RA 10175 Cybercrime Act: Complete Philippines Guide

RA 10175 does not set out a list of ten cyber crimes. Section 4 of the Cybercrime Prevention Act of 2012, as enacted, contains 13 numbered offence entries in three groups: six under Section 4(a), three under Section 4(b) and four under Section 4(c). The widely circulated “10 types” lists are third-party summaries, not a statutory count. Thirteen is not the number of currently enforceable offences either, because Section 4(c)(1) was repealed and Section 4(c)(3) was struck down. See the count, group by group.

Direct Answer

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, is the Philippine statute that defines cybercrime offences, sets their penalties, and creates the procedures and institutions for investigating them. It was approved on 12 September 2012. Section 4 groups the offences into three families — offences against computer data and systems, computer-related offences, and content-related offences — and Section 6 separately raises the penalty one degree when a crime already defined elsewhere is committed through information and communications technology.

The law also designates the National Bureau of Investigation and Philippine National Police as cybercrime law-enforcement authorities and created a national framework for cybercrime coordination and international cooperation.

Primary authority: Republic Act No. 10175, Senate of the Philippines Legislative Digital Resource. Every section number, figure and definition on this page was read from that government copy of the Act on 22 September 2026.

RA 10175 at a Glance

Item	Detail
Short title	Cybercrime Prevention Act of 2012
Number	Republic Act No. 10175
Approved	12 September 2012
Effectivity clause	Fifteen days after the completion of publication in the Official Gazette or in at least two newspapers of general circulation
Offence provisions	Section 4 (three families of offences), Section 5 (aiding or abetting, and attempt), Section 6 (penalty one degree higher)
Penalty provisions	Section 8 (natural persons), Section 9 (juridical persons)
Investigating authorities	National Bureau of Investigation (NBI) and Philippine National Police (PNP), Section 10
Court	Regional Trial Court, with designated special cybercrime courts, Section 21
Central authority for international cooperation	DOJ Office of Cybercrime, Section 23
Coordinating body	Cybercrime Investigation and Coordinating Center (CICC), Sections 24 to 26

Key Takeaways

• RA 10175 sets no list of “10 types” of cyber crime. Section 4 as enacted has 13 numbered entries — six in 4(a), three in 4(b), four in 4(c) — and two of those entries are no longer enforceable as written.
• RA 10175 covers both crimes directed at computer systems and traditional crimes committed through ICT.
• Illegal access, computer-related fraud and identity theft are expressly defined cybercrime offenses.
• Cyber libel is libel under the Revised Penal Code committed through a computer system or similar means.
• Section 6 generally increases by one degree the penalty for crimes under the Revised Penal Code or special laws when committed through ICT.
• NBI and PNP are the law-enforcement authorities named in Section 10.
• The original Section 4(c) has four numbered entries, with cyber libel at 4(c)(4). That historical count is not a list of four currently enforceable offenses: 4(c)(1) was repealed, 4(c)(3) was voided, and the child-protection framework changed under RA 11930.
• Section 9 makes a company liable in its own right, with the fine capped at ₱10,000,000 where a person in a leading position acted for its benefit, and ₱5,000,000 where the offence was made possible by a lack of supervision.
• Section 13 sets a minimum six-month preservation period for traffic data and subscriber information, with extension and case-preservation provisions. Report promptly, but do not assume records disappear on a universal six-month deadline.
• Section 18 is an express exclusionary rule: evidence procured without a valid warrant, or beyond the authority of one, is inadmissible in any proceeding.
• Parts of RA 10175 were challenged before the Supreme Court. The Supreme Court’s Disini decision declared Sections 4(c)(3), 12 and 19 void and limited how Section 5 applies to content-related offenses. Read the decision alongside the later laws cited below.

RA 10175 in 60 Seconds

Statutory category	Exact offenses	Common Philippine examples
Section 4(a): offenses against data and systems	Illegal access; illegal interception; data interference; system interference; misuse of devices; cybersquatting	Breaking into Facebook or email, intercepting private transmissions, deleting files, deploying malware or ransomware, disrupting a server, trafficking access credentials, or registering another’s protected name in bad faith
Section 4(b): computer-related offenses	Computer-related forgery; computer-related fraud; computer-related identity theft	Creating inauthentic electronic records, manipulating computer data to cause financial loss, phishing for credentials, taking over an account, or using another person’s identifying information without right
Section 4(c): content-related entries	Original text: cybersex; child pornography; unsolicited commercial communications; libel	Cybersex under 4(c)(1) was repealed by RA 11930. The child-protection framework must be read with RA 11930, which repealed RA 9775. Section 4(c)(3) is void under Disini; cyber libel remains subject to that decision’s limits.
Section 5: related liability	Aiding or abetting; attempt	Disini upheld Section 5 for Section 4(a), Section 4(b) and the then-existing cybersex provision, but not for Sections 4(c)(2), (3) or (4). RA 11930 later repealed the cybersex provision; the 2014 ruling does not revive it.
Section 6: ICT-qualified crimes	Crimes already defined by the Revised Penal Code or special laws committed through ICT	Online estafa, threats, harassment, or other existing crimes where ICT satisfies the statutory requirements and raises the penalty one degree

Fast rule: Section 4 lists cyber-specific offenses. Section 6 does not create a new offense; it changes the penalty for an existing crime committed through ICT. One incident may also involve the Data Privacy Act, Access Devices Regulation Act, Safe Spaces Act, AFASA, or another special law.

Jump to a Section

1. Are there 10 types of cyber crime?
2. Section map of the Act
3. Offences against computer data and systems
4. Computer-related offences
5. Content-related offences, including cyber libel
6. Penalties for individuals
7. Penalties for companies
8. Preservation, disclosure, warrants and the exclusionary rule
9. Who investigates, and which court hears the case
10. Worked scenarios
11. What victims should do
12. Check the controlling sources

Section Map: What Each Part of RA 10175 Does

RA 10175 is short but structurally dense, and most confusion about it comes from mixing up the offence provisions with the procedural ones. This map is the fastest way to find the provision that actually governs a question.

Sections 2 to 8: policy, definitions, offenses and penalties

Section	Heading as printed	What it does
2	Declaration of Policy	States the policy basis. The Act opens by recognising ‘the vital role of information and communications industries in the nation’s social and economic development.’
3	Definition of Terms	Defines computer system, traffic data, service provider, critical infrastructure at 3(j), and cybersecurity at 3(k)
4(a)	Offenses against the confidentiality, integrity and availability of computer data and systems	Six offences: illegal access, illegal interception, data interference, system interference, misuse of devices, cyber-squatting
4(b)	Computer-related Offenses	Three offences: computer-related forgery, fraud, and identity theft
4(c)	Content-related Offenses	Four original entries: cybersex (later repealed), child pornography (read with RA 11930), unsolicited commercial communications (void under Disini), and libel (subject to Disini‘s limits)
5	Other Offenses	5(a) aiding or abetting the commission of a cybercrime; 5(b) attempt
6	Penalty one degree higher	Where a crime defined in the Revised Penal Code or a special law is committed by, through and with the use of ICT, ‘the penalty to be imposed shall be one (1) degree higher’
7	Liability under Other Laws	Subject to double-jeopardy limits. Disini barred duplicate prosecutions for the same online libel under RA 10175 and the Revised Penal Code, and for the same online child-pornography act under RA 10175 and RA 9775; other applications were left to actual cases.
8	Penalties	The imprisonment and fine ranges for the Section 4 offences

Sections 9 to 17: corporate liability, law enforcement and computer data

Section	Heading as printed	What it does
9	Corporate Liability	Separate fines against a juridical person, with two triggers and two ceilings
10 and 11	Law Enforcement Authorities; Duties of Law Enforcement Authorities	Names the NBI and PNP, requires special cybercrime units, and requires reporting to the DOJ
12	Real-Time Collection of Traffic Data	Void under the Supreme Court’s Disini decision; heading and original text shown for history
13	Preservation of Computer Data	Minimum preservation periods, extension and case-preservation duties on service providers
14	Disclosure of Computer Data	A court-warranted disclosure order, to be complied with within seventy-two hours
15	Search, Seizure and Examination of Computer Data	What law enforcement may do under a warrant, and the assistance it may require
16	Custody of Computer Data	Deposit with the court within forty-eight hours of the warrant expiring
17	Destruction of Computer Data	Immediate and complete destruction once the preservation period lapses

Sections 18 to 26: exclusionary rule, blocking, jurisdiction and the CICC

Section	Heading as printed	What it does
18	Exclusionary Rule	Evidence obtained without a warrant, or beyond it, is inadmissible
19	Restricting or Blocking Access to Computer Data	Void under the Supreme Court’s Disini decision; heading and original text shown for history
20	Noncompliance	Non-compliance with a Chapter IV order is punished under Presidential Decree No. 1829
21	Jurisdiction	Regional Trial Court, with designated special cybercrime courts
22 and 23	International Cooperation; Department of Justice	Creates the DOJ Office of Cybercrime as central authority for mutual assistance and extradition
24 to 26	Cybercrime Investigation and Coordinating Center	Creates the CICC, sets its composition, and gives it its powers and functions

An important caution about Sections 12 and 19. Both were among the provisions challenged before the Supreme Court after the Act took effect. The table above reports the original statutory text. The Supreme Court’s Disini decision declared Sections 12 and 19 void; neither provision may be treated as a current investigative or blocking power. See Check the controlling sources.

What Are the 10 Types of Cyber Crime?

Direct answer. There is no statutory list of ten. Republic Act No. 10175 groups its cybercrime offences in Section 4, and that section as enacted carries 13 numbered entries: six under Section 4(a), three under Section 4(b) and four under Section 4(c). Any article that promises “the 10 types of cyber crime” is summarising, grouping or dropping entries, not quoting the Act. Cybercode reports the count the statute actually uses, and then the part the lists leave out — that two of the thirteen can no longer be charged as written.

Where the Count Comes From, Group by Group

Statutory group	Numbered entries as enacted	Current position
Section 4(a), offences against computer data and systems	Six: 4(a)(1) to 4(a)(6)	All six stand as enacted
Section 4(b), computer-related offences	Three: 4(b)(1) to 4(b)(3)	All three stand as enacted
Section 4(c), content-related offences	Four: 4(c)(1) to 4(c)(4)	4(c)(1) repealed by RA 11930; 4(c)(3) void under Disini; 4(c)(4) valid only as to the original author
Section 4 in total	Thirteen numbered entries	Not thirteen currently chargeable offences; the Section 4(c) row above explains why

Section 4(c)(2) is the remaining qualification. It referred to the Anti-Child Pornography Act of 2009, which Republic Act No. 11930 repealed; current conduct is examined under RA 11930’s own offences instead.

The Acts Section 4 Actually Names

Section 4(a) names illegal access, illegal interception, data interference, system interference, misuse of devices and cyber-squatting. Section 4(b) names computer-related forgery, computer-related fraud and computer-related identity theft. Section 4(c) names cybersex, child pornography, unsolicited commercial communications and libel. That is the whole of the Act’s own offence list, read from the Senate copy of RA 10175.

Why the circulating numbers differ. Two further provisions are often counted as extra “types”, which is where lists of 15 or more come from. Section 5 punishes aiding or abetting and attempt — ways of taking part in a cybercrime, not separate cybercrimes — and Disini cut its reach, leaving it void as applied to Sections 4(c)(2), 4(c)(3) and 4(c)(4). Section 6 creates no offence at all: it raises by one degree the penalty for a crime already defined in the Revised Penal Code or a special law when that crime is committed through information and communications technology. Online estafa, online threats and online harassment therefore appear on many “types of cybercrime” lists while being Revised Penal Code or special-law crimes carrying a Section 6 uplift.

What to do with this instead of counting. The count does not decide a case; the elements do. Identify the conduct, match it to one numbered entry, check whether that entry still stands, and only then look at the penalty and the reporting route. Work through the Section 4(a) offences, the computer-related offences and the content-related entries in order, use the penalty table for the bracket that applies, and take the result to the PNP Anti-Cybercrime Group or NBI Cybercrime Division with the evidence preserved. If no Section 4 entry fits, the conduct may still be an offence under another statute read with Section 6.

Offences Against Computer Data and Systems

Illegal Access

Accessing the whole or any part of a computer system without right can constitute illegal access. This can include unauthorized entry into accounts, servers, devices, databases, or networks depending on the facts.

Illegal Interception

The law penalizes interception by technical means, without right, of non-public computer-data transmissions.

Data Interference

Intentional or reckless alteration, deletion, damage or deterioration of computer data without right can fall under data interference, including conduct involving malicious code or viruses.

System Interference

Intentionally altering or recklessly hindering the functioning of a computer or network through unauthorized manipulation of data or programs can be system interference.

Misuse of Devices

The Act addresses certain devices, programs, passwords, access codes and similar data designed or intended for use in committing covered cybercrime offenses.

Cybersquatting

Bad-faith acquisition of a domain name to profit, mislead, destroy reputation, or deprive another person of a name or protected mark can fall within the law when statutory conditions are met.

The Six Section 4(a) Offences at a Glance

Provision	Offence	The core of the statutory test	Read more
4(a)(1)	Illegal Access	‘the access to the whole or any part of a computer system without right’	Unauthorised account access
4(a)(2)	Illegal Interception	Interception by technical means, without right, of non-public transmissions of computer data	Illegal interception under RA 10175
4(a)(3)	Data Interference	Intentional or reckless alteration, damaging, deletion or deterioration of computer data without right	Malware attacks
4(a)(4)	System Interference	Intentional alteration, or reckless hindering, of the functioning of a computer or network	After a business cyberattack
4(a)(5)	Misuse of Devices	Devices, programs, passwords and access codes designed or intended for use in committing the offences above	Priced separately in Section 8
4(a)(6)	Cyber-squatting	Acquisition of a domain name in bad faith, on the grounds the section sets out	Domain registered using a brand name

Why the grouping matters. Section 8 does not price these six identically. Misuse of devices under 4(a)(5) carries its own ceiling, and an offence against critical infrastructure sits in a heavier bracket altogether. The penalty table sets them side by side.

Computer-Related Offences

Computer-Related Forgery

This can involve unauthorized input, alteration or deletion of computer data that produces inauthentic data intended to be treated as authentic for legal purposes, or knowingly using such data for a fraudulent or dishonest design.

Computer-Related Fraud

Unauthorized input, alteration or deletion of computer data or interference with a computer system that causes damage with fraudulent intent can constitute computer-related fraud. Section 4(b)(2) expressly provides a penalty one degree lower if no damage has yet been caused.

Computer-Related Identity Theft

The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another without right can fall within computer-related identity theft.

Content-Related Offences: What Section 4(c) Actually Lists

Direct answer. The Act as enacted listed four entries: cybersex at 4(c)(1), child pornography at 4(c)(2), unsolicited commercial communications at 4(c)(3), and libel at 4(c)(4). The current position differs: RA 11930, Section 44, repealed 4(c)(1) and RA 9775, while Disini voided 4(c)(3) and limited online-libel liability.

Provision	Offence	What the provision covers
4(c)(1)	Cybersex — repealed	This was an offense in the 2012 text. RA 11930, Section 44, expressly repealed it. Do not use its former elements as a current standalone RA 10175 charge.
4(c)(2)	Child pornography — historical cross-reference	The original provision referred to RA 9775, which RA 11930 later repealed. For current conduct, examine RA 11930’s OSAEC and CSAEM offenses and penalties. Earlier conduct requires a date-specific analysis; repeal did not automatically extinguish liability for acts reenacted in RA 11930.
4(c)(3)	Unsolicited Commercial Communications	Original text addressed commercial electronic messages and listed exceptions; the Supreme Court declared this provision void in Disini
4(c)(4)	Libel	Libel as defined in Article 355 of the Revised Penal Code, as amended, committed through a computer system or any other similar means which may be devised in the future

Section 4(c)(3): original text and current status

As enacted, this provision addressed unsolicited commercial communications and listed three exceptions. The Supreme Court later declared Section 4(c)(3) unconstitutional in Disini. The following exceptions describe the historical statutory text, not a current RA 10175 criminal rule:

1. there is prior affirmative consent from the recipient;
2. the communication is a service or administrative announcement to an existing user; or
3. an opt-out mechanism is present, the source is not disguised, and the message does not contain misleading information.

What that means in practice. A business cannot be charged under Section 4(c)(3) because the Supreme Court declared that provision void. Those historical exceptions no longer determine criminal liability under Section 4(c)(3). Other applicable privacy, consumer-protection and fraud rules may still govern a campaign. Separately, and independently of RA 10175, how the addresses were obtained in the first place is a question for the Data Privacy Act.

Cyber Libel: What Section 4(c)(4) Says, and What It Does Not Say

What the text says. Section 4(c)(4) applies to the unlawful or prohibited acts of libel ‘as defined in Article 355’ of the Revised Penal Code, as amended, committed through a computer system or any other similar means which may be devised in the future. The cross-reference is the important part. RA 10175 contains no definition of libel of its own, no list of elements of its own, and no set of defences of its own. All of those still come from the Revised Penal Code.

Three consequences that follow directly from that text. First, an online post is not libellous merely because it is hostile or damaging — the Revised Penal Code elements still have to be made out. Second, because Section 4(c)(4) borrows the underlying offence rather than replacing it, the arguments available in an ordinary libel case are not switched off by the fact that publication happened online. Third, the online-libel provision and Section 6 must be read together: Section 4(c)(4) identifies online libel, while Section 6 supplies the one-degree-higher penalty rule.

The Disini limit. The Court upheld Section 4(c)(4) for the original author, but not for people who merely receive the post and react to it. It also voided Section 5’s application to online libel. A person’s own new defamatory statement must be assessed on its own facts; the ruling should not be turned into blanket immunity for everything written in a comment. See the decision’s discussion and dispositive ruling.

Two Cybercode pages go deeper on this cluster: Online Libel in the Philippines covers the elements, the penalty and a victim’s remedies, and Cyber Libel Prescription covers the filing deadline, which is the single most frequently misstated point in the whole cluster. For the offence list and the one-degree-higher rule read against each other in one place, see RA 10175 Sections 4 and 6.

Decision Snapshot

Conduct	Possible RA 10175 issue
Breaking into another person’s account	Illegal access
Deleting or corrupting data	Data interference
Disrupting a network or service	System interference
Manipulating data to obtain money	Computer-related fraud
Using another person’s identifying information	Computer-related identity theft
Publishing potentially libelous material online	Cyber libel

What Are the Penalties Under RA 10175?

Direct answer. Section 8 sets the penalties for the Section 4 offences. The figures below are statutory floors and ceilings, not sentences: what a court actually imposes turns on the offence charged, the circumstances, and the rules on the application of penalties.

Common Offenses and Their Penalty Framework

• Illegal access: as a Section 4(a) offense, it is generally punishable by prisión mayor—6 years and 1 day to 12 years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both.
• Computer-related identity theft: as a Section 4(b) offense, it generally carries the same Section 8 range. If no damage has yet been caused, Section 4(b)(3) provides a penalty one degree lower.
• Cyber libel: Article 355 libel committed through ICT is subject to Section 6’s one-degree-higher rule. The commonly stated imprisonment range is prisión correccional maximum to prisión mayor minimum—4 years, 2 months and 1 day to 8 years—subject to the Indeterminate Sentence Law and the court’s application of penalty rules. A fine-only sentence is legally possible in an appropriate case, as the Supreme Court explained in People v. Soliman. See the complete cyber-libel guide.

Offense or group	Penalty stated by RA 10175
Most Section 4(a) and 4(b) offenses, including illegal access and identity theft	Prisión mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both
Section 4(a)(5), misuse of devices	Prisión mayor, or a fine of not more than ₱500,000, or both
Section 4(a) offense against critical infrastructure	Reclusión temporal, or a fine of at least ₱500,000 up to an amount commensurate with the damage, or both
Former Section 4(c)(1), cybersex	Repealed by RA 11930, Section 44. The original Section 8 range is not a current standalone cybersex penalty under this provision.
Section 4(c)(2), historical RA 9775 cross-reference	The original Act raised RA 9775 penalties one degree for computer-based conduct. RA 11930 repealed RA 9775 and has its own offenses and penalties. Determine the date, conduct and governing law; do not automatically apply the old formula to RA 11930.
Section 4(c)(3), unsolicited commercial communications	Void under Disini. The penalty printed in the original Act is not enforceable under this provision.
Section 5, aiding or abetting and attempt	One degree lower than the prescribed penalty, or a fine of ₱100,000 to ₱500,000, or both, for an offense to which Section 5 validly applies. Disini excluded Sections 4(c)(2), (3) and (4); its ruling on cybersex predated the repeal of 4(c)(1).

The point most summaries miss. Critical infrastructure is a separate and heavier bracket, and Section 3(j) is what decides whether a target falls inside it. An attack on an ordinary corporate network and an attack on a system meeting the Section 3(j) description are not priced the same way — which is why the classification question is worth settling early rather than at sentencing.

Section 6 also provides that crimes defined and penalized by the Revised Penal Code or special laws, when committed through ICT, are covered by the relevant provisions of RA 10175 and generally carry a penalty one degree higher than the ordinary penalty.

Because criminal penalties are technical and offense-specific, a person facing investigation or prosecution should obtain legal advice based on the actual charge rather than relying on a simplified online estimate.

When Is a Company Liable Under RA 10175?

Direct answer. Yes, separately from any individual. Section 9 makes a juridical person liable in its own right in two situations, each with its own ceiling, and that liability does not displace the criminal liability of the natural person who committed the act.

Trigger	What it describes	Fine ceiling
Act of a person in a leading position	The punishable act is knowingly committed on behalf of, or for the benefit of, the juridical person by a natural person in a leading position within it — a position based on a power of representation, an authority to take decisions, or an authority to exercise control	₱10,000,000
Lack of supervision or control	The commission of the act was made possible because such a person failed to supervise or control someone acting under the juridical person’s authority, for its benefit	₱5,000,000

In both situations the fine is expressed as at least double the fines imposable, subject to the ceiling. Note that the enrolled text cross-refers to Section 7 at that point. Cybercode reports the cross-reference exactly as the Senate copy prints it rather than silently correcting it to the penalty section.

What a business should take from Section 9. The second trigger is the one that reaches ordinary companies, and it is the one most often missed. It does not require anyone in management to have known about the offence. It asks whether supervision or control was absent in a way that made the offence possible — which is a question about access control, logging, joiner-mover-leaver process and vendor oversight, not about intent. The practical baseline is in Cybersecurity in the Philippines, and the parallel privacy-side duty in DBNMS breach notification.

Preservation, Disclosure, Warrants and the Exclusionary Rule

Chapter IV is where most practical cybercrime questions are actually answered: how long the evidence survives, what an investigator can compel, and what happens to evidence taken the wrong way.

Section	What it requires	The clock
13, Preservation of Computer Data	Traffic data and subscriber information: at least six months from the transaction. Content data: six months from receipt of the law-enforcement preservation order.	Law enforcement may order one further six-month period. When preserved data is used in a case, furnishing the provider with the transmittal document to the prosecutor is notice to preserve it until the case ends.
14, Disclosure of Computer Data	On a court warrant, law enforcement may order any person or service provider to disclose subscriber information, traffic data or relevant data in its possession, for an officially docketed investigation	Seventy-two hours to comply
15, Search, Seizure and Examination	Securing the computer system or storage medium, making a copy, maintaining its integrity, and conducting forensic examination under a warrant. Persons knowledgeable about the system may be required to give reasonable assistance	An extension of up to thirty days to complete the examination, on court approval
16, Custody of Computer Data	Deposit of the examined data with the court in a sealed package, with an affidavit and a certification that no unauthorised duplicate was made	Forty-eight hours after the warrant expires
17, Destruction of Computer Data	Immediate and complete destruction of the preserved data once the Section 13 or Section 15 period lapses	On lapse of the period
18, Exclusionary Rule	Evidence procured without a valid warrant, or beyond the authority of one, is inadmissible in any proceeding before any court or tribunal	None
20, Noncompliance	Read with PD 1829 and Disini: punishable noncompliance must involve knowing or willful obstruction, and the order must concern a surviving Chapter IV provision.	Prisión correccional in its maximum period, or a ₱100,000 fine, or both, for each punishable instance; guilt requires judicial determination.

Practical preservation check. Record the incident date, the provider, the data needed and any existing report number. Ask investigators promptly about preservation; a request to preserve data is different from authority to disclose it. Do not assume a provider still has the records, but do not abandon an older complaint on the assumption that everything was deleted after six months. See electronic evidence preservation.

Sections 12 and 19: void provisions shown for historical context. Section 12 concerns the real-time collection of traffic data and Section 19 concerns a Department of Justice order to restrict or block access to computer data. Both were among the provisions challenged before the Supreme Court. The Supreme Court declared both sections void in Disini; the statutory table above is historical text, not a current authority to collect traffic data in real time or block access. See Check the controlling sources.

Who Enforces the Cybercrime Prevention Act?

For cybercrime complaints in the Philippines, RA 10175 names the NBI and PNP as law-enforcement authorities, while the NBI Cybercrime Division and PNP Anti-Cybercrime Group are specialized units. The Act also gives the DOJ a central role in international cybercrime cooperation and establishes the CICC for national coordination.

Authority or unit	Role identified in this guide
NBI	Law-enforcement authority named in Section 10
PNP	Law-enforcement authority named in Section 10
NBI Cybercrime Division	Specialized cybercrime unit
PNP Anti-Cybercrime Group	Specialized cybercrime unit
DOJ	Central role in international cybercrime cooperation
Cybercrime Investigation and Coordinating Center	National cybercrime coordination

Section 11 adds a supervisory layer on top of that: the cybercrime units of the NBI and the PNP are required to submit pre-operation, post-operation and investigation reports to the Department of Justice.

Section 23 creates an Office of Cybercrime within the DOJ as the central authority for mutual legal assistance and extradition in cybercrime matters. That is the channel used when the evidence sits with a foreign platform or provider, which is the ordinary case in an online fraud or impersonation complaint. Sections 24 to 26 originally created the Cybercrime Investigation and Coordinating Center (CICC) under the Office of the President. RA 10844, Section 15(b), later attached it to the DICT for policy and program coordination and transferred specified cybersecurity functions, including formulation of the national cybersecurity plan, to the DICT.

Section 21 decides the court. Jurisdiction lies with the Regional Trial Court, and the Act directs that special cybercrime courts be designated and manned by specially trained judges. A cybercrime complaint therefore does not begin and end with the investigating agency: it moves to a prosecutor, and then to a designated RTC branch.

Body	Created or named by	What to use it for
PNP Anti-Cybercrime Group	A Section 10 special unit	Filing a complaint and operational response. See the PNP-ACG complaint process
NBI Cybercrime Division	A Section 10 special unit	Investigation and digital forensics. See the NBI complaint process
DOJ Office of Cybercrime	Section 23	International cooperation and mutual legal assistance
CICC	Sections 24 to 26, read with RA 10844 Section 15(b)	Cybercrime coordination; attached to DICT for policy and program coordination
Regional Trial Court	Section 21	Trial, including through designated cybercrime courts

For the full routing list of where each type of complaint goes, use the cybercrime reporting directory, and what happens after you report a cybercrime for the sequence that follows.

Does RA 10175 Apply Only to Hackers?

No. RA 10175 covers much more than breaking into systems. It can reach computer-related fraud, identity theft, forgery, cyber libel, malicious interference with data or services, and crimes defined elsewhere that are committed through ICT.

Does RA 10175 Cover Online Scams and Phishing?

It can. A phishing campaign may involve illegal access, misuse of devices, computer-related forgery, computer-related fraud, or identity theft depending on what the attacker created, obtained, or used. An ordinary online selling scam may instead be estafa under the Revised Penal Code committed through ICT, engaging Section 6. Financial-account scams may also fall under RA 12010, while stolen card or access-device information may trigger RA 8484 as amended.

The word “scam” is not itself a single RA 10175 charge. Investigators must match the evidence to the elements of the correct offense and any overlapping special law.

Worked Scenarios: Which Provision Actually Bites

Illustrative Philippine scenarios, not reported cases. These examples show how the conduct, the evidence and the applicable law change the analysis. They do not establish guilt or select a charge for a real complaint.

1. An ex-partner logs into your email using a remembered password

The starting point is Section 4(a)(1) illegal access — access to the whole or any part of a computer system without right. A remembered password does not create a right of access. If messages were then altered or deleted, 4(a)(3) data interference is also in play, as a separate offence rather than an aggravation. See Unauthorised account access.

2. A seller takes payment for goods that never existed

Ask what the seller represented before or when the buyer paid. For estafa by deceit, the false representation, reliance and resulting loss must be proved; failed delivery alone does not answer those questions. Keep the listing, full chat and payment record. Use of ICT may engage Section 6. Section 4(b)(2) requires its own computer-data or system-manipulation elements. See the Supreme Court’s statement of the elements of estafa by deceit in People v. Urquico, G.R. No. 238910, 20 July 2022 and the computer-related fraud guide.

3. Someone opens a social media account in your name

Section 4(b)(3) computer-related identity theft reaches the intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, without right. Depending on what was posted, Republic Act No. 11313 may also apply, because its Section 12 expressly names impersonating identities of victims online. See Fake accounts and impersonation, Is catfishing a crime? and the Safe Spaces Act.

4. A company is hit by ransomware and customer data is exposed

Two tracks open at once, and they run on different clocks. The criminal track runs through Sections 4(a)(3) and 4(a)(4). The regulatory track requires a separate assessment under the Data Privacy Act. Where the breach meets the notification criteria, the seventy-two-hour clock runs from knowledge or reasonable belief that it occurred, under NPC Circular 16-03, Section 17(A) and is entirely independent of whether a criminal complaint is ever filed. Treating the police report as discharging the privacy duty is the classic and expensive mistake. See DBNMS breach notification and What to do after a business cyberattack.

5. A scam text arrives from an unregistered number

RA 10175 is not the only statute in play, and often not the main one. Republic Act No. 11934 governs SIM registration and its reporting route, and Republic Act No. 12010 governs financial account scamming. See the SIM Registration Act and AFASA.

6. A debit card is used abroad without the cardholder’s knowledge

Access-device offences under Republic Act No. 8484, as amended by Republic Act No. 11449, frequently do more work here than RA 10175 does — and the two are not alternatives, because Section 7 provides that a prosecution under RA 10175 is without prejudice to liability under other laws. See the Access Devices Regulation Act.

What Should a Cybercrime Victim Do?

1. Stop immediate loss or access. Contact the bank or e-wallet, freeze cards or transfers, change compromised passwords from a clean device, sign out other sessions, and enable multifactor authentication. Do not destroy the affected device or reset it before preserving evidence if an investigation may follow.
2. Preserve original evidence. Save full screenshots and screen recordings, URLs, usernames, email headers, chat exports, transaction references, wallet or bank details, phone numbers, dates, times, and the original files. Keep an untouched copy and a simple evidence log.
3. Report to the service that can limit harm. Notify the bank, e-wallet, platform, marketplace, telecom provider, employer, or system administrator. Request a case or reference number and ask that relevant records be preserved.
4. Choose the proper government route. PNP-ACG and NBI Cybercrime Division investigate cybercrime. The CICC is a coordinating body under Sections 24 to 26, not an investigating or prosecuting agency. For online scams, the Inter-Agency Response Center hotline 1326, a joint channel of the CICC, the DICT, the NPC and the NTC, takes reports and refers them (Philippine Information Agency, 31 December 2025), but that report is not a criminal complaint. For formal criminal prosecution, a complaint ultimately proceeds through the proper prosecutor and, if probable cause is found, the designated Regional Trial Court.
5. Bring an organized complaint package. Include identification, a chronological incident summary, the evidence index, loss records, respondent details if known, platform or bank reports, and witness information.
6. Act quickly. Platform records may be deleted, funds can move rapidly, and legal prescriptive periods differ by offense. Ask investigators whether a preservation request or urgent financial hold is available.

Use Where and How to Report Cybercrime in the Philippines and the Cybercrime Reporting Directory for current channels and requirements.

Frequently Asked Questions

What are the cybercrime offenses under RA 10175?

Short answer: The original Section 4 lists six data-and-system offenses, three computer-related offenses and four content-related entries. Read that historical list with Disini and RA 11930: the unsolicited-communications provision is void, cybersex under 4(c)(1) was repealed, and RA 9775 was replaced by the newer child-protection law. Section 5’s reach is limited; Section 6 applies to crimes defined elsewhere and committed through ICT. The section map helps locate the provision, but each charge still requires its own elements.

What five Philippine laws may apply to an online incident?

There is no official set of five. Depending on the facts, check RA 10175 for defined cyber offenses, the Revised Penal Code for estafa or other existing crimes committed through ICT, RA 10173 for misuse of personal data, RA 8484 as amended for access-device offenses, and RA 12010 for financial-account scamming. One incident can involve more than one law; which applies depends on the evidence and each law’s elements.

What are examples of cybercrime in the Philippines?

Examples that may meet RA 10175 are entering an account without right (illegal access), deleting another person’s computer data (data interference), manipulating computer data to cause financial loss (computer-related fraud), using another person’s identifying information without right (computer-related identity theft), and publishing material that meets the elements of online libel. A phishing or online-selling scam is not automatically one particular RA 10175 charge; the facts may instead support an offense under another law. The worked scenarios show how to sort them.

Who can be a victim of cybercrime?

Individuals, businesses and other organizations can be affected. The protected interest may be an account, computer system, data, money, identity or reputation, depending on the offense. A victim does not need technical expertise to report: preserve the records, stop immediate loss and use the appropriate reporting route.

Can you give a real Philippine cybercrime case example?

Yes. The NBI reported a July 2026 Pasay operation involving arrests for alleged computer-related fraud under Section 4(b)(2); the press release describes romance and cryptocurrency-investment scam allegations, not convictions. In a decided online-libel case, the Supreme Court’s People v. Soliman decision discusses a Facebook-post conviction and a fine. These illustrate different offenses and different case stages; neither supplies a universal rule for another person’s facts.

What punishment is given for cybercrime in the Philippines?

There is no single cybercrime penalty. Section 8 sets different imprisonment and fine rules for different Section 4 offenses, and Section 6 can raise the penalty for an existing crime committed through ICT. A court applies the charge, evidence and sentencing rules. Section 4(c)(3)’s penalty cannot be imposed because that provision is void, and the former cybersex offense in Section 4(c)(1) was repealed by RA 11930. Use the offense-by-offense penalty table and the separate online-libel guide for the specific issue.

What are the 10 types of cyber crime?

RA 10175 sets no list of ten. Section 4 groups its offenses into three families: offenses against computer data and systems, computer-related offenses, and content-related offenses. Within those groups it names particular acts, including illegal access, illegal interception, data or system interference, misuse of devices, computer-related forgery or fraud, identity theft, and cyber libel. The enacted Section 4 has 13 numbered entries (six plus three plus four), not an official list of 10 or 12. Section 4(c)(3) was later voided, while RA 11930 repealed Section 4(c)(1) and RA 9775. The number 13 therefore describes the original text, not a current enforceable-offense count. Check the elements of the specific offense before deciding where to report or which penalty applies. See RA 10175, Section 4 and the reporting guide.

Is hacking someone’s Facebook account a cybercrime?

Unauthorized access to an account can potentially fall within illegal access under RA 10175, depending on the evidence and circumstances.

Does RA 10175 cover scams and phishing?

Yes, when the conduct satisfies a defined offense. Phishing may involve computer-related forgery, fraud, identity theft, misuse of devices, or illegal access. An online payment scam may be estafa committed through ICT under Section 6 rather than computer-related fraud under Section 4(b)(2), unless computer data or a system was manipulated in the manner that provision requires. RA 12010, RA 8484, the Revised Penal Code, and other statutes may also apply.

Does the law protect businesses too?

Yes. Cybercrime can target individuals, companies, organizations, databases, networks and critical infrastructure.

Is every offensive online post cyber libel?

No. The elements of libel still have to be established. Offensiveness alone is not enough. Read Section 4(c)(4) with the Revised Penal Code’s libel provisions, including Article 353’s definition, Article 354’s malice rule and Article 355’s publication provision.

Which subsection is cyber libel?

Cyber libel is Section 4(c)(4). The other three entries are part of the original numbering: cybersex at 4(c)(1) was later repealed, 4(c)(2) must be read with the newer child-protection law, and unsolicited commercial communications at 4(c)(3) was declared void.

What is the difference between Section 4 and Section 6?

Section 4 identifies the Act’s cybercrime offenses, including provisions that refer to conduct already defined in other laws. Section 6 raises the penalty one degree for crimes under the Revised Penal Code or special laws committed through ICT. It does not dispense with the underlying crime’s elements. For online libel, Sections 4(c)(4) and 6 are read together.

How long do providers keep the records that identify a sender?

Traffic data and subscriber information must be preserved for at least six months from the transaction; content data for six months from receipt of a preservation order. Section 13 allows a one-time six-month extension and continued preservation for a case through its transmittal-notice mechanism. Section 17 applies when the relevant periods expire. This retention framework is different from a complaint’s prescriptive period.

Can a company be fined even if management did not know?

Section 9 provides for liability where the commission of the offence was made possible by a lack of supervision or control over a person acting under the company’s authority, for its benefit. That trigger is framed around supervision, not knowledge. The ceiling in that situation is ₱5,000,000.

Is evidence collected without a warrant usable?

Section 18 is an express exclusionary rule: evidence procured without a valid warrant, or beyond the authority of one, is inadmissible in any proceeding before any court or tribunal. That provision is about what law enforcement obtains. It is a separate question from whether a victim’s own screenshots of their own account can be used, which is covered in screenshots as evidence.

Which court hears a cybercrime case?

Section 21 places jurisdiction with the Regional Trial Court and directs that special cybercrime courts be designated, manned by specially trained judges.

Does RA 10175 ban marketing email?

No. The Supreme Court declared Section 4(c)(3), the Act’s unsolicited-commercial-communications offense, unconstitutional in Disini. Do not use its original exceptions as today’s criminal-liability test. How the addresses were collected is a separate question under the Data Privacy Act.

Is the whole Act still in force exactly as written?

No. Disini invalidated some provisions and limited others. Separately, RA 11930, Section 44, repealed the cybersex provision and RA 9775. The original text must be read with later laws and controlling decisions, including the rules applicable to the date of the alleged conduct.

Do I need a lawyer to report a cybercrime?

No. A complaint can be brought to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division without counsel. Legal advice becomes valuable once a case is filed, when a charge is being framed, or where the same conduct also creates civil or employment exposure.

Related Cybercrime Guides

• Cybercrime Philippines Hub
• Where and How to Report Cybercrime
• RA 10175 Sections 4 and 6: the offence list and the one-degree-higher rule
• Illegal interception under RA 10175
• Computer-related fraud
• Computer-related identity theft
• Unauthorised account access
• Electronic evidence in the Philippines
• Are Messenger messages admissible as evidence?
• Online scam complaint procedure
• OSAEC and CSAEM Act
• Are deepfakes illegal in the Philippines?

Official Sources

• Republic Act No. 10175, full text — Senate of the Philippines Legislative Digital Resource
• Republic Act No. 10175 — Supreme Court E-Library
• Philippine News Agency — RA 10175 enforcement coverage
• National Bureau of Investigation
• PNP Anti-Cybercrime Group
• Department of Justice
• Supreme Court of the Philippines — current decisions and legal updates

Check the Controlling Sources

Read the original Act together with the court rulings and later laws cited beside each rule. For the constitutional limits on online libel, aiding or abetting, real-time traffic-data collection and blocking access, consult the Supreme Court’s Disini v. Secretary of Justice decision, especially its final disposition. The original text alone does not establish that every provision remains enforceable.

About This Guide

Author: Cybercode.ph Editorial Team. Sources rechecked as of: October 8, 2026.

Corrections. If a section number, figure or date on this page is wrong, the fastest check is the Senate copy linked under Official Sources. Where two government sources disagree, Cybercode flags the disagreement rather than choosing between them.

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.