If your Facebook, email, GCash, Maya, online banking, Instagram, Lazada, Shopee, work account, or other online account was hacked in the Philippines, treat it as both a security emergency and a possible legal case. Your first priorities are to stop the attacker’s access, preserve evidence before it disappears, report money-related losses immediately, and file the right complaint with the proper agency. Philippine law recognizes several offenses that may apply, including illegal access, identity theft, computer-related fraud, hacking, access device fraud, financial account scamming, and data privacy violations.

What “online account hacking” means under Philippine law

In everyday language, “hacked” usually means someone got into your account without permission. Legally, the exact offense depends on what the attacker did.

Examples:

What happened	Possible legal issue
Someone logged in to your email or social media without permission	Illegal access under the Cybercrime Prevention Act
Someone changed your password, deleted files, or locked you out	Data interference or system interference
Someone used your name, photos, ID, or account to scam others	Computer-related identity theft, estafa, or fraud
Someone transferred money from your bank or e-wallet	Computer-related fraud, access device fraud, financial account scamming
Someone stole login credentials, OTPs, or card details	Misuse of devices, access device fraud, phishing-related offenses
A company failed to protect your personal data or ignored a breach	Data Privacy Act issue before the National Privacy Commission

The main Philippine cybercrime law is Republic Act No. 10175, the Cybercrime Prevention Act of 2012. It penalizes, among others, illegal access to a computer system, data interference, system interference, misuse of devices, computer-related fraud, and computer-related identity theft. The law also gives jurisdiction to Regional Trial Courts and recognizes special cybercrime courts. (Supreme Court E-Library) (Supreme Court E-Library) (Supreme Court E-Library)

Immediate steps to take within the first hour

1. Secure your account and devices

Use a clean device if you suspect your phone or laptop has malware.

Do these immediately:

Change the password of the hacked account.
Change the password of your email account connected to password recovery.
Turn on two-factor authentication or multi-factor authentication.
Log out all active sessions.
Remove unknown devices, apps, extensions, recovery emails, and recovery numbers.
Check forwarding rules in email accounts.
Update your phone, computer, browser, and antivirus tools.
Change passwords for accounts using the same or similar password.

If the attacker changed your password, use the platform’s account recovery page. For social media accounts, report the account as hacked through the official help center. Avoid paying anyone who claims they can “recover” the account through unofficial methods; this often leads to a second scam.

2. Preserve evidence before reporting or deleting anything

Many victims panic and delete messages, posts, transaction alerts, or suspicious emails. That can hurt the case.

Save the following:

Screenshots of login alerts, password reset emails, suspicious posts, chats, comments, and transaction notices
URLs or profile links of suspicious accounts
Email headers, if available
Date and time of each incident
Device names, IP addresses, or locations shown in security logs
Bank, e-wallet, or card transaction reference numbers
Names, usernames, phone numbers, account numbers, and wallet numbers used by the attacker
Proof that the account belongs to you, such as old emails, IDs, account settings, or billing records
Any demand messages, threats, blackmail, or scam conversations

For stronger evidence, keep the files in their original form where possible. Screenshots are useful, but original emails, downloadable logs, PDF statements, SMS messages, and transaction confirmations are better.

3. Notify your bank, e-wallet, or card issuer immediately

If money was transferred, report it first to the bank, credit card company, or e-wallet provider through official channels. Ask them to:

Freeze or temporarily restrict the account, card, or wallet
Block suspicious transactions if still pending
Issue a case or ticket number
Provide written confirmation of your report
Investigate the recipient account or wallet
Preserve logs and transaction details

This is time-sensitive. Some transfers become harder to reverse once the funds are withdrawn or moved through several accounts.

For unresolved complaints against BSP-supervised financial institutions, the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism generally requires the consumer to report first to the financial institution’s own complaint channel before escalating to BSP. BSP’s consumer assistance page also allows complaints through its BSP Online Buddy and CIR form. (Bangko Sentral ng Pilipinas) (Bangko Sentral ng Pilipinas)

Legal bases in the Philippines

Cybercrime Prevention Act: RA 10175

Under RA 10175, the following offenses commonly appear in hacked-account cases:

Illegal access — accessing all or part of a computer system without right.
Data interference — intentionally or recklessly altering, damaging, deleting, or deteriorating computer data without right.
System interference — interfering with a computer or network by inputting, transmitting, damaging, deleting, or suppressing data or programs.
Misuse of devices — using, producing, selling, distributing, or possessing hacking tools, passwords, access codes, or similar data intended for cybercrime.
Computer-related fraud — unauthorized input, alteration, deletion, or interference with a computer system that causes damage with fraudulent intent.
Computer-related identity theft — acquiring, using, misusing, transferring, possessing, altering, or deleting another person’s identifying information without right. (Supreme Court E-Library) (Supreme Court E-Library)

RA 10175 also provides that crimes under the Revised Penal Code or special laws may be covered when committed through information and communications technology, with penalties generally one degree higher. This matters when hacking is used to commit estafa, threats, coercion, unjust vexation, falsification, or other offenses. (Supreme Court E-Library)

Data Privacy Act: RA 10173

The Data Privacy Act of 2012, or RA 10173, protects personal information in government and private-sector information systems. It gives data subjects rights to access, correction, blocking, removal, destruction of unlawfully obtained or unauthorized data, and indemnity for damages in proper cases. (National Privacy Commission) (National Privacy Commission)

This law may apply when:

A company’s weak security exposed your account or personal data.
Your ID, phone number, address, photos, or other personal information were misused.
A platform, school, employer, online lender, merchant, or service provider failed to secure your information.
You asked a company to act on a privacy violation and it ignored you.

Personal information controllers must implement reasonable organizational, physical, and technical security measures. They must also notify the National Privacy Commission and affected data subjects when sensitive personal information or information usable for identity fraud is reasonably believed to have been acquired by an unauthorized person and is likely to create a real risk of serious harm. (National Privacy Commission)

Access Devices Regulation Act: RA 8484 as amended by RA 11449

If the hacked account involves credit cards, debit cards, ATM cards, payment cards, account numbers, PINs, online banking credentials, or e-wallet access, RA 8484, as amended by RA 11449, may apply.

RA 8484 defines an access device broadly to include cards, codes, account numbers, PINs, and other means of account access that can obtain money, goods, services, or transfer funds. (Lawphil)

RA 11449 modernized the law by adding concepts such as hacking, card skimming, payment cards, applications, and online banking. It also penalizes accessing any application, online banking account, credit card account, ATM account, or debit card account in a fraudulent manner, even if no monetary loss results. (Supreme Court E-Library)

Anti-Financial Account Scamming Act: RA 12010

For bank and e-wallet account scams, Republic Act No. 12010, the Anti-Financial Account Scamming Act, is also important. It covers financial account scamming, money muling, and social engineering schemes involving financial accounts. The law recognizes that usernames, passwords, bank account details, credit card information, e-wallet information, and other electronic credentials may be “sensitive identifying information.” (Lawphil)

This may matter if the hacker convinced you to reveal an OTP, used your account as a mule account, or transferred stolen funds through another person’s bank or e-wallet.

Where to report a hacked online account in the Philippines

Situation	Where to report	Practical notes
Hacked account with no money loss yet	Platform help center, PNP Anti-Cybercrime Group, or NBI Cybercrime Division	Preserve proof before account recovery if possible
Bank, card, or e-wallet loss	Bank/e-wallet/card issuer first; then BSP if unresolved; law enforcement for criminal complaint	Get ticket numbers and written responses
Scam messages, phishing, impersonation	CICC 1326 hotline, PNP ACG, NBI CCD	Fast reporting helps trace accounts and numbers
Privacy breach by a company, school, employer, or platform	National Privacy Commission	Usually requires prior written notice to respondent
Threats, blackmail, sexual extortion, or doxxing	PNP ACG or NBI CCD immediately	Do not negotiate or send more money/images
Identity used to scam others	PNP ACG or NBI CCD, plus platform reports	Publish a careful notice only if needed; avoid accusing named persons without proof

The NBI Cybercrime Division citizen’s charter describes investigative assistance for victims of computer crimes. It states that the general public may request assistance, with complaint filing, preliminary interview, sworn statements, and examination of relevant devices as part of the process. (National Bureau of Investigation)

The Cybercrime Prevention Act names the NBI and PNP as the law enforcement authorities responsible for cybercrime enforcement and requires them to organize cybercrime units or centers handled by special investigators. (Supreme Court E-Library)

How to file a cybercrime complaint step by step

1. Prepare a clear incident timeline

Write a simple chronology:

When you last had normal access
When you discovered the hacking
What changed in the account
What the attacker did
What money or data was lost
What steps you took to secure the account
Who you already reported to
Ticket numbers, case numbers, or reference numbers

Use exact dates and times. If you are abroad, indicate the time zone.

2. Prepare your evidence folder

Create one folder with subfolders such as:

01 Identity and ownership proof
02 Screenshots
03 Emails and login alerts
04 Transaction records
05 Platform reports
06 Bank or e-wallet reports
07 Witness statements

Do not alter metadata if you can avoid it. Keep originals. Make backup copies.

3. Execute a complaint-affidavit or sworn statement

A complaint-affidavit is a sworn written statement explaining what happened and why you are filing a complaint. It should usually contain:

Your full name, address, contact number, and email
Your relationship to the account
Facts showing account ownership
Details of unauthorized access
Losses suffered, if any
Names, usernames, phone numbers, wallet numbers, account numbers, URLs, or other identifiers of the suspect, if known
A list of attached evidence
A statement that the facts are based on your personal knowledge or authentic records

In practice, law enforcement may help you prepare a complaint sheet or take your sworn statement. If you already prepared an affidavit, bring printed copies and digital copies.

4. File with the NBI Cybercrime Division or PNP Anti-Cybercrime Group

Bring:

Valid government ID
Complaint-affidavit or prepared narrative
Printed screenshots and digital copies
Device used, if relevant and safe to bring
Bank/e-wallet/card statements
Platform ticket numbers
Proof of account ownership
Contact details of witnesses
Authorization or special power of attorney if filing for someone else

For serious cases, law enforcement may evaluate whether preservation requests, disclosure requests, warrants, subpoenas, or coordination with service providers are needed.

5. Follow through with the prosecutor’s office if a criminal case is referred

After investigation, cybercrime complaints may be referred for preliminary investigation before the prosecutor. The prosecutor determines whether there is probable cause to file an Information in court.

Because cybercrime cases often depend on platform logs, IP records, subscriber information, and transaction trails, delays can happen when evidence is held by foreign platforms or private companies. RA 10175 allows preservation of computer data and disclosure of subscriber, traffic, or relevant data through proper legal processes, including court warrants where required. (Supreme Court E-Library)

Why speed matters: preservation of electronic evidence

Electronic evidence can disappear quickly. Platforms may delete logs after a retention period. Scammers may change usernames, deactivate accounts, wipe chats, or move money through mule accounts.

Under RA 10175, traffic data and subscriber information relating to communication services are preserved for a minimum period of six months from the transaction, and content data may be preserved for six months from receipt of a law enforcement preservation order. Law enforcement may order a one-time six-month extension. (Supreme Court E-Library)

The Supreme Court’s Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, governs applications and court orders involving preservation, disclosure, interception, search, seizure, examination, custody, and destruction of computer data.

Filing a privacy complaint with the National Privacy Commission

A privacy complaint is different from a cybercrime complaint. You usually file with the NPC when your issue is against an organization that mishandled, failed to protect, unlawfully processed, or failed to act on your personal data.

Examples:

A company account was hacked because the company failed to secure your personal data.
A lending app, merchant, employer, school, or platform exposed your ID or contact list.
Your personal data was used for identity fraud and the organization ignored your request.
You asked for correction, blocking, deletion, or explanation and received no proper action.

The NPC says a formal complaint must be filed in a specific format, printed and filled out, notarized, and submitted personally, by courier, or by scanned email. (National Privacy Commission)

The NPC’s complaint mechanics also state that data subjects, authorized representatives with a special power of attorney, and the NPC on its own initiative may file complaints. Complaints should include evidence and witness affidavits. In general, the complainant must first inform the respondent in writing and give it a chance to address the issue; proof of this written notice must be attached, and no response within 15 calendar days may satisfy this exhaustion requirement. (National Privacy Commission)

Special situations

My Facebook or Instagram was hacked and used to borrow money

Report the account to the platform immediately. Screenshot the fake messages and list the people contacted. If money was sent, ask the sender to preserve the transaction receipt and file their own report with the bank, e-wallet, or law enforcement.

If you post a public warning, keep it factual:

“My account was compromised.”
“Please disregard messages asking for money.”
“I have reported this to the platform and authorities.”

Avoid naming a suspected person unless you have reliable evidence. Wrong accusations can create separate legal problems.

My GCash, Maya, or online banking account was emptied

Report to the provider immediately and ask for a ticket number. Change your email and mobile security settings. If your SIM was lost, replaced, or ported without permission, report to the telco as well.

File a criminal complaint if there was unauthorized access or transfer. If the provider’s response is delayed or unsatisfactory, escalate through BSP consumer assistance after first using the provider’s own complaint channel. (Bangko Sentral ng Pilipinas) (Bangko Sentral ng Pilipinas)

My email was hacked and used to access everything else

Email is often the “master key.” After recovering it, check:

Recovery email and phone number
Mail forwarding rules
App passwords
Connected third-party apps
Cloud storage
Password manager
Bank and e-wallet alerts
Social media password resets

Then notify important contacts that your email was compromised, especially if business invoices, payment instructions, or confidential documents were involved.

I am outside the Philippines

Filipinos abroad and foreigners may still report incidents connected to the Philippines, especially if the victim, suspect, account, device, bank, e-wallet, or damage is connected to the country. RA 10175 gives Philippine courts jurisdiction where elements are committed in the Philippines, a computer system is wholly or partly situated in the Philippines, or damage is caused to a person who was in the Philippines when the offense was committed. (Supreme Court E-Library)

If you need to submit affidavits from abroad, Philippine agencies may require notarization, consular acknowledgment, or apostille depending on where the document was executed and how it will be used. DFA apostille guidance explains that apostille is used for Philippine public documents for use abroad, while foreign documents for use in the Philippines generally follow the authentication or apostille process of the issuing country. (Apostille Services) (Philippine Embassy)

The hacker is unknown

Most cybercrime complaints start with an unknown suspect. That is normal. Provide identifiers instead:

Username
Profile URL
Email address
Phone number
Wallet number
Bank account number
IP address shown in logs
Transaction reference number
Device name or location shown in login history

Law enforcement may use legal processes to request subscriber, traffic, or account information from service providers.

Common mistakes that weaken hacked-account cases

Deleting chats, emails, or posts before saving evidence
Reporting only to the platform and not to the bank or law enforcement when money is involved
Waiting weeks before reporting financial transfers
Sending more money to “recover” an account or stop blackmail
Posting accusations online without proof
Using edited screenshots only, with no original files
Failing to get ticket numbers from banks, e-wallets, platforms, or agencies
Filing with the NPC without first sending written notice to the respondent when exhaustion of remedies is required
Ignoring email security after recovering a social media account
Using the same password again after recovery

Documents and evidence checklist

Document or evidence	Why it matters
Valid ID	Establishes identity of complainant
Proof of account ownership	Shows the hacked account belongs to you
Screenshots with date/time	Captures visible evidence before deletion
Original emails and login alerts	Helps trace access, devices, and recovery attempts
Transaction receipts	Shows financial loss and recipient details
Bank/e-wallet ticket number	Proves timely reporting
Platform report confirmation	Shows you used official recovery/reporting channels
Complaint-affidavit	Formal sworn narration for law enforcement or prosecutor
Witness affidavits	Useful if others received scam messages or sent money
Special power of attorney	Needed if someone files for you
Notarization, consular acknowledgment, or apostille	May be needed for affidavits executed abroad

Frequently Asked Questions

Can I file a case if my online account was hacked but no money was stolen?

Yes. Illegal access, identity theft, data interference, system interference, or fraudulent access to an online account may still be legally relevant even without actual money loss. RA 10175 and RA 11449 both recognize offenses that may apply even before or without completed financial loss, depending on the facts. (Supreme Court E-Library) (Supreme Court E-Library)

Should I report to the NBI or PNP?

Either may be appropriate for cybercrime complaints. RA 10175 identifies both the NBI and PNP as cybercrime law enforcement authorities. In practice, victims often choose based on location, urgency, availability, and whether a regional cybercrime unit is accessible. (Supreme Court E-Library)

Is a hacked Facebook account a cybercrime in the Philippines?

It can be. If someone accessed your account without permission, used your identity, sent scam messages, altered data, or locked you out, the facts may fall under illegal access, computer-related identity theft, computer-related fraud, or related offenses.

What if the hacker is in another country?

You may still report in the Philippines if there is a Philippine connection, such as a Filipino victim, Philippine bank or e-wallet, Philippine-based damage, or a computer system partly situated in the Philippines. Cross-border cases are slower because they may require platform cooperation, mutual legal assistance, or coordination through proper channels.

Can the barangay handle a hacked-account case?

Barangays can help document incidents or disputes involving known local persons, but cybercrime investigation usually needs the PNP Anti-Cybercrime Group, NBI Cybercrime Division, prosecutors, and courts. Do not rely only on barangay blotter if money was stolen, threats were made, or electronic evidence may disappear.

Can I recover stolen money from a hacked e-wallet or bank account?

Sometimes, but it depends on how quickly you reported, whether the funds are still traceable or frozen, the provider’s findings, and the applicable rules. Report immediately to the provider, get a ticket number, request investigation and preservation of records, and escalate to BSP if the provider’s response remains unresolved after using its complaint channel. (Bangko Sentral ng Pilipinas)

Can I file with the National Privacy Commission and the NBI at the same time?

Yes, if there are separate issues. The NBI or PNP handles criminal cybercrime investigation. The NPC handles data privacy violations, such as mishandling of personal data by an organization. The same incident may involve both, but the complaints have different purposes and requirements.

Do screenshots count as evidence?

Screenshots can help, but they are stronger when supported by original emails, account logs, transaction records, URLs, device logs, sworn statements, and platform or bank confirmations. Keep originals and avoid editing files.

What if someone used my hacked account to scam my friends?

Tell affected contacts immediately and ask them to preserve the messages and receipts. They may need to file their own report if they lost money. You should also file a report showing your account was compromised and used without your consent.

Can I sue the platform or company for failing to protect my account?

Possibly, but it depends on the facts, the platform’s duties, its security measures, its response, and whether Philippine jurisdiction and data privacy rules apply. For Philippine organizations that control or process your personal data, the Data Privacy Act may provide rights to access, correction, blocking, removal, destruction, complaint, and indemnity in proper cases. (National Privacy Commission)

Key Takeaways

A hacked online account in the Philippines may involve cybercrime, data privacy, access device fraud, or financial account scamming laws.
Secure the account first, but preserve evidence before deleting anything.
Report financial losses immediately to the bank, e-wallet, or card issuer and get a ticket number.
File cybercrime complaints with the NBI Cybercrime Division or PNP Anti-Cybercrime Group when there is unauthorized access, identity misuse, fraud, threats, or financial loss.
File with the National Privacy Commission when the issue involves misuse, exposure, or poor protection of personal data by an organization.
Act quickly because electronic logs, chats, accounts, and transaction trails can disappear.
Keep originals, screenshots, transaction records, platform reports, and sworn statements organized.
If you are abroad, prepare for notarization, consular acknowledgment, or apostille requirements for documents executed outside the Philippines.