I. Introduction

Online fraud has become one of the most common technology-enabled crimes in the Philippines. It appears in many forms: fake online selling, phishing, account takeover, investment scams, romance scams, job scams, SIM-related fraud, digital wallet scams, unauthorized bank transfers, social media impersonation, fake delivery schemes, and fraudulent marketplace transactions.

Although these acts happen through the internet, they are not legally “less real” than traditional fraud. Philippine law treats online fraud as punishable criminal conduct when the elements of a crime are present. The fact that the deception was committed through Facebook, Messenger, TikTok, Instagram, Viber, Telegram, email, online banking, e-wallets, websites, or marketplace platforms may even aggravate liability under cybercrime laws.

This article discusses the Philippine legal framework for online fraud complaints, the criminal remedies available to victims, where and how to file complaints, what evidence to preserve, what offenses may apply, and what practical issues arise in pursuing online fraud cases.

II. What Is Online Fraud?

Online fraud is not a single offense under Philippine law. It is a general description for fraudulent acts committed through electronic means. Depending on the facts, the act may fall under one or more offenses, such as:

Estafa or swindling under the Revised Penal Code;
Computer-related fraud under the Cybercrime Prevention Act;
Identity theft under cybercrime law;
Illegal access or hacking;
Misuse of devices or computer data;
Data privacy violations;
Unauthorized bank or e-wallet transactions;
Investment fraud or securities violations;
SIM registration-related offenses;
Falsification or use of fake documents;
Violation of consumer protection laws, when applicable.

The key legal point is that the internet is usually the method, medium, or instrument of the fraud. The underlying wrongful act remains deception, misrepresentation, unauthorized access, identity misuse, or unlawful taking of money or property.

III. Main Philippine Laws Involved

A. Revised Penal Code

The Revised Penal Code remains the foundation for many fraud complaints. The most common offense is estafa, especially when the offender deceives the victim into sending money, goods, services, or property.

Traditional estafa provisions can apply even when the transaction occurs online. For example, if a seller falsely represents that an item exists, accepts payment, and never delivers because there was no intent to deliver from the start, the conduct may constitute estafa.

B. Cybercrime Prevention Act of 2012

The Cybercrime Prevention Act recognizes crimes committed through information and communications technology. It does not replace traditional crimes; instead, it punishes certain acts committed through computer systems and may increase penalties when ordinary crimes are committed using ICT.

Important cybercrime-related offenses include:

Computer-related fraud;
Computer-related identity theft;
Illegal access;
Data interference;
System interference;
Misuse of devices;
Cyber-squatting, in certain cases;
Content-related offenses, where applicable;
Traditional crimes committed through ICT, which may be punished one degree higher.

For online fraud, the most relevant provisions are computer-related fraud and identity theft, along with the rule that crimes under the Revised Penal Code committed through ICT may carry heavier penalties.

C. Access Devices Regulation Act

This law may apply when fraud involves credit cards, debit cards, ATM cards, account numbers, PINs, passwords, or other access devices. Unauthorized use, possession, production, trafficking, or use of access devices can create criminal liability.

Examples include unauthorized credit card transactions, phishing for card credentials, use of stolen card details, or possession of access device data with intent to defraud.

D. Electronic Commerce Act

The E-Commerce Act recognizes electronic documents, electronic signatures, and digital transactions. It is relevant because screenshots, emails, chat logs, digital receipts, online contracts, electronic confirmations, and transaction records may have evidentiary value.

It also penalizes certain computer-related acts, though cybercrime law has become the more commonly invoked statute in many online fraud cases.

E. Data Privacy Act

Online fraud often involves misuse of personal information. If the offender unlawfully collects, uses, discloses, sells, or processes personal data, the Data Privacy Act may be relevant.

This law may apply where personal information is obtained through phishing, fake forms, impersonation, unauthorized database access, or social engineering. The National Privacy Commission may also become involved if there is a data breach, unauthorized processing, or negligence by a personal information controller.

F. Consumer Protection Laws

Where the fraud arises from online selling, defective goods, misleading advertisements, fake sellers, or unfair trade practices, consumer protection laws may also be relevant. The Department of Trade and Industry may assist in consumer complaints, especially where the seller is identifiable and engaged in trade or business.

However, purely criminal scams, fake identities, and syndicate-style fraud usually require police and prosecutorial action.

G. Securities Regulation and Investment Laws

Investment scams, Ponzi schemes, fake trading platforms, unauthorized solicitation of investments, and fraudulent crypto or forex schemes may involve violations of securities laws. The Securities and Exchange Commission may issue advisories, investigate, and refer matters for criminal prosecution.

A common warning sign is a person or entity offering guaranteed high returns, referral bonuses, “risk-free” investments, or trading profits without proper registration or authority.

H. SIM Registration Law

Fraud committed using mobile numbers may implicate SIM registration rules, especially when false identities, mule SIMs, or registered numbers are used to facilitate scams. While SIM registration does not automatically identify the scammer in every case, it may assist law enforcement in tracing suspects through proper legal processes.

IV. Common Forms of Online Fraud in the Philippines

A. Online Selling Scams

This is one of the most common types of online fraud. The offender posts an item for sale, receives payment through bank transfer, e-wallet, remittance, or cash-in, then fails to deliver the item.

Not every failed online sale is automatically criminal. A criminal case is stronger when there is evidence that the seller had fraudulent intent from the beginning, such as:

Using fake names or fake accounts;
Posting stolen photos;
Giving inconsistent addresses;
Blocking the buyer after payment;
Repeatedly scamming multiple buyers;
Using mule accounts;
Refusing refund while inventing false excuses;
Offering items at suspiciously low prices;
Using fake courier receipts or fake tracking numbers.

B. Phishing and Smishing

Phishing occurs when a victim is deceived into giving passwords, OTPs, card details, or account credentials through fake websites, emails, messages, or links. Smishing is phishing through SMS.

Common examples include fake bank alerts, fake e-wallet verification links, fake delivery notices, fake government aid registration, fake job applications, and fake account recovery pages.

Possible crimes include computer-related fraud, identity theft, illegal access, and access device fraud.

C. E-Wallet and Online Banking Fraud

Victims may lose money through unauthorized transfers, account takeover, fake customer service accounts, fake QR codes, OTP scams, or social engineering.

The liability of the offender is criminal. Separately, the bank, e-wallet provider, or financial institution may have duties under regulations, internal dispute processes, and consumer protection frameworks. Victims should report immediately because time is critical for freezing accounts or tracing funds.

D. Investment Scams

Investment scams promise high returns with little or no risk. They may be presented as crypto trading, forex trading, online franchises, lending pools, casino investment groups, AI trading bots, “tasking” platforms, or networking schemes.

Possible violations include estafa, syndicated estafa, securities violations, cybercrime offenses, and money laundering-related offenses where proceeds are moved through multiple accounts.

E. Romance Scams

A scammer builds a relationship online and later asks for money due to alleged emergencies, medical needs, business problems, travel expenses, customs fees, or inheritance release fees.

Romance scams often involve fake identities and may include identity theft, estafa, and cybercrime-related offenses.

F. Job and Task Scams

Victims are offered online jobs, part-time tasks, product ratings, app reviews, or “commission-based” work. They are later asked to deposit money to unlock commissions or withdraw earnings.

These scams may qualify as estafa, computer-related fraud, or investment-type fraud depending on the scheme.

G. Marketplace and Delivery Scams

Fraud may occur through fake payment confirmations, fake delivery riders, fake parcel notices, fake COD refunds, or buyer scams where the victim-seller is tricked into releasing goods without valid payment.

Both buyers and sellers may be victims.

H. Identity Theft and Impersonation

A person may create fake social media accounts using another person’s name, photos, business identity, or credentials to solicit money or deceive others. This may constitute computer-related identity theft and other offenses depending on the acts committed.

V. Estafa in Online Fraud Cases

A. Nature of Estafa

Estafa is a crime involving deceit, abuse of confidence, or fraudulent means causing damage to another. In online fraud, the usual theory is estafa by deceit.

The prosecution generally needs to show:

The offender made a false representation or used deceit;
The deceit was made before or at the time of the transaction;
The victim relied on the deceit;
The victim parted with money, property, goods, or rights;
The victim suffered damage.

B. Importance of Fraudulent Intent

A mere failure to pay, refund, or deliver does not always constitute estafa. Philippine criminal law distinguishes between civil breach of contract and criminal fraud.

A case is more likely criminal when the offender never intended to comply from the start. Evidence of this intent may be inferred from conduct, including false identity, fake documents, immediate blocking, repeated similar scams, or disappearance after payment.

C. Online Transactions as Evidence of Deceit

Chats, payment receipts, screenshots, posts, order confirmations, email exchanges, bank deposit slips, e-wallet transaction records, and courier documents may help establish the fraudulent transaction.

The stronger the timeline, the stronger the case: representation, reliance, payment, failure, excuses, disappearance, and damage should be documented clearly.

VI. Computer-Related Fraud

Computer-related fraud under cybercrime law generally involves unauthorized input, alteration, deletion, or suppression of computer data, or interference in the functioning of a computer system, causing damage with fraudulent intent.

This may apply when the fraud involves manipulation of digital systems, unauthorized transfers, fake electronic records, fraudulent account activity, or use of computer data to cause financial loss.

Examples include:

Manipulating an account to transfer funds;
Using stolen credentials to move money;
Creating fake online payment confirmations;
Interfering with computer data to deceive a victim;
Using compromised accounts to solicit money;
Altering digital transaction records.

Computer-related fraud is particularly important when the fraudulent act is not simply a false promise but involves misuse of digital systems.

VII. Computer-Related Identity Theft

Computer-related identity theft involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person through ICT.

In online fraud cases, this may apply where a scammer:

Uses another person’s name or photo;
Pretends to be a legitimate seller, bank officer, government employee, employer, or company representative;
Uses stolen personal data to open accounts;
Creates fake social media accounts;
Uses another person’s identification documents;
Takes over an account and pretends to be the owner;
Uses a business name or logo to deceive customers.

Identity theft may be charged separately from estafa or computer-related fraud if the facts support it.

VIII. Unauthorized Access and Account Takeover

If the offender gains access to an email account, social media account, bank account, e-wallet, or device without permission, illegal access may be involved.

Examples include:

Hacking a Facebook account and asking the victim’s friends for money;
Accessing an e-wallet using stolen OTPs;
Logging into an email account to reset financial passwords;
Taking over a marketplace account to scam buyers;
Using malware or phishing links to capture credentials.

The victim should immediately secure accounts, change passwords, revoke sessions, enable two-factor authentication, notify financial institutions, and preserve evidence before deleting anything.

IX. Online Fraud and the One-Degree-Higher Penalty Rule

A significant feature of Philippine cybercrime law is that crimes defined and penalized by the Revised Penal Code, when committed by, through, and with the use of information and communications technologies, may be covered by cybercrime law and punished more severely.

This means that estafa committed through online platforms may be treated more seriously than ordinary offline estafa, depending on the charge and circumstances.

The prosecution may charge ordinary estafa, cyber-related estafa, computer-related fraud, identity theft, or a combination, depending on the facts.

X. Where to File an Online Fraud Complaint

Victims may file reports or complaints with several agencies, depending on the nature of the case.

A. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group handles cybercrime complaints, including online scams, hacking, identity theft, phishing, and online fraud.

Victims may approach the nearest cybercrime unit or police station. The case may be referred to the proper cybercrime office if technical investigation is needed.

B. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division also investigates online fraud, hacking, phishing, impersonation, and other cybercrime complaints.

The NBI may be especially useful when the case involves complex digital evidence, multiple victims, syndicates, or cross-border elements.

C. Office of the City or Provincial Prosecutor

A criminal complaint may be filed with the prosecutor’s office for preliminary investigation. In many cases, victims first secure police or NBI assistance, but a complaint-affidavit may also be filed directly with the prosecutor if the offender is identifiable and the evidence is ready.

D. Barangay

Barangay conciliation is generally required for certain disputes between individuals who live in the same city or municipality and where the offense is not too serious. However, many online fraud cases are not suitable for barangay conciliation, especially where:

The offender is unknown;
The parties live in different cities or municipalities;
The offense carries a penalty beyond the barangay conciliation threshold;
The case involves cybercrime;
The case requires urgent law enforcement action;
The fraud involves multiple victims or organized activity.

E. Department of Trade and Industry

The DTI may assist in consumer complaints involving online sellers, misleading advertisements, defective goods, or unfair sales practices. However, DTI processes are generally administrative or mediation-oriented and do not replace criminal prosecution.

F. Securities and Exchange Commission

For investment scams, unauthorized investment solicitation, Ponzi schemes, fake trading groups, and unregistered securities offerings, the SEC may investigate, issue advisories, and refer cases for prosecution.

G. National Privacy Commission

If the case involves misuse, unauthorized disclosure, or unlawful processing of personal data, the NPC may be relevant. This is especially true for data breaches, identity misuse, unauthorized personal data collection, and negligent handling of personal information by organizations.

H. Banks, E-Wallet Providers, and Financial Institutions

Victims should immediately report unauthorized transfers or scam payments to the bank, e-wallet provider, payment processor, or remittance center. This is important for possible account freezing, transaction tracing, internal investigation, and dispute handling.

However, reporting to the financial institution does not automatically file a criminal case. A separate complaint with law enforcement or the prosecutor is usually necessary.

XI. What Evidence Should a Victim Preserve?

Evidence is the backbone of an online fraud complaint. Victims should preserve evidence before the scammer deletes accounts, changes usernames, or blocks access.

Important evidence includes:

Screenshots of conversations showing the offer, representation, agreement, payment instructions, excuses, and refusal to refund;
Full chat logs, preferably exported where possible;
Profile links and usernames of the scammer;
URLs of posts, pages, listings, websites, or advertisements;
Screenshots of the account profile, including photos, names, contact details, and account creation indicators if visible;
Payment receipts, bank transfer confirmations, e-wallet receipts, remittance slips, and reference numbers;
Account numbers, mobile numbers, QR codes, wallet names, bank names, and recipient names used;
Emails, including full headers if phishing is involved;
SMS messages, including sender numbers and timestamps;
Call logs and recordings, if legally obtained;
Fake documents, fake IDs, fake invoices, fake delivery receipts, or fake tracking numbers;
Courier details, if used;
Proof of ownership or identity, if impersonation is involved;
Proof of damage, including amount lost and related expenses;
Witness statements, especially from other victims.

Victims should avoid editing screenshots in ways that may raise doubts. It is better to keep original files, original devices, and unaltered metadata where possible.

XII. The Complaint-Affidavit

A criminal complaint usually requires a complaint-affidavit. This is the victim’s sworn statement narrating the facts.

A good complaint-affidavit should include:

The complainant’s full name, address, and contact details;
The respondent’s known name, alias, username, phone number, email, bank account, e-wallet account, or other identifying details;
A chronological narration of events;
The specific false representations made;
The reason the complainant relied on those representations;
The amount paid or property lost;
The date, time, and method of payment;
What happened after payment;
The respondent’s refusal, disappearance, blocking, or further deception;
A list of attached evidence;
A statement that the complainant is executing the affidavit to file criminal charges.

The affidavit should be clear, factual, and organized. Emotional language is less useful than precise dates, names, amounts, transaction numbers, and screenshots.

XIII. Sample Structure of a Complaint-Affidavit

A basic structure may look like this:

Republic of the Philippines City/Municipality of ________

Complaint-Affidavit

I, [name], of legal age, Filipino, residing at [address], after being duly sworn, state:

I am filing this complaint against [name/alias/username], who represented himself/herself as [identity used], for online fraud, estafa, and other applicable cybercrime offenses.
On [date], I saw a post/listing/message on [platform] offering [item/service/investment].
The respondent represented that [specific false statement].
Relying on this representation, I sent the amount of PHP [amount] through [bank/e-wallet/remittance] to [account name/account number/mobile number] on [date and time].
After receiving payment, respondent [failed to deliver/blocked me/gave false tracking numbers/refused refund/disappeared].
I later discovered that [facts showing fraud, such as fake identity, repeated victims, stolen photos, fake receipts].
Attached are copies of screenshots, payment receipts, profile links, and other evidence.
I suffered damage in the amount of PHP [amount].
I am executing this affidavit to support the filing of criminal charges for estafa, cybercrime, identity theft, computer-related fraud, and other offenses that may be warranted.

Affiant further sayeth naught.

This is only a structural example. Actual affidavits should be tailored to the facts and evidence.

XIV. Identifying the Offender

A major difficulty in online fraud cases is identifying the real person behind an account. Scammers often use fake names, dummy accounts, mule bank accounts, prepaid SIMs, stolen IDs, or compromised profiles.

Investigators may trace suspects through:

Bank or e-wallet account records;
SIM registration information;
IP logs, where legally obtainable;
Platform records;
Device or account access logs;
CCTV from cash-out or remittance locations;
Courier records;
Linked accounts and reused contact details;
Other victims’ reports;
Financial transaction trails.

Private individuals usually cannot compel platforms, banks, or telcos to disclose confidential records on their own. Law enforcement, prosecutors, courts, or authorized agencies may need to issue proper requests, subpoenas, warrants, or preservation orders depending on the information sought.

XV. Preservation of Computer Data

In cybercrime cases, preserving digital evidence is crucial. Relevant computer data can disappear quickly. Accounts may be deleted, logs may expire, and scammers may change usernames.

Cybercrime law provides mechanisms for preservation of computer data. Law enforcement authorities may require service providers to preserve traffic data, subscriber information, or content data under proper legal procedures.

Victims should report quickly and provide exact links, usernames, dates, transaction numbers, and platform details to help investigators act before data is lost.

XVI. Can a Victim Get the Money Back?

A criminal case primarily seeks punishment of the offender. However, restitution or civil liability may also be pursued in connection with the criminal action.

Possible recovery routes include:

Refund or settlement, if the offender is identified and willing to pay;
Civil liability in the criminal case, if conviction or settlement occurs;
Civil action for collection or damages, where appropriate;
Bank or e-wallet reversal, if the transaction can still be stopped or frozen;
Asset freezing or tracing, in more serious cases involving proceeds of crime;
Restitution orders, depending on case outcome.

In practice, recovery is often difficult if money has been immediately withdrawn, transferred through mule accounts, converted to crypto, or moved abroad. This is why immediate reporting is important.

XVII. Criminal Case vs. Civil Case

Online fraud can give rise to both criminal and civil liability. The distinction matters.

A criminal case punishes the offender for a public wrong. It requires proof beyond reasonable doubt at trial.

A civil case seeks recovery of money, damages, or enforcement of obligations. It generally requires preponderance of evidence.

Some cases are truly civil disputes, such as delayed delivery, poor service, or nonpayment arising from a legitimate transaction. Others are criminal because deceit existed from the beginning.

The same transaction may involve both: the offender may be prosecuted criminally and also ordered to pay civil liability.

XVIII. When Is Non-Delivery a Crime?

Non-delivery becomes more likely criminal when the seller never intended to deliver. Indicators include:

The seller used a fake identity;
The seller used stolen product photos;
The seller gave a fake address;
The seller blocked the buyer after payment;
The seller gave a fake tracking number;
The seller repeated the same conduct against multiple buyers;
The seller used different names and accounts;
The seller immediately withdrew or transferred funds;
The seller made false claims before payment;
The seller never had the item in the first place.

On the other hand, a mere delay, supplier problem, logistics issue, or inability to perform may not automatically be estafa unless fraudulent intent is shown.

XIX. Jurisdiction and Venue

Online fraud may involve different places: the victim’s location, the offender’s location, the bank or e-wallet location, the place where the fraudulent representation was received, and the place where damage occurred.

Venue can be complex in cybercrime cases because the offense may be committed through electronic systems across multiple locations. In practice, victims often file complaints where they reside, where they suffered damage, or where the law enforcement cybercrime office accepts the complaint.

For court purposes, venue and jurisdiction must comply with procedural rules. Prosecutors and courts determine the proper venue based on the facts and applicable law.

XX. Prescription of Offenses

Criminal offenses must be filed within the prescriptive period set by law. The period depends on the offense and penalty. More serious offenses usually have longer prescriptive periods.

Victims should not delay. Even where the prescriptive period is long, delay can weaken evidence, make tracing harder, and allow scammers to disappear.

XXI. Role of Social Media Platforms and Online Marketplaces

Social media platforms and marketplaces may help by removing fraudulent content, suspending accounts, preserving data, or responding to lawful requests from authorities.

Victims should report fraudulent profiles, posts, pages, or listings through platform reporting tools, but this should not replace preserving evidence. Once a post or account is removed, the victim may lose access to useful proof.

Before reporting a scam account for takedown, victims should save:

Profile URL;
Username;
Display name;
Screenshots of posts;
Chat history;
Payment instructions;
Photos used;
Comments from other victims;
Time and date of access.

XXII. Role of Banks and E-Wallet Providers

Banks and e-wallet providers can be critical because many scams depend on financial trails. Victims should immediately report the fraud and provide transaction details.

The report should include:

Sender account name and number;
Recipient account name and number;
Date and time of transfer;
Amount;
Reference number;
Screenshots of the fraudulent transaction;
Police report or complaint reference, if available.

The victim may request that the institution investigate, freeze suspicious funds if still available, or coordinate with law enforcement. Whether funds can be recovered depends on timing, internal procedures, and legal authority.

XXIII. Money Mules

Many scammers use money mules. A money mule is a person whose bank account, e-wallet, SIM, or identity is used to receive or move scam proceeds.

A mule may be:

A willing participant;
A person paid to open accounts;
A person deceived into receiving money;
A victim of identity theft;
A person whose account was taken over.

Money mules may face criminal liability if they knowingly assist in receiving, withdrawing, transferring, or laundering scam proceeds. Even claiming “I only lent my account” may not be a complete defense if knowledge or participation is proven.

XXIV. Syndicated Estafa and Large-Scale Fraud

Some online fraud schemes involve organized groups, multiple victims, large amounts, or systematic solicitation. These may trigger more serious charges, including syndicated estafa or economic sabotage-type allegations depending on the facts and applicable law.

Investment scams, fake lending platforms, online task scams, and large marketplace scam networks may involve multiple offenders and a broader criminal enterprise.

Victims should coordinate with other victims where possible, because multiple complaints may help show pattern, intent, conspiracy, and scale.

XXV. Cyber Libel Risks When Posting About Scammers

Victims often want to post warnings online. While warning others may be understandable, victims should be careful because public accusations can lead to cyber libel complaints if false, excessive, or unsupported.

Safer practices include:

Stick to verifiable facts;
Avoid insults and threats;
Do not publish private personal information unnecessarily;
Avoid accusing someone unless evidence is strong;
Say “I filed a complaint” rather than declaring guilt;
Blur sensitive information of third parties;
Preserve evidence privately for authorities.

Truth may be a defense in defamation-related cases, but litigation risk remains. A victim should prioritize formal reporting over social media retaliation.

XXVI. Data Privacy Concerns When Sharing Evidence

Victims should also be mindful of data privacy. Posting IDs, phone numbers, addresses, bank account details, or private conversations online may create separate legal risks.

Evidence should be submitted to law enforcement, prosecutors, courts, banks, platforms, or proper agencies. Public disclosure should be limited and responsible.

XXVII. Online Fraud Involving Minors

If minors are involved, additional protections and procedures apply. Cases may involve child protection laws, online sexual abuse or exploitation concerns, identity misuse, or special rules on handling minors as victims, witnesses, or offenders.

Where a minor is a victim, parents or guardians should report promptly and avoid public posting of the child’s identity or private information.

XXVIII. Cross-Border Online Fraud

Many online scams are operated from outside the Philippines or involve foreign victims, foreign platforms, offshore servers, or international financial accounts.

Cross-border cases are harder because investigation may require cooperation with foreign platforms, law enforcement agencies, financial institutions, and regulators. Still, Philippine authorities may investigate if Filipino victims are affected or if parts of the offense occurred in the Philippines.

Victims should provide as much identifying information as possible, including URLs, email headers, crypto wallet addresses, transaction hashes, foreign phone numbers, and platform usernames.

XXIX. Crypto-Related Online Fraud

Crypto scams may include fake exchanges, fake wallet support, investment pools, pump-and-dump groups, impersonated traders, fake airdrops, seed phrase phishing, and romance-investment scams.

Important evidence includes:

Wallet addresses;
Transaction hashes;
Exchange account details;
Chat logs;
Website URLs;
Screenshots of dashboards;
Deposit instructions;
Smart contract addresses, if applicable.

Crypto transactions are often irreversible. However, blockchain records may help trace movement of funds, especially when funds pass through regulated exchanges.

XXX. Administrative Remedies vs. Criminal Remedies

Victims often ask whether they should file with DTI, SEC, NPC, BSP-supervised institutions, PNP, NBI, or the prosecutor. The answer depends on the goal.

Administrative remedies may help with:

Consumer mediation;
Regulatory violations;
Data privacy complaints;
Financial institution complaints;
SEC enforcement;
Platform or business accountability.

Criminal remedies aim to:

Identify the offender;
Investigate the crime;
File charges;
Prosecute;
Punish;
Establish criminal and civil liability.

In many cases, both tracks may be pursued.

XXXI. Practical Steps for Victims

A victim of online fraud in the Philippines should generally do the following:

Step 1: Preserve Evidence

Take screenshots, export chats, save receipts, copy links, record usernames, and keep original files. Do not delete conversations.

Step 2: Secure Accounts

Change passwords, enable two-factor authentication, log out unknown sessions, secure email accounts, freeze cards, and notify banks or e-wallet providers.

Step 3: Report to Financial Institutions

Immediately report the transaction to the bank, e-wallet, remittance center, or payment provider. Ask for investigation and possible freezing or reversal if still possible.

Step 4: Report to Platform

Report the fraudulent account, page, listing, or website to the platform, but only after preserving evidence.

Step 5: File with Law Enforcement

Approach the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or local police cybercrime desk. Bring printed and digital copies of evidence.

Step 6: Prepare a Complaint-Affidavit

Organize the facts chronologically and attach evidence. Identify possible respondents by name, alias, account number, phone number, username, or email.

Step 7: File with Prosecutor, if Appropriate

The complaint may proceed to preliminary investigation if the offender is identified and the evidence supports criminal charges.

Step 8: Coordinate with Other Victims

For repeated scams, multiple victims can strengthen evidence of fraudulent intent and pattern.

XXXII. Common Defenses Raised by Accused Persons

An accused person in online fraud cases may argue:

There was no deceit;
The case is merely civil;
The accused intended to deliver or refund;
The account was hacked;
Someone else used the bank or e-wallet account;
The accused was only a money mule and did not know the scam;
The screenshots were fabricated;
The complainant sent money voluntarily;
The identity of the offender was not proven;
The prosecution failed to prove guilt beyond reasonable doubt.

Because of these defenses, evidence should establish not only payment and non-delivery, but also deceit, identity, intent, and damage.

XXXIII. Strengthening the Case

A strong online fraud complaint usually has:

Clear proof of the fraudulent representation;
Clear proof that the victim relied on it;
Clear proof of payment;
Clear proof of damage;
Clear link between the online account and the respondent;
Evidence of false identity or fake claims;
Evidence of blocking, disappearance, or refusal to refund;
Evidence of repeated similar conduct;
Certified or verifiable financial records;
Properly preserved digital evidence.

The weakest cases are those where the victim has only a name, no screenshots, no payment proof, no account details, and no way to identify the offender.

XXXIV. Screenshots as Evidence

Screenshots may be accepted as evidence, but they are stronger when supported by:

Original device access;
Exported chat records;
URLs and timestamps;
Payment records from banks or e-wallets;
Affidavits explaining how screenshots were obtained;
Platform records obtained through legal process;
Corroborating witnesses.

Screenshots should not be cropped in a misleading way. The full conversation is often better than selected portions.

XXXV. Electronic Evidence in Court

Philippine rules recognize electronic evidence. Electronic documents, emails, digital photographs, chat logs, and transaction records may be admitted if properly authenticated.

Authentication may involve testimony from the person who captured or received the electronic communication, metadata, system records, certifications, or other proof showing that the evidence is what it claims to be.

The opposing party may challenge authenticity, completeness, or integrity. This is why original files, devices, full message threads, and official transaction records are important.

XXXVI. Settlement in Online Fraud Cases

Some online fraud cases are settled when the offender refunds the money. However, settlement does not automatically erase criminal liability, especially for public offenses. It may affect the complainant’s willingness to pursue the case, civil liability, or prosecutorial assessment, but the legal effect depends on the offense and stage of proceedings.

Victims should be careful with settlement terms. A written acknowledgment of debt, undertaking to refund, or admission may be useful, but victims should avoid signing documents that waive rights without understanding the consequences.

XXXVII. Demand Letters

A demand letter may be useful in some cases, especially where the respondent is known. It may show that the victim sought return of money and that the respondent refused or failed to comply.

However, in cases involving fake identities, account takeover, phishing, or disappearing scammers, a demand letter may be impractical. Immediate reporting is usually more important.

A demand letter should state:

The facts of the transaction;
The amount paid;
The obligation to deliver or refund;
The deadline for compliance;
The intention to pursue legal remedies if ignored.

XXXVIII. Special Issues in Online Selling Platforms

Where fraud occurs on platforms such as Facebook Marketplace, Shopee, Lazada, Carousell, TikTok Shop, Instagram, or independent websites, the platform’s terms and dispute mechanisms may matter.

Victims should check whether the transaction was protected by platform escrow, buyer protection, return/refund policies, or official checkout systems. Transactions moved outside the platform are riskier and harder to recover.

A common scam tactic is to persuade buyers to transact outside the platform to avoid fees, then disappear after receiving direct payment.

XXXIX. Preventive Measures

Online fraud prevention is not a criminal remedy, but it is legally important because many scams succeed through avoidable risk.

Practical precautions include:

Verify seller identity;
Avoid sending full payment to unknown sellers;
Use platform-protected payment systems;
Avoid clicking suspicious links;
Never share OTPs;
Verify bank and e-wallet account names;
Check SEC registration for investment offers;
Be suspicious of guaranteed returns;
Avoid urgent pressure tactics;
Use strong passwords and two-factor authentication;
Confirm requests for money through another channel;
Do not lend bank accounts, e-wallets, SIMs, or IDs.

XL. Liability of Persons Who Lend Accounts or SIMs

A person who allows another to use his or her bank account, e-wallet, SIM card, ID, or online account may be exposed to investigation. Even if that person claims not to be the mastermind, the account holder may become a respondent if funds were received or moved through the account.

The key issue is knowledge and participation. If the person knowingly assisted the fraud, criminal liability may arise. If the person was deceived or hacked, evidence must support that defense.

XLI. Online Fraud by Corporations or Registered Businesses

If the fraud involves a registered business, corporation, partnership, or sole proprietorship, complaints may include both individual officers and the entity where warranted.

Corporate registration does not legalize fraudulent activity. Officers, directors, agents, or employees who personally participated in fraud may be held liable.

For consumer or investment matters, DTI or SEC records may help identify responsible persons.

XLII. Remedies for Businesses Victimized by Online Fraud

Businesses may be victims of online fraud through fake suppliers, fake purchase orders, invoice redirection, business email compromise, unauthorized access, fake customer payments, and chargeback fraud.

Business victims should preserve:

Email headers;
Invoice trails;
supplier communications;
access logs;
bank instructions;
internal approvals;
CCTV or delivery records;
employee reports;
cybersecurity incident records.

Business email compromise cases may involve cybercrime, estafa, falsification, access device violations, and data privacy issues.

XLIII. Online Fraud and Money Laundering

Large-scale fraud may generate proceeds that are transferred through multiple accounts, converted to crypto, or withdrawn through intermediaries. In serious cases, anti-money laundering rules may become relevant.

Financial institutions may file suspicious transaction reports where required. Law enforcement may coordinate with appropriate agencies to trace and freeze proceeds under proper legal processes.

For ordinary victims, the practical step is still immediate reporting to the bank or e-wallet provider and law enforcement.

XLIV. Remedies When the Offender Is Unknown

A victim may still report the case even if the offender’s real name is unknown. The complaint may initially identify the respondent by alias, username, phone number, email, bank account, e-wallet account, or other identifiers.

The purpose of investigation is often to uncover the person behind those identifiers. Victims should provide all possible leads.

A complaint against an unknown person may later be amended or supplemented once the offender is identified.

XLV. Importance of Multiple Complaints

Scammers often victimize many people. A single complaint may look like an isolated transaction, but multiple complaints can show a fraudulent pattern.

Multiple victims can help prove:

Common scheme;
Repeated false representations;
Use of the same payment accounts;
Use of the same fake identity;
Intent to defraud from the start;
Organized activity;
Larger damages.

Victims may coordinate, but each victim should still preserve individual proof of payment and communication.

XLVI. The Role of Prosecutors

The prosecutor evaluates whether there is probable cause to charge the respondent in court. The prosecutor is not deciding guilt beyond reasonable doubt at the preliminary investigation stage. The issue is whether the evidence is sufficient to believe that a crime was committed and that the respondent is probably guilty.

The respondent may file a counter-affidavit. The complainant may file a reply-affidavit. The prosecutor may dismiss the complaint or file an information in court.

XLVII. The Role of Courts

If the case reaches court, the prosecution must prove guilt beyond reasonable doubt. The complainant may testify and identify the evidence. Digital evidence must be authenticated. Financial records may require proper presentation. Law enforcement officers, bank representatives, or platform custodians may be called depending on the case.

A conviction may result in imprisonment, fines, civil liability, or other consequences depending on the offense.

XLVIII. Limitations and Realities of Enforcement

Online fraud cases face practical challenges:

Fake identities;
Foreign-based offenders;
Fast movement of funds;
Use of mule accounts;
Deleted accounts;
Uncooperative platforms;
Limited digital evidence;
Delayed reporting;
Difficulty proving intent;
Difficulty linking the account to the real person.

These challenges do not mean the case is hopeless. They mean that prompt action and careful evidence preservation are essential.

XLIX. Checklist for Victims

A victim preparing to file a complaint should gather:

Full name of complainant;
Valid ID of complainant;
Chronology of events;
Screenshots of posts, profiles, chats, and payment instructions;
URLs and usernames;
Phone numbers and email addresses used;
Bank or e-wallet account details of recipient;
Transaction receipts and reference numbers;
Proof of amount lost;
Demand messages, if any;
Proof of blocking or disappearance;
Names of other victims, if known;
Draft complaint-affidavit;
Digital copies in USB or cloud storage;
Printed copies, if required by the receiving office.

L. Key Legal Takeaways

Online fraud in the Philippines may be prosecuted through traditional criminal laws and cybercrime laws. The most common charge is estafa, but cybercrime offenses such as computer-related fraud, identity theft, illegal access, and access device violations may also apply.

The success of a complaint depends heavily on evidence. Victims should preserve digital records, report quickly, secure financial accounts, and file with the proper authorities.

Not every failed online transaction is criminal. The crucial issue is whether there was deceit or fraudulent intent at the start. Where the offender used fake identities, false representations, mule accounts, phishing links, unauthorized access, or repeated scam patterns, criminal remedies become stronger.

Online fraud is legally actionable, but it is also technically complex. The best approach is prompt preservation of evidence, immediate reporting to financial institutions, filing with cybercrime authorities, and preparation of a clear, well-supported complaint-affidavit.