I. Introduction

The rise of digital technology has changed the way Filipinos communicate, transact, work, and do business. It has also created new avenues for criminal activity. Online scams, hacking, identity theft, cyber libel, phishing, sextortion, unauthorized access to accounts, and online harassment are now common concerns for individuals, businesses, schools, professionals, and public officials.

In the Philippines, cybercrime complaints are governed primarily by Republic Act No. 10175, otherwise known as the Cybercrime Prevention Act of 2012, together with the Revised Penal Code, special penal laws, the Rules on Cybercrime Warrants, the Rules on Electronic Evidence, and related issuances of law enforcement agencies and prosecutors.

This article explains, in the Philippine legal context, what cybercrime is, where and how to file a cybercrime complaint, what evidence to prepare, what happens after filing, and what remedies may be available to complainants.

This is a general legal discussion and should not be treated as a substitute for advice from counsel on a specific case.

II. Legal Framework on Cybercrime in the Philippines

A. Cybercrime Prevention Act of 2012

The principal law on cybercrime in the Philippines is the Cybercrime Prevention Act of 2012. It punishes certain acts committed through, against, or by means of computer systems, information and communications technology, or the internet.

The law covers both traditional crimes committed online and offenses that specifically target computer systems or data.

B. Revised Penal Code and Special Laws

Some online acts are punishable not only under the Cybercrime Prevention Act but also under existing penal laws. For example:

Online threats may be prosecuted under the Revised Penal Code;
Online fraud may involve estafa;
Online sexual exploitation may involve child protection laws, anti-trafficking laws, or anti-photo and video voyeurism laws;
Unauthorized use of personal data may involve the Data Privacy Act;
Online libel may involve Article 353 of the Revised Penal Code, as applied through the Cybercrime Prevention Act.

The use of the internet or a computer system may qualify the act as cybercrime or may increase the applicable penalty, depending on the offense charged.

C. Electronic Evidence

Cybercrime cases often rely heavily on electronic evidence. Philippine courts recognize electronic documents, electronic communications, screenshots, metadata, digital files, logs, and related materials, provided their authenticity, integrity, relevance, and admissibility can be established.

Because electronic evidence is vulnerable to alteration, deletion, or fabrication, preservation and proper handling of evidence are crucial.

III. Common Cybercrimes in the Philippines

Cybercrime complaints may involve several kinds of acts. The most common include the following:

A. Illegal Access

Illegal access refers to unauthorized access to a computer system, account, device, server, network, or database. Examples include hacking into an email account, social media account, online banking account, or company database.

B. Illegal Interception

This involves the unauthorized interception of private communications or computer data. It may include unlawful monitoring, capturing, or recording of data transmissions.

C. Data Interference

This involves unauthorized alteration, deletion, deterioration, or suppression of computer data. Examples include deleting company files, changing records, defacing a website, or corrupting a database.

D. System Interference

This refers to acts that seriously hinder or interfere with the functioning of a computer system. Distributed denial-of-service attacks, malware deployment, or intentional disruption of systems may fall under this category.

E. Misuse of Devices

This includes the production, possession, sale, procurement, importation, distribution, or use of devices, programs, passwords, or access codes intended for cybercrime.

F. Cyber-Squatting

Cyber-squatting generally involves the acquisition of a domain name in bad faith, especially where the domain name is identical or confusingly similar to an existing trademark, name, or business identity.

G. Computer-Related Forgery

This involves the input, alteration, or deletion of computer data resulting in inauthentic data, with intent that it be considered or acted upon as authentic.

H. Computer-Related Fraud

This involves the unauthorized input, alteration, or deletion of computer data or interference with a computer system that causes damage or economic loss. Online scams, account takeovers, fake payment confirmations, and phishing-related schemes may fall under this category.

I. Computer-Related Identity Theft

This involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person, whether natural or juridical, without right.

Examples include using another person’s name, photos, government ID, email address, phone number, login credentials, or personal data to commit fraud or deception.

J. Cybersex

Cybersex, as penalized by law, involves the willful engagement, maintenance, control, or operation, directly or indirectly, of lascivious exhibition of sexual organs or sexual activity through a computer system for favor or consideration.

K. Child Pornography and Online Sexual Exploitation

Where minors are involved, stricter laws apply. Online sexual abuse or exploitation of children may involve serious offenses under child protection laws, anti-trafficking laws, and cybercrime laws.

Complaints involving minors must be handled with urgency and sensitivity. Immediate law enforcement intervention is usually necessary.

L. Unsolicited Commercial Communications

Certain forms of unsolicited commercial communications may be punishable if they violate the requirements or exceptions under the law.

M. Cyber Libel

Cyber libel is libel committed through a computer system or similar means. It generally involves a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or contempt a person, made through online publication.

Examples may include defamatory posts on social media, blogs, websites, online forums, or messaging platforms where publication to third persons is present.

IV. Who May File a Cybercrime Complaint?

A cybercrime complaint may generally be filed by:

The person directly injured by the cybercrime;
A parent or guardian, if the victim is a minor;
An authorized representative of a company, corporation, association, or institution;
A public officer or government agency affected by the offense;
A person authorized by law or by the victim to act on their behalf.

For corporations or organizations, the complaint is usually filed by an authorized officer, employee, legal counsel, compliance officer, security officer, or representative. Proof of authority, such as a board resolution, secretary’s certificate, special power of attorney, or written authorization, may be required.

V. Where to File a Cybercrime Complaint in the Philippines

A complainant may consider several possible venues depending on the facts of the case.

A. Philippine National Police Anti-Cybercrime Group

The Philippine National Police Anti-Cybercrime Group, commonly known as the PNP-ACG, receives and investigates cybercrime complaints. It has offices and units that handle online scams, hacking, cyber libel, online threats, identity theft, and other cybercrime-related matters.

A complainant may file a complaint with the PNP-ACG or with a local police station, which may refer the matter to the appropriate cybercrime unit.

B. National Bureau of Investigation Cybercrime Division

The National Bureau of Investigation Cybercrime Division, or NBI-CCD, also investigates cybercrime complaints. It is commonly approached for cases involving hacking, cyber libel, online fraud, account compromise, unauthorized access, impersonation, and other internet-related offenses.

The NBI may conduct technical investigation, request records where legally proper, and refer cases for prosecution.

C. Office of the City or Provincial Prosecutor

A complainant may file a criminal complaint directly with the appropriate Office of the City Prosecutor or Office of the Provincial Prosecutor for preliminary investigation.

In practice, many complainants first go to law enforcement agencies such as the PNP-ACG or NBI-CCD because cybercrime complaints often require technical assistance, preservation of evidence, tracing of accounts, and investigation before a prosecutor can evaluate the case.

D. Department of Justice Office of Cybercrime

The Department of Justice Office of Cybercrime plays an important role in cybercrime policy, coordination, international cooperation, preservation requests, and related matters. In appropriate cases, especially where data preservation or cross-border coordination is involved, DOJ mechanisms may become relevant.

E. Other Agencies Depending on the Offense

Depending on the nature of the cybercrime, other agencies may also be involved:

National Privacy Commission, for personal data breaches or Data Privacy Act issues;
BSP or financial institutions, for bank fraud, e-wallet scams, unauthorized transactions, or phishing;
DICT-related channels, for certain cybersecurity concerns;
DSWD, PNP Women and Children Protection Center, or child protection units, for online exploitation of minors;
SEC or DTI, for scams involving businesses, investments, online sellers, or consumer transactions;
School, employer, platform, or service provider, for immediate administrative or account-related relief.

Filing with the proper agency depends on the offense, urgency, identity of the offender, type of evidence, and relief sought.

VI. Venue and Jurisdiction

Cybercrime cases present unique jurisdictional issues because online acts can happen across cities, provinces, or countries.

In general, venue may be connected to:

The place where the offended party resides;
The place where the complainant accessed, received, or discovered the offending material;
The place where the offender acted;
The place where the computer system, server, device, or account was accessed or affected;
The location where damage occurred;
The location provided by applicable procedural rules or jurisprudence.

Because venue may affect the validity of proceedings, it is often advisable to consult counsel or ask the receiving law enforcement office or prosecutor’s office regarding the proper venue.

For cyber libel, venue may be especially important because libel rules and cybercrime rules may require careful analysis of where the complaint should be filed.

VII. Prescriptive Periods

A complainant should act promptly. Criminal offenses have prescriptive periods, meaning the State may lose the right to prosecute if a complaint is filed too late.

The prescriptive period depends on the offense charged and the applicable penalty. Cybercrime cases may involve penalties under the Cybercrime Prevention Act, the Revised Penal Code, or special laws.

For practical purposes, a complainant should file as soon as possible because online evidence can be deleted, accounts may be deactivated, messages may disappear, IP logs may be overwritten, and platforms may retain records only for limited periods.

Delay can weaken the case even if the complaint is technically still within the prescriptive period.

VIII. Evidence Needed for a Cybercrime Complaint

The strength of a cybercrime complaint often depends on the quality of evidence. A complainant should gather, organize, and preserve evidence before filing.

A. Basic Evidence

The following should usually be prepared:

Screenshots of posts, messages, profiles, emails, websites, transaction pages, or account activity;
URLs or links to the offending content;
Dates and times when the content was posted, received, accessed, or discovered;
Names, usernames, handles, profile links, phone numbers, email addresses, account numbers, wallet numbers, or other identifiers used by the offender;
Copies of emails, chat logs, SMS messages, call logs, or private messages;
Transaction receipts, bank transfer records, e-wallet confirmations, order records, or payment screenshots;
Proof of ownership of compromised accounts;
Proof of identity of the complainant;
Proof of authority, if filing for a company or another person;
A written narration of facts.

B. Screenshots

Screenshots are commonly used, but they should be taken carefully. Each screenshot should show:

The full content complained of;
The account name, username, profile photo, email address, phone number, or other identifier;
The date and time, if visible;
The URL or platform;
The surrounding context, when relevant;
Replies, comments, shares, reactions, or other proof of publication, if relevant.

Avoid cropping screenshots too tightly. If possible, capture the entire page or conversation thread.

C. URLs and Links

For online posts, webpages, social media profiles, videos, and public content, the URL is important. A screenshot without the link may make verification more difficult.

If the content is later deleted, the screenshot and saved URL may still help investigators and prosecutors determine what happened.

D. Electronic Files

If the case involves malware, hacked files, altered documents, fake IDs, forged digital documents, intimate images, or videos, preserve the original files where possible. Do not modify metadata unnecessarily.

Make backup copies, but keep the original file in its original storage location if safe to do so.

E. Devices

In some cases, the complainant’s device may be relevant evidence. This may include phones, laptops, tablets, hard drives, CCTV systems, routers, or storage devices.

Do not reset, reformat, or tamper with a device that may contain evidence. If the device was hacked or infected, disconnect it from the internet if necessary to prevent further damage, but avoid deleting files unless advised by a qualified professional.

F. Affidavits

A cybercrime complaint usually requires a sworn statement or complaint-affidavit. The affidavit should clearly state:

The complainant’s personal circumstances;
The identity of the respondent, if known;
The facts constituting the offense;
The specific online acts complained of;
How the complainant discovered the offense;
The harm suffered;
The evidence attached;
The request for investigation and prosecution.

Supporting witnesses may also execute affidavits.

G. Notarization

Complaint-affidavits and supporting affidavits are generally notarized. Government-issued identification should be brought for notarization.

H. Preservation of Evidence

Because digital evidence can disappear quickly, complainants should preserve evidence immediately. This includes downloading records, saving screenshots, exporting chats, saving emails with headers, preserving receipts, and documenting account activity.

Where appropriate, law enforcement or prosecutors may request preservation of computer data from service providers through proper legal channels.

IX. Practical Steps Before Filing

Before going to law enforcement, a complainant should do the following:

Step 1: Identify the Nature of the Cybercrime

Determine what happened. Was it hacking, identity theft, online fraud, cyber libel, threats, harassment, extortion, unauthorized transaction, or online sexual exploitation?

The nature of the act affects where to file, what evidence is needed, and what laws apply.

Step 2: Preserve Evidence Immediately

Take screenshots, save URLs, export messages, save emails, download receipts, and keep copies of transaction records.

For emails, preserve the full email including headers if possible. For messaging apps, export the conversation if the platform allows it.

Step 3: Do Not Engage Recklessly with the Offender

Avoid threatening the offender, retaliating, hacking back, posting personal information, or publicly accusing someone without legal advice. Such acts may create legal exposure for the complainant.

If communication with the offender is necessary, keep it factual and preserve the exchange.

Step 4: Secure Accounts

Change passwords, enable two-factor authentication, log out of all sessions, revoke suspicious third-party app access, update recovery emails and phone numbers, and notify banks or platforms where necessary.

If an account was hacked, try to preserve evidence before making changes, but prioritize preventing further harm.

Step 5: Notify Banks, E-Wallets, or Platforms

For financial fraud, immediately notify the bank, e-wallet provider, credit card company, online marketplace, or payment platform. Request freezing, reversal, investigation, or preservation of records where available.

For social media abuse, report the offending content to the platform, but preserve evidence before deletion.

Step 6: Prepare a Chronology

Write a clear timeline. Include dates, times, accounts used, amounts paid, conversations, links, and actions taken.

A well-organized chronology helps investigators and prosecutors understand the case.

Step 7: Prepare Identification and Supporting Documents

Bring valid government-issued IDs. If filing on behalf of another person or entity, bring authorization documents.

X. Step-by-Step Guide to Filing a Cybercrime Complaint

Step 1: Choose the Proper Office

The complainant may proceed to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, local police cybercrime desk if available, or the prosecutor’s office.

For urgent cases involving continuing harm, threats, extortion, minors, financial fraud, or account compromise, prompt reporting to law enforcement is strongly advisable.

Step 2: Bring Required Documents

The complainant should bring:

Valid government-issued ID;
Printed complaint-affidavit, if already prepared;
Electronic and printed copies of evidence;
Screenshots with URLs and dates;
Receipts and transaction records;
Chat logs, emails, SMS, and call logs;
Device, if relevant and safe to bring;
Authorization documents, if filing for someone else or a company.

It is useful to bring both hard copies and digital copies stored in a USB drive, external drive, or secure cloud folder.

Step 3: Execute a Complaint-Affidavit

If the complainant has no affidavit yet, the receiving office may provide guidance on what information is needed. However, law enforcement personnel do not act as private counsel. For complex cases, a lawyer may help prepare the complaint-affidavit.

The affidavit must be truthful, specific, and supported by evidence.

Step 4: Submit Evidence

Attach evidence as annexes. Label each annex clearly. For example:

Annex “A” – Screenshot of respondent’s Facebook profile;
Annex “B” – Screenshot of defamatory post;
Annex “C” – URL of post;
Annex “D” – Messenger conversation;
Annex “E” – GCash transaction receipt;
Annex “F” – Bank confirmation email.

Each annex should be referred to in the affidavit.

Step 5: Initial Evaluation

The receiving officer may conduct an initial assessment to determine whether the facts constitute cybercrime and whether additional evidence is needed.

The complaint may be accepted for investigation, referred to another unit, or returned for completion of documents.

Step 6: Investigation

The investigating agency may:

Review the evidence;
Interview the complainant and witnesses;
Identify accounts, phone numbers, IP addresses, devices, or payment channels;
Request preservation of data through proper channels;
Coordinate with platforms, banks, telcos, or other entities when legally permissible;
Conduct digital forensic examination when necessary;
Prepare a referral to the prosecutor.

Law enforcement cannot simply access private accounts, seize devices, or obtain confidential data without following legal procedures.

Step 7: Filing with the Prosecutor

If evidence is sufficient, the law enforcement agency or complainant may file the complaint with the prosecutor’s office for preliminary investigation.

The prosecutor will determine whether there is probable cause to charge the respondent in court.

Step 8: Preliminary Investigation

During preliminary investigation, the respondent is usually given an opportunity to submit a counter-affidavit. The complainant may submit a reply-affidavit if allowed.

The prosecutor may dismiss the complaint, require additional evidence, or recommend filing of an information in court.

Step 9: Court Proceedings

If probable cause is found, an information is filed in court. The case then proceeds through arraignment, pre-trial, trial, and judgment.

The prosecution must prove guilt beyond reasonable doubt.

XI. Contents of a Cybercrime Complaint-Affidavit

A strong complaint-affidavit should contain the following:

A. Caption

The affidavit should identify the complainant, respondent, and nature of the complaint.

B. Personal Circumstances

The complainant should state name, age, citizenship, civil status, address, and contact details.

C. Capacity to File

If filing for a corporation, organization, minor, or another person, the affidavit should state the complainant’s authority.

D. Facts of the Case

The affidavit should narrate the events in chronological order. Avoid vague allegations. State specific facts.

E. Identification of Respondent

If the respondent is known, state their name and details. If unknown, identify available information such as username, account link, phone number, email address, bank account, e-wallet number, IP-related details, or other identifiers.

F. Description of the Offense

The affidavit should explain how the acts constitute cybercrime. It is not necessary for a layperson to use perfect legal terminology, but the facts should clearly show the offense.

G. Damage or Injury

State the harm suffered, such as financial loss, reputational damage, emotional distress, account compromise, business interruption, exposure of private information, or threats to safety.

H. Evidence and Annexes

Refer to each piece of evidence by annex number or letter.

I. Prayer or Request

The complainant may request investigation, filing of appropriate charges, preservation of evidence, and other lawful relief.

J. Verification and Oath

The affidavit must be signed and notarized.

XII. Sample Outline of a Complaint-Affidavit

A cybercrime complaint-affidavit may follow this structure:

Republic of the Philippines City/Municipality of ________ S.S.

Complaint-Affidavit

I, [name], of legal age, Filipino, [civil status], and residing at [address], after being sworn in accordance with law, state:

I am the complainant in this case.
I am filing this complaint against [name/username/unknown person] for acts constituting cybercrime.
On [date], I discovered that [state facts].
The respondent used the account/profile/email/number [details].
The acts complained of were committed through [platform/device/system].
Attached as Annex “A” is [description].
Attached as Annex “B” is [description].
As a result of respondent’s acts, I suffered [damage].
I respectfully request that the matter be investigated and that appropriate criminal charges be filed.

IN WITNESS WHEREOF, I have signed this affidavit on [date] in [place].

[Signature] [Name]

SUBSCRIBED AND SWORN to before me this [date] in [place], affiant exhibiting competent proof of identity.

XIII. Special Considerations for Common Complaints

A. Online Scam or Fraud

For online scams, preserve:

Chat history with the seller or scammer;
Product listing or advertisement;
Profile link or account details;
Payment receipts;
Bank account or e-wallet number;
Delivery records;
Proof that goods or services were not delivered;
Any promises, excuses, or admissions by the scammer.

Immediately report the transaction to the bank, e-wallet provider, online marketplace, or platform.

If the scam involves investment solicitation, securities, lending, cryptocurrency, or business schemes, other regulatory agencies may also be relevant.

B. Hacked Social Media or Email Account

For hacked accounts, preserve:

Account ownership proof;
Login alerts;
Password reset emails;
Unauthorized posts or messages;
Device login history;
Recovery attempts;
Identity documents requested by the platform;
Screenshots of changed email, phone number, or recovery details.

Report the hack to the platform immediately and enable security measures.

C. Cyber Libel

For cyber libel, preserve:

The defamatory post or message;
URL or link;
Date and time of publication;
Identity of the poster;
Proof that third persons saw or accessed the statement;
Comments, shares, reactions, or reposts;
Explanation of why the statement is false and defamatory;
Evidence of damage to reputation.

The complainant should also consider defenses that may be raised, such as truth, fair comment, privileged communication, absence of malice, or lack of identification.

D. Online Threats and Harassment

For threats or harassment, preserve:

Threatening messages;
Account details;
Call logs;
Voice recordings, if lawfully obtained;
History of repeated conduct;
Prior incidents;
Evidence showing fear, alarm, or safety risk.

If there is an immediate threat to life or safety, contact local police or emergency services.

E. Sextortion or Non-Consensual Intimate Images

For sextortion or intimate image abuse, preserve evidence but do not distribute or repost the material. Save communications, threats, account details, payment demands, and links.

If the victim is a minor, the matter should be treated as urgent and reported immediately to authorities.

Victims should avoid negotiating endlessly with extortionists. Payment does not guarantee deletion and may encourage further demands.

F. Identity Theft and Impersonation

For impersonation, preserve:

Fake profile links;
Screenshots of the fake account;
Messages sent by the impersonator;
Evidence that the complainant’s name, photo, or personal data was used;
Proof of confusion or damage;
Reports made to the platform.

If financial accounts or IDs were used, notify banks, government agencies, and affected institutions.

G. Unauthorized Bank or E-Wallet Transactions

For unauthorized transactions, preserve:

Transaction history;
SMS or email alerts;
Bank or e-wallet statements;
OTP-related messages;
Phishing links or fake websites;
Communications with supposed bank representatives;
Report tickets with the financial institution.

Immediately request account blocking, transaction investigation, and preservation of records.

XIV. Cybercrime Warrants and Investigation Tools

Cybercrime investigations may require court-issued warrants. Under Philippine procedure, cybercrime warrants may include warrants to disclose computer data, intercept computer data, search, seize, and examine computer data, and other related processes.

These warrants are important because many forms of digital evidence are private, confidential, or held by third parties.

Law enforcement must observe constitutional rights, privacy rights, and procedural safeguards. Evidence obtained illegally may be challenged in court.

XV. Role of Service Providers, Platforms, Banks, and Telcos

Many cybercrime cases involve third-party records held by platforms, banks, e-wallet providers, telecommunications companies, internet service providers, web hosts, or online marketplaces.

These entities may possess:

Account registration data;
Login records;
IP logs;
Transaction records;
Device identifiers;
Communication logs;
Payment trails;
Subscriber information.

However, complainants usually cannot compel disclosure of confidential records on their own. Law enforcement or prosecutors may need to make proper requests, obtain warrants, or use lawful preservation mechanisms.

XVI. Filing Fees and Costs

Filing a cybercrime complaint with law enforcement generally does not require a private complainant to pay a filing fee. However, practical costs may include:

Printing and photocopying;
Notarization;
Transportation;
Legal consultation;
Technical assistance;
Data recovery or forensic services, if privately obtained.

Court-related fees may arise in separate civil actions or other proceedings.

XVII. Remedies Available to Victims

A cybercrime complainant may seek different forms of relief depending on the facts.

A. Criminal Prosecution

The main remedy is criminal prosecution of the offender. If convicted, the offender may face imprisonment, fine, or both.

B. Civil Liability

A criminal case may include civil liability arising from the offense. The complainant may seek restitution, damages, or indemnity, depending on the case.

C. Independent Civil Action

In some cases, the victim may pursue a separate civil action for damages, injunction, or other relief.

D. Platform Remedies

The complainant may report content, request takedown, recover an account, block the offender, or ask the platform to preserve records.

E. Bank or E-Wallet Remedies

For unauthorized transactions, victims may request freezing, reversal, chargeback, account blocking, or internal investigation.

F. Protective Measures

For threats, harassment, stalking, abuse, exploitation, or domestic violence-related cyber incidents, protective orders or urgent police intervention may be available depending on the circumstances.

XVIII. Rights of the Respondent

A person accused of cybercrime has constitutional and procedural rights, including:

The right to due process;
The right to be informed of the accusation;
The right to counsel;
The right against unreasonable searches and seizures;
The right against self-incrimination;
The presumption of innocence;
The right to confront witnesses in court;
The right to challenge the admissibility of evidence.

Cybercrime enforcement must balance victim protection, public safety, privacy rights, and civil liberties.

XIX. Risks of False or Weak Complaints

A complainant should ensure that the complaint is truthful and evidence-based. Filing a baseless complaint may expose the complainant to legal risks, including possible counterclaims or criminal liability for perjury, malicious prosecution, unjust vexation, libel, or other causes of action depending on the circumstances.

Before filing, review the evidence carefully and avoid exaggeration. State facts, not speculation.

XX. Data Privacy Considerations

Cybercrime complaints often involve personal data. Complainants should avoid unnecessary public disclosure of sensitive personal information, especially IDs, addresses, bank details, private photos, intimate material, or information about minors.

When submitting evidence to authorities, disclose what is necessary for investigation. When posting warnings online, avoid doxxing, defamatory accusations, or publication of sensitive data.

The Data Privacy Act may become relevant when personal information is collected, used, disclosed, or processed without authority.

XXI. Cybercrime Involving Minors

Cases involving minors require special care. These may include online grooming, sextortion, sexual exploitation, cyberbullying, identity theft, threats, or circulation of intimate images.

Parents, guardians, schools, and authorities should prioritize:

Immediate safety of the child;
Preservation of evidence;
Non-distribution of harmful material;
Psychological support;
Reporting to proper child protection and law enforcement agencies;
Confidential handling of the child’s identity.

The child should not be blamed, shamed, or forced to repeatedly recount traumatic events without proper support.

XXII. Cross-Border Cybercrime

Many cybercrimes involve foreign platforms, overseas offenders, international servers, or payment channels outside the Philippines.

Cross-border cases may require:

Preservation requests;
Mutual legal assistance;
Coordination with foreign law enforcement;
Cooperation from multinational platforms;
International data requests;
Longer investigation timelines.

Even if the offender is abroad, a complaint may still be filed in the Philippines if the victim, damage, access, or relevant acts are connected to Philippine jurisdiction.

XXIII. Common Mistakes to Avoid

Complainants should avoid the following mistakes:

Deleting messages or posts before preserving evidence;
Submitting cropped screenshots without URLs or dates;
Failing to record usernames, account links, and transaction details;
Resetting or wiping devices too soon;
Publicly accusing suspects without sufficient proof;
Negotiating with extortionists without preserving evidence;
Waiting too long before reporting;
Sending original devices or files to unverified persons;
Failing to notify banks or platforms immediately;
Filing in the wrong venue without asking for guidance;
Relying only on screenshots when stronger evidence is available;
Failing to execute a clear affidavit.

XXIV. Practical Evidence Checklist

Before filing, prepare the following:

Valid government ID;
Complaint-affidavit;
Witness affidavits, if any;
Screenshots of the offending content;
URLs or links;
Profile links, usernames, phone numbers, emails, account numbers;
Chat logs and exported conversations;
Emails with headers, if available;
SMS and call logs;
Bank, e-wallet, or payment records;
Proof of account ownership;
Proof of company authority, if applicable;
Timeline of events;
Device or storage media, if relevant;
Copies of platform reports or bank complaints;
Printed and digital copies of evidence.

XXV. Suggested Format for Organizing Annexes

A complainant may organize evidence this way:

Annex A – Complainant’s valid ID;
Annex B – Screenshot of respondent’s profile;
Annex C – Screenshot of offending post/message;
Annex D – URL of post/profile;
Annex E – Conversation history;
Annex F – Payment receipt;
Annex G – Bank or e-wallet transaction record;
Annex H – Platform report or ticket;
Annex I – Proof of damage;
Annex J – Other supporting documents.

Each annex should be legible and labeled.

XXVI. What Happens After Filing?

After filing, the complainant should expect some or all of the following:

The complaint will be received and evaluated;
The complainant may be interviewed;
Additional documents may be requested;
Investigators may examine digital evidence;
The case may be assigned to an investigator;
Data preservation or formal requests may be initiated;
The case may be referred to the prosecutor;
The prosecutor may require counter-affidavits and reply-affidavits;
The prosecutor may dismiss the case or file it in court;
If filed in court, trial proceedings will follow.

The process can take time, especially if the offender is unknown, data must be requested from third parties, or the evidence is technically complex.

XXVII. Can a Complaint Be Filed if the Offender Is Unknown?

Yes. A complaint may be filed even if the offender’s real name is unknown. The complainant should provide all available identifiers, such as:

Username;
Profile link;
Email address;
Phone number;
Bank account;
E-wallet number;
IP-related information, if available;
Website domain;
Marketplace account;
Delivery details;
Any other traceable information.

Law enforcement may investigate the identity of the offender through lawful means.

XXVIII. Can Online Content Be Taken Down?

Takedown may be possible, depending on the platform, content, law violated, and urgency. The complainant may report the content directly to the platform while also preserving evidence.

In certain cases, authorities may coordinate with platforms or seek appropriate legal processes. For intimate images, child exploitation material, impersonation, scams, and threats, platforms may act more quickly if reports are complete and properly categorized.

However, takedown does not automatically result in criminal prosecution. A separate complaint may still be needed.

XXIX. Cybercrime Complaint Versus Platform Report

A platform report is not the same as a criminal complaint.

A platform report asks the website, app, marketplace, or social media company to act under its community standards or terms of service. Possible platform actions include content removal, account suspension, warning, account recovery, or restriction.

A criminal complaint asks Philippine authorities to investigate and prosecute a violation of law.

For serious cases, both remedies may be pursued.

XXX. Cybercrime Complaint Versus Data Privacy Complaint

Some incidents may involve both cybercrime and data privacy violations.

For example, unauthorized access to personal information may constitute identity theft, illegal access, or data interference. It may also involve unlawful processing or disclosure of personal data under the Data Privacy Act.

A complainant may consider filing with law enforcement for cybercrime and with the National Privacy Commission for data privacy violations, depending on the facts.

XXXI. Cybercrime Complaint Versus Civil Case

A criminal complaint seeks punishment of the offender. A civil case seeks private relief such as damages, injunction, restitution, or other civil remedies.

Some victims file a criminal complaint, while others pursue civil remedies, settlement, administrative complaints, or platform remedies. The appropriate approach depends on the evidence, urgency, costs, and objectives of the complainant.

XXXII. Settlement and Desistance

Some cybercrime cases may involve settlement discussions, apology, restitution, takedown, or desistance. However, criminal liability is generally an offense against the State, and an affidavit of desistance does not automatically require dismissal of a criminal case.

Settlement may affect the complainant’s participation, civil liability, or prosecutorial assessment, but the prosecutor and court are not always bound by it.

Complainants should seek legal advice before signing settlement documents, waivers, quitclaims, or affidavits of desistance.

XXXIII. Penalties

Penalties for cybercrime vary depending on the offense. The Cybercrime Prevention Act imposes penalties that may include imprisonment and fines. Where a crime under the Revised Penal Code or special laws is committed by, through, or with the use of information and communications technology, the penalty may be affected by the cybercrime law.

The exact penalty depends on the offense charged, applicable law, aggravating or qualifying circumstances, and court findings.

XXXIV. Corporate and Business Victims

Businesses may file cybercrime complaints for:

Hacking;
Data breaches;
Defacement of websites;
Business email compromise;
Phishing using company identity;
Fraudulent invoices;
Misuse of corporate accounts;
Theft of customer data;
Unauthorized access by employees or former employees;
Disruption of systems;
Online impersonation of the business.

Companies should preserve logs, access records, internal reports, incident response findings, HR records, contracts, and proof of authority of the filing representative.

Businesses should also consider regulatory reporting obligations, especially where personal data, financial transactions, or critical systems are involved.

XXXV. Cybercrime in the Workplace

Cybercrime may arise in employment settings. Examples include unauthorized access to company email, copying confidential files, deleting records, spreading defamatory content online, using company systems for fraud, or accessing employee data without authority.

Employers may pursue administrative, civil, and criminal remedies. Employees also retain privacy, labor, and due process rights.

Before filing a criminal complaint, companies should conduct a careful internal investigation, preserve logs, secure systems, and avoid illegal surveillance or unauthorized access.

XXXVI. Cyber Libel: Special Discussion

Cyber libel remains one of the most frequently discussed cybercrime offenses in the Philippines. To support a cyber libel complaint, the complainant generally needs to establish the elements of libel, committed through a computer system.

The usual elements include:

Imputation of a discreditable act or condition;
Publication;
Identification of the person defamed;
Malice.

Online publication may include posts, comments, blogs, videos, captions, online articles, or messages made accessible to third persons.

Not every offensive statement is libelous. Insults, opinions, satire, fair comment, privileged communications, or true statements on matters of public interest may raise legal defenses. Context matters.

Because cyber libel implicates freedom of expression, reputation, and criminal law, it is advisable to obtain legal advice before filing or responding to a complaint.

XXXVII. Online Fraud: Special Discussion

Online fraud may be charged as cybercrime, estafa, computer-related fraud, identity theft, or other offenses depending on the method used.

Common forms include:

Fake online selling;
Fake investment schemes;
Phishing;
Romance scams;
Employment scams;
Loan scams;
Fake customer support pages;
Business email compromise;
Marketplace scams;
Unauthorized e-wallet or bank transfers.

For fraud cases, the payment trail is critical. Complainants should immediately obtain and preserve transaction records and report to financial institutions.

XXXVIII. Hacking and Unauthorized Access: Special Discussion

Hacking complaints require evidence showing unauthorized access or interference. Useful evidence includes:

Login alerts;
Account recovery emails;
IP logs, if available;
Device history;
Unauthorized posts or messages;
Changed passwords or recovery details;
Server logs;
Forensic reports;
Admissions or communications from the offender.

Victims should secure systems quickly but preserve logs before they are overwritten.

XXXIX. Practical Tips for a Strong Complaint

A strong cybercrime complaint is:

Specific;
Chronological;
Evidence-based;
Properly annexed;
Supported by screenshots, URLs, and records;
Clear about the damage suffered;
Filed promptly;
Consistent with available documents;
Free from exaggeration;
Properly sworn and notarized.

The complainant should make the investigator’s and prosecutor’s job easier by presenting the case clearly.

XL. Frequently Asked Questions

1. Can I file a cybercrime complaint online?

Some agencies may provide online reporting channels or initial complaint mechanisms, but formal complaints often require submission of documents, affidavits, identification, and evidence. Requirements may vary by office and case type.

2. Do I need a lawyer to file?

A lawyer is not always required to file a complaint. However, legal assistance is advisable for complex cases, cyber libel, corporate complaints, cases involving large financial loss, minors, intimate images, cross-border issues, or technical evidence.

3. What if the post was deleted?

You may still file if you preserved screenshots, URLs, witness statements, cached records, reports, or other proof. Deleted content may be harder to verify, so early preservation is important.

4. Are screenshots enough?

Screenshots may help, but they are stronger when supported by URLs, metadata, witness affidavits, platform records, transaction records, device logs, or other corroborating evidence.

5. Can I sue someone using a fake account?

Yes, but you must provide available identifiers. Law enforcement may investigate the real identity through lawful processes.

6. Can I post the scammer’s identity online?

Be careful. Public accusations may expose you to defamation, privacy, or harassment claims if done improperly. Reporting to authorities and platforms is safer.

7. Can I recover stolen money?

Possibly, but recovery depends on how quickly the incident is reported, whether funds can be frozen or traced, and whether the offender or recipient account can be identified. Criminal prosecution does not always guarantee recovery.

8. What should I do if intimate images are being used to threaten me?

Preserve evidence, do not distribute the material, report immediately to law enforcement and the platform, and seek support from trusted persons or counsel. If a minor is involved, urgent reporting is necessary.

9. Can a company file a complaint?

Yes. The company should authorize a representative and submit proof of authority, evidence of the cybercrime, and proof of damage or risk.

10. What if the offender is abroad?

A complaint may still be filed in the Philippines if there is a sufficient Philippine connection. Cross-border cases may require international cooperation and may take longer.

XLI. Conclusion

Filing a cybercrime complaint in the Philippines requires prompt action, careful preservation of electronic evidence, and a clear presentation of facts. The complainant should identify the nature of the offense, gather screenshots, URLs, transaction records, account details, and other supporting documents, then file with the appropriate law enforcement agency or prosecutor’s office.

Cybercrime cases are often technical, time-sensitive, and evidence-driven. The earlier the victim acts, the greater the chance that digital evidence can be preserved and the offender identified.

A well-prepared complaint-affidavit, properly organized annexes, and coordinated reporting to law enforcement, platforms, banks, and relevant agencies can significantly improve the chances of a successful investigation and prosecution.