatbot BOB |
| NTC | IMEI blocking, telecoms that host/allow access to illicit domains | ntc@ntc.gov.ph |
| National Privacy Commission (NPC) | Phishing sites harvesting personal data | complaints@privacy.gov.ph |
4. Evidence: Collect Before Contact
- Full‑page screenshots showing URL, timestamp, and entire scroll (use browser extensions or dev‑tools → “Capture full‑size screenshot”).
- HAR/PCAP logs or at minimum browser network logs for redirections.
- Copies of e‑mails/SMS exchanges, invoices, e‑wallet confirmation slips.
- WHOIS record (save as PDF) for domain ownership and registrar.
- Hash and seal files (SHA‑256) if you downloaded malware or fake documents.
- Affidavit draft: narrative of facts in chronological order, signed and notarized later.
Keep originals read‑only; do not edit metadata. Under §14 RA 10175, investigators can compel service providers to preserve logs for 90 days, renewable, so request this preservation in your complaint.
5. Step‑by‑Step Reporting Workflow
Scenario: You paid for goods via an online “luxury outlet” website hosted on .xyz, item never arrived.
| # | Action | Details & Tips |
|---|---|---|
| 1 | Preserve Evidence | Screenshots, receipts, chats, tracking page, WHOIS |
| 2 | Determine Proper Agency | Non‑delivery = DTI; fraud = NBI/PNP; possible privacy breach = NPC |
| 3 | Draft Sworn Complaint | State facts, attach annexes (A, B, C…), include contact info |
| 4 | File Online or Walk‑In | NBI e‑portal or physically at Taft Avenue HQ; bring USB drive with evidence |
| 5 | Request Log Preservation | Quote §14 RA 10175 in your request letter to ISP/registrar |
| 6 | Parallel Civil Remedies | File small‑claims (<₱400k) data-preserve-html-node="true" or regular civil case (damages) in RTC of your residence or where scam occurred |
| 7 | Follow‑ups | Get NBI/PNP reference number; check prosecutor’s office for Resolution; respond to subpoena for clarifications |
| 8 | Coordinate Takedown | Forward the blotter or NBI Acknowledgment to domain registrar, hosting provider, Google Safe Browsing (safebrowsing.google.com) to expedite blocklist |
6. Special Pathways & Fast‑Track Channels
| Type of Scam Site | Extra/Alternate Route | Typical Turn‑Around |
|---|---|---|
| Investment/Trading | SEC STOp – Online Scam Tracker Portal; BSP if e‑wallet used | 1–3 days → Advisory; 2–4 weeks → Cease‑and‑Desist |
| Counterfeit Luxury Goods (.ph domain) | dotPH Abuse Desk (abuse@dot.ph) – attach proof of trademark ownership | 24–48 hrs suspension |
| Phishing of Bank | Bank’s fraud hotline (e.g., BDO 8708‑7080) + BSP; banks often auto‑notify CERT‑PH | Few hours for URL block |
| Malware Distribution | CERT‑PH with copy of malware sample hash; they flag to global feeds | 24 hrs |
| Data‑leak/Privacy | NPC: Data Breach Notification portal within 72 hrs of discovery | NPC Preliminary Evaluation in 15 days |
7. What Happens After You File
- Evaluation & Cyber‑Triaging – NBI/PNP validates jurisdiction and sufficiency of evidence.
- Sub‑poena or Search Warrant – prosecutors apply (Rule 126, Rules of Court) to seize servers.
- Digital Forensics – chain‑of‑custody forms; imaging of drives; verification using hash values.
- Inquest or Regular Filing – if suspect is arrested in flagrante, inquest within 36 hrs; otherwise, prosecutor issues Subpoena‑Duces‑Tecum to respondent, then Resolution.
- Information Filed in Court – Regional Trial Court, designated Cybercrime Court (per A.M. No. 03‑03‑03‑SC).
- Takedown/Blocking Order – Court or DOJ‑OOC may direct DICT/NTC and ISPs to geo‑block the site (§19 RA 10175).
8. Civil & Administrative Remedies
- Civil Damages – Art. 33 Civil Code allows independent civil action for defamation/fraud; claim actual, moral, exemplary damages.
- Temporary Restraining Order (TRO)/Injunction – Secure ex parte TRO vs. payment processors to freeze funds.
- Asset Forfeiture – AMLC can issue Freeze Orders for proceeds of unlawful activity (Sec. 10 RA 9160 as amended).
- Administrative Penalties – DTI can impose fines/closure; BSP can revoke e‑money issuer’s CA if complicit.
9. International Dimensions
Many scam sites use offshore hosting. Tools:
- MLAT / Budapest Convention – Philippines acceded in 2018; DOJ‑OOC sends requests.
- INTERPOL Global Cybercrime Directorates – NBI is National Central Bureau.
- APCERT & ASEAN CERTs – CERT‑PH coordinates cross‑border incident response.
10. Sample Complaint‑Affidavit Outline
Use 12‑pt font, double‑spaced, notarize after signing
- Title & Caption – “AFFIDAVIT‑COMPLAINT FOR VIOLATION OF RA 10175, ART. 315 RPC, AND RA 7394”
- Personal Background – Name, age, nationality, address, government ID.
- Narration of Facts – numbered paragraphs (date, time, URL accessed, transaction steps, non‑delivery, attempts to contact).
- Elements of the Offense – state how acts constitute computer‑related fraud, estafa, unfair trade.
- Supporting Annexes – A (screenshots), B (receipt), C (WHOIS), etc.
- Prayer – request investigation, prosecution, takedown, restitution.
- Verification & Certification of Non‑Forum Shopping – if simultaneously filing civil case.
- Jurat – Notary public details, government‑issued ID number.
11. Practical Tips & Common Pitfalls
| Do | Don’t |
|---|---|
| File within 10 days of discovery to preserve ISP logs | Delete chats/e‑mails; you may be accused of evidence spoliation |
| Use official portals; retain ticket numbers | Pay “processing fees” to fake “NBI online verification” |
| Coordinate with multiple agencies when scam overlaps jurisdictions | Assume a single report auto‑triggers a takedown—follow up |
| Escalate to bank/e‑wallet within 24 hrs for chargeback/freeze | Expect full refund if you wired money via remittance (high bar) |
| Check SEC Advisories before investing | Rely on .org/.ph domains as proof of legitimacy |
12. Penalties Facing Perpetrators
- Cyber‑Fraud (RA 10175 §4(a)(2)): prision mayor (6 yrs 1 day–12 yrs) + up to ₱1 M fine per count
- Estafa: depending on amount, up to reclusion temporal (20 yrs) + restitution
- Consumer Act violations: fine ₱500–₱300,000 + permanent closure
- Data Privacy breaches: up to 6 yrs + ₱5 M fine
- Contempt for ignoring blocking/takedown order: arrest + fine under Rules of Court
Courts may also award civil damages and profit disgorgement under Art. 2200 et seq. Civil Code.
13. Frequently Asked Questions
Can I sue a foreign registrar in PH courts? Yes, if the scam’s effects are felt in the Philippines and the registrar “purposefully avails” itself of Philippine commerce (see Spouses Imbong v. Registry, G.R. No. —). Expect jurisdictional challenges; coordinate with DICT for blocking instead.
Will reporting guarantee my money back? Not necessarily. Criminal cases punish; recovery depends on asset tracing and civil action. File ex parte freeze petitions and coordinate with AMLC early.
Is anonymous reporting allowed? For intelligence tips, yes (CERT‑PH, SEC). For criminal complaints you must identify yourself; otherwise, prosecutors cannot proceed.
What if the scammer uses Facebook/Instagram? Report via the platform and file with NBI; meta will only act quickly if accompanied by law‑enforcement request numbers.
14. Conclusion
Reporting scam websites is both a civic duty and a strategic first step toward redress. Armed with the legal bases, agency channels, and procedural road‑map above, victims and advocates can move swiftly—within Philippine jurisdiction and beyond—to shut down fraudulent domains, preserve evidence, and bring perpetrators to justice.
This article provides general information and is not a substitute for specific legal advice. Consult a qualified Philippine lawyer for guidance on your case.