Quick answer

If someone is demanding money, property, a sexual act, access to an account, or any other benefit while threatening violence, exposure, humiliation, prosecution, or release of private material:

Call 911 immediately if anyone is in danger, the person is nearby, a weapon is involved, or a meeting is being forced.
Preserve the evidence before blocking or reporting the account. Save the complete conversation, account details, payment instructions, voice messages, and transaction records.
Do not make another payment, meet the person alone, or try to trap or threaten them yourself.
Report the incident to the nearest police station, the PNP Anti-Cybercrime Group for an online incident, or the NBI Cybercrime Division. For cybercrime intake and referral, you may also call the government’s 1326 hotline.
If money was transferred, immediately notify both the sending bank or e-wallet and, if identifiable, the receiving institution. Ask that the transaction and recipient account be flagged and traced.

You can report even if you did not pay and even if the offender used an anonymous or overseas account. “Blackmail” or “extortion” is not always the formal name of the charge in the Philippines. Depending on the precise threat and demand, the conduct may constitute threatening publication for compensation, grave or light threats, coercion, robbery, an intimate-image offense, gender-based online sexual harassment, violence against women and children, or another offense.

If there is an immediate safety risk

Treat the matter as an emergency if the offender:

Is outside your home, workplace, or school;
Is following or stalking you;
Has a weapon or has threatened immediate physical harm;
Is forcing an in-person meeting;
Knows where a child or vulnerable person is;
Threatens to harm themselves or another person immediately; or
Has started carrying out the threatened violence.

Call the nationwide Unified 911 emergency number and move to a populated or secured place if you can do so safely. Tell a trusted person where you are. Do not confront the offender or travel to a requested meeting place.

If the threat is from a current or former intimate partner, contact the police Women and Children Protection Desk and ask about an immediate protection order under the Anti-Violence Against Women and Their Children Act.

What offense may apply

The correct charge depends on the offender’s exact words, the threatened harm, what was demanded, whether anything was taken, the relationship between the parties, and whether a phone, computer, or online service was used.

Conduct	Law that may apply	Important distinction
Threatening to publish a libel concerning a person or their family, or offering to prevent publication in exchange for compensation	Article 356 of the Revised Penal Code	The penalty is arresto mayor, a fine of ₱40,000 to ₱400,000, or both. The provision specifically refers to threatened publication of a libel or an offer to prevent it for compensation.
Threatening a crime while demanding money or imposing another condition	Article 282, grave threats	Liability and the penalty can depend on the threatened crime and whether the offender achieved the demanded purpose. Payment is not required before a threat may be reported.
Making a conditional threat to commit a wrongful act that is not itself a crime	Article 283, light threats	This may cover some harmful conditional threats that do not fall under grave threats.
Using violence, threats, or intimidation to compel someone to do something against their will, or prevent a lawful act	Article 286, grave coercions	The compelled act may itself be right or wrong; the issue is the unlawful use of force, threat, or intimidation without legal authority.
Taking personal property or obtaining money through violence or intimidation	Articles 293 and 294, robbery	The classification and penalty depend on how the taking occurred and whether injury or other aggravating circumstances were involved.
Threatening or sharing sexual images without consent	Republic Act No. 9995, the Safe Spaces Act, or other special laws	Consent to create or possess an intimate image does not necessarily mean consent to copy, publish, or distribute it.
Sexual extortion or threatened distribution of sexual material involving a child	Republic Act No. 11930	A child’s apparent consent does not legalize the conduct. Special handling and reporting protections apply.

The relevant Revised Penal Code provisions and amended fines are found in Act No. 3815 and Republic Act No. 10951.

When an offense under the Revised Penal Code or another special law is committed by, through, or with the use of information and communications technology, Section 6 of the Cybercrime Prevention Act may apply. It generally imposes a penalty one degree higher than the penalty under the underlying law.

A legitimate demand is not automatically extortion. For example, a creditor may demand payment of a real debt and warn that lawful collection proceedings will be filed. But threatening violence, unlawful exposure, fabricated accusations, or another wrongful act to force payment can cross the line. The fact that some information is true does not, by itself, make every threat or demand lawful.

Preserve evidence before blocking the account

If it is safe to wait a few minutes before blocking the offender, preserve:

The complete conversation, including messages before and after the threat;
Screenshots showing dates, times, usernames, phone numbers, and platform names;
A screen recording that shows the account profile and scrolls through the full conversation;
Profile links, user IDs, channel names, group names, email addresses, and URLs;
Original emails, including their full headers where available;
Voice messages, voicemails, call logs, and any recording the offender sent;
Payment demands, QR codes, bank or e-wallet details, cryptocurrency addresses, and transaction references;
Receipts and confirmation messages for any payment already made;
Photographs of physical letters, packages, or damage;
Names and contact details of witnesses;
A short chronology stating when each threat, demand, payment, or disclosure happened; and
Medical, counseling, workplace, or school records relevant to harm caused by the incident.

Keep the original device and original files. Make at least one secure backup. Avoid cropping, annotating, filtering, or repeatedly converting evidence. If you create a copy, retain the untouched original and note when and how the copy was made.

Electronic documents and accurate printouts may be admitted in evidence if properly presented and authenticated under the Rules on Electronic Evidence. Context and reliable preservation matter; one isolated screenshot may not show who controlled the account or what the full exchange meant.

Do not circulate intimate images to friends, relatives, group chats, or social media as “proof.” If a child appears in the material, do not download, duplicate, or forward it unnecessarily. Preserve the message and account information and show the material directly to the authorized investigator.

Be cautious about secretly recording a private telephone or in-person conversation. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without the authorization of all parties, and the Supreme Court has applied the prohibition even to a participant in the conversation. Preserve existing chats and voicemails and ask an investigator or lawyer before making a covert recording.

Where and how to report

Police

Go to the nearest PNP station. For an online incident, ask for referral to the PNP Anti-Cybercrime Group. If the victim is a woman or child, or the conduct is sexual or intimate-partner violence, ask for the Women and Children Protection Desk.

Explain that you want the incident formally recorded and investigated. An initial blotter entry can document the report, but the investigator may also require a sworn statement or complaint-affidavit for further action.

National Bureau of Investigation

You may submit an initial report through the NBI Online Complaint page or go to the NBI Cybercrime Division or a regional cybercrime office.

Under the NBI’s published investigative-assistance procedure, a complainant may be interviewed, complete and swear to a complaint sheet, provide supporting documents, and present a relevant device for examination. Witnesses may be asked to execute sworn statements. The NBI states that its investigative service has no fee.

An online submission may be only the beginning of the process. Be prepared to appear, verify your identity, execute a sworn statement, and provide the original evidence.

Cybercrime hotline

For online scams, cyberfraud, or cyber-enabled blackmail, call the government’s 1326 hotline, which the Department of Information and Communications Technology describes as a 24/7 reporting and referral channel. You may also use the CICC reporting portal.

The hotline is not a substitute for 911 during an emergency or for a sworn criminal complaint when one is required.

Bank or e-wallet

If money was sent:

Contact the financial institution through the number or channel shown in its official app, website, or the back of your card.
Report the transaction as connected to threats or unlawful activity.
Request a case or reference number.
Ask whether the recipient account and remaining funds can be flagged, traced, or temporarily held.
Notify the receiving institution if it can be identified.
Preserve every response and acknowledgment.

The Anti-Financial Account Scamming Act permits regulated institutions, under applicable BSP rules, to investigate disputed transactions and temporarily hold disputed funds when statutory grounds exist. Recovery is not guaranteed, particularly if funds have already been withdrawn or transferred onward.

Complain first through the institution’s formal consumer-assistance mechanism. If the institution does not resolve the complaint, the BSP Consumer Assistance Mechanism may be used for escalation.

What to put in your complaint

Give the investigator a clear factual account:

Who you are and how the offender contacted you;
The exact words or substance of each threat;
What the offender demanded;
The deadline or conditions imposed;
What the offender threatened to do;
Whether the offender appeared able to carry out the threat;
Whether any money, property, password, image, document, or service was given;
The accounts, numbers, devices, or locations used;
Why you believe a particular person may be responsible, clearly separating facts from suspicion;
Whether the threat is continuing;
Whether any material has already been published or sent to others; and
Whether another person, especially a child, is at risk.

Do not exaggerate or fill gaps with guesses. State when you do not know something.

Bring your device, copies of the evidence, transaction records, and identification if available. Before leaving, ask for:

The complaint, blotter, docket, or reference number;
The investigator’s name, unit, and official contact details;
A copy or acknowledgment of your sworn statement;
An inventory or acknowledgment of any device or original item surrendered; and
Written follow-up instructions.

Ask promptly about preserving provider data

Online services may hold subscriber records, traffic data, login records, and content for limited periods. Under Section 13 of the Cybercrime Prevention Act, service providers must preserve specified traffic data and subscriber information for at least six months from the transaction date. Content data must be preserved for six months after receipt of a lawful preservation order, with a possible one-time extension.

Ask the investigator whether a preservation request should immediately be sent to the platform, telecommunications company, email provider, bank, or e-wallet. A victim’s request to customer support is useful, but it does not replace a formal law-enforcement preservation order.

Provider records are not automatically released to a complainant. Section 14 permits law enforcement, with a court warrant and in connection with an officially docketed and assigned complaint, to require disclosure of relevant subscriber, traffic, or other data. Anonymous accounts can therefore be investigated, but identification is not guaranteed.

What may happen after the report

The police or NBI may:

Take a sworn statement and supporting affidavits;
Preserve or examine relevant electronic evidence;
Seek provider, financial, or telecommunications records through lawful process;
Conduct interviews or surveillance;
Coordinate with another police unit, prosecutor, regulator, or foreign authority;
Apply for an appropriate warrant; or
Refer the complaint to the prosecutor for evaluation.

The prosecutor determines whether the evidence supports filing a criminal case and what offense should be charged. A report does not guarantee an immediate arrest, account takedown, recovery of money, or conviction.

For offenses carrying a prescribed imprisonment of at least six years and one day, regular preliminary investigation ordinarily applies. Lower-penalty offenses may follow summary or expedited procedures under current Department of Justice rules. The available remedy after an adverse prosecutor’s resolution and its deadline can differ by procedure—some periods are as short as 10 calendar days, while regular preliminary investigation generally allows 15 calendar days for a motion for reconsideration. Obtain the written resolution promptly and consult counsel immediately rather than assuming one deadline applies to every case.

Special situations

Threats involving intimate images

Do not pay merely because the offender says payment will permanently delete the material. Payment often does not remove existing copies or prevent another demand.

The Anti-Photo and Video Voyeurism Act prohibits specified nonconsensual recording and the copying, reproduction, sale, distribution, publication, or broadcasting of covered sexual images. For prohibited copying and distribution, prior consent to the original recording does not necessarily constitute consent to share it.

Gender-based online sexual harassment under the Safe Spaces Act can include online sexual threats, cyberstalking, intimidation, impersonation, and uploading or sharing sexual media without consent. The PNP Anti-Cybercrime Group receives complaints, while the PNP Women and Children Protection Desk is also designated to handle relevant cases.

After preserving evidence, use the platform’s official nonconsensual-intimate-image reporting process. A platform report is helpful but should not replace a police or NBI report.

If a child is involved

Report immediately to 911 in an emergency, the PNP Women and Children Protection Center or Anti-Cybercrime Group, or the NBI.

Republic Act No. 11930 expressly covers online sexual abuse or exploitation of children, sexual extortion, and certain threats to distribute nude or sexual images of a child, including manipulated or fabricated material. Do not confront the offender alone or circulate the content.

The Council for the Welfare of Children lists Makabata Helpline 1383 and current reporting channels on the IACVAWC report-abuse page. A child should be assisted by a safe adult who is not the suspected offender.

Current or former partner

Threats, coercion, harassment, or psychological abuse by a husband, former husband, current or former dating or sexual partner, or a person with whom a woman has a common child may fall under Republic Act No. 9262. Ask the Women and Children Protection Desk, a social worker, or a lawyer about a barangay protection order, temporary protection order, or permanent protection order.

Do not use private mediation or a face-to-face meeting if it would expose the victim to further coercion or violence.

Workplace or school

Report to law enforcement when a crime may have occurred. An internal report to a school or employer can support immediate protective measures—such as schedule changes, restricted access, or preservation of institutional records—but it does not replace a criminal complaint.

Ask the institution in writing to preserve CCTV footage, access logs, emails, messages, and relevant records before routine deletion.

Anonymous or overseas offender

Report locally and provide every account identifier, URL, phone number, payment destination, time zone, and language used. Philippine courts may have jurisdiction over a cybercrime when an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, or the offense caused damage to a person in the Philippines. Cross-border identification and evidence collection may take longer and can require cooperation from foreign providers or authorities.

Deadlines and barangay conciliation

There is no single “24-hour” or “48-hour” filing deadline for every blackmail or extortion case. Prescription depends on the offense ultimately charged, its prescribed penalty, when it was discovered, and whether a complaint or information interrupted the period under Articles 90 and 91 of the Revised Penal Code. Special laws may have different rules.

Report promptly because:

Threats may escalate;
Platform, CCTV, telecommunications, and financial records may be deleted;
Cybercrime preservation periods are limited;
Funds may be transferred or withdrawn; and
Some legal remedies have short review or reconsideration periods.

Barangay conciliation is not automatically required for every threat or demand. Under Sections 408 and 412 of the Local Government Code, it generally applies only to covered disputes between parties who meet the residence requirements. It excludes, among others, offenses punishable by imprisonment exceeding one year or a fine exceeding ₱5,000. Urgent court action, possible detention, provisional remedies, and an impending prescription period are also treated differently.

Many serious online, sexual, or intimate-image offenses exceed those jurisdictional limits. A lower-level threat between residents of the same city or municipality may still require barangay proceedings before a court case can proceed. This does not prevent an emergency call, a police incident report, evidence preservation, or a request for immediate protection. Let the investigator or prosecutor determine whether a certificate to file action is required.

Common mistakes to avoid

Deleting the conversation after becoming upset;
Saving only the most dramatic message and losing its context;
Cropping out dates, usernames, or platform details;
Paying repeatedly in the hope that the demands will stop;
Meeting or following instructions to “prove” cooperation;
Continuing a risky conversation without guidance from an investigator;
Secretly recording private calls without first checking the law;
Forwarding intimate or child sexual material to friends or unofficial helpers;
Publicly accusing or doxxing a suspected person before identity is verified;
Editing original evidence or surrendering a device without getting an acknowledgment;
Relying only on a platform report;
Delaying because the offender is anonymous or overseas; and
Paying supposed “hackers,” “recovery agents,” or unofficial fixers who promise to erase content or retrieve money.

Use only contact details found on official government, bank, e-wallet, or platform websites. Government investigators should not require payment to “open” a criminal investigation.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if eligible, or a recognized legal-aid organization promptly when:

Violence, stalking, abduction, or an imminent forced meeting is involved;
Intimate material is about to be released or has already been circulated;
A child is involved;
The offender is a current or former partner and protection orders may be needed;
Substantial or repeated payments have been made;
The complaint concerns a public official, employer, school authority, or person with control over the victim;
The police or prosecutor declines the complaint or issues a written resolution;
A device is being requested for forensic examination;
A search, arrest, takedown, or preservation order may be needed urgently; or
The offender or critical provider is abroad.

Frequently asked questions

Can I report if I did not pay?

Yes. A conditional criminal threat may be reportable even when the offender did not achieve the demanded purpose. Preserve the demand and the threat.

What if I already paid?

You can still report. Payment does not waive your rights or make you responsible for the offender’s conduct. Notify the police and the financial institutions immediately, but do not assume the money can be recovered.

Should I block the offender?

Usually, preserve the evidence first. If continued contact is causing danger or severe distress, block immediately after saving what you safely can. If an investigator is already involved, ask whether they want communication preserved or monitored. Do not keep engaging merely to collect more evidence.

What if the threat is to publish true information?

Truth does not automatically resolve the issue. Article 356 specifically concerns threatened publication of a libel, but other provisions on threats or coercion may apply depending on what is demanded and whether the threatened act is wrongful or unlawful. A good-faith warning that lawful proceedings will be filed is different from using intimidation, violence, unlawful disclosure, or fabricated accusations to obtain a benefit.

Do I need to know the offender’s real identity?

No. Report the account, number, link, payment details, and other identifiers. Investigators may seek subscriber or transaction records through lawful process, although attribution may not always be possible.

Do I need a lawyer to make the first report?

No. You may initially report directly to the police, NBI, or an appropriate government hotline. Legal assistance is valuable when preparing a detailed complaint-affidavit, seeking a protection order, responding to a prosecutor’s resolution, or handling a factually complicated case.

Will the offender be arrested immediately?

Not necessarily. A warrantless arrest is allowed only under legally defined circumstances. Otherwise, investigators may need to gather evidence, obtain records, refer the complaint to a prosecutor, and seek a court-issued warrant.

Official sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The applicable offense and procedure depend on the exact messages, documents, relationships, evidence, and surrounding facts. Laws, agency procedures, and contact channels were checked against official sources as of August 2, 2026.