In an increasingly digital landscape, the Philippines has seen a significant rise in cybercrime, ranging from phishing and investment scams to full-scale identity theft. Navigating the aftermath of a digital attack requires swift action and a clear understanding of the legal frameworks provided by Philippine law, primarily the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) and the Data Privacy Act of 2012 (Republic Act No. 10173).

Phase 1: Immediate Containment and Evidence Gathering

Before filing a formal complaint, the victim must secure their digital footprint and preserve the integrity of the evidence.

Document Everything: Take screenshots of all fraudulent transactions, suspicious emails, social media profiles used by the scammer, and conversation logs. Do not delete any messages, as these serve as digital trails.
Secure Accounts: Change passwords for all online accounts using "Two-Factor Authentication" (2FA). If financial details were compromised, immediately call your bank to freeze credit cards or temporarily suspend mobile banking access.
Preserve Digital Metadata: If possible, save the email headers or the URLs of the phishing sites. This information is crucial for law enforcement to trace IP addresses.

Phase 2: Reporting to Financial Institutions and Platforms

Under the BSP (Bangko Sentral ng Pilipinas) Circulars, banks have a responsibility to investigate fraudulent transfers.

Bank Incident Report: File a formal protest with your bank’s fraud department. Provide the transaction reference numbers and the time of the incident.
Platform Reporting: If the scam occurred on a social media platform (Facebook, Telegram) or an e-commerce site (Lazada, Shopee), report the user profile through the platform’s internal reporting mechanism to prevent further victimization.

Phase 3: Engaging Law Enforcement Agencies

In the Philippines, two primary agencies handle cybercrime. You should visit their offices to file a formal "Affidavit of Complaint."

1. PNP Anti-Cybercrime Group (PNP-ACG)

The PNP-ACG is the frontline for criminal investigation. They handle violations of RA 10175, including computer-related fraud and identity theft.

Location: Camp Crame, Quezon City (or regional satellite offices).
Requirement: Bring a printed copy of all evidence and a government-issued ID.

2. NBI Cybercrime Division (NBI-CCD)

The NBI is often preferred for complex scams involving international elements or large-scale syndicates.

Location: NBI Building, Taft Avenue, Manila.

Phase 4: Addressing Identity Theft via the National Privacy Commission (NPC)

If your personal data (TIN, SSS, Passport, or facial recognition data) was stolen, you are a victim of a data breach under the Data Privacy Act.

NPC Complaint: You may file a formal complaint with the National Privacy Commission if a "Personal Information Controller" (like a bank or a website) failed to protect your data, leading to the theft.
Identity Restoration: Notify government agencies (DFA, LTO, PSA) if you suspect your government-issued IDs are being used by others. This creates a paper trail that protects you from future liabilities incurred by the impostor.

Relevant Laws and Penalties

Law	Focus	Key Provisions
R.A. 10175	Cybercrime Prevention Act	Penalizes Computer-related Fraud and Identity Theft with imprisonment (6–12 years) and heavy fines.
R.A. 10173	Data Privacy Act	Protects individuals from unauthorized processing of personal information.
R.A. 11934	SIM Registration Act	Provides a mechanism to track scammers using local SIM cards by mandating registration.
R.A. 12010	State Financial Account Scamming Act (AFASA)	Specifically targets "money mules" and social engineering schemes like phishing.

The Importance of the "Affidavit of Complaint"

To initiate a preliminary investigation by the Prosecutor’s Office, you must execute a Sworn Affidavit. This document must detail:

The Manner of the Scam: How you were contacted and what lures were used.
The Damage: The specific amount of money lost or the specific data compromised.
The Perpetrator: Any known aliases, account numbers, or phone numbers used by the scammer.

Legal action in the Philippines can be a lengthy process, but establishing a formal record with the PNP or NBI is the only way to potentially recover funds through court-ordered restitution or to clear your name if your identity is used to commit further crimes.