Filing a police blotter for online threats or cyber harassment is an important first step, but it usually does not start a criminal case by itself. After making the report, your priorities are to protect yourself, preserve digital evidence, help investigators identify the person behind the account, and file the appropriate sworn complaint with the police cybercrime unit, the National Bureau of Investigation, or the prosecutor’s office.

What a Police Blotter Does—and Does Not Do

A police blotter is the station’s official record of what you reported. It normally contains the date and time of the report, the names or account details involved, a summary of the incident, and the officer who received it.

The blotter can help establish that:

You reported the threat promptly.
Your account of the incident was recorded close to the time it happened.
Police were informed about a possible danger.
There is a reference number for follow-up investigation.

However, a blotter entry is not automatically a criminal complaint, arrest warrant, protection order, or court case. The Supreme Court has repeatedly explained that police blotter entries are not conclusive proof that everything stated in them is true. They must still be supported by testimony, electronic evidence, witness statements, and other proof. (Lawphil)

Ask the police station for the blotter entry number and, when available, a certified copy or blotter extract. Record the name, rank, unit, and contact details of the officer assigned to your report.

Which Philippine Laws May Apply to Online Threats and Harassment?

There is no single offense in Philippine law called “cyber harassment” that covers every unpleasant or abusive online interaction. The applicable law depends on the exact words used, whether there was a threat of a crime, whether the conduct was sexual or gender-based, the relationship between the parties, and whether private information or intimate images were shared.

Online conduct	Possible legal basis	Important point
Threatening to kill, injure, kidnap, burn property, or commit another crime	Article 282 of the Revised Penal Code, in relation to Section 6 of RA 10175	A threat may be punishable even if the threatened crime is not ultimately carried out.
Repeated unwanted sexual messages, gender-based insults, cyberstalking, impersonation, or online sexual harassment	RA 11313, the Safe Spaces Act of 2019	The law covers certain gender-based sexual harassment committed through information and communications technology.
Harassment or threats by a husband, former husband, boyfriend, former boyfriend, dating partner, sexual partner, or father of a woman’s child	RA 9262, the Anti-Violence Against Women and Their Children Act of 2004	Repeated harassment, stalking, humiliation, and conduct causing mental or emotional anguish may constitute psychological violence.
Posting defamatory accusations publicly or sending them to other people	Cyberlibel under RA 10175, in relation to Articles 353 and 355 of the Revised Penal Code	A purely private insult sent only to the person concerned may not satisfy the publication element of libel, although another offense may apply.
Sharing intimate photos or videos without consent	RA 9995, the Anti-Photo and Video Voyeurism Act of 2009	Consent to taking an intimate image does not automatically mean consent to publish, copy, or distribute it.
Posting an address, phone number, identification document, financial information, or other personal data	RA 10173, the Data Privacy Act of 2012	“Doxxing” may raise privacy-law issues, although not every disclosure automatically violates the Act.
Threats intended to force someone to pay, surrender property, withdraw a complaint, or perform an act	Grave coercion, robbery, extortion-related offenses, or other Revised Penal Code provisions	The correct charge depends on the demand, threat, and surrounding circumstances.

Article 282 of the Revised Penal Code covers certain threats against a person, honor, property, or family involving a wrong that amounts to a crime. When an offense under the Revised Penal Code or another special law is committed through information and communications technology, Section 6 of RA 10175 may apply and may increase the prescribed penalty by one degree. (Lawphil)

The Safe Spaces Act specifically addresses gender-based online sexual harassment. The law identifies the Philippine National Police Anti-Cybercrime Group as the primary law-enforcement unit responsible for implementing provisions involving gender-based online sexual harassment. (Lawphil)

What to Do Immediately After Filing the Police Blotter

1. Protect yourself from immediate harm

Treat a specific and credible threat seriously, especially when the person:

Knows your home, workplace, school, or daily routine.
Has previously assaulted, stalked, or followed you.
Mentions a weapon or sends a photo of one.
Gives a deadline or specific location.
Is already nearby.
Has access to your children or family.
Threatens to publish intimate images unless you comply with a demand.

Move to a secure place when necessary. Inform trusted household members, building security, school officials, or workplace security. For immediate danger, contact the nearest police station or emergency services rather than waiting for a cybercrime investigator to review the account.

Do not agree to meet the sender merely to “settle” the matter or discover their identity.

2. Obtain the blotter reference details

Before leaving the station, or during your next visit, obtain:

Blotter entry number.
Date and time of entry.
Name of the police station.
Name and rank of the receiving officer.
Investigator or unit assigned.
Copy or extract of the entry, when available.
Instructions for submitting additional evidence.

Check whether the entry accurately reflects the threat. If an important fact was omitted—such as a weapon, previous assault, home address disclosure, or threat against a child—ask that a supplemental report be recorded.

3. Preserve the electronic evidence before blocking or reporting the account

Screenshots are useful, but screenshots alone are not always the strongest possible evidence. Preserve the material in several forms.

Take screenshots showing:

The complete message, post, or comment.
Date and time displayed.
Account name and username.
Profile photograph.
Profile URL or account link.
Post URL, message thread, or group name.
Earlier and later messages that provide context.
Reactions, shares, comments, or recipients when relevant.

Also consider:

Making a screen recording that starts from the account profile and navigates to the threatening content.
Exporting or downloading the complete chat history.
Saving emails in their original format, including headers.
Saving voice messages, missed-call logs, and voicemail files.
Photographing the screen with another device when content may disappear.
Keeping the original phone, laptop, or storage device.
Backing up the files to at least two secure locations.
Writing a chronological incident log.

Do not crop, annotate, recolor, or edit the only copy of a screenshot. You may create a marked copy for explanation, but keep the untouched original.

The Philippine Rules on Electronic Evidence allow electronic documents and electronic communications to be presented in court, but their authenticity, reliability, and connection to the parties may still need to be established. Testimony from a person with personal knowledge can also be important for chats, calls, text messages, and similar communications. (Lawphil)

4. Record why the threat appears credible

Investigators need more than the threatening words. Explain the surrounding facts that make the threat believable or urgent.

Prepare a short written timeline covering:

How you know the sender.
When the harassment began.
Previous arguments, violence, stalking, or demands.
Whether the sender knows your address or schedule.
Whether the sender has access to weapons.
Whether the sender has carried out similar threats before.
Names of people who witnessed the conduct.
Any physical, emotional, financial, or reputational harm already suffered.

A statement such as “I will find you” may be evaluated differently when sent by a stranger than when sent by a former partner who has previously appeared outside the victim’s home.

5. Ask for referral to a cybercrime unit

Ordinary police stations can record the complaint and address immediate safety concerns, but account identification and platform data requests often require specialized handling.

Ask whether the case should be referred to:

The PNP Anti-Cybercrime Group, including its regional or local cybercrime units.
The NBI Cybercrime Division or an NBI regional or district office.
The Women and Children Protection Desk when RA 9262, child protection, or sexual abuse is involved.
The city or provincial prosecutor’s office for preliminary investigation.

The NBI maintains procedures for investigative assistance to victims of computer-related crimes and also provides an official online complaint facility. Supporting evidence should still be organized for submission or follow-up with the appropriate office. (National Bureau of Investigation)

6. Request prompt preservation of platform data

Social media companies, email providers, telecommunications companies, and messaging platforms may retain different categories of data for limited periods. Deleted accounts, changed usernames, disappearing messages, and expiring logs can make identification harder.

Section 13 of RA 10175 allows authorized law-enforcement authorities to require the preservation of specified computer data. The law generally provides a six-month preservation period from receipt of the preservation order, subject to lawful extensions and further legal process. (Lawphil)

Tell the investigator immediately when:

The sender is using a fake or anonymous account.
Messages are disappearing.
The account has been deactivated.
The sender has announced an intention to delete evidence.
The account uses a foreign platform.
The threat is linked to a phone number, email address, payment account, IP address, or delivery transaction.

A private individual ordinarily cannot compel a platform to disclose protected subscriber or traffic data. Law-enforcement authorities may need preservation requests, cybercrime warrants, subpoenas, or international cooperation procedures.

7. Report the content to the platform after preserving it

After securing the evidence, use the platform’s reporting tools for threats, harassment, impersonation, stalking, intimate-image abuse, or disclosure of private information.

Save:

The platform’s confirmation email.
Report or ticket number.
Date and time of the report.
Copy of the form submitted.
Any response stating that content was removed or retained.

Reporting may protect you and other users, but platform removal does not replace a police or prosecutor complaint. Conversely, removal of content does not necessarily erase evidence already preserved by you or the service provider.

8. Prepare and file a complaint-affidavit

A complaint-affidavit is a sworn written statement describing the offense, identifying the respondent when possible, and attaching supporting evidence.

It should clearly state:

Your full name, address, and contact details.
The respondent’s name or all known account identifiers.
Your relationship with the respondent.
The exact threatening or harassing conduct.
Dates, times, platforms, and account links.
Why you believed the threat was serious.
Harm, fear, distress, or expenses caused.
Witnesses and available supporting records.
The offense or laws believed to apply, when known.

Arrange the attachments in order and label them—for example, “Annex A,” “Annex B,” and so on. Refer to each attachment in the affidavit.

The affidavit must be sworn before a person authorized to administer oaths, following the requirements of the office receiving it. Some prosecutor’s offices administer oaths to complainants, while others may require notarized documents or additional copies. Confirm local requirements before filing.

Evidence and Documents Checklist

Document or evidence	Why it matters
Government-issued identification	Establishes the complainant’s identity.
Police blotter copy or reference number	Shows the initial report and provides a follow-up reference.
Complaint-affidavit	Presents the facts under oath.
Full screenshots	Shows the content, time, account, and context.
Screen recording	Demonstrates where the content appeared and how the account was accessed.
Original device	May be inspected or forensically examined when authenticity is disputed.
Chat or account export	Preserves metadata and the longer conversation.
URLs, usernames, profile IDs, email addresses, and phone numbers	Helps investigators identify and preserve the correct account.
Witness affidavits	Corroborates the threat, harassment, publication, or resulting fear.
Prior reports or barangay records	Shows repeated conduct or escalation.
Medical or psychological records	May support claims of injury, trauma, anxiety, or emotional anguish.
Proof of relationship	Important for RA 9262 cases involving spouses, former partners, dating partners, or a common child.
Platform report confirmations	Documents removal requests and platform responses.
Receipts and proof of losses	May support claims involving damaged property, relocation, treatment, security expenses, or lost income.

Bring both printed and electronic copies. Keep a complete duplicate of everything submitted and obtain a receiving stamp, reference number, or acknowledgment.

Where Should You File the Next Complaint?

Situation	Appropriate office or remedy
Immediate danger or a threat likely to be carried out soon	Nearest police station or emergency response service
Anonymous account, hacked account, impersonation, or platform-data tracing	PNP Anti-Cybercrime Group or NBI Cybercrime Division
Formal criminal prosecution	Office of the City Prosecutor or Provincial Prosecutor with jurisdiction
Gender-based online sexual harassment	PNP Anti-Cybercrime Group and the appropriate prosecutor
Threats or psychological violence by a spouse, former spouse, dating partner, former dating partner, or father of a woman’s child	Women and Children Protection Desk, barangay or court for a protection order, and prosecutor
Unauthorized disclosure or misuse of personal data	National Privacy Commission, in addition to any criminal complaint
Harassment connected to employment or school	Employer, human resources office, school administration, or disciplinary office, without abandoning available criminal remedies

A complaint to the National Privacy Commission generally requires a verified or notarized complaint form and supporting evidence. The NPC publishes its official complaint procedure and forms. A privacy complaint may supplement, but does not automatically replace, a police or prosecutor complaint involving threats or harassment. (National Privacy Commission)

Does the Case Have to Go Through the Barangay First?

Not every online-threat or cyber-harassment case must pass through barangay conciliation.

Under the Katarungang Pambarangay system, prior barangay proceedings may be required for certain disputes between individuals who reside in the same city or municipality. However, the law and Supreme Court rules recognize exclusions, including offenses carrying penalties beyond the barangay system’s coverage, parties residing in different cities or municipalities, and situations requiring urgent legal action. (Lawphil)

Do not allow a “barangay first” instruction to delay emergency protection, evidence preservation, or reporting of a serious threat. Ask the receiving officer or prosecutor to identify the legal basis if they believe barangay conciliation is mandatory.

For qualifying RA 9262 cases, a victim may seek a Barangay Protection Order, commonly called a BPO. The Punong Barangay is directed to act on the application on the date of filing through an ex parte determination, meaning the initial decision may be made based on the applicant’s evidence without first requiring the respondent’s participation. (Lawphil)

What Happens After You File the Complaint-Affidavit?

1. Initial evaluation and investigation

The police, NBI, or prosecutor will examine whether the facts potentially constitute an offense and whether there is sufficient evidence connecting the respondent to the account.

Investigators may ask for:

A supplemental affidavit.
The original device.
Additional screenshots or exports.
Witness affidavits.
Identification of account URLs or profile numbers.
Proof of ownership of the phone number or email address.
Prior conversations showing motive and context.
Consent for forensic examination of a device.

2. Account identification and data requests

When the account is anonymous, law enforcement may seek subscriber information, traffic data, IP-related records, or other evidence through lawful procedures.

This is often the main bottleneck. Delays may result from:

Incomplete URLs or usernames.
Accounts being deleted before preservation.
Use of virtual private networks or shared connections.
Prepaid SIMs registered under disputed identities.
Foreign service providers.
International data requests.
Platform retention policies.
Heavy cybercrime-unit caseloads.

A display name or profile photo alone does not conclusively identify the person operating an account.

3. Prosecutor’s preliminary investigation

When the complaint is sufficient in form, the prosecutor may require the respondent to submit a counter-affidavit. The complainant may be allowed or directed to respond to new evidence.

The prosecutor then determines whether the evidence justifies filing a criminal information in court. The Department of Justice publishes information on the filing of complaints for preliminary investigation, although documentary and copy requirements may vary by office. (Department of Justice)

4. Court proceedings

If the prosecutor files an information, the case proceeds before the court with jurisdiction. Cybercrime cases may be assigned to designated cybercrime courts depending on the offense and venue.

A filed court case does not guarantee conviction. The prosecution must still prove the offense and the accused’s identity beyond reasonable doubt.

Practical Timelines and Costs

There is no single timetable for every cyber-harassment case. A straightforward case involving an identified sender may move faster than a case requiring records from several foreign platforms.

Stage	Practical range
Police blotter and immediate safety assessment	Usually the same day
Organizing screenshots, exports, affidavit, and attachments	Often one to several days
Cybercrime referral and data-preservation request	Should be initiated as soon as possible
Identification of an anonymous account	Several weeks to months, sometimes longer
Prosecutor evaluation and preliminary investigation	Commonly several weeks to several months
Court proceedings	Potentially many months or years

These are practical estimates, not guaranteed statutory deadlines. Platform response time, international coordination, incomplete evidence, office workload, and requests for additional affidavits can significantly extend the process.

There is ordinarily no charge for making a police blotter entry. Filing a criminal complaint commonly does not involve a filing fee comparable to a civil case, but you may incur expenses for:

Notarization.
Photocopying and printing.
Certified records.
Transportation.
Medical or psychological documentation.
Translations.
Apostille or consular services.
Private legal representation.

Confirm current requirements with the specific office because local practices can differ.

Common Mistakes After Filing a Blotter

Assuming the blotter automatically starts the case

A blotter records the incident. Follow up with the assigned investigator and ask what sworn complaint, referral, or prosecutor filing is required.

Blocking or reporting before saving evidence

Blocking may remove access to the account or conversation. Preserve the content first unless immediate blocking is necessary for safety.

Saving only cropped screenshots

A cropped image may hide the account identity, date, URL, or context. Keep full-screen originals and the original device.

Deleting the victim’s own account

Deleting your account may eliminate messages, metadata, login records, and platform-report history that investigators need.

Responding with threats

A retaliatory threat can create a separate complaint against you and may complicate the original case. Keep responses minimal, non-threatening, and focused on safety.

Publicly doxxing the suspected sender

Publishing someone’s address, identification, family details, or workplace can expose you to privacy, harassment, or defamation claims—particularly if you identify the wrong person.

Filing against only a display name

Include the account URL, numerical profile ID when available, linked email addresses, phone numbers, payment accounts, prior usernames, and other identifiers.

Waiting for the harassment to become worse

Delay can cause loss of platform data and may create prescription issues. Preserve and report serious conduct promptly.

Exaggerating or editing evidence

Describe exactly what happened. Do not insert missing words, alter dates, combine separate messages into a misleading image, or claim that an account is confirmed when it is only suspected.

Special Situations

The sender is a spouse, former partner, or dating partner

For a woman threatened or repeatedly harassed by a husband, former husband, boyfriend, former boyfriend, dating partner, sexual partner, or father of her child, RA 9262 may provide remedies beyond an ordinary criminal complaint.

Online stalking, repeated degrading messages, threats, humiliation, and conduct causing mental or emotional anguish may support a psychological-violence complaint when the statutory relationship and other elements are present. Protection orders may prohibit contact, threats, harassment, or approaching specified places. (Lawphil)

The account is fake or anonymous

Preserve every technical and contextual clue:

Exact profile URL.
User ID or channel ID.
Previous usernames.
Linked phone numbers or email addresses.
Payment requests and account names.
Delivery addresses.
Shared photographs.
Voice recordings.
Writing patterns.
Mutual contacts.
Login-alert emails.
Dates and times of activity.

Do not publicly accuse a suspected person unless identity is properly established.

The threatener or victim is outside the Philippines

A person abroad may still report conduct connected to the Philippines, but jurisdiction, venue, evidence authentication, and access to foreign platform records can complicate the case.

A complainant executing an affidavit abroad may be asked to use:

A Philippine embassy or consulate for notarization.
A local notary followed by an apostille, when applicable.
Consular authentication when the country is outside the Apostille Convention.
A certified English translation for foreign-language documents.

The Philippines has applied the Apostille Convention since 2019. The receiving prosecutor or investigating office should confirm the exact form required before documents are sent internationally. (Philippine Embassy in New Delhi)

Bring or submit a passport copy, local address, Philippine contact details, and all available account information. Cross-border platform requests commonly take longer than purely domestic investigations.

The harassment involves work or school

Report the conduct through the employer’s, university’s, or school’s disciplinary and safety procedures, especially when the sender is a co-worker, manager, teacher, student, or member of the same organization.

Administrative action may help stop contact, preserve institutional records, or impose workplace or school restrictions. It does not prevent a separate criminal complaint when the conduct violates Philippine law.

Frequently Asked Questions

Is a police blotter enough to have the sender arrested?

No. A blotter records the allegation but does not by itself establish criminal liability or authorize an arrest. Police and prosecutors still need evidence of an offense and evidence connecting the respondent to it.

Can police identify a fake Facebook or social media account?

Sometimes. Identification may require preserved platform records, subscriber information, IP-related evidence, phone or email records, witness testimony, and lawful cybercrime warrants. Success is not guaranteed, especially when data has been deleted or routed through foreign services.

Should I block the person immediately?

Preserve the messages, account URL, username, dates, and surrounding context first when it is safe to do so. Block immediately when continued contact creates an urgent safety or emotional risk, but try to save the evidence beforehand.

Is one screenshot enough to file a complaint?

One screenshot may justify an initial report, but a stronger complaint includes full conversations, account links, exports, the original device, a timeline, and evidence showing who operated the account.

Do I need a lawyer to file?

You may personally report to the police, PNP Anti-Cybercrime Group, NBI, or prosecutor. A lawyer can be particularly helpful when the sender is anonymous, several offenses may apply, the case involves an intimate partner, or the evidence must be obtained from foreign platforms.

Can I file a case if the threat was sent in a private message?

Yes. A private message may support a threat, coercion, stalking, Safe Spaces Act, or RA 9262 complaint depending on its contents and circumstances. Public posting is not required for every offense.

What if the sender says the message was only a joke?

Calling a threat a joke does not automatically remove liability. Authorities examine the actual words, context, relationship, prior conduct, apparent intent, and whether the message reasonably conveyed a threat.

Can I seek a restraining or protection order?

A woman covered by RA 9262 may seek a barangay, temporary, or permanent protection order against a qualifying intimate partner or former partner. Other victims may have different remedies depending on the offense and pending court proceedings.

What should I do if the police tell me to settle privately?

You may consider a safe and lawful settlement for minor disputes, but you should not be pressured to meet a threatening person, waive rights, or participate in confrontation. Serious threats, intimate-image abuse, stalking, domestic violence, and continuing danger require proper investigation and protective measures.

Can I file both a criminal complaint and a platform or privacy complaint?

Yes, when the facts support them. A platform report may remove content, an NPC complaint may address misuse of personal data, and a criminal complaint may pursue offenses such as grave threats, online sexual harassment, or unlawful sharing of intimate images. Each process serves a different purpose.

Key Takeaways

A police blotter creates an official record, but it is usually only the beginning of the legal process.
Preserve complete, unedited electronic evidence before blocking, deleting, or reporting the account.
Record URLs, usernames, profile IDs, phone numbers, email addresses, dates, and all available identifying details.
Ask for referral to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, Women and Children Protection Desk, or prosecutor as the situation requires.
Request prompt preservation of platform data, particularly for fake, deleted, or disappearing accounts.
Prepare a clear complaint-affidavit supported by organized and labeled attachments.
Serious or immediate threats should be treated as safety emergencies, not merely online disagreements.
The correct legal remedy depends on the content of the messages, the parties’ relationship, the identity evidence, and whether the conduct involves threats, sexual harassment, intimate images, defamation, stalking, or personal-data misuse.