1) What counts as an “online scam” for complaint purposes

In practice, “online scam” covers a wide range of schemes where the offender uses the internet, mobile networks, social media, messaging apps, e-wallets, online marketplaces, or email to deceive a victim into sending money, disclosing credentials, or surrendering access to accounts or devices.

Common patterns include:

Non-delivery / fake seller: payment made, item never delivered, seller disappears.
Fake buyer / overpayment / courier scam: victim is tricked into paying “fees,” “insurance,” “verification,” or “release charges.”
Phishing / account takeover: victim enters OTP/passwords on fake links; accounts get hijacked.
Investment / crypto / “double your money”: promises of high returns; withdrawals blocked unless more money is paid.
Love/romance scams: relationship grooming followed by urgent money requests.
Impersonation: pretending to be bank staff, e-wallet support, government office, employer, or a known friend.
Job/placement scams: “training fee,” “medical fee,” “processing fee,” or “reservation fee” demanded upfront.
Loan app harassment and extortion: abusive collection practices and threats using harvested contacts.
Subscription/charge scams: unauthorized transactions after “free trial” bait.

A single incident can trigger multiple offenses (e.g., swindling plus identity theft plus illegal access) depending on evidence.

2) Why the “Cybercrime Unit” matters—and what it actually is

Victims often say “Cybercrime Unit” to mean any of the following enforcement avenues:

PNP Anti-Cybercrime Group (PNP-ACG) – police unit focused on cybercrime.
NBI Cybercrime Division – investigative unit under the NBI.
Local police cyber desks / Women and Children Protection Desk (WCPD) – for related concerns such as online sexual exploitation, harassment, threats; they can help route cases to specialized units.
Prosecutor’s Office (DOJ/City/Provincial Prosecutor) – where the criminal complaint is ultimately evaluated for filing in court.

For most scam victims, the specialized cyber units are used to record the complaint, preserve digital evidence, trace identifiers, and help build a case suitable for prosecution.

3) Key Philippine laws commonly invoked in online scam complaints

An online scam case is frequently anchored on a combination of:

A) Revised Penal Code: Estafa (Swindling)

Many scams are fundamentally deceit-based with damage caused by the victim’s reliance on false pretenses. Estafa is often the backbone charge for:

fake sellers,
bogus services,
fake investments,
impersonation for money.

B) Cybercrime Prevention Act (RA 10175)

This law covers cyber offenses and recognizes “computer-related” crimes and cyber-enabled circumstances. In scam contexts, it commonly supports charges such as:

computer-related fraud (where deceit/fraud is carried out through a computer system),
illegal access (hacking, unauthorized access),
identity theft (use of another’s identity or identifying information),
plus other relevant cyber offenses depending on the act.

It also affects jurisdiction/venue rules, preservation of evidence, and certain investigative tools (handled through legal process).

C) Access Devices Regulation Act (RA 8484)

If the scam involves misuse of credit cards/access devices or card-not-present fraud patterns, RA 8484 may apply alongside or instead of other charges.

D) Electronic Commerce Act (RA 8792)

This supports the legal recognition of electronic data messages and electronic documents and is often cited to reinforce admissibility/recognition of electronic transactions and records.

E) Data Privacy Act (RA 10173) (when applicable)

If a scam involves unauthorized processing of personal data, doxxing, or abusive collection practices (common in some loan app incidents), data privacy violations may come into play (often pursued with the National Privacy Commission, but can also support criminal angles depending on the facts).

F) Other possible offenses

Depending on what happened, complaints can involve:

threats/harassment (online),
libel-related issues (highly fact-specific),
extortion,
falsification (if fake IDs/documents were used),
trafficking/online exploitation offenses (if present).

4) Where to file: which Cybercrime office and what “venue” means

Victims can generally lodge a complaint with:

the PNP-ACG field office (where available),
the NBI Cybercrime Division (or NBI offices with cyber capability),
or the nearest police station for referral.

Venue considerations (where the case may be filed/prosecuted) can be flexible in cyber cases because elements occur across locations:

where the victim was when they were deceived or sent money,
where the suspect was,
where the platform, bank/e-wallet, or device activity is connected.

For practical purposes, victims usually file where they reside or where the transaction occurred, then investigators coordinate as needed.

5) What you should do immediately (time-critical steps)

Online scam cases are evidence-sensitive. Early steps can improve recoverability and traceability:

Stop further transfers and do not negotiate payment demands.
Preserve everything:
- screenshots (but also save originals where possible),
- screen recordings showing profile URLs and chat threads,
- transaction receipts (e-wallet/bank confirmation),
- emails with full headers (if email scam),
- URLs, account IDs, phone numbers, QR codes.
Secure your accounts:
- change passwords, enable MFA,
- revoke device sessions,
- report compromised accounts to the platform.
Notify your bank/e-wallet immediately:
- request hold/trace where available,
- document your reference number/ticket.
Do not “clean up” your device if it’s a hacking incident:
- investigators may need logs, messages, and device artifacts.

6) Evidence checklist (what the Cybercrime Unit will want)

A well-prepared complaint is usually won or lost on evidence quality. Bring both digital copies and printed copies.

A) Your identification and basic documents

Government-issued ID
Proof of your account ownership (SIM registration details if relevant, e-wallet account name, bank account name)

B) Communications evidence

Full chat thread screenshots (include date/time stamps)
Links to profiles, pages, posts, marketplace listings
Usernames/handles and profile URLs
Email messages with headers (for phishing)
Call logs/recordings (if lawful and available)

C) Transaction evidence

E-wallet/bank transfer receipts
Reference numbers, timestamps, amounts
Destination account details shown on the app
Any invoices, “order forms,” shipping receipts, tracking numbers (often fake but still useful)

D) Device and technical identifiers (when available)

Phone number(s)
Email addresses
Wallet IDs
Bank account number/name
URLs and domains used
Screenshots showing the scammer’s account identifiers
For account takeover: login alerts, device/session logs

E) Witness and corroboration

If someone else saw the transaction or communications, list them as potential witnesses.
If multiple victims exist, group evidence can show pattern and strengthen probable cause.

7) Writing your complaint: the “narrative” that investigators and prosecutors need

Whether filed at PNP-ACG/NBI or directly at the prosecutor, the complaint should clearly lay out:

Who you are (complainant) and your contact details
Who the suspect is (even if unknown), with identifiers:
- name used, handle, phone, e-wallet/bank account, profile links
Chronology:
- first contact,
- representations made,
- your reliance and transfers,
- what happened after payment,
- discovery of deception and damage
Damage:
- amount lost, other losses (account access, data, reputational harm)
Evidence list:
- numbered annexes (screenshots, receipts, links)
Relief sought:
- investigation, identification, filing of charges,
- assistance in tracing funds and accounts.

A tight timeline and consistent identifiers (exact account numbers, exact handles, exact reference numbers) are crucial.

8) Police/NBI intake: what happens when you file with a Cybercrime Unit

While procedures differ by office workload, a typical flow is:

Interview / complaint intake
Sworn statement / affidavit preparation
Evidence submission and initial validation
Case referral for technical assistance
- preservation requests, tracing, coordination with service providers
Coordination with financial institutions/platforms
Case build-up for prosecution
- identifying respondents,
- linking identity to accounts,
- establishing elements of fraud/deceit and damage.

Reality check: Identification is hardest when the offender uses fake identities, disposable SIMs, mule accounts, or offshore platforms. That’s why bank/e-wallet trail and platform identifiers matter.

9) If you know the suspect’s real identity vs. “John Doe”

A) Named respondent (best case)

If you have credible identity information (real name, address, or strong proof linking a person to the account), case evaluation and summons/service are more straightforward.

B) Unknown suspect (John Doe)

You can still file. The complaint will rely on:

e-wallet/bank recipient details,
platform account details,
IP/device traces (subject to legal process),
coordination with providers.

The goal early on is to turn anonymous identifiers into a real person through lawful investigative steps.

10) Parallel reporting you can do (and why it matters)

Besides PNP-ACG/NBI, parallel reports can create faster “freezes” or takedowns:

Bank/e-wallet dispute and fraud report: to attempt reversals/holds and flag recipient accounts.
Platform report (Facebook/Meta, X, Instagram, Telegram, marketplaces, etc.): to preserve the account and prevent further victimization.
SIM/network provider report (if phone-based scam) to document and potentially restrict abuse.
National Privacy Commission (if personal data misuse/loan app harassment) where appropriate.

Parallel reporting does not replace criminal filing; it helps with mitigation and evidence trails.

11) Recovery of money: what’s realistic

Recovery depends on speed, trail quality, and whether the funds are still within reachable channels.

Fast reporting improves chances of a hold or reversal.
If funds moved across multiple mule accounts or cashed out quickly, recovery becomes harder.
Courts can order restitution in appropriate cases, but execution depends on identifying the offender and locating assets.

Even if recovery is uncertain, filing matters to:

build a criminal case,
block accounts,
prevent future victims,
support pattern-based investigations.

12) Prosecutor stage: what gets a scam case filed in court

To move from complaint to court case, the prosecutor typically looks for:

Clear deceit/fraudulent representation
Proof you relied on it
Proof of damage (loss)
Evidence linking the suspect to the scam identifiers (accounts, handles, numbers)
Authenticity and integrity of electronic evidence (properly presented and explained)

Well-organized annexes and consistent identifiers are often the difference between dismissal and filing.

13) Electronic evidence: making screenshots “stick”

Screenshots are useful but can be challenged if:

they’re cropped without identifiers,
they omit timestamps/URLs,
they don’t show continuity of the conversation.

Better practices:

Capture the full chat thread with visible handles and timestamps.
Include a screen recording showing navigation to the profile/page and the conversation.
Preserve original files and metadata where possible.
Print copies for annexes but keep digital originals for forensic verification.

For email scams, preserve full headers (not just the visible message body).

14) If the scam involved hacking/phishing

Your complaint may include not just fraud but:

illegal access,
identity theft,
interference or misuse of data,
unauthorized transactions.

Extra evidence to bring:

login alerts and security emails,
device/session history screenshots,
OTP messages,
phishing link URL and landing page screenshots,
timeline of when access was lost and regained,
bank/e-wallet logs of unauthorized transfers.

Also document your mitigation steps (password changes, provider ticket numbers).

15) If the scam involves minors, intimate images, or sexual threats

These cases can escalate into serious offenses. Priorities include:

immediate reporting and evidence preservation,
coordination with appropriate desks and units,
protective measures and takedown pathways.

Do not pay demands; preserve communications and identifiers.

16) Practical “do’s and don’ts” when dealing with the Cybercrime Unit

Do:

Prepare a clear timeline and index of annexes.
Bring both printed and digital copies (USB/cloud link if allowed).
Provide exact account details and reference numbers.
Keep your narrative factual and chronological.

Don’t:

Alter screenshots (annotations can be placed separately; keep originals clean).
Publicly shame the suspect online in a way that complicates the case.
Continue transacting “to recover money” (common secondary scam).
Assume the unit can instantly trace without enough identifiers.

17) Sample structure of a complaint affidavit (outline)

Personal circumstances and identification
How you encountered the respondent (platform, handle, link)
Representations made by respondent
Your actions in reliance (payments/transfers with dates and refs)
Subsequent acts showing deceit (non-delivery, blocking, fake tracking, etc.)
Total loss and impact
Evidence list (Annex “A” to “__”)
Prayer for investigation and filing of charges

18) Frequently encountered issues in online scam complaints

Mule accounts: recipient account belongs to someone else; investigators must prove conspiracy or trace onward transfers.
Cross-border actors: offshore operators complicate identification and enforcement.
Platform encryption/private groups: limits evidence access without cooperation/legal process.
Victim delay: late reporting reduces chances of fund hold and data retention.

19) Bottom line

An “online scam complaint to the Cybercrime Unit” in the Philippines is most effective when treated as an evidence-driven case build-up: preserve identifiers, document transactions with reference numbers, promptly report to banks/e-wallets and platforms, and submit a clear sworn narrative with organized annexes. The likely legal anchors are estafa and cybercrime-related offenses, with additional laws depending on whether the scam involved account takeover, identity misuse, access device fraud, or personal data abuse.