Last materially reviewed: September 6, 2026
Direct Answer
You file a PNP Anti-Cybercrime Group complaint in person at an anti-cybercrime unit. A desk officer assesses whether the incident is cybercrime-related, endorses you to an investigator, and you complete an Incident Record Form. Bring one valid government ID and your printed online evidence. Published PNP citizen’s charter service standards list no fee for this walk-in assistance.
Compare this route with other reporting channels in Cybercode’s Cybercrime Philippines authority hub.
Key Takeaways
- Section 10 of RA 10175 requires both the NBI and the PNP to organise a cybercrime unit “manned by special investigators to exclusively handle cases involving violations of this Act.”
- The published PNP walk-in flow: desk officer, assessment, endorsement to an investigator, Incident Record Form (IRF), extraction of online evidence, preservation request to the service provider.
- The published checklist names printed screenshots of the posted material and of transaction receipts, the statement of account and dispute, printed social-media conversations, and one valid government ID.
- Fees are listed as “None”; the whole service standard runs about two and a half hours.
- The PNP investigates; a public prosecutor decides whether an Information is filed in court.
- Print your screenshots, but never delete the originals — the underlying export is what survives challenge.
- Data-privacy complaints, organisational security incidents and consumer-refund disputes belong to other agencies.
On This Page
- Decision snapshot: where your situation belongs
- Governing law and authorities
- Requirements, element by element
- Exceptions: what PNP-ACG will not handle
- Hypothetical Philippine scenarios
- Evidence and documentation
- The filing procedure, step by step
- Realistic outcomes
- Common mistakes
- Filing-day document checklist
- Frequently asked questions
- Related Cybercode guides
- Official sources
- Disclaimer
Decision Snapshot: Where Your Situation Belongs
| Your situation | Right agency | What to bring | Next step |
|---|---|---|---|
| Online selling scam, non-delivery after payment, fake seller | PNP Anti-Cybercrime Group or NBI Cybercrime Division | Valid ID, printed chats, printed proof of payment, statement of account and dispute | Walk in to an anti-cybercrime unit and complete the Incident Record Form |
| Account takeover of your social-media or email account | PNP Anti-Cybercrime Group or NBI Cybercrime Division | Valid ID, account URL and username, login-alert emails, platform ticket numbers | Secure the account first, then file; ask the investigator about a preservation request |
| Sextortion or threats to publish intimate images | PNP Anti-Cybercrime Group (women and children desks where applicable) | Valid ID, printed conversation, offender’s account links, payment demands | Report immediately; do not pay and do not delete the thread |
| A company mishandled or leaked your personal data | National Privacy Commission | Verified or notarized complaint, evidence, witness affidavits | Use the NPC complaint process, not a police blotter |
| A network intrusion against your organisation’s systems | CERT-PH under the DICT Cybersecurity Bureau | Incident timeline, logs, affected asset list | Report the incident to CERT-PH; file a criminal complaint separately if you want prosecution |
Governing Law and Authorities
The PNP’s authority is statutory. Section 10 of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, provides that “the NBI and the PNP shall organize a cybercrime unit or center manned by special investigators to exclusively handle cases involving violations of this Act.” That is why there are two parallel national doors and why a complainant may choose either.
The mechanics of a walk-in complaint are not in the statute. They are published as service standards in each PNP office’s citizen’s charter under the RA 11032 anti-red-tape regime. The Southern Police District Citizen’s Charter 2024 publishes the anti-cybercrime walk-in service in full and is the concrete source used here. Wording differs between offices; the shape of the service does not.
After the police stage, the case enters the criminal-procedure system: preliminary investigation under Rule 112 of the Revised Rules of Criminal Procedure, and, where computer data is needed, the Rule on Cybercrime Warrants. That half is covered in what happens after you report a cybercrime.
Requirements, Element by Element
1. One valid government-issued identification
“One (1) of any valid proof of identification” — driver’s licence, passport or government-issued ID. Bring the physical card. If your ID was itself misused in the incident, bring a second one and say so.
2. Printed screenshots of the posted material
The charter lists “printed screenshot of posted libelous remarks.” Read it broadly: printed captures of whatever was published or sent, showing the URL bar, timestamp and display name. Print the whole thread.
3. Printed screenshots of transaction receipts
Where money moved, print the receipt showing the reference number, amount, date and time, and the destination account or wallet number.
4. Statement of account and dispute
Your bank or e-money issuer’s own statement covering the transaction period, plus proof you raised a dispute. Lodge that dispute on or before the day you file; it creates a dated third-party record.
5. Printed conversations from social media
The exchange itself, printed from the first message and including the account identifier — not only the incriminating line.
6. The Incident Record Form
Completed by the complainant at the unit with the investigator’s help, roughly fifty minutes in the published standard. It is what turns your visit into a recorded incident, so write down the reference details it generates.
Exceptions: What PNP-ACG Will Not Handle
The desk officer’s first job is an assessment: is this a cybercrime or cyber-related incident at all? Several categories get redirected.
- Data-privacy violations. A company that lost, sold or misused your personal data answers to the National Privacy Commission, which requires a notarised complaint-assisted form or a verified complaint, evidence and witnesses’ affidavits.
- Organisational security incidents. Intrusions, ransomware and defacements affecting an organisation’s systems go to CERT-PH under the DICT Cybersecurity Bureau — an incident-response channel, not a prosecution channel. The two can run in parallel.
- Pure consumer disputes. Late delivery, defective goods or an unhonoured warranty from a legitimate merchant is a DTI consumer matter. Deception with intent to gain is different, and does belong with the police.
- Unregistered investment solicitations. Reported to the Securities and Exchange Commission, which can issue advisories and cease-and-desist orders no police unit can issue.
- Complaints against your own bank or wallet provider. An unreversed unauthorised debit or a refused dispute is a Bangko Sentral ng Pilipinas consumer-assistance matter, alongside any criminal complaint against the offender.
- Offences with no computer element. Handled by the police station with territorial jurisdiction, not by an anti-cybercrime unit.
Many incidents straddle these lines, and filing with one agency does not bar the others. The full map is in the cybercrime reporting directory.
Hypothetical Philippine Scenarios
The following situations are illustrative hypotheticals, not real cases.
Hypothetical A: the marketplace seller who vanished
Maricel pays PHP 18,500 by e-wallet for a phone advertised in a buy-and-sell group; the seller blocks her an hour later. She screenshots the listing, chat and transfer receipt, files a wallet dispute the same afternoon, downloads her statement, prints everything and brings one valid ID. The desk officer assesses the matter as cybercrime-related, she completes the IRF, and the investigator extracts the online evidence and asks the provider to preserve records. Nothing is refunded that day; what she has is a recorded, evidenced complaint.
Hypothetical B: the takeover that becomes a fraud on other people
Rico’s Facebook account is taken over and used to solicit “emergency loans” from his contacts; two friends send money. Before changing anything he prints the login alerts and the messages sent from his account. He files, and so do the two friends — each is a separate offended party with a separate loss to prove. See what to do when your Facebook account is hacked.
Hypothetical C: the wrong door
A clinic finds a spreadsheet of patient records posted in a public forum. The assessment identifies two obligations: a criminal complaint about the unauthorised access, and a personal-data breach answerable to the National Privacy Commission on its own timetable. Handling one leaves the other exposed.
Evidence and Documentation
The charter asks for printed material because a desk needs paper. Your case, later, needs more than paper.
A screenshot is not the underlying record
A screenshot is a picture of a screen. The underlying record is what the platform, bank or mail server actually holds: the account’s data export, the raw message with its headers, the server log line, the bank statement, the platform’s response to your report. A screenshot can be questioned; the underlying record is harder to dispute and carries metadata a picture does not. Print the screenshot for the desk and separately preserve the export. See are screenshots admissible evidence and electronic evidence preservation.
What to preserve, by type
- Messages and posts: the platform’s data archive, the permanent URL of each post, and the numeric account ID, which survives a display-name change.
- Email: the full message with headers, saved as .eml, not a forwarded copy.
- Money: reference numbers, destination account or wallet number, exact timestamps, the statement of account, and the dispute ticket number.
- Devices and logs: stop using an affected device and ask the investigator early — logs age out.
- Platform response: the abuse-report ticket number and the platform’s reply, which dates your discovery.
The affidavit
A criminal case eventually runs on a complaint-affidavit: your sworn first-person narrative with evidence lettered as annexes. Write the chronology now, in plain dates and times. At the police stage you may execute a sworn statement instead; the same chronology feeds both.
The Filing Procedure, Step by Step
- Stop the bleeding first. Secure accounts, change passwords from a clean device, enable two-factor authentication, and tell your bank or e-wallet provider to freeze or dispute the transaction.
- Preserve before you tidy. Request your platform data export and save emails with headers while the material is still online.
- Lodge the financial dispute and get a reference number — that produces the “statement of account and dispute” the checklist asks for.
- Write a one-page chronology with dated entries, then print the five checklist items.
- Choose your door: PNP-ACG or the NBI Cybercrime Division, both designated by Section 10 of RA 10175. See the NBI cybercrime complaint process.
- Report to the desk officer. About thirty minutes is allotted to the assessment of whether the complaint is cybercrime or cyber-related.
- Accept the endorsement to an investigator — about three minutes.
- Complete the Incident Record Form — around fifty minutes, with the investigator assisting. Write down your reference.
- Hand over the online evidence for extraction, about ten minutes.
- Ask for preservation. The charter’s final step is “preservation of data to the concerned service provider.” Ask whether a request has gone out, and to whom.
- Keep your own copy of everything you surrendered and follow up in writing.
The whole published service standard runs about two hours and thirty-three minutes, with no fee. Plan a half-day, not a lunch break. For the wider question of where to report first, see how to report cybercrime in the Philippines.
Realistic Outcomes
Filing starts a process. It does not guarantee an arrest, a prosecution or your money back.
Some complaints move quickly because the offender is identifiable from the transaction trail. Many take months, because attribution needs subscriber information from a provider and that needs a court warrant under Section 14 of RA 10175 — which is why an officially docketed complaint matters, since the statute ties disclosure to a valid complaint duly recorded. Some go nowhere: false registration details, money moved offshore, or data the provider no longer holds.
Even a strong police file does not decide the charge. The case goes to a public prosecutor for preliminary investigation under Rule 112, where the respondent is subpoenaed and given ten days to file a counter-affidavit and the prosecutor may find no probable cause and dismiss. Dismissal at that stage is ordinary. What filing reliably gives you is a dated official record, a preservation request before the data ages out, and standing as a complainant if the same offender resurfaces.
Common Mistakes
- Deleting the conversation after screenshotting it. The screenshot is a copy; the thread is the source. Block if you must, but do not delete.
- Confronting the offender, which warns them to wipe the account.
- Arriving with only screenshots on a phone. The checklist asks for printed material and one valid ID.
- Skipping the bank or wallet dispute, which leaves you without a statement of account and dispute.
- Cropping screenshots, which removes the timestamp, URL and account identity — the things that make a capture worth anything.
- Posting the case publicly, which can prejudice the investigation and invite a counter-complaint.
- Waiting. Section 13 of RA 10175 sets a minimum six-month preservation period from the transaction. Report inside that window.
- Assuming the police will refund you. Refunds come from the issuer’s dispute process, a civil claim, or restitution in a criminal case.
Filing-Day Document Checklist
Print this and tick it before you leave the house.
| Item | Form to bring it in | Why it matters | Done |
|---|---|---|---|
| Valid government ID | Physical card, plus one photocopy | Named in the published checklist | ☐ |
| Printed screenshots of the posted or sent material | Full-screen prints showing URL, timestamp, display name | Named in the published checklist | ☐ |
| Printed transaction receipts | Prints showing reference number, amount, date, destination | Named in the published checklist | ☐ |
| Statement of account and dispute | Bank or e-wallet statement plus the dispute reference | Named in the published checklist | ☐ |
| Printed social-media conversation | Whole thread from the first message | Named in the published checklist | ☐ |
| Platform data export and emails as .eml | On a USB drive | The underlying record behind the screenshots | ☐ |
| Offender account URL and numeric ID, one-page chronology | Printed | Survives name changes; speeds up the IRF | ☐ |
Frequently Asked Questions
Is there a filing fee?
No. The published PNP walk-in anti-cybercrime complaint service lists fees as “None,” and the NBI Cybercrime Division’s citizen’s charter entry likewise lists no fee.
Can I file online instead of walking in?
The PNP service published as a citizen’s charter standard is the walk-in one described here. The NBI separately publishes an online complaint form. Either way, expect to appear in person eventually, because sworn statements are executed in person.
Should I go to the PNP or the NBI?
Section 10 of RA 10175 designates both. Practical considerations decide it: which office you can reach, and where you can return for follow-up. Do not file the same complaint with both without telling each.
What if I do not know who did it?
That is the normal case. Identifying the offender is what the investigation is for, and Section 14 of RA 10175 provides the warrant-based route to subscriber information.
Do I have to go to the barangay first?
Barangay conciliation covers certain disputes between residents of the same city or municipality. It is not the route for an anonymous online offender and is not a precondition to reporting a cybercrime.
How long do I have to report?
Beyond any prescriptive period for the offence, evidence has a shelf life: Section 13 of RA 10175 sets a minimum six-month preservation period from the date of the transaction for traffic data and subscriber information. Reporting early is what makes preservation possible. What comes next is in our guide to the post-filing pipeline.
Related Cybercode Guides
- Cybercrime Reporting Directory Philippines — which agency handles what
- What Happens After You Report Cybercrime — the pipeline from complaint to court
- How to Report Cybercrime in the Philippines
- NBI Cybercrime Complaint Process
- Online Scam Complaint Procedure
- Sextortion: What Victims Should Do
- Hacked Facebook Account in the Philippines
- Computer-Related Identity Theft
- Are Screenshots Admissible Evidence?
- Electronic Evidence Preservation
- Government Cybersecurity Agencies Directory
Official Sources
- Republic Act No. 10175, Cybercrime Prevention Act of 2012 — Sections 10, 13, 14 (verified 6 September 2026)
- PNP Southern Police District Citizen’s Charter 2024 — anti-cybercrime walk-in complaint service standard, requirements, steps and fees (verified 6 September 2026)
- NBI Citizen’s Charter — Investigative Assistance for Victims of Computer Crimes (Cybercrime Division) (verified 6 September 2026)
- NBI Online Complaint (verified 6 September 2026)
- Revised Rules of Criminal Procedure, Rule 112 (verified 6 September 2026)
- National Privacy Commission — File a Complaint (verified 6 September 2026)
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.