Online scams in the Philippines often involve fake online sellers, bogus investments, “too-good-to-be-true” deals, phishing, account takeovers, or impersonation. Many of these scenarios fit Estafa (Swindling) under the Revised Penal Code (RPC), Article 315, sometimes together with other offenses (including cybercrime-related charges) depending on how the scam was executed.
This article explains (1) when an online scam becomes estafa, (2) where and how to file a complaint, (3) what to expect from the prosecutor and court process, and (4) how to preserve and recover evidence correctly, especially digital evidence, without accidentally ruining its value.
1) Estafa in Online Scams: What It Is and What Must Be Proven
A. The core idea
Estafa is generally committed when a person defrauds another by deceit or abuse of confidence, causing damage or prejudice.
In online scams, the most common theory is estafa by deceit—fraudulent representations made before or at the time the victim parts with money, goods, or property.
B. The elements (what the complaint must show)
While the specific paragraph of Article 315 matters, online-scam estafa typically needs facts showing:
Deceit or fraudulent representation
- The suspect made a false statement (e.g., “I have stock,” “This is a legitimate investment,” “I am from your bank,” “I will ship after payment”), or used fraudulent acts (fake IDs, fake receipts, impersonation), before or simultaneous with taking the money.
Reliance by the victim
- The victim believed the representation and acted because of it (sent payment, released goods, disclosed credentials, etc.).
Damage or prejudice
- Loss of money/property, missed opportunity, or other measurable prejudice.
Causal connection
- The loss happened because of the deceit.
Practical tip: Investigators and prosecutors look for a clean story: what was promised → what you relied on → what you paid/gave → what you received (often nothing) → what happened after.
C. Common online-scam patterns that often qualify as estafa
- Fake online seller / “bogus seller”: collects payment then blocks the buyer; or ships junk.
- Investment/loan scams: guaranteed returns, fake platforms, “release fee,” “tax fee,” “processing fee.”
- Impersonation: pretending to be a company, influencer, relative, or bank representative to obtain money.
- Marketplace scams: fake buyer/seller, fraudulent delivery tracking, fake escrow links.
- “Overpayment” and refund scams: tricking victims into sending “refunds,” “fees,” or transfer reversals.
D. Estafa vs. other possible crimes (why multiple charges may apply)
Depending on the facts, an online scam may also implicate:
- Cybercrime-related offenses under the Cybercrime Prevention Act (RA 10175) (e.g., when computer systems are used as instruments; venue and procedure may be affected).
- Falsification (fake receipts, fake IDs, altered documents).
- Identity-related offenses (impersonation using another’s name/account).
- Theft (in account takeover scenarios, especially if funds were taken without consent and without “voluntary” delivery).
Prosecutors can evaluate which charge best matches the evidence. Many complaints are framed as estafa, with supporting facts that show the use of online systems.
2) Who You File Against: Known Person, Pseudonym, or “John Doe”
A. If you know the suspect’s identity
File against the person using:
- Full name (as in ID), aliases, address, contact number, email, usernames/handles, and payment accounts used.
B. If you don’t know the real identity
You can still file a complaint using:
- The online handle/page name, phone numbers, bank/e-wallet account details, delivery addresses, and any identifying data you have.
- Some complaints are filed against a “John Doe/Unknown” while law enforcement works on attribution, but providing traceable leads (account numbers, platform URLs, chat logs) is critical.
3) Where to Report and Where to File the Estafa Complaint
A. Reporting vs. filing a criminal case
- Reporting is asking law enforcement to document and investigate.
- Filing a criminal complaint is submitting sworn statements and evidence for preliminary investigation (usually at the Office of the Prosecutor).
Often, victims do both: report to cybercrime units for technical help and simultaneously prepare the prosecutor filing.
B. Common entry points in the Philippines
- Local police / police station (blotter and initial report; may refer to cyber units)
- PNP Anti-Cybercrime Group (ACG) (for cyber-related investigation support)
- NBI Cybercrime Division / NBI (investigation support; subpoena capability via proper channels)
- City/Provincial Prosecutor’s Office (for the actual criminal complaint and preliminary investigation)
C. Venue (where the case may be filed)
Venue can be tricky in online scams because acts occur across locations. Common anchors include:
- Where the victim sent the money / performed the act of disposition.
- Where the victim received the fraudulent communications.
- Where the accused resides, may be found, or where an element of the offense occurred.
Cyber-related rules can broaden venue options when computer systems are used. In practice, prosecutors often accept filing where the victim resides or where the transaction occurred, as long as the narrative supports it.
4) Step-by-Step: How to File an Estafa Complaint (Typical Flow)
Step 1 — Preserve evidence immediately (before confronting the scammer)
Many scam operations delete chats, deactivate pages, or edit posts after being challenged. Evidence preservation should be first.
(See the evidence section below for exact procedures.)
Step 2 — Identify and document the scam transaction
Prepare a clean chronology:
- When and where you found the offer (URL, marketplace listing, post link)
- What representations were made (price, delivery time, guarantees, identity claims)
- The full conversation timeline (chat logs)
- Payment details (amount, method, reference numbers)
- Proof of non-delivery or misrepresentation (no shipment, fake tracking, defective item)
- Attempts to resolve (demand/refund requests) and the suspect’s responses
Step 3 — Consider sending a demand for refund/return (carefully)
A demand is not always required to file estafa, but it can:
- strengthen the story that you tried to resolve,
- show bad faith when they refuse, block, or make excuses.
Do not send threats or defamatory posts; keep it factual. Preserve proof that the demand was sent and received.
Step 4 — Execute your Complaint-Affidavit and supporting affidavits
You typically need:
- Complaint-Affidavit (your sworn narrative with attachments)
- Affidavit of witnesses (if any—e.g., someone who saw the transactions, helped pay, received calls, or was present during events)
- Affidavit of authentication for electronic evidence (often integrated into the complaint affidavit; more below)
- Annexes (screenshots, printouts, receipts, IDs, etc.)
These must be subscribed and sworn (notarized) before a notary public (or administered by authorized officers where applicable).
Step 5 — File with the Office of the Prosecutor for preliminary investigation
You submit:
- Complaint-Affidavit (and witness affidavits)
- Attachments (marked Annex “A,” “B,” etc.)
- Respondent details (identity or leads)
The prosecutor evaluates if there is probable cause. The process usually involves:
- issuance of subpoena to the respondent,
- respondent’s counter-affidavit,
- possible reply and rejoinder,
- then a resolution.
If probable cause is found, an Information is filed in court.
Step 6 — Criminal court proceedings
Once in court, the case proceeds through arraignment, pre-trial, trial, and judgment. Digital evidence must be properly authenticated and presented.
Step 7 — Recovering money (restitution and civil liability)
Estafa carries civil liability (restitution/damages). Often, the civil action is treated as implied with the criminal action unless properly reserved or separately pursued. Actual recovery depends on:
- identifying the perpetrator,
- locating assets,
- and enforcing judgments (or obtaining voluntary settlement).
5) The Evidence Problem: How Victims Accidentally Ruin Their Own Case
Digital scams rise or fall on evidence quality. Common mistakes include:
- only saving a few cropped screenshots (missing timestamps/URLs)
- failing to preserve the original message thread
- deleting chats after “saving screenshots”
- posting the scammer’s details publicly (triggering deletion of accounts and evidence)
- paying again to “recover funds” (secondary scam)
- using hacked or illegally obtained evidence (risk of inadmissibility and liability)
The standard you want to meet is: complete, credible, and verifiable.
6) Preserving Electronic Evidence Properly (Philippine Court Reality)
Philippine courts accept electronic evidence, but it must be:
- Relevant
- Authentic
- Shown to be unaltered or reliably captured
- Presented with proper foundation testimony
The governing principles come from the Rules on Electronic Evidence and the Rules of Evidence (authentication and best evidence principles adapted to electronic records).
A. What to collect (evidence checklist)
1) Identity and contact trails
- Profile/page URL, username/handle, user ID if visible
- Phone numbers, emails, messaging app IDs
- Any IDs sent (even if fake—still evidence)
- Delivery addresses, pickup points, remittance details
- Bank/e-wallet account numbers and names displayed in the transfer interface
2) Communications
- Full chat thread (not just the key lines)
- Voice messages (download/export where possible)
- Emails (including headers if accessible)
- SMS messages (screenshots + telco records if later obtained)
- Call logs (not recordings unless lawful; see below)
3) Transaction records
- Bank transfer screenshots and official transaction receipts
- E-wallet reference numbers
- Deposit slips, remittance receipts
- Proof of encashment where obtainable through lawful process
- Screenshots of confirmation pages and in-app transaction history
4) The “offer” itself
- Listing URL, post link, product photos, claims, pricing, terms
- Screenshots of the profile/page and listing
- Platform messages about the listing (order confirmation, delivery details)
5) Proof of damage and non-performance
- No delivery after promised date
- Fake tracking: screenshots + courier verification responses
- Received wrong/defective item: unboxing video, photos, correspondence
- Refund refusal or blocking: evidence of being blocked, last messages
7) How to Capture Evidence So It Survives Cross-Examination
A. Use a “3-layer capture” method
For every important item (chat, listing, payment confirmation), capture:
- Screenshot (quick, visual snapshot)
- Screen recording (shows navigation, reduces “edited screenshot” suspicion)
- Export/download (best if the platform allows downloading chat history or data)
If you can only do one, prefer screen recording plus well-framed screenshots.
B. Screenshot rules that help in court
- Include timestamps, usernames, and the entire conversation segment.
- Avoid cropped images that remove context.
- Capture the top of the chat showing the account name/handle.
- Capture the scam instructions (where to send money) and the payment confirmation.
- Take screenshots showing the URL for listings/pages (browser address bar visible).
- Use your phone’s setting to show time and date in the status bar.
C. Screen recording best practices
- Start on your phone home screen (shows time).
- Navigate to the app, open the profile, show the username/URL, scroll through the chat.
- Scroll slowly; pause on key messages and payments.
- Avoid overlays or third-party “beautifier” apps that could be accused of altering output.
D. Preserve originals and keep a clean chain of custody
Courts worry about tampering. Make it easy to answer:
- Who captured the evidence?
- When and how?
- Where was it stored?
- Was it edited?
Do this:
- Save originals to a dedicated folder.
- Back up to at least two storage locations (e.g., external drive + cloud).
- Do not edit images (no markup, no cropping) in your “originals” folder. If you need annotations for clarity, create a separate “working” copy.
E. File naming and logging (simple but powerful)
Create a simple evidence log (even a notebook works):
EVID-01 Chat thread screenshots (Messenger) captured 2026-01-18, device iPhone/Android model, saved to folder /OriginalsEVID-02 Screen recording of profile + chatEVID-03 Bank transfer receipt ref# _______EVID-04 Listing URL capture + screenshots
This becomes your testimony roadmap.
8) Special Category: “Ephemeral” Electronic Communications (Chats, SMS, DMs)
Chats and text messages are often treated as “ephemeral” communications in evidence practice, which means courts frequently require:
- testimony from a party to the communication (you), and/or
- proof of how the messages were captured, and
- corroboration (payments, platform info, linked account numbers).
Practical takeaway: Your affidavit should clearly state:
- you personally received/sent the messages,
- the account/handle used,
- the device you used,
- that the screenshots/recordings are faithful captures of what you saw,
- and that you did not alter them.
9) Avoiding Illegal Evidence Collection (Do Not Do These)
A. Do not hack, phish, or access accounts without authorization
Illegally obtained data can create criminal exposure and may complicate admissibility.
B. Be careful with recording calls
The Philippines has an Anti-Wiretapping Law (RA 4200). Recording private communications without proper consent can be legally risky. As a safer approach:
- preserve call logs, messages, and written communications,
- and narrate what was said in sworn testimony,
- while law enforcement handles lawful acquisition where needed.
C. Do not “dox” the suspect publicly while building the case
Public accusations often trigger:
- evidence deletion,
- account shutdowns,
- retaliation,
- and side disputes (defamation/harassment claims).
Keep the focus on preservation and formal reporting.
10) Getting Platform/Bank/Telco Evidence the Right Way
Victims often ask: “Can I force the platform or bank to reveal who owns the account?” Usually:
- Platforms and financial institutions have privacy and bank secrecy constraints.
- Disclosure often requires lawful process (subpoena/court order) handled through prosecutors/courts and investigators.
A. What you can do immediately
- Request your own official bank statement or transaction certification.
- Save in-app transaction history and reference numbers.
- Report the account to the platform/e-wallet/bank’s fraud channels (and preserve the ticket/reference).
B. What law enforcement/prosecutors may do later
- Use legal processes to request subscriber/account information and transaction trails.
- Coordinate with relevant agencies for tracing and, in some cases, asset preservation actions, subject to legal standards.
Practical tip: Provide investigators with precise identifiers:
- exact account numbers
- exact reference numbers
- exact URLs and usernames
- timestamps of transactions/messages
11) Writing a Strong Complaint-Affidavit (Structure That Works)
A good complaint-affidavit reads like a timeline and is easy to verify.
Suggested outline
Personal circumstances
- Name, age, address, occupation
How you encountered the offer/solicitation
- Platform, date, URL/handle, screenshots (Annexes)
The representations made
- What was promised; quote or describe; attach proof
Your reliance and the transaction
- Payment method, amount, date/time, reference numbers (Annexes)
What happened after payment
- Non-delivery, excuses, blocking, refusal to refund
Damage
- Total loss, incidental expenses, other prejudice
Identification details of respondent
- Handle, phone, bank/e-wallet details, any leads
Evidence authentication statements
- How you captured screenshots/recordings; device used; no alteration
Prayer
- That respondent be prosecuted for Estafa (and other applicable offenses), and that restitution/damages be awarded
Annex list
- Annex “A” chat screenshots, Annex “B” payment receipt, etc.
Attachments: keep them organized
- Use a cover page listing annexes.
- Print clearly; avoid tiny, unreadable screenshots.
- Maintain a digital copy and originals.
12) What Happens in Preliminary Investigation (What to Expect)
- Filing: Prosecutor receives your complaint and attachments.
- Subpoena: Respondent is required to submit a counter-affidavit.
- Counter-affidavit: Respondent denies, claims misunderstanding, claims delivery, or claims someone else used the account.
- Reply: You address defenses—this is where solid evidence matters.
- Resolution: Prosecutor finds probable cause or dismisses.
- Information filed in court: If probable cause exists.
Common defense in online scams: “Not me; my account was hacked.” This is why evidence connecting the respondent to payment channels, delivery addresses, repeated conduct, or consistent handles becomes crucial.
13) Recovering Money: Realistic Legal Paths
A. Restitution through the criminal case
Estafa includes civil liability—courts can order restitution/damages if guilt is proven. Recovery depends on enforceability.
B. Settlement
Some cases settle after demand or during proceedings. Preserve proof of any settlement, and ensure releases are properly documented.
C. Separate civil actions / small claims (when applicable)
If identity is known and the dispute fits civil recovery, civil actions may be considered. Small claims thresholds and coverage depend on current Supreme Court rules, and not all scam situations fit cleanly as “collection” without overlapping criminal issues.
D. Practical recovery actions (non-court but evidence-preserving)
- Report and seek account restrictions through the platform/e-wallet/bank fraud channels.
- Coordinate with investigators promptly—time is critical for fund tracing.
14) Evidence Pack: A Simple “Gold Standard” Bundle
If you want one consolidated set that prosecutors can work with quickly, assemble:
One-page chronology (dates, events, amounts, handles)
Complaint-affidavit (notarized)
Annexes, labeled and indexed
- Full chat screenshots (not cherry-picked)
- Screen recording of profile + chat
- Listing/post screenshots with URL
- Payment receipts + transaction history
- Demand message and responses
Storage
- USB drive with folders:
/Originals,/Working,/Printed PDFs
- USB drive with folders:
Evidence log
- short list explaining what each file is and when captured
15) Red Flags That Indicate You’re Being Scammed Again During “Recovery”
Many victims are targeted twice. Watch for:
- someone claiming they can “retrieve” funds for a fee
- “AMLC fee,” “release fee,” “tax clearance fee”
- fake “lawyer” or “agent” sending unofficial-looking documents
- requests for your OTP, passwords, or remote access
These are typically follow-on scams.
16) Summary: The Winning Formula
A successful estafa complaint for an online scam usually comes down to:
- a clear narrative of deceit → reliance → payment → loss,
- strong digital evidence preserved without alteration,
- traceable identifiers (handles, account numbers, URLs, reference numbers),
- proper sworn affidavits and organized annexes,
- prompt reporting to cyber-capable investigators and filing with the prosecutor.