How to Report Sextortion in the Philippines: Evidence, PNP-ACG/NBI Cybercrime, and Legal Remedies

This guide is written for Philippine readers. It is educational, not legal advice. Laws evolve and facts matter—if you can, consult a lawyer or proceed directly to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division.

1) What “sextortion” means under Philippine law

“Sextortion” isn’t a single offense in the statute books. It’s usually a combination of crimes committed online, such as:

Grave threats / coercion (threatening to post intimate content to force payment or acts), under the Revised Penal Code.
Unlawful recording or sharing of intimate images/videos, under the Anti-Photo and Video Voyeurism Act (RA 9995)—even if the image/video was originally taken with consent, sharing or threatening to share it without consent is punishable.
Cybercrime offenses under the Cybercrime Prevention Act (RA 10175) (e.g., illegal access, identity theft, computer-related fraud, aiding or abetting).
Online gender-based sexual harassment under the Safe Spaces Act (RA 11313) (includes sending threats and sexual harassment through online platforms).
If the victim is a child (under 18), conduct may qualify as Online Sexual Abuse or Exploitation of Children under RA 11930 (and related child-protection laws). Penalties and procedures are more severe and urgent.
In intimate partner contexts, acts can also fall under VAWC (RA 9262) when the offender is a spouse/partner or has a dating/sexual relationship with the victim (protection orders available).
Possible Data Privacy Act (RA 10173) violations if personal/sensitive data are unlawfully processed or disclosed.

2) Immediate actions (first 30–60 minutes)

Do not pay. Payment rarely stops extortion and can invite more demands.
Stop talking to the extorter after you preserve evidence (below). Block only after you capture what you need.
Preserve the scene:
- Take full-screen screenshots of the chat threat, user profile/handle, and account links.
- Export chat logs (many apps allow export).
- Save filenames, URLs, message IDs, phone numbers, email addresses, and payment instructions the extorter gave.
- If a link was sent, copy the full URL; if a file was sent, save the original file.
Secure your accounts: change passwords, enable 2-factor authentication, log out of unknown sessions.
Tell trusted contacts (only those who might be targeted by the extorter) to ignore any messages and to save any communications they receive from the offender.

If there’s an immediate threat to life or physical safety, call 911.

3) Building a solid evidence file (digital forensics “lite” for civilians)

Courts and investigators care about authenticity and integrity. You can help:

What to collect

Screenshots of threats, profiles, and timelines (capture device date/time in the frame if possible).
Raw exports (chat/json/html) from the platform.
Original media files (don’t re-save or re-compress).
Headers/metadata where possible (e.g., email headers).
Call logs/voicemails if any.
Payment traces: receipts, transaction IDs, account names/numbers, wallet nicknames, QR codes.
Witness info: anyone who saw the threats or received messages.

Simple chain-of-custody

Create an Evidence Log (a spreadsheet or document). One row per item:

Item No.
Date/time acquired
Source (device/app/link)
Short description (e.g., “WhatsApp chat export 2025-08-20 22:14, user +44…”)
File hash (optional but helpful): on Windows, certutil -hashfile <file> SHA256; on macOS/Linux, shasum -a 256 <file>; paste the resulting hash in the log.
Keeper (who holds it) and storage location.

Keep original files unchanged. If you make working copies, note that in the log.

Do’s and don’ts

Do record the timeline (first contact, threat, demand, deadlines).
Do save the extorter’s requested payment channels (bank, e-wallet, crypto).
Don’t “test” links from suspicious senders on your primary device—use screenshots.
Don’t forward intimate images to anyone except law enforcement or your counsel; forwarding can itself be a crime, especially if a minor is involved.

4) Where and how to report

You can report to either the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division. You may also make an initial blotter at any police station (Women and Children Protection Desk for women/children). Simultaneous reporting is fine; agencies often coordinate.

What to bring

Valid ID and contact details.
Affidavit/Complaint (a sworn statement) – see template below.
Your evidence bundle (USB drive with files and a printed index; also bring your device if asked).
If payment occurred, bring bank/e-wallet receipts and your reference numbers.
If the victim is a minor, bring proof of age (birth certificate, school ID) and a parent/guardian.

What happens after you report

Intake & blotter: officers record the incident and assess immediate risks.
Case build-up: investigators may ask you to walk them through the chats, identify accounts, and execute consent for data preservation from platforms or providers.
Preservation / takedown: law enforcement can formally request data preservation, seek takedowns, and apply for cybercrime warrants (e.g., to disclose subscriber info, search/seize/examine devices or accounts, or intercept ongoing communications) through designated cybercrime courts.
Prosecutor: the complaint proceeds to preliminary investigation. You may be asked to subscribe and swear to your affidavit before a prosecutor (or authorized officer).
Filing in court: if probable cause is found, an Information is filed in a designated cybercrime court (venue is flexible where any element occurred or where the relevant computer system is located).
Confidentiality: victim identities in voyeurism/child cases are protected; ask officers about confidentiality measures in filings.

If the offender is overseas or uses foreign platforms, authorities can still act. They routinely use international cooperation channels to request data or assistance. This can take time—but your early report and preservation make it possible.

5) Legal charges commonly used in sextortion cases

Exact charges depend on facts; prosecutors bundle what fits best.

Revised Penal Code
- Grave threats / grave coercion (threatening to publish intimate content unless you pay or do acts).
- Estafa (if deceit causes you to part with money).
RA 9995 – Anti-Photo and Video Voyeurism
- Prohibits publication, broadcasting, selling, or distribution of intimate images/videos without consent (even if originally taken with consent). Attempted or threatened distribution can support charges in combination with threats/coercion.
RA 10175 – Cybercrime Prevention Act
- Illegal access, illegal interception, data interference, system interference, computer-related fraud/forgery, computer-related identity theft, aiding/abetting. Cybercrime qualifiers often increase penalties for underlying crimes when committed through ICT.
RA 11313 – Safe Spaces Act
- Online gender-based sexual harassment (unwanted sexual remarks, threats, or misogynistic conduct online), with criminal and administrative remedies.
RA 11930 – OSAEC and Anti-CSAE Materials (if the victim is a child)
- Possession, production, distribution, solicitation, grooming, livestreaming, and facilitation—very serious offenses.
RA 9262 – Anti-VAWC (if the offender is a partner/ex-partner)
- Psychological violence, economic abuse; Protection Orders (BPO/TPO/PPO) are available.
RA 10173 – Data Privacy Act
- Unlawful processing or unauthorized disclosure of sensitive personal information; administrative complaints may be filed with the privacy regulator alongside criminal action.

Civil remedies: You may also sue for damages under the Civil Code (Articles 19, 20, 21, 26—privacy, dignity, human relations), plus attorney’s fees and injunctive relief (e.g., to bar further distribution), subject to court discretion.

6) Special scenarios

A) The victim is a minor

Do not handle or forward the files yourself; let law enforcement collect them.
Expect priority handling, social worker involvement, and different interview protocols (child-friendly and recorded).
Schools and guardians should be looped in for protective measures.

B) Payment already made

Do not send more.
Immediately notify your bank/e-wallet with a written dispute and request a freeze/trace (include transaction IDs, timestamps, account names/numbers).
Give the reference numbers to PNP-ACG/NBI; they can coordinate with financial institutions and regulators.

C) Accounts hacked

Change passwords, enable 2FA, review recovery emails/phones, remove unknown sessions/apps.
Tell contacts a compromise occurred to blunt reputational damage.
Investigators may pursue illegal access and identity-theft angles.

D) Offender abroad / anonymous

You can still prosecute if any element occurred in the Philippines (e.g., you received threats here, your account was accessed here). Investigators can use data-disclosure requests and international cooperation. Your evidence bundle and early report are key.

7) Practical playbook: step-by-step

Preserve everything (screenshots + exports + originals) and fill your Evidence Log.
Harden your accounts (passwords, 2FA, session review).
Report to PNP-ACG or NBI Cybercrime (bring ID, affidavit, evidence).
Tell your bank/e-wallet if money moved; file a written dispute.
Use platform reporting tools (flag the account/content, request takedown).
Consider protective orders (VAWC) or injunction (via counsel) where appropriate.
Support: seek counseling/medical/legal support; you are not alone.

8) Affidavit of Complaint (simple template)

Note: This is a sample. Your prosecutor or investigator may have a preferred format.

Republic of the Philippines City/Province of __________

AFFIDAVIT OF COMPLAINT

I, $Your Name$, Filipino, of legal age, residing at $address$, after having been duly sworn, depose and state:

I am the account holder of $platform + handle/email/number$.
On $date/time, with timezone$, user $handle/URL/number$ sent me messages demanding $money/act$ and threatening to $publish intimate images/videos/link$ if I did not comply.
Attached as Annex “A” are screenshots of the threats; Annex “B” is the chat export; Annex “C” are payment instructions given by the respondent; Annex “D” are transaction records (if any); Annex “E” is my Evidence Log with file hashes.
I did not consent to the publication or distribution of any intimate image/video.
I suffered $fear, anxiety, reputational harm, financial loss$.
I am filing this complaint for violations of the Revised Penal Code (grave threats/coercion and any applicable felonies), RA 9995, RA 10175, RA 11313, and other related laws, and pray that appropriate charges be filed.

I certify that the facts stated are true and correct of my own personal knowledge or based on authentic records.

$Signature over printed name$ $Date$

SUBSCRIBED AND SWORN to before me this $date$, affiant exhibiting $ID type & number$ issued on $date/place$.

$Prosecutor/Notary/Authorized Administering Officer$

9) Sample “Evidence Bundle” index (put on the first page of your USB/printout)

Index 0 – Evidence Log (CSV/PDF)
A1 – Chat screenshots (PNG), folder with timestamped filenames
A2 – Full chat export (ZIP containing JSON/HTML)
B1 – Offender profile screenshots + URLs
C1 – Payment instructions and QR codes (PNG/PDF)
C2 – Bank/e-wallet receipts with transaction IDs (PDF)
D1 – Email header (if email used) as .eml or .txt
E1 – Device details (model/OS, only if asked)
F1 – Hash manifest (hashes.txt with SHA-256 values)

10) Platform and institutional remedies (in parallel with criminal action)

Report on the platform (Facebook/Instagram/TikTok/X/WhatsApp/Telegram, etc.). Choose abuse/harassment/sexual exploitation and non-consensual intimate imagery categories.
Notice-and-takedown: Send a short, factual request to the platform’s legal/reporting address including URLs, your affidavit or police blotter reference, and a statement of lack of consent.
Search engine de-indexing: If something is posted on a website, request removal from the host/administrator, and de-indexing from major search engines.
Privacy complaint: You may file with the data protection authority for unlawful processing/disclosure of sensitive personal information (often pursued alongside criminal complaints).

Keep copies of every ticket number and acknowledgement; add them to your Evidence Log.

11) Frequently asked questions

Q: Will paying make it stop? A: Almost never. It signals you can be coerced again. Report instead.

Q: What if the intimate material was recorded with my consent? A: Sharing or threatening to share without your consent can still be criminal (RA 9995), among others.

Q: Can I get a protective order? A: Yes, VAWC protection orders are available when the abuser is a partner/ex-partner. Outside VAWC, prosecutors can seek conditions of bail or protective measures; civil injunctions are also possible.

Q: Can I stay anonymous? A: Law enforcement will need your identity to build the case, but confidentiality protections apply in certain cases (voyeurism and child cases). Ask the officer/prosecutor about protective measures.

Q: The offender is abroad—do I still have a case? A: Yes, if any element occurs here (you’re in PH, device here, data here), authorities can coordinate internationally for data and suspects.

12) One-page checklist (tear-off)

☐ Screenshot threats, profiles, payment instructions
☐ Export chat; save original files; log hashes
☐ Change passwords; turn on 2FA; sign out other sessions
☐ Report to PNP-ACG/NBI Cybercrime (bring ID, affidavit, evidence)
☐ File bank/e-wallet dispute (attach receipts, case reference)
☐ Report and request takedown on the platform/host/search engine
☐ Consider protective order (VAWC) or injunction with counsel
☐ Get support (family, counselor, support org)

Final notes

Speed matters: the sooner you report, the easier to preserve data and trace accounts.
Accuracy matters: keep your Evidence Log clean; don’t alter originals.
You have rights: Philippine law provides criminal, civil, and administrative remedies. Use them.