Online Scam Complaint in the Philippines
A comprehensive legal guide for victims, lawyers, law-enforcement officers, platform operators, and policy makers (updated 24 June 2025)
1. What counts as an “online scam”?
Any fraudulent scheme that (a) is executed or facilitated through an electronic system, computer device, or the internet, and (b) intends to obtain money, property, data, or an act/omission from a victim by deceit, false pretense, or abuse of confidence. Philippine law does not use a single catch-all term; instead, prosecutors charge:
| Modus | Common Charges | Key Statutes |
|---|---|---|
| Non-delivery/“bogus seller” | Estafa (Art. 315 ¶ 2(a) RPC); Sec. 6 RA 10175 (Cyber-estafa) | Revised Penal Code; Cybercrime Prevention Act |
| Investment/Ponzi | Sec. 8 & 26 RA 8799 (Securities Regulation Code); Estafa; Banking laws | SRC; RPC; AMLA |
| Phishing/Account take-over | Illegal Access (Sec. 4 a 1 RA 10175); Identity Theft (Sec. 4 b 3 RA 10175); Data Privacy Act violations | Cybercrime Act; RA 10173 |
| Romance/Love-scam | Estafa; Trafficking in Persons (if sexual exploitation) | RPC; RA 9208 as amended by RA 11862 |
| Business-Email Compromise (BEC) | Swindling; Falsification (Art. 171-172 RPC) | RPC; Cybercrime Act |
| SIM swap, OTP interception | Computer-related Fraud (Sec. 4 b 2 RA 10175); RA 11934 violations | Cybercrime Act; SIM Registration Act |
| Crypto rug-pull | Estafa; Unregistered securities; RA 11765 consumer-protection breaches | RPC; SRC; FPSCPA |
2. Core legal framework
| Law | Scope & Highlights |
|---|---|
| Revised Penal Code (RPC) | Art. 315 (estafa), Art. 318 (other deceits). Penalty is based on the amount swindled; crimes committed “by means of information and communications technology” are aggravated (+1 degree). |
| RA 8792 – E-Commerce Act (2000) | Recognises validity and evidentiary weight of e-documents & e-signatures; empowers DTI to investigate deceptive online sales. |
| RA 10175 – Cybercrime Prevention Act (2012) | Defines computer-related offenses (Sec. 4) and cyber-estafa (§ 6 links to Art. 315). Provides extraterritorial jurisdiction (Sec. 21) when any element, victim, or data is in the PH. |
| RA 7394 – Consumer Act | Misrepresentation, deceptive sales acts, and DTI administrative sanctions up to ₱300,000 + closure of business. |
| RA 10667 – Philippine Competition Act | Covers large-scale online pyramid & chain-distribution schemes. |
| RA 11127 – National Payment Systems Act & BSP Circular 1160 | Mandate e-wallets (e.g., GCash, Maya) to reverse or freeze funds upon law-enforcement request. |
| RA 11765 – Financial Products and Services Consumer Protection Act (FPSCPA, 2022) | Broad, technology-neutral consumer shield; BSP, SEC, IC empowered to impose up to ₱50 million fine & criminal penalties on financial service providers that abet fraud. |
| RA 11934 – SIM Registration Act (2022) | Telcos must deactivate scam SIMs within 24 hours of validated complaint; imposes 6-12 yr imprisonment for fraudulent registrations. |
| Rules on Electronic Evidence (A.M. No. 01-7-01-SC) | Chat logs, emails, social-media posts, blockchain transaction hashes are admissible if authenticated (Sec. 2-3, 11-12). |
3. Where and how to file a complaint
a. Criminal route
| Office | Jurisdiction | How to file |
|---|---|---|
| NBI Cybercrime Division | Nationwide, complex or syndicated cases | Online e-complaint portal → execute Sworn Statement + submit digital evidence; expect subpoena for verification hearing. |
| PNP Anti-Cybercrime Group (ACG) | Immediate police action, arrests in flagrante | Walk-in (Camp Crame or regional CCGUs) or E-Sumbong portal; file Police Incident Report. |
| DOJ Office of Cybercrime / Prosecutor’s Office | Inquest & preliminary investigation | After police complaint, fiscal issues subpoena to respondent; affiant must appear for clarificatory hearing. Venue: where any element occurred or where the complainant resides (Sec. 21 RA 10175). |
| Cybercrime Investigation & Coordinating Center (CICC) | For cross-border, intelligence, takedown requests | Accepts complaints but usually transmits to NBI/PNP; can invoke MLAT/Budapest Convention. |
Prescriptive period:
- Estafa ≤ ₱1.2 M – 12 years;
- Cyber-estafa or those aggravated by ICT – 20 years (Sec. 6 RA 10175 jo. Art. 90 RPC); clock starts on discovery if fraud concealed.
b. Civil & administrative routes
| Remedy | Threshold | Forum |
|---|---|---|
| Small Claims (A.M. 08-8-7-SC, as amended) | ≤ ₱1 million | MTC; no lawyer needed; can cite screenshots as annexes. |
| Regular civil action | > ₱1 million or complex damages | RTC of plaintiff’s residence or where cause arose. |
| DTI E-Commerce Division | deceptive online sales ≤ ₱5 M | File Affidavit-Complaint; DTI may issue Subpoena, order refund, or close e-store. |
| BSP Consumer Assistance | Bank/e-wallet disputes | Submit complaint to bank first → escalate to BSP Consumer Protection Department within 15 days if unresolved. |
| SEC Enforcement | Unregistered investment / crypto offerings | Use SEC FORM OCR-GS online; SEC may impose cease-and-desist & asset freeze, and file criminal case. |
| National Privacy Commission (NPC) | Phishing or identity theft involving personal data | File Complaints-Assisted Investigation; NPC can fine up to ₱5 M per violation. |
4. Evidence checklist (Rule 11 Rules on Electronic Evidence)
- Screenshots / screen recordings: entire conversation thread, transaction receipt, profile page.
- Metadata: URL, timestamp (Philippine Standard Time), sender’s user ID, IP logs if available.
- Payment trail: bank or e-wallet transaction history (CSV or PDF certified by custodian).
- Courier records: airway bill, parcel photos for non-delivery.
- Device forensics: if malware suspected, ask law-enforcement for digital imaging.
- Notarised printouts are optional but certification under Sec. 1 Rule 2 E-Evidence (person who printed or possesses original file) boosts admissibility.
5. Jurisdiction & extraterritorial reach
- Section 21 RA 10175: Philippine courts have jurisdiction if (i) any element of the crime, (ii) the victim, or (iii) a computer system used is in the Philippines.
- For foreign suspects, prosecutors request MLAT assistance (DOJ-OOC is central authority) or Take-Down Orders against websites under Sec. 5 RA 10175 IRR.
- The Philippines acceded to the Budapest Convention on Cybercrime in 2018; mutual legal assistance and expedited preservation of data apply.
6. Penalties & asset recovery
| Offense | Imprisonment | Fine | Ancillary |
|---|---|---|---|
| Cyber-estafa (Sec. 6 RA 10175 jo. Art 315 RPC) | Prision mayor to reclusion temporal (12 y 1 d – 20 y) depending on amount | 3× amount defrauded | Restitution; asset forfeiture (RA 10175 Sec. 5 g) |
| Computer-related fraud (Sec. 4 b 2 RA 10175) | 6 y 1 d – 12 y | up to ₱500 K per act | Confiscation of devices |
| Identity theft | 6 y 1 d – 12 y | ₱200 K–₱500 K | Deportation of aliens |
| SIM Reg Act violations | 6 y – 12 y | ₱200 K–₱300 K | Permanent revocation of telco licence (for repeat corporate offenders) |
Asset freeze / restitution
- AMLA (RA 9160 as amended) authorises the Anti-Money Laundering Council (AMLC) to freeze scam proceeds in 24 hours (ex-parte Freeze Order).
- Victims file Motion to Intervene in forfeiture cases to be recognised as claimants.
- BSP Circular 1108 obliges e-money issuers to reverse “erroneous or unauthorised” transfers within 15 calendar days after complaint + law-enforcement validation.
7. Recent jurisprudence & administrative issuances
| Citation | Gist |
|---|---|
| People v. Go (G.R. 248363, 19 Apr 2022) | Affirmed conviction for cyber-estafa via FB Marketplace; screenshots authenticated by complainant are prima facie admissible. |
| People v. Dizon (G.R. 256342, 26 Jan 2023) | Held that bank e-statements certified by the custodian satisfy Sec. 2 Rule 11 E-Evidence. |
| DTI AO 22-04 (2022) | Uniform Guidelines for Online Sellers: mandatory display of SEC/DTI registration, mobile number, and return/refund policy. |
| BSP Memorandum M-2024-015 | Requires banks/e-wallets to implement near-real-time fraud-monitoring and allow self-service account freezing through their apps. |
| NPC Circular 2024-01 | Defines phishing as an unauthorised processing punishable under Sec. 25 RA 10173; provides mandatory 72 hour breach notification involving ≤ 100 data subjects if online credential harvesting is detected. |
8. Practical step-by-step for victims
Preserve evidence immediately (screenshots, emails, transaction refs).
Secure accounts – change passwords, enable MFA, report compromised cards to bank.
File incident report with PNP-ACG or NBI (online or walk-in). Bring two valid IDs for notarisation of affidavit.
Notify bank/e-wallet in writing within 15 days; request chargeback/freeze citing BSP Circular 1160 Sec. X189.9.
Escalate:
- Non-delivery goods → DTI;
- Investment → SEC Enforcement;
- Data breach → NPC;
- Banking services → BSP.
Monitor case: prosecutors have 60 days to resolve complaints (DOJ Cir. 49-2020), extendible once. Request birth certificate (PSA) if identity of scammer uncertain (needed for subpoena).
Consider civil action for damages, especially emotional distress (Art. 2219 Civil Code) and exemplary damages if scam was grossly fraudulent.
9. Prevention & compliance checklist for businesses and platforms
- Know-Your-Customer (KYC): adhere to BSP Circular 1122 (2024) enhanced due diligence for online merchants.
- Real-time fraud analytics: flag IP-address velocity and device fingerprint anomalies.
- Escrow or COD options: reduce risk of non-delivery complaints.
- Mandatory dispute-resolution desk (RA 11765 Sec. 4).
- Consumer education: publish red flags (too-good-to-be-true ROI, pressure to act quickly, requests to “keep it secret”).
- Compliance officer: designate and register with CICC per CICC MC 2023-01 for critical information infrastructure (CII).
10. Emerging trends (2025 and beyond)
- Generative-AI deep-fake scams: DOJ Bill on “Synthetic Media Fraud” filed May 2025 proposes higher penalties.
- Cross-platform “super-app” fraud: BSP sandbox allows real-time open-banking APIs; increases attack surface—regulators leaning toward shared liability model.
- Cryptocurrency regulation: House Bill 6710 “Digital Assets Act” (pending) classifies rug-pulls as special complex crime with up to 40 years imprisonment.
- Mandatory traceability of online ads: DICT-DTI Joint AO (draft, April 2025) to require ad platforms to verify advertiser identity before publication.
11. Key take-aways
- The Philippines uses existing penal statutes (estafa) enhanced by the Cybercrime Act to prosecute online scams.
- Victims should parallel-track criminal, civil, and administrative remedies for the best chance of recovery.
- Electronic Evidence Rules make well-preserved screenshots and digital logs decisive.
- Regulatory fragmentation means filing with the correct agency (DTI, SEC, BSP, NPC, CICC) is as important as going to the police.
- Recent reforms (SIM Registration, FPSCPA, stronger AMLA freeze powers) give victims faster relief, but speedy evidence preservation remains the single most critical factor.
Stay vigilant, document everything, and act quickly—online fraud moves at the speed of a click, but so can justice when the law is properly leveraged.