What Case to File Against an Online Scammer in the Philippines: Estafa, Swindling, and Cybercrime

This is general information on Philippine law and procedure. For advice on your specific facts, consult counsel.

1) The big picture

Online scams are usually prosecuted by combining traditional crimes under the Revised Penal Code (RPC)—primarily estafa/swindling—with technology-specific offenses under the Cybercrime Prevention Act of 2012 (RA 10175) and, where applicable, other special laws (e.g., Access Devices Regulation Act, Data Privacy Act, SIM Registration Act). In many cases you don’t have to choose only one: the same conduct can be charged as estafa qualified by or committed through information and communications technologies (ICT), which increases the penalty, and/or charged as a standalone computer-related fraud or identity theft under RA 10175.

2) Core criminal options

A. Estafa (Article 315, Revised Penal Code)

When to use: You paid money, surrendered property, or incurred a liability because of deceit or abuse of confidence, and you suffered damage.

Common modes relevant to online deals

Deceit/false pretenses: The scammer used a fake identity, bogus proof of payment, or false claims (e.g., “brand-new phone, shipping today”) to induce payment.
Misappropriation/conversion: You sent money or an item “in trust” (e.g., consignment, remittance for purchase) and the person diverted it.
Fraudulent acts causing damage: E.g., phishing you into typing an OTP that allowed transfers.

Elements to prove (typical deceit mode)

False representation or fraudulent act prior to or at the time of the transaction;
Reliance by the victim;
Delivery of money/property (or the victim incurred an obligation);
Damage or prejudice (actual loss or disturbance of property rights).

Notes on amounts and penalties

Penalties for estafa scale with the amount defrauded (updated by RA 10951). Larger amounts mean higher penalties. (Exact brackets change by statute; prosecutors compute this using receipts, bank records, and app transaction histories.)

B. Swindling / Other Deceits (Articles 316 & 318, RPC)

When to use: The fraud doesn’t neatly fit a specific estafa mode but is still deceitful—e.g., selling or pledging property as unencumbered when it’s mortgaged, disposing of property without authority, real-estate style online “reservation” ruses, or other deceptions not expressly covered elsewhere.

Think of these as catch-all provisions for property-related deceit that still caused damage.

C. Cybercrime Prevention Act (RA 10175)

You can pursue two tracks under RA 10175:

Crimes under the RPC committed through ICT (Sec. 6): If estafa/swindling was carried out online—through social media, messaging apps, spoofed sites, phishing pages, or e-wallet/bank transfers initiated via computers or phones—the penalty for the underlying RPC offense is raised by one degree.
Standalone cyber offenses (Sec. 4):
- Computer-related fraud (Sec. 4(b)(2)): manipulating data or systems to obtain property (e.g., OTP interception, account takeovers, payment system tampering).
- Computer-related identity theft (Sec. 4(b)(3)): unauthorized acquisition/use of personal data or credentials to commit the fraud (e.g., SIM-swap, cloned e-wallet).
- Illegal access, data interference, device misuse (Sec. 4(a), 4(c)): often charged when the scammer hacked or used tools to breach your account.

Why this matters: RA 10175 provides special jurisdiction, preservation/search warrants for computer data, and allows prosecutors to stack cyber elements with RPC crimes for appropriate penalties.

3) Choosing the right charge (decision guide)

You paid because you were deceived online → Estafa (Art. 315) + Sec. 6 of RA 10175 (estafa via ICT).
Your account was hijacked / OTP phished; funds transferred → Computer-related fraud (RA 10175 Sec. 4(b)(2)) and possibly estafa via ICT against the person who received or orchestrated the transfers.
Scammer used your identity or card/wallet → Identity theft (RA 10175 Sec. 4(b)(3)); if a card or access device was used, consider Access Devices Regulation Act (RA 8484).
Property sold/pledged online but title/authority is bogus → Swindling/other deceits (Arts. 316/318) (and estafa, if elements fit).
Business-like online selling with systemic deception → Estafa (multiple counts), Unfair/deceptive practices complaints to DTI, SEC (if investment-type), plus cybercrime charges.

You can combine charges if facts support them. Prosecutors will rationalize the final set after preliminary investigation.

4) Venue, jurisdiction, and which office to approach

Where to file a criminal complaint:
- PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division for investigation.
- Office of the City/Provincial Prosecutor for inquest (if suspect is under arrest) or regular filing (preliminary investigation).
Court jurisdiction: Regional Trial Courts (often designated Special Cybercrime Courts) hear cybercrime and ICT-qualified cases.
Venue: Any place where an element of the offense occurred (e.g., where deceit was received, payment sent, money withdrawn, or where the device/system used is located). This is especially helpful when the scammer is in another city.

5) Evidence: what wins (and what sinks) online-fraud cases

A. Prove the deceit and your reliance

Full chat/email threads showing the false statements before you sent money.
Screenshots with visible timestamps, usernames, and URLs/handles.
Call logs/voicemails (exported where possible).

B. Prove payment/delivery and loss

Bank/e-wallet slips (GCash/Maya), transaction IDs, SMS advisories, and app logs.
Courier receipts, tracking history, or proof of non-delivery/return-to-sender.
For account takeovers: device logs, login alerts, and IP/location notices from providers.

C. Link the account holder / money mule

Beneficiary account details: bank name, account number, account holder, mobile number, and KYC screenshots if available.
Withdrawal points (ATM CCTV, branch visit records) gathered via subpoena/warrants through investigators.

D. Electronic evidence rules

Keep data in original form when possible; export chats as PDF/CSV if the app allows.
The Rules on Electronic Evidence recognize printouts and electronic copies if authenticated (e.g., by the person who captured them, or via service-provider certifications).
Do not alter images/metadata; save to a separate drive. Maintain a simple chain-of-custody log: who collected, when, and where it was stored.

6) Practical filing roadmap (step-by-step)

Freeze the bleeding immediately
- Report within the app (Facebook/Instagram/Carousell/etc.).
- Notify your bank/e-wallet to flag recipient accounts; request transaction recall or hold if still possible.
- Change passwords; enable MFA; secure email/phone.
- If sensitive IDs were exposed, request SIM change and account alerts.
Go to investigators
- PNP-ACG or NBI Cybercrime: bring a timeline, evidence folder, and a sworn statement draft. They can assist in data preservation letters and preparing cyber warrants (e.g., to disclose subscriber info of numbers/emails, obtain logs from banks/e-wallets/social platforms).
Prepare and file the criminal complaint
- Affidavit-Complaint (see outline below);
- Annexes: chats, receipts, IDs, screenshots, device logs;
- Witness affidavits (if someone witnessed the handoff/negotiation);
- Acknowledgment of data sources (which device/app each annex came from).
- File with the City/Provincial Prosecutor (or inquest if there’s a warrantless arrest).
During preliminary investigation
- Respond to counter-affidavits with a reply focusing on elements (deceit, reliance, damage, ICT use).
- Ask investigators to follow the money trail (beneficiary accounts, cash-out points, IP logs).
Civil remedies (parallel to the criminal case)
- Damages (actual, moral, exemplary) in the criminal action or via a separate civil suit.
- Rescission/cancellation and recovery of what you paid; replevin for seized goods.
- For investment scams, pursue restitution and administrative sanctions via SEC (if securities-like), DTI (consumer protection), or BSP/financial regulators (payment services issues).

7) Affidavit-Complaint outline (you can adapt this)

Title/Parties
Introduction: your name, address, ID details; respondent’s known identifiers (handles, numbers, account names).
Jurisdiction/Venue: where elements occurred; that ICT/devices used were in/accessible within the Philippines.
Facts (chronological timeline):
- Initial contact; representations; attached proof (Annexes A-D).
- Payment/delivery; transaction details (Annexes E-H).
- Non-delivery/breach; resulting damage.
Offenses charged:
- Estafa (Art. 315 [specify mode]) committed through ICT (RA 10175 Sec. 6); and/or
- Computer-related fraud/identity theft (RA 10175 Sec. 4[b]); and/or
- Swindling/other deceits (Arts. 316/318).
Prayer: issuance of subpoenas; filing of Informations; restitution; protective orders (e.g., data preservation).
Verification & Certification against forum shopping
Annex list with short descriptions.

8) Special laws that often apply

RA 8484 (Access Devices Regulation Act): Fraud involving credit/debit cards and similar devices; obtaining money through unauthorized use.
RA 8792 (E-Commerce Act): Recognizes electronic documents; can support evidentiary and civil enforcement angles.
RA 10173 (Data Privacy Act): If the scammer unlawfully processed or disclosed your personal data (administrative/criminal sanctions).
RA 11765 (Financial Products and Services Consumer Protection Act): For regulatory complaints to the BSP/SEC/IC against financial service providers mishandling disputes.
RA 11934 (SIM Registration Act): Facilitates subpoenas for subscriber info tied to scam numbers.
B.P. 22 (Bouncing Checks Law): If a check was used and dishonored (less common in purely online scams, but still relevant).

9) Time bars (prescription) and strategic timing

RPC crimes (like estafa/swindling) and RA 10175 offenses have prescriptive periods that vary with the penalty. As a rule of thumb: the more serious the penalty, the longer the prescriptive period. Do not delay—report quickly to enable data preservation and to keep venue and witness recollection clean.
For special laws, prescription typically follows Act No. 3326 (e.g., up to 12 years for offenses punishable by imprisonment of six years or more; shorter for lesser penalties). Exact computation is technical and fact-specific.

10) Common defenses—and how to counter them

“It was just a civil dispute.” → Emphasize prior deceit, fake identities, and intent from the start, not mere non-performance.
“We never transacted.” → Produce payment records, IP/device logs tying the account to the respondent, and platform verification (KYC screenshots).
“No damage.” → Itemize amounts, fees, and consequences (e.g., frozen funds, chargebacks, lost opportunity), with documents.

11) Practical tips to strengthen your case

Document everything immediately; export chats with app-generated file hashes if available.
Preservation letters to platforms/banks early; investigators can follow with Cybercrime Warrants (Preserve, Disclose, Search/Examine, Intercept) under the Supreme Court’s Rules on Cybercrime Warrants.
Name money mules as respondents if they knowingly aided the scheme.
If you recovered funds via recall/chargeback, update your damage computation but don’t drop the case if other amounts or non-monetary harm remain.
Coordinate with multiple victims to establish a pattern of deceit (useful for probable cause).

12) Quick checklist (print and bring)

Valid ID; contact details
Timeline of events (dates, times, apps used)
Chat/email exports; screenshots with timestamps/handles
Bank/e-wallet proofs; transaction IDs; chargeback/recall notes
Listing/post URLs; profile pages; platform reports/tickets
Device logs, login alerts, OTP/SMS messages
Any witness statements
Draft Affidavit-Complaint with annex tabs

13) Bottom line

For online seller/buyer scams: Estafa (Art. 315) via ICT (RA 10175 Sec. 6) is the backbone.
For account takeovers/phishing schemes: add computer-related fraud and identity theft under RA 10175.
For property/real-estate style deceits that fall outside classic estafa modes: use Articles 316/318 (swindling/other deceits).
File through PNP-ACG/NBI Cybercrime, then the Prosecutor’s Office; preserve electronic evidence early, and pair the criminal case with civil and regulatory remedies when helpful.

If you want, tell me your exact scenario (what was promised, what you sent, where the money went, and what proof you have), and I’ll map it to the best charge set and a one-page affidavit draft you can use.