What Evidence Should You Save After a Gaming Ban, Item Theft or Fraudulent Transfer?

Last materially reviewed: October 4, 2026

Key takeaways

• Capture evidence before the platform page, inventory, message thread or transaction history changes.
• Keep originals. Use copies for highlighting, redaction, annotation and complaint attachments.
• A screenshot shows what appeared on a screen; it does not automatically prove who controlled an account, how the record was created or that nothing was omitted.
• Transaction IDs, timestamps, account identifiers and platform-generated records usually make the evidence easier to verify.
• Ask the platform to preserve relevant records promptly, but do not misstate this as a court order or a preservation order issued by Philippine law enforcement.

Jump to a section

• What to save in the first 30 minutes
• Evidence matrix by incident
• How to preserve screenshots properly
• How to request platform preservation
• What Philippine law says
• How to build the evidence pack
• Your options and where to take the evidence

What should you save in the first 30 minutes?

1. Record the exact time. Note the date, time, timezone, device, network and what you were doing when the ban, theft or transfer appeared.
2. Capture the whole screen. Include the account name or ID, visible URL or app screen, warning text, transaction ID and device clock where possible.
3. Export what can be exported. Download emails, chat history, receipts, invoices, account data, security alerts and transaction history in their original available formats.
4. Photograph or record disappearing screens. A short screen recording can preserve navigation context, but keep separate still images of the decisive screens.
5. Save the governing rules. Download or print the terms of service, enforcement policy, item description, refund policy and appeal procedure that were displayed or linked at the relevant time.
6. Preserve payment proof. Keep official receipts, card or e-wallet references, order numbers, currency amounts and the payment account used. Redact full card numbers only in copies sent to others.
7. Secure the account. If compromise is suspected, save evidence first where safe, then change the password, revoke sessions and enable multi-factor authentication. Do not contact or threaten the suspected offender.

Evidence matrix: ban, item theft and fraudulent transfer

Incident	Preserve first	Why it matters
Account ban or suspension	Ban notice, stated rule, enforcement code, account ID, appeal deadline, terms version, recent activity and support tickets	Connects the sanction to the claimed rule and shows whether notice and review were available
Virtual item disappeared	Before-and-after inventory, item ID, purchase receipt, acquisition date, item description, trade history and platform status notices	Helps prove the item existed, how it was acquired and when control changed
Unauthorized item transfer	Transfer ID, recipient account, timestamp, confirmation message, login history, device alerts and recovery actions	Builds the event sequence and separates an account takeover from an authorized trade
Fraudulent purchase or charge	Invoice, payment reference, amount, merchant descriptor, email headers, account ledger and bank or e-wallet dispute reference	Links the platform event to the payment and the financial loss
Cheating or fraud accusation	Exact allegation, match or transaction identifiers, relevant gameplay records, installed software list, prior warnings and appeal replies	Allows the disputed event to be tested instead of arguing only that the decision was unfair
Chat-based scam	Full conversation export, profile URL or user ID, offer, payment request, transfer proof and report confirmation	Preserves representations, identity clues, reliance and the transaction trail

Are screenshots enough as evidence in the Philippines?

Screenshots can support a platform appeal, consumer complaint, police report or court case, but they are stronger when accompanied by the original electronic record and facts showing where the image came from. The Rules on Electronic Evidence (A.M. No. 01-7-01-SC) recognize electronic documents, require authentication of private electronic documents and allow courts to consider how a record was generated, stored and communicated, how the originator was identified and whether the system preserved its integrity.

A clean evidence capture should show context. Avoid cropping away the account name, address bar, time, transaction identifier or surrounding messages. Do not draw arrows or add labels to the original. If an explanation is needed, duplicate the file and annotate the copy.

A practical screenshot protocol

• Capture the full screen before taking close-ups.
• Use sequential filenames such as 01-ban-notice-2026-10-04-1325-PHT.png.
• Keep the original file metadata intact; do not resave the only copy through a messaging app that may compress it.
• Export the underlying email or conversation when the service provides an export function.
• Record the page URL, app version, account identifier and timezone in a separate evidence log.
• Back up the untouched folder to a second secure location.

How should you ask a gaming platform to preserve records?

Send a concise support request immediately. Identify the account, incident date range, disputed item or transaction IDs and the records you want preserved. Ask for preservation of relevant login, device, IP, inventory, transfer, payment, moderation and support records while the appeal or investigation is pending. Keep the ticket number and the platform’s response.

Sample request: “Please preserve records relating to account [ID] from [date/time range], including login and device history, inventory changes, transaction or transfer IDs, moderation records, support communications and the version of the terms or policy applied. This request concerns the disputed [ban/item transfer/charge] reported under ticket [number]. Please confirm receipt and advise what account data or transaction history I may obtain.”

This is a user request, not a compulsory legal order. Section 13 of Republic Act No. 10175 creates preservation duties for specified computer data and allows law-enforcement authorities to require preservation of content data and an extension in the circumstances stated by the law. A private user should not claim to exercise those government powers. If the event may be criminal and platform-held logs are important, prompt reporting matters because investigators may need formal legal process.

What Philippine law makes preservation important?

Electronic Commerce Act: integrity and reliability matter

Republic Act No. 8792 gives legal recognition to electronic data messages and electronic documents. Its provisions on originals and authentication focus on whether electronic information remained complete and unaltered, can be displayed and is reliable for the purpose for which it was generated. This is why the untouched source file, export or platform record can be more valuable than an edited image. See CyberCode’s Electronic Commerce Act guide.

Rules on Electronic Evidence: authenticity is not automatic

The Rules on Electronic Evidence state that a person offering a private electronic document as authentic bears the burden of proving authenticity. Integrity, reliability, originator identification and system controls can affect evidentiary weight. These are legal standards for proceedings, not a promise that every platform appeal will follow courtroom rules. They nevertheless explain why complete, original and traceable records are safer than isolated screenshots.

Cybercrime Prevention Act: platform data can require formal process

Republic Act No. 10175 defines illegal access, data interference, computer-related fraud and computer-related identity theft, among other offenses. It assigns cybercrime enforcement to the National Bureau of Investigation and Philippine National Police. Sections 13–16 address preservation, disclosure, search, examination and custody of computer data. Disclosure of relevant platform-held data may require a court warrant or other authorized legal process; a victim normally cannot compel the platform simply by demanding private logs.

Data Privacy Act: request your personal data carefully

Section 16 of Republic Act No. 10173 gives data subjects rights concerning personal information being processed, including access and correction rights subject to the law. An access request may help obtain account-related personal data, but it does not automatically entitle a user to another person’s data, confidential anti-fraud methods, privileged material or every internal security log. Ask specifically for your account data and avoid framing privacy law as unlimited discovery.

How to organize a gaming-incident evidence pack

Use a simple folder structure that another person can understand without interviewing you first:

• 00 Summary: one-page statement of the incident, account ID, loss and requested remedy.
• 01 Timeline: date, time, timezone, event, source file and action taken.
• 02 Account: profile, ownership indicators, registration email and security settings.
• 03 Transactions: receipts, payment references, item and transfer ledgers.
• 04 Communications: original emails, chat exports and support tickets.
• 05 Rules: terms, enforcement policy, item description and refund policy.
• 06 Security: login alerts, session history, device details and recovery actions.
• 07 Copies for submission: redacted and annotated copies; never replace the originals.

What should the timeline contain?

Field	Example
Date and time	October 4, 2026, 1:25 PM PHT
Event	Login alert received from an unfamiliar device
Source	Original email saved as 2026-10-04-login-alert.eml
Account or transaction ID	Account ID and transfer reference exactly as displayed
Action taken	Sessions revoked; password changed; ticket filed
Result	Platform acknowledged ticket at 1:43 PM PHT

What not to do

• Do not delete messages, receipts or the original app before exports are complete.
• Do not crop, recolor, enhance or annotate the only copy of an image.
• Do not publish sensitive account evidence publicly; it may expose recovery codes, contact data or investigative details.
• Do not access another person’s account or device to “collect proof.” Unauthorized access can create a separate legal problem.
• Do not fabricate missing evidence or alter dates. State clearly when a detail is based on memory.
• Do not wait for an appeal result before preserving evidence that may disappear.

Your options and where to take the evidence

The evidence pack is the same for every route; what changes is who you send it to. Start with the platform’s internal appeal, security or fraud channel, because the operator controls the account and the item ledger. Then add the outside route that matches the incident.

Incident	Where to take it	What to bring	Timing
Ban or suspension you dispute	The platform’s appeal channel; see bans without an appeal and, for a court claim, suing over a mistaken ban	Ban notice, rule cited, account ID, terms version, appeal replies	The platform sets its own appeal window; no statutory period was verified
Item or account taken by someone else	Platform security team, then the PNP Anti-Cybercrime Group or NBI Cybercrime Division	Timeline, login alerts, transfer IDs, ticket number	Promptly; providers must keep traffic data for at least six months under RA 10175 Sec. 13
Paid items or credits lost	Platform refund process, then a DTI consumer complaint; see refunds after a ban	Receipts, payment references, item descriptions, terms	Consumer Act claims prescribe in two years (RA 7394 Art. 169)
Card or e-wallet charge you did not authorise	Your bank or e-wallet first, then the BSP; see unauthorised e-wallet transactions	Statement line, transaction reference, dispute ticket	Report the same day; the provider’s own rules set the clock
You want your own account data	Written access request to the platform, then the National Privacy Commission	Copy of your request, proof of identity, the platform’s reply	NPC complaint only after 15 calendar days without proper action

Each route has a different legal basis. Section 10 of Republic Act No. 10175 makes the NBI and the PNP responsible for enforcing the Cybercrime Prevention Act, so they, not the player, can seek the court process needed to obtain platform logs. Article 162 of the Consumer Act (RA 7394) gives DTI consumer arbitration officers original and exclusive jurisdiction over consumer complaints without preventing court action, and Article 169 sets a two-year prescriptive period for claims under the Act. For personal data, Section 16(c) of the Data Privacy Act gives a right of reasonable access, and Rule II, Section 2 of the NPC’s 2021 Rules of Procedure, as amended requires you to inform the company in writing first and allow 15 calendar days before filing a complaint.

If the facts point to account takeover, computer-related fraud or identity theft, use CyberCode’s cybercrime reporting guide and agency directory. If the dispute is about whether a stolen skin, character or parcel of virtual land is legally yours, read whether stolen game items count as property; for a platform that removed items itself, see when a platform may delete or confiscate virtual items.

First action today: create the read-only evidence folder and the one-page timeline, then file the platform ticket and save its number. Every later route asks for those three things. Preserve a clean copy of everything you submit and each acknowledgment or docket number.

Frequently asked questions

Should I record my screen after discovering an unauthorized transfer?

Yes, when it can be done safely and without changing the account. Record the navigation path, account identifier, inventory and transfer details, then save still screenshots and any available data export. A screen recording adds context but should not replace the original transaction record.

Should I calculate a hash for each evidence file?

A cryptographic hash can help show that a file has not changed, but it is not mandatory for every support appeal. For a high-value dispute, calculate hashes after collecting the originals, record the method used and keep the originals read-only. A hash does not prove that the original content was true.

Can the platform refuse to give me another player’s identity?

Yes. Privacy, confidentiality and legal-process rules can restrict disclosure. Ask the platform to preserve the information and provide it to properly authorized investigators if required, rather than demanding that private data be sent directly to you.

Does changing my password destroy evidence?

Usually not, but first capture the visible incident details, active sessions and login history if it is safe to do so. Then secure the account promptly. Record when the password was changed and which sessions or devices were revoked.

Can I rely on a screenshot sent through Messenger?

Use it if that is all you have, but ask for the original file or capture if available. Messaging services may compress images or remove metadata. Keep the message showing who sent the file and when.

How quickly should I report the incident?

Report it immediately after preserving the essential records and securing the account. Platform appeal, payment-dispute and law-enforcement processes may have different deadlines, and relevant logs may not remain available forever.

Disclaimer

Cybercode.ph provides general educational information about technology, cybersecurity, privacy and related legal issues. It is not a substitute for legal, cybersecurity or professional advice for a specific situation.

Sources rechecked as of: 5 October 2026

Related reading

Related postCan a Gaming Platform Permanently Ban a Filipino User Without an Appeal?Use this guide to assess the notice, evidence and review process behind a disputed ban.Read post →CyberCode guideCan a Gaming Platform Delete or Confiscate Virtual Items?See how platform terms, paid value and the reason for removal affect a restoration or refund claim.Read guide →