Evidence Preservation, Reporting Channels, and Case-Filing Steps (Practical Legal Guide)

For general information only; not legal advice.

1) What counts as an “online scam” in Philippine law?

“Online scam” isn’t a single crime label in statutes. In practice, it refers to fraud and deception carried out through the internet, mobile apps, social media, e-wallets, or electronic messages—often prosecuted as:

Estafa (Swindling) under the Revised Penal Code (RPC), Article 315 (most common for fake sellers, investment scams, and similar schemes).
Computer-Related Fraud (and related cybercrime offenses) under Republic Act (RA) 10175 (Cybercrime Prevention Act) when the scam is executed through information and communications technology (ICT).
Other related crimes depending on the facts (identity theft, unauthorized access, theft, falsification, etc.).

Key idea: The platform (Facebook, Messenger, Telegram, online marketplace, e-wallet) is usually the means. The crime is defined by the deceit + harm and the specific acts.

2) Estafa basics (RPC Article 315): when does an online scam become “estafa”?

A. Core elements prosecutors look for

While Article 315 has several forms, most “online selling” and “investment” scams fall under estafa by false pretenses/fraudulent acts. In simplified terms, prosecutors typically look for:

Deceit or fraudulent representation (e.g., pretending to sell a real product, impersonating a legitimate business, guaranteeing impossible returns, using fake proofs).
The victim relied on that deceit (it influenced the decision to pay, send money, or hand over property).
The victim suffered damage/prejudice (loss of money/property, or being deprived of it).

B. Common online-scam patterns prosecuted as estafa

Fake seller / “paid but not delivered” (seller disappears; fake tracking; bogus courier).
“Reservation fee” / “processing fee” traps (continuous fee requests; no product/service).
Investment/crypto “guaranteed returns” with fabricated profits, withdrawal blocks, and pressure to “top up.”
Impersonation scams (posing as a brand, influencer, logistics company, bank representative).
Romance/scam + money requests (emergency stories; travel fees; medical expenses).

C. Estafa vs. “breach of contract” (why it matters)

Not every failed online transaction is automatically estafa. A mere failure to deliver can sometimes be treated as a civil dispute (collection/refund) if there was no initial deceit. What pushes it into estafa is proof that deception existed at the start (or that fraudulent acts were used to obtain the money).

Practical clue: Evidence that the “seller” used fake identity, fake address, fake receipts, repeated victimization, scripted lies, or never intended delivery supports estafa.

3) Cybercrime angle: how RA 10175 changes the case

A. Why RA 10175 matters

Online scams often qualify for cybercrime handling because they use ICT. This affects:

Where to report (specialized units like PNP Anti-Cybercrime Group/NBI Cybercrime).
Evidence needs (digital trail, device/account identifiers).
Penalties (there are situations where penalties may be increased when crimes are committed through ICT).

B. Related cybercrime offenses that may apply

Depending on the method, authorities may evaluate:

Computer-Related Fraud (when ICT is used to manipulate or misuse systems/data to cause loss).
Identity-related offenses (e.g., misuse of identifiers, impersonation).
Unauthorized access / illegal access (if accounts were hacked).
Phishing/credential harvesting-type conduct (often paired with other offenses).
Online libel or threats may appear in scam contexts (e.g., blackmail), but these require careful fact-matching.

Important: You don’t need to perfectly label the crime when reporting. Your job is to present facts and evidence; investigators/prosecutors determine appropriate charges.

4) Time is evidence: what to do in the first 24–72 hours

Step 1: Stop further loss

Stop sending money (including “verification fees,” “release fees,” “tax fees,” “upgrade fees”).
If you shared OTPs/passwords: change passwords immediately, enable 2FA, and secure email accounts first (email is often the recovery channel).

Step 2: Contact the payment channel fast (bank/e-wallet/remittance)

Provide:

Transaction reference number
Date/time
Amount
Recipient account name/number
Screenshots of transfer confirmation

Request:

Account tagging (mark as suspected fraud)
Hold/reversal options (if any are still possible)
Trace request or documentation you can use for a complaint

Outcome varies: many transfers are effectively final once credited, but early reporting can still help with account tagging, future prevention, and investigative tracing.

Step 3: Preserve digital evidence (before it disappears)

Scammers delete chats, deactivate accounts, or edit posts. Preserve now:

Screenshots (include URL, account name/handle, timestamps, and the full conversation context)
Screen recordings scrolling through chat threads (shows continuity)
Copies of listings, profiles, posts, comments, IDs used, and payment instructions
Any voice notes, emails, SMS, Viber/Telegram logs

Step 4: Write a timeline while memory is fresh

Create a simple chronology:

When you first saw the offer
What was promised
What was asked (down payment, fee)
What you paid and when
What happened after payment (excuses, threats, blocks)

A clear timeline helps prosecutors quickly see deceit + reliance + damage.

5) Evidence checklist (what makes a case “file-ready”)

A. Identity and account identifiers (the “who”)

Try to capture:

Profile URL, username/handle, display name
Phone numbers used
Email addresses
E-wallet/bank account numbers and account names
Any government ID image sent (even if fake—keep it)
Delivery address or meet-up location proposed
Other linked pages/accounts used (backup accounts)

B. Misrepresentation and inducement (the “deceit”)

Examples:

Screenshots of claims (“legit,” “authorized seller,” “guaranteed returns,” “limited slots,” “processing required”)
Fake receipts/tracking numbers/courier confirmations
Screenshots of vouches/testimonials (often fabricated; still relevant)
Promises about delivery date, refund policy, withdrawal ability (investment scams)

C. Payment and loss (the “damage”)

Bank/e-wallet transfer receipts (transaction ID is crucial)
Deposit slips, remittance receipts
Proof you paid the same person/account the scammer instructed
If partial refunds occurred, keep those too (they can show a pattern of luring victims)

D. Post-payment behavior (often very persuasive)

Being blocked after payment
Repeated fee demands
Threats, harassment, doxxing (if present)
Admissions or contradictions in chat

E. Witness and corroboration

Anyone who saw the transaction happen or heard calls
Other victims (if you can identify them)
Any platform reports or emails from the marketplace verifying account actions

6) Digital evidence rules in the Philippines (why formatting and authenticity matter)

Philippine courts follow the Rules on Electronic Evidence. In practice, this means:

A. You must be able to explain:

How you got the screenshots/files
That they are authentic (true copies of what you saw/received)
That they were not altered

B. Practical best practices to strengthen admissibility

Keep original files (not only forwarded images). Don’t crop away timestamps/handles.
Export chats where the app allows it.
Use screen recording to show continuity (less “selective” than isolated screenshots).
Store copies in at least two places (phone + cloud/drive).
Avoid editing or marking up originals. If you need annotations, create a separate annotated copy.
Document your device details (phone model, number, SIM, app used).

C. “Affidavit of the complainant” is often the bridge

Most cases start with a Complaint-Affidavit attaching printed screenshots/records as annexes. You attest:

You personally witnessed/received the messages
The attachments are true and correct copies
The timeline and payments are accurate

Investigators may later request device extraction or additional verification.

7) Where to report (Philippine channels) and what each one is for

A. PNP Anti-Cybercrime Group (ACG)

Useful for:

Online fraud complaints
Digital trail preservation assistance
Coordination for cyber-related investigations

B. NBI Cybercrime Division

Useful for:

Cases needing more technical investigative support
Coordinated enforcement, identification efforts, and case build-up

C. Local police / cyber desk (if accessible)

Useful for:

Taking an initial blotter report
Assisting with affidavit preparation and referral

D. Platform and payment-provider reporting (non-criminal but important)

Marketplace/social media reporting can help preserve accounts and flag behavior.
Banks/e-wallets can tag accounts and provide transaction certification for case records.

Tip: Reporting to law enforcement and to the payment channel are not mutually exclusive—do both.

8) The criminal case path: from complaint to prosecution to trial

Stage 1: Preparation of the complaint packet

A typical packet includes:

Complaint-Affidavit (narrative + sworn statements)
Attachments/Annexes (screenshots, receipts, IDs, URLs, recordings)
Proof of identity (valid ID copies)
Witness affidavits (if any)
Complainant’s contact details

Stage 2: Filing for preliminary investigation (Prosecutor’s Office)

For estafa and many related offenses, cases commonly go through preliminary investigation:

You file the complaint with the Office of the City/Provincial Prosecutor (or through assistance from law enforcement).
The prosecutor evaluates if there is probable cause.

Stage 3: Respondent is required to answer (counter-affidavit)

The prosecutor issues subpoena to the respondent (if identifiable and reachable).
Respondent submits a Counter-Affidavit and evidence.
You may submit a Reply-Affidavit (depending on procedure).

Stage 4: Prosecutor’s resolution

Possible outcomes:

Dismissal (insufficient evidence / purely civil dispute)
Finding of probable cause → filing of Information in court

Stage 5: Court proceedings

The case is raffled to the proper court (cybercrime-related cases may be handled by designated cybercrime courts).
If warranted, the court may issue a warrant of arrest.
Arraignment, pre-trial, trial, judgment.

Reality check: The biggest practical hurdle is often identifying the real person behind the account, especially if the scammer used mules, fake IDs, or layered accounts. That’s why payment traces and account identifiers matter.

9) Venue and jurisdiction: where to file when it happened online

For crimes, venue is generally tied to where elements of the offense occurred. In online scams, possible anchors include:

Where the victim was located when induced/paid
Where the scammer operated from (if known)
Where payment was sent/received/withdrawn
Where communications were accessed

Because cyber-enabled crimes can involve multiple locations, venue can become technical. A practical approach is to file where:

You (the victim) reside or where you transacted, and
The prosecutor’s office/law enforcement unit can reasonably act on the evidence trail

Authorities can advise on refinements once the facts are reviewed.

10) Civil remedies and refund recovery options (in parallel or separately)

A. Civil action alongside criminal case

In many criminal cases (including estafa), civil liability (restitution/damages) can be pursued. Courts may order restitution if guilt is proven.

B. Pure civil route: refund/collection

If evidence supports a contract dispute more than deceit:

Demand letter (with proof of receipt)
Civil collection case

C. Small claims (where applicable)

For straightforward money claims (refunds/loans), there is a small claims process designed to be faster and simpler than ordinary civil actions, subject to the Supreme Court’s current coverage and limits.

D. Practical recovery barriers

Even with a strong case:

Funds may already be cashed out
Recipient accounts may be under another person’s name (money mule)
Cross-platform or cross-border issues may exist

This is why early bank/e-wallet reporting and law enforcement tracing are crucial.

11) Common scam types and the evidence that best supports each

A. Fake online seller / non-delivery

Best evidence:

Listing + chat negotiation + promise of delivery
Payment instruction message
Transfer receipt (with reference number)
Proof of blocking or refusal to refund
Fake tracking and inconsistencies

B. Investment/crypto “guaranteed returns”

Best evidence:

Recruitment messages and ROI promises
“Dashboard” screenshots + deposit history
Withdrawal denial messages (“upgrade,” “tax,” “verification”)
Proof of multiple top-ups requested
Group chat roles, admin accounts, voice calls

C. Phishing / account takeover

Best evidence:

SMS/email phishing message, fake link
Device/login notifications
Unauthorized transfers history
Change of credentials evidence
Bank/e-wallet incident report and timestamps

D. Romance/emergency scams

Best evidence:

Money requests tied to fabricated emergencies
Proof of identity manipulation (stolen photos, inconsistent details)
Payment proofs and timelines
Any attempts to move off-platform quickly (often a red flag)

12) Drafting the Complaint-Affidavit: practical structure

A clear affidavit often follows this flow:

Personal circumstances Name, age, address, and confirmation you are executing the affidavit.
How you encountered the scammer Platform, date/time, account/profile link.
What was represented Product/service/investment terms and guarantees; attach screenshots.
How you relied on it Why you believed it (documents shown, vouches, urgency tactics).
Payment details Exact amounts, dates/times, transaction IDs, recipient details.
What happened after payment Non-delivery, fee demands, blocking, threats, excuses.
Damage Total loss, consequential harm (if any).
Other victims / pattern (if known) Mention if you discovered similar complaints.
Request for action That charges be filed for the appropriate offenses and that attached evidence be considered.
Annex list Label attachments clearly: Annex “A” (profile), Annex “B” (chat), Annex “C” (receipt), etc.

Style tips:

Use exact dates/times and consistent amounts.
Avoid conclusions like “he is guilty”; focus on facts: “He stated X,” “I paid Y,” “He blocked me.”
Keep screenshots readable and sequential.

13) Mistakes that weaken cases (and how to avoid them)

Not capturing URLs/identifiers A username alone can change; capture profile links and account IDs where possible.
Only sending cropped screenshots Crops can raise authenticity doubts; keep full-screen originals.
Missing transaction reference numbers These are often the strongest objective anchor.
Letting the timeline get messy A prosecutor should be able to understand the case in 5–10 minutes.
Paying “recovery agents” Secondary scams often target victims promising retrieval for a fee.
Posting accusations with personal data Public “expose” posts can create legal risk if they include defamatory statements or doxxing. Evidence submission to authorities is the safer channel.

14) What “success” can look like in practice

Depending on the case quality and identifiability:

Account tagging and prevention (payment channels)
Identification and prosecution (criminal case)
Restitution orders if convicted
Civil settlement in some scenarios
Platform takedown and victim protection measures

The strongest drivers of outcomes are:

Traceable payment trail
Clear proof of deceit
Preserved digital evidence
Identifiable respondent (or a path to identify through lawful processes)

15) Quick reference: “Case Filing Steps” checklist

Secure accounts and stop loss
Report to bank/e-wallet/remittance with transaction details
Preserve evidence (screenshots + screen recording + URLs + receipts)
Write timeline and compute total loss
Prepare Complaint-Affidavit with numbered annexes
Report to PNP ACG / NBI Cybercrime / local police (for documentation and investigative support)
File at Prosecutor’s Office for preliminary investigation (estafa/cyber-related offenses)
Monitor subpoenas and deadlines (counter-affidavit, replies)
Follow the case into court if probable cause is found

16) Key Philippine laws commonly involved (orientation list)

Revised Penal Code, Article 315 (Estafa/Swindling)
RA 10175 (Cybercrime Prevention Act)
Rules on Electronic Evidence (for admissibility and authentication of digital evidence)
Potentially, depending on facts:
- RA 8792 (E-Commerce Act) (electronic transactions framework)
- RA 8484 (Access Devices Regulation Act) (card/access-device fraud contexts)
- RA 10173 (Data Privacy Act) (misuse of personal data; also affects lawful data requests)
- Other RPC provisions (falsification, threats, coercion, theft-related offenses)

17) Bottom-line principles

Build the case around facts, not labels.
Evidence quality beats volume. Clear timeline + traceable payment + preserved identifiers is the winning combination.
Speed matters. Early reporting improves traceability and reduces deletion risk.
Online scams are still “real-world” crimes. The law focuses on deception, reliance, and damage—ICT is simply the tool used.