Report Online Scam Philippines

Here’s a practical, Philippine-focused legal guide you can use end-to-end—both to understand your options and to actually report an online scam.

Report Online Scam (Philippines): The Complete Legal Guide

Scope. This explains (1) what counts as an “online scam” under Philippine law, (2) the correct places to report (criminal, regulatory, and platform channels), (3) how to preserve and present digital evidence, (4) expected process and timelines, and (5) civil and consumer remedies. It’s general information, not legal advice.

1) What is an “online scam” under PH law?

Online scams are schemes that use the internet, social media, messaging apps, e-commerce sites, e-wallets, or online banking to deceive and obtain money, property, data, or access. Depending on the facts, prosecutors typically charge one or more of the following:

  • Estafa (swindling) under the Revised Penal Code (RPC, Art. 315)—classic fraud (false pretenses, deceit) done online.

  • Cybercrime Prevention Act (Republic Act No. 10175). Often paired with estafa to reflect the use of information and communication technologies (ICTs). Key offenses:

    • Computer-related fraud (Sec. 4(b)(2))
    • Computer-related identity theft/unauthorized use of identifiers (Sec. 4(b)(3))
    • Illegal access, interception, data interference, device misuse (Sec. 4(a), 4(c))

  • Access Devices Regulation Act (RA 8484). Card cloning/phishing that captures card numbers, OTPs, or CVVs.

  • Data Privacy Act (RA 10173). Unlawful processing/disclosure of personal data, data breaches from phishing, SIM/ID takeovers.

  • E-Commerce Act (RA 8792). Recognizes electronic documents/signatures and supports enforcement against online misrepresentation.

  • Financial Products and Services Consumer Protection Act (RA 11765). Powers the BSP/SEC/IC to address unfair/abusive financial practices (e.g., investment or e-wallet scams).

  • Special laws when applicable: – Anti-Photo and Video Voyeurism (RA 9995) and Anti-Child Pornography (RA 9775) for sextortion/CSAM; – VAWC (RA 9262) for tech-facilitated abuse within covered relationships; – SIM Registration Act (RA 11934) can aid attribution via telco records.

Jurisdiction & reach. RA 10175 allows extraterritorial application in specified cases (e.g., when any element occurs in the Philippines, or the offense targets a Filipino/Philippine computer system). That matters for cross-border scams, crypto fraud, and foreign-based actors.

2) First 24-hour checklist (what to do immediately)

  1. Stop contact and payments. Do not negotiate with the scammer.

  2. Preserve evidence (don’t delete!):

    • Full chat/email threads, screenshots, call logs;
    • Usernames/handles, profile URLs, phone numbers, email addresses;
    • Payment records (transfer confirmations, reference numbers, account names/numbers, wallet addresses/TxIDs);
    • Device & network details (timestamps, IPs if visible, headers for emails).

  3. Notify your bank/e-wallet (e.g., card issuer, online bank, GCash/Maya/GrabPay) and request:

    • Account freeze/hold, chargeback/dispute, OTP compromise handling, and internal fraud investigation.

  4. Report on-platform (Facebook/Instagram/TikTok/X, Shopee/Lazada/Carousell, marketplace groups) to takedown pages/listings and preserve platform logs.

  5. Change passwords, enable MFA, and scan devices for malware (phishing may have harvested credentials).

  6. If intimate images or child exploitation is involved: escalate immediately to law enforcement; do not forward contraband images.

3) Where to report (all channels you should use)

A. Criminal enforcement (primary)

  • PNP Anti-Cybercrime Group (ACG). File a criminal complaint for cybercrime/estafa. You can walk in to an ACG office or coordinate via their official email/portal/social channels.
  • NBI Cybercrime Division. Alternative to PNP; you may file with either (or both), but practically you’ll pursue one case to avoid duplication.
  • Department of Justice – Office of Cybercrime (DOJ-OOC). Policy and international cooperation; coordinates with prosecutors and foreign counterparts after a case is built.

Outcome: Law enforcement can secure cyber warrants (Rules on Search, Seizure, and Examination of Computer Data: A.M. No. 17-11-03-SC), trace flows, request subscriber info from telcos, and work with platforms.

B. Financial & market regulators (parallel)

  • BSP (banks/e-money/e-wallets, including VASPs supervised by BSP): complaints for unauthorized transfers, account takeovers, social engineering that led to debits.
  • SEC (investment/“double your money”/crypto or trading “platform” solicitations; unregistered securities, boiler rooms, Ponzi/pyramids).
  • Insurance Commission (IC) for scams involving insurance/pre-need products.
  • AMLC (through your bank/e-wallet’s suspicious transaction reporting). Law enforcement may also seek asset freezing and bank inquiry once a case is filed.

C. Consumer & telecom/ICT

  • DTI – Consumer Protection Group for e-commerce/retail disputes (non-delivery, fake goods, bait-and-switch from PH-based sellers).
  • NTC (for scam calls/SMS and number blocking; coordinates with telcos).
  • CICC (Cybercrime Investigation and Coordinating Center) and DICT (public reporting/awareness, inter-agency coordination).

D. Data protection/privacy

  • NPC (National Privacy Commission). For phishing/data breach/identity theft complaints; NPC can order compliance, mediation, or penalties on personal-information controllers/processors.

Tip: Use all applicable lanes: criminal (PNP/NBI) + regulator (BSP/SEC/DTI/NPC) + platform + your bank/e-wallet. They serve different purposes (prosecution, refunds/holds, takedowns, privacy remedies).

4) Building a winning case: evidence & formatting

A. Preserve forensically

  • Keep original devices unaltered where possible; avoid factory resets.
  • Export chats in original format (e.g., “export chat” with media).
  • Take screenshots with visible full timestamps, URLs, and IDs.
  • For emails, retain full headers.
  • For crypto, record wallet addresses and transaction hashes.

B. Legal rules on electronic proof

  • Rules on Electronic Evidence (A.M. No. 01-7-01-SC). Electronic documents and signatures are admissible if authenticity and integrity are shown (hashes, metadata, custodian testimony).
  • Best evidence & chain of custody. Note how, when, and by whom each item was created, obtained, and stored. Keep a simple evidence log: Item – Source – Date/Time – How obtained – Stored at – Hash (if any).

C. What law enforcement will ask for

  • Your valid ID and contact info.
  • Sworn statement/affidavit narrating: timeline, deception, payments, losses, and your efforts to verify legitimacy.
  • Supporting documents: screenshots/exports, bank/e-wallet statements, deposit slips, courier records, platform ticket IDs, and any witness details.

Template – Affidavit outline

  1. Your identity and capacity.
  2. How you discovered the offer/post and the representations made.
  3. Communications chronology (dates/times, channels, usernames).
  4. Payment details (amounts, reference numbers, accounts/wallets).
  5. Harm suffered (financial, data, reputational).
  6. Steps taken (bank dispute, platform report, regulator complaints).
  7. Request for investigation/prosecution and restitution.

5) Filing the case: criminal, civil, and administrative tracks

A. Criminal complaint flow (typical)

  1. Initial report to PNP-ACG or NBI Cybercrime.
  2. Case build-up (subpoenas to banks/telcos/platforms; digital forensics; cyber warrants).
  3. Prosecutor filing (inquest if suspect is caught; otherwise regular filing with the Office of the City Prosecutor where the offense or any element occurred, or where complainant resides when allowed).
  4. Information filed in court if probable cause is found.
  5. Arraignment/trial; restitution may be ordered upon conviction.

B. Civil remedies (get money back or damages)

  • Independent civil action for damages (tort/estafa-related fraud).
  • Rescission/annulment of fraudulent contracts; unjust enrichment.
  • Small Claims in First Level Courts (no lawyers required up to the current monetary threshold; check the latest limit—recently increased).
  • Replevin or recovery of specific property if traceable.

C. Administrative/Consumer complaints

  • BSP/SEC/DTI/NPC processes can lead to refunds, penalties, and orders against institutions or erring entities separate from the criminal case.

6) Special scenarios & how to report them

  • Bank/e-wallet account takeovers (ATO), unauthorized transfers, “quishing”/QR scams: – Immediately dispute with your bank/e-wallet; ask for temporary credit, transaction reversal, and freeze of recipient accounts; file BSP complaint if mishandled.
  • Investment/crypto trading platforms promising fixed returns, referral bonuses: – Screenshot ads, “proof of payout,” and contract terms; SEC complaint for unregistered securities/illegal solicitation; criminal estafa/cybercrime in parallel.
  • Sextortion/non-consensual intimate images: – Report to PNP/NBI urgently; consider RA 9995 and, if minors are involved, RA 9775. Ask platforms for emergency takedowns.
  • Merchant fraud on e-commerce sites (non-delivery/fakes): – Use platform dispute tools, then DTI complaint if unresolved; consider Small Claims for recovery.
  • SIM-based scams/SMS/OTP theft: – NTC/telco for number blocking and SIM attribution; PNP/NBI for criminal action; change credentials and enable MFA-app (not SMS) where possible.
  • Business email compromise (BEC) / invoice redirection: – Urgently contact both banks for a hold; file PNP/NBI and notify BSP; coordinate with counterparties’ banks for recall.

7) What to expect: timelines, costs, and practical realities

  • Speed. Freezes/recalls are most successful when reported within hours to a few days. Criminal investigations take longer (weeks to months) depending on cooperation from platforms/banks and cross-border issues.
  • Fees. Police/NBI complaint filing is generally free; you may incur notarization, copying, and (if you hire counsel) attorney’s fees. Court filing fees apply for civil actions (waivable for indigent litigants).
  • Restitution. Chargebacks/disputes may reverse card payments; account-to-account transfers or crypto are harder but not hopeless—early trace and freeze can work.

8) Practical tips to improve your odds

  • Act fast and in parallel. Report to law enforcement, your bank/e-wallet, platform, and the relevant regulator on the same day if you can.
  • Use a single, well-organized evidence bundle. Table of contents; numbered exhibits; timeline view.
  • Be precise with amounts and timestamps. Courts and regulators rely on details; vague narratives slow cases.
  • Don’t pay “verification” or “release” fees. Classic secondary scam targeting victims after they report.
  • Security reset. New passwords, app-based MFA, and recovery info updated on email, bank, and social media.

9) Frequently asked: short answers

  • Can I report if the scammer is overseas? Yes. RA 10175 supports extraterritorial reach in several situations; PH agencies can also use mutual legal assistance.
  • Do screenshots count? Yes—under the Rules on Electronic Evidence—but preserve originals and exports whenever possible.
  • Where do I file if the seller is “online only”? Venue can be where any element happened (where you received the deceit, sent the money, or suffered loss) or as allowed by special rules.
  • Can I stay anonymous? You’ll usually need to identify yourself to authorities; for privacy-sensitive matters, discuss protective measures with investigators or counsel.
  • Is there a deadline? Criminal prescriptive periods apply (varies by offense/penalty); report as soon as possible to maximize asset recovery.

10) Ready-to-use filing checklist

Your packet should include:

  1. Government ID (clear copy).
  2. Sworn statement/affidavit (see outline above).
  3. Timeline (date/time – event – exhibit ref).
  4. Evidence folder: chats, emails (with headers), screenshots (with URLs/timestamps), posts/listings, payment proofs (bank/e-wallet refs), courier receipts, wallet addresses/TxIDs.
  5. Bank/e-wallet dispute reference numbers; platform report ticket IDs.
  6. Any regulator complaint numbers (BSP/SEC/DTI/NPC).
  7. Contact details of witnesses/handlers you dealt with (bank officer, platform agent).

Short boilerplate you can adapt (Affidavit opening)

I, [Name], of legal age, Filipino, with address at [address], after having been duly sworn, depose and state:

  1. On [date/time], I saw [post/ad/message] on [platform/app] by user [handle/URL/ID] offering [goods/services/investment]…
  2. The respondent represented that [key misrepresentations]…
  3. Relying on said representations, I sent [amount] via [bank/e-wallet] on [date/time], Ref. No. [XXXX], to account [name/number/wallet]…
  4. Thereafter, [non-delivery, blocking, further demands]…
  5. Attached are Annexes “A” to “__” consisting of screenshots, message exports, and proofs of payment…
  6. I request the filing of appropriate charges under RA 10175, RPC Art. 315 (estafa), and other applicable laws.

11) When to consult counsel

  • Losses are significant, you’re dealing with cross-border or corporate victims, or sensitive content is involved.
  • You’ve received a demand letter or platform counter-claim.
  • You need help with asset tracing, injunctions, or settlements.

Final word

The key is speed + completeness: report across criminal, financial, regulatory, and platform channels, and deliver a tight, well-documented evidence pack. If you want, tell me the scam type (e.g., investment, e-commerce, e-wallet ATO, sextortion), and I’ll tailor a one-page action plan and a customized affidavit draft you can file.

Disclaimer: This content is not legal advice and may involve AI assistance. Information may be inaccurate.

Privacy Policy

Terms of Use

Lawyer Login

 
 
Privacy Policy         Terms of Use         Lawyer Login