How to Report Cybercrime in the Philippines: NBI and PNP

How Do I Report Cybercrime in the Philippines?

You file a cybercrime complaint in the Philippines in two stages. First, preserve your evidence, then execute a sworn complaint at the NBI Cybercrime Division or the PNP Anti-Cybercrime Group — Section 10 of Republic Act No. 10175 names those two bodies, and only those two, as the law-enforcement authorities for the Act. Second, the matter reaches a prosecutor as a complaint-affidavit for preliminary investigation, in five copies plus one for every respondent. Both stages run on documents sworn under oath. If money moved, tell the bank or e-wallet the same day.

A CICC-linked hotline report is different from a formal criminal complaint. CICC coordinates cybercrime response; NBI and PNP handle criminal investigation. RA 10844 Section 15(b) attached CICC to DICT and transferred specified cybersecurity functions, including the national cybersecurity plan, to DICT. A Philippine Information Agency release dated 31 December 2025 describes the Inter-Agency Response Center (I-ARC) Hotline 1326 as a joint line of the CICC, the Department of Information and Communications Technology, the National Privacy Commission and the National Telecommunications Commission for reporting online scams. That is a government news report about a referral and coordination channel, not the criminal complaint itself, and not a substitute for filing one.

If personal data was leaked or unlawfully processed, a National Privacy Commission process may run alongside the criminal route. If there is an immediate threat to life or physical safety, go to the nearest police station or emergency services first and preserve the digital evidence afterwards.

Primary authorities read for this guide: Republic Act No. 10175 (Senate Legislative Digital Resource), the NBI Citizen’s Charter entry for the Cybercrime Division, the Department of Justice requirements for filing a complaint for preliminary investigation, the DOJ Office of Cybercrime and the PNP Anti-Cybercrime Group. Read the statutory text together with the Supreme Court’s Disini ruling, including its invalidation of Section 19.

Ready to report? Open the official route

Open NBI official cybercrime complaint intake instructions

The NBI describes attending its Cybercrime Division for assistance with the complaint sheet, interview and sworn statements. This link is an instruction page, not an online complaint submission form.

Keep the receiving desk, submission date and reference number in your own notes. Ask which documents or next steps are still required. Reading this page does not submit a complaint.

Evidence and action

RuleA criminal complaint rests on sworn statements. The DOJ requirements for preliminary investigation call for a complaint-affidavit and witness affidavits, in five copies plus one for each respondent.

What changes the answerIf a company leaked your personal data, the route is usually the NPC, after written notice and 15 calendar days. Gender-based online sexual harassment goes to the PNP Anti-Cybercrime Group under Section 13 of the Safe Spaces Act.

What to preserveFull screenshots with URLs and usernames, email headers, chat exports, transaction records, login alerts and a written timeline. Keep the originals; never access another person’s account to collect evidence.

When to actRA 10175 Section 13 requires preservation of traffic data and subscriber information for a minimum of six months from the transaction (RA 10175, Section 13). That is a retention rule, not a filing deadline; prescriptive periods differ by offence.

Next stepBefore intake, write a dated chronology with amounts, account identifiers and platform names. Keep every case or reference number you receive.

Not sure which agency fits your case? The free Scam or Hack Triage tool gives you an action plan and the order to report in.

Jump to a Section

How to file a cyber crime complaint
Who the law says investigates cybercrime
Which agency should you contact?
Where the CICC fits — and where it does not
Reporting to the PNP Anti-Cybercrime Group
Reporting to the NBI Cybercrime Division
What the prosecutor will need
Evidence to preserve before reporting
The reporting sequence, step by step
Clocks and deadlines that actually bite
Six worked scenarios
Frequently asked questions
Official sources
Verification log

Decision Snapshot

Question	Practical answer
Is there one national desk that takes every cybercrime report?	No. RA 10175 Sec. 10 puts enforcement with the NBI and the PNP, each of which runs its own cybercrime unit.
Does the CICC investigate my case?	No. Secs. 24–26 give it coordination, monitoring and planning functions, not investigation.
Do I have to pick between the NBI and the PNP?	Practically yes — file with one, and say so if you have already reported elsewhere. Both are law-enforcement authorities under the same section.
Does a report to a platform, bank or telecom count as reporting the crime?	No. Those are parallel and useful, but they are not a criminal complaint.
Will I need a sworn statement?	Yes. Both the NBI intake process and the DOJ preliminary-investigation requirements are built on affidavits executed under oath.
Does filing a report cost money?	The NBI Citizen’s Charter entry for this service records no fee.
Is a report the same as a criminal case?	No. Prosecution begins at the prosecutor’s office after preliminary investigation.
Should I block the sender first?	No — preserve first, then block, unless blocking is needed for your safety.

Choose Your Route

Money transfer or SIM/account takeover: contact the provider or bank while preserving the law-enforcement trail.
Privacy or leaked personal data: assess the NPC complaint or breach route in addition to cybercrime reporting.
Threat, harassment or exploitation: preserve evidence and prioritize safety; do not confront the offender if doing so increases risk.

Key Takeaways

Two bodies enforce the Cybercrime Prevention Act. Section 10 of RA 10175 makes the National Bureau of Investigation and the Philippine National Police “responsible for the efficient and effective law enforcement of the provisions of this Act,” and requires each to organise a cybercrime unit staffed by special investigators who handle Act violations exclusively.
The CICC is not one of them. Its powers under Sec. 26 are eight coordination, monitoring, planning, international-cooperation and recommendation functions. This statutory list does not make CICC a criminal investigating agency. Hotline 1326 can receive scam reports for referral; a formal criminal complaint follows the NBI or PNP route.
Your report is built on a sworn statement. The NBI Citizen’s Charter describes a complaint sheet completed under oath; the Department of Justice requires a complaint-affidavit and witness affidavits before a prosecutor will act.
Preserve before you block or delete. Original messages, headers, URLs, account identifiers and transaction records are what the investigator can actually work with.
Move on the money the same day. A criminal report does not freeze or recall a transfer — the bank, e-wallet or card issuer does, under its own process.
Evidence gathered without a valid warrant is inadmissible. Sec. 18 of RA 10175 says so in terms, which is why the lawful route matters more than the fast one.
One incident often needs several reports. Criminal complaint, bank dispute, platform takedown and, where personal data is involved, a National Privacy Commission process can all run at once without replacing one another.

How to File a Cyber Crime Complaint in the Philippines

Filing a cyber crime complaint in the Philippines is two filings, not one. You first swear a complaint at the NBI Cybercrime Division or the PNP Anti-Cybercrime Group, the two law-enforcement authorities named in Section 10 of RA 10175. What the investigators develop is then taken to a prosecutor, where the filing becomes a complaint-affidavit for preliminary investigation under the Department of Justice’s documentary requirements. Most reporting guides describe only the first stage, which is why people arrive at the prosecutor’s office with the wrong number of copies.

The two stages, and what runs alongside them

Filing	Where it goes	What you sign	What it produces
Stage 1: law-enforcement intake	NBI Cybercrime Division or PNP Anti-Cybercrime Group, under RA 10175 Sec. 10	A sworn complaint sheet, plus sworn statements from you and from any witnesses	An investigation, a reference number, and requests to preserve records
Stage 2: preliminary investigation	The prosecutor’s office, on the DOJ requirements	Investigation Data Form in 2 copies certified under oath; complaint-affidavit and each witness affidavit in 5 copies plus one per respondent	A prosecutor’s resolution on whether the case is filed in court
Alongside: the money	Your bank, e-wallet or card issuer	That provider’s own dispute or fraud-hold form, not an affidavit	A possible hold, recall or dispute. It is not a criminal complaint
Alongside: personal data	National Privacy Commission	A notarised complaint-affidavit, after written notice to the organisation	A separate NPC proceeding about the data-privacy violation
Alongside: the platform	The platform’s own reporting tool	Its report form, with no oath	Takedown or account suspension only. No criminal case starts

Hotline 1326 is not a third stage. A Philippine Information Agency release dated 31 December 2025 describes the Inter-Agency Response Center line as the government’s 24/7 central number for reporting online selling scams, run jointly by the CICC, the DICT, the NPC and the NTC, and records that enforcement itself is handled by the PNP Anti-Cybercrime Group and the NBI Cybercrime Division. Calling it can get an account flagged and a referral made. It does not file your complaint for you.

The steps for filing, in order

Preserve before you touch anything. Screenshots showing URLs and account names, original messages and headers, transaction records, login alerts, and a dated timeline. See what to preserve.
Secure the accounts, and call the bank the same day if money moved. A criminal complaint does not recall a transfer; only the provider can attempt that.
Write the chronology before you go. Dates, amounts, account identifiers, platform names, and what you have already reported. Use the incident summary.
Swear the complaint at the NBI or the PNP-ACG. Either is a valid first filing. The complaint sheet is executed under oath, so write only what you can stand behind. See the NBI intake process and the PNP route.
Keep the reference number and ask what is still owed. Which documents, which desk, and how to follow the matter up.
Prepare for the prosecutor. Count the copies against the number of respondents, not against five. See what the prosecutor will need.
File the parallel reports that match the harm. Bank, platform, telecom, or the National Privacy Commission where personal data was involved.

What filing does not do. It does not freeze money, remove a post, or guarantee that anyone is identified. Section 18 of RA 10175 makes evidence procured without a valid warrant inadmissible in any proceeding, so the lawful route is also the only useful one. And the practical clock is Section 13: traffic data and subscriber information are preserved for a minimum of six months from the date of the transaction, which is why the week you file in matters more than the month you file in.

Your first action today. Open one folder, put every original record in it unedited, and write the chronology. Then take it to whichever of the two units is nearer — the NBI Cybercrime Division or your regional PNP Anti-Cybercrime unit — and ask at intake which supporting documents the prosecutor will require for your particular offence. If you are not sure which lane your incident belongs in, work through the scam or hack triage tool first.

Who the Law Says Investigates Cybercrime

Most pages about reporting cybercrime in the Philippines list agencies. Few of them say which agency the statute actually empowers to do what, and the difference decides where a complaint should go. Here is the allocation as Republic Act No. 10175 sets it out.

Body	Where it comes from	What RA 10175 gives it	Does it take your complaint?
National Bureau of Investigation	Sec. 10	Responsibility for law enforcement under the Act, plus a duty to organise a cybercrime unit or centre of special investigators handling Act violations exclusively	Yes — through the Cybercrime Division
Philippine National Police	Sec. 10	The same responsibility and the same duty to organise a dedicated cybercrime unit	Yes — through the Anti-Cybercrime Group and regional units
Department of Justice	Secs. 11 and 23	Receives law-enforcement reports; hosts the Office of Cybercrime for international mutual assistance and extradition.	See the prosecutor’s complaint requirements. Section 19’s blocking power was struck down in Disini (2014).
Regional Trial Court	Sec. 21	Jurisdiction over Act violations, with designated special cybercrime courts manned by specially trained judges	No — it tries the case
Cybercrime Investigation and Coordinating Center	Secs. 24–26	Policy coordination among concerned agencies, formulation and enforcement of the national cybersecurity plan, a computer emergency response team, monitoring of cases handled by others, international cooperation, and recommendations for new laws and policies	Hotline 1326 receives reports for referral and coordination; criminal investigation is handled by NBI or PNP. Read the original statutory functions alongside RA 10844 Section 15(b), which transferred specified cybersecurity functions to DICT.

That last row is the single most common misunderstanding about reporting cybercrime here, and it has a practical consequence: routing a complaint through a coordinating body adds a hop. The complaint still has to reach the NBI or the PNP before anyone investigates it. For the full statutory reading of the CICC’s mandate, see what the Cybercrime Investigation and Coordinating Center actually handles; for the Act as a whole, see the complete guide to RA 10175.

Which Agency Should You Contact?

Route by what happened, not by which agency you have heard of. The middle column is the provision an investigator is likely to be working from, which is also what makes your evidence relevant.

What happened	Likely RA 10175 provision	Where to file	Run in parallel
Someone got into your account without permission	Sec. 4(a)(1) illegal access	NBI Cybercrime Division or PNP-ACG	Platform recovery; preserve login alerts — see unauthorised account access and a hacked Facebook account
You paid a seller who never delivered, or a fake investment	Sec. 4(b)(2) computer-related fraud, and estafa via Sec. 6	NBI or PNP-ACG	Bank or e-wallet dispute the same day — see online estafa and the online scam complaint procedure
Your name, photos or ID were used as someone else’s identity	Sec. 4(b)(3) computer-related identity theft	NBI or PNP-ACG	NPC route where personal data was processed — see identity theft and fake accounts and impersonation
Your messages or transmissions were intercepted	Sec. 4(a)(2) illegal interception	NBI or PNP-ACG	Preserve device and network records — see illegal interception
Files were encrypted, deleted or corrupted	Secs. 4(a)(3) data interference and 4(a)(4) system interference	NBI or PNP-ACG	Do not wipe the machine — see malware attacks and ransomware response
A defamatory post about you	Sec. 4(c)(4) libel, defined by Art. 355 of the Revised Penal Code	NBI or PNP-ACG	Capture the whole post, URL and account — and mind the clock, see cyber libel prescription and online libel
Your SIM was swapped or ported away	Fraud and identity-theft provisions, depending on the facts	NBI or PNP-ACG	Telco and bank immediately — see SIM-swap fraud liability and the SIM Registration Act
A company lost or leaked your personal data	Not primarily RA 10175 — this is the Data Privacy Act	National Privacy Commission	See how to file an NPC complaint and breach notification through the DBNMS
Immediate threat to life or safety	Safety first; the cyber offence is secondary	Nearest police station or emergency services	Preserve the digital evidence once you are safe

1. Reporting to the NBI Cybercrime Division

The National Bureau of Investigation publishes the intake process for this in its Citizen’s Charter, under the service name “Investigative Assistance for Victims of Computer Crimes (CCD)”. It is the most concrete published account of what actually happens when you walk in with a cybercrime complaint in the Philippines, so it is worth reading closely rather than summarising.

Item	What the Citizen’s Charter records
Who may avail	General public
Checklist of requirements	None listed
Fees	None
Total processing time	1 hour and 10 minutes
Where	The Cybercrime Division, with Regional Cybercrime Centers handling complaints filed outside headquarters under the same process

The published steps run as follows.

Filing (about 10 minutes). You go to the Cybercrime Division to file a complaint or request investigative assistance. Division personnel help you complete the complaint sheet.
Preliminary interview and initial investigation (30 minutes to 1 hour). An Agent or Special Investigator interviews you, helps complete the sworn complaint sheet, and prepares a request for authority to investigate.
Sworn statements. You and any witnesses execute sworn statements, or submit affidavits you have already prepared. Agents collect the supporting documents and evidence relevant to the investigation.
Approval (about 30 minutes). The complaint sheet and the request for authority to investigate go to the Office of the Deputy Director for Investigation for approval, then return to the Division.

Two things in that sequence matter more than they look. First, the complaint sheet is sworn — you are signing under oath at the intake stage, so a vague or inflated narrative is a liability, not a formality. Second, nothing in the charter requires you to arrive with a lawyer or a prepared affidavit, but arriving with one you have already drafted collapses step 3. Bring a written chronology with dates, amounts, account identifiers and platform names, and the process moves faster than the published hour and ten minutes suggests.

One thing this guide will not tell you: the street address. The NBI’s own homepage and its Citizen’s Charter entry do not describe the location in the same terms — the homepage read on 22 September 2026 gives a Filinvest Cyberzone, Pasay City address for the Bureau, while the charter entry read for this update refers to filings outside NBI Taft headquarters going to Regional Cybercrime Centers. Rather than pick one, confirm the current office and its hours on the NBI site immediately before you travel. Our fuller walkthrough is at the NBI cybercrime complaint process.

2. Reporting to the PNP Anti-Cybercrime Group

The Philippine National Police is the second of the two law-enforcement authorities named in Sec. 10 of RA 10175, and the Anti-Cybercrime Group is the unit it organised to meet that section’s requirement of “a cybercrime unit or center manned by special investigators to exclusively handle cases involving violations of this Act.” Regional anti-cybercrime units operate under the same mandate, which is what makes the PNP route practical outside Metro Manila.

One statute sends a specific class of complaint to the PNP-ACG by name. Section 13 of the Safe Spaces Act, Republic Act No. 11313, provides that for gender-based online sexual harassment the PNP Anti-Cybercrime Group “shall receive complaints…and develop an online mechanism for reporting real-time gender-based online sexual harassment acts and apprehend perpetrators.” If your complaint is about online sexual harassment, misogynistic or homophobic abuse, non-consensual sharing of intimate images, cyberstalking or online impersonation of the kind Sec. 12 of that Act describes, the PNP-ACG is the statutorily designated route rather than merely one of two options.

What to bring is the same discipline the NBI process demands: a written chronology, government-issued identification, the original device or evidence if it is requested, and printed or digital copies of the supporting records. Expect to execute a sworn statement.

A limit worth stating plainly. The Anti-Cybercrime Group’s website answers, but the pages reachable for this update publish operational news and case announcements rather than a mandate statement, a complaint procedure, a hotline, an email address or an office address. This guide therefore publishes no PNP-ACG contact details, because none could be read from a government host during this review. Confirm the current unit, address and hours on the PNP site or at your nearest station before travelling. Our fuller walkthrough is at the PNP Anti-Cybercrime Group complaint process.

3. Where the CICC Fits — and Where It Does Not

The Cybercrime Investigation and Coordinating Center is the body most often named first in advice about reporting cybercrime in the Philippines, and its name is part of the reason: it contains the word “Investigation.” The statute that created it does not give it any.

Section 24 of RA 10175 creates the CICC as “an inter-agency body,” under the administrative supervision of the Office of the President, for “policy coordination among concerned agencies and for the formulation and enforcement of the national cybersecurity plan.” Section 26 then lists eight powers: formulating the national cybersecurity plan and extending assistance through a computer emergency response team; coordinating measures to prevent and suppress cybercrime; monitoring cybercrime cases being handled by participating law enforcement and prosecution agencies; facilitating international cooperation; coordinating private-sector, local-government and NGO participation; recommending laws and policies; calling on government agencies for assistance; and performing other matters related to cybercrime prevention and suppression, including capacity building.

Read the statute with the Supreme Court’s ruling. Section 10 assigns law enforcement under RA 10175 to the NBI and PNP; Sections 11 and 23 address DOJ reporting and international cooperation. In Disini v. Secretary of Justice, G.R. No. 203335, En Banc, 18 February 2014, the Supreme Court declared Section 19 unconstitutional. Do not rely on that section as authority for a DOJ order blocking suspected computer data. A request to remove content still needs an applicable platform process or lawful remedy; a criminal report does not itself secure removal.

This is not a reason to ignore the coordination channels. It is a reason to understand what they are for. A Philippine Information Agency release dated 31 December 2025 describes the Inter-Agency Response Center Hotline 1326 as “the government’s 24/7 central number where the public can conveniently report online selling scams,” and quotes a DICT regional director describing it as a collaborative effort of the CICC, the DICT, the National Privacy Commission and the NTC. Reporting there can get a scam flagged, a number or account escalated and a referral made. It does not create a criminal case, and it does not start the clock on one. If you want an investigation, the complaint still has to reach the NBI or the PNP.

What this guide will not restate. An earlier version of this page published a CICC email address alongside hotline 1326. That address could not be re-verified for this update: the CICC’s own website returned a 403 error on its root and again on its complaint-filing page, so nothing on it could be read. The address is therefore neither repeated nor silently deleted — it is flagged here as unverified, and readers should take the current contact details from the CICC site itself. The full statutory analysis is at what the CICC actually handles.

What the Prosecutor Will Need

A report to an investigator and a complaint for preliminary investigation are two different filings, and most reporting guides stop before the second. Knowing what the second one requires changes how you prepare for the first, because the affidavit you swear at intake is the document that has to survive it.

The Department of Justice publishes the documentary requirements for filing a complaint for preliminary investigation. They are exacting about copies.

Document	Copies required	Form
Investigation Data Form (NPS INV Form No. 1)	2	Duly accomplished and certified under oath
Complaint-Affidavit or sworn statement of the complainant or victim	5, plus one for every respondent	Sworn
Affidavit or sworn statement of each witness	5, plus one for every respondent	Sworn
Supporting documents, which the DOJ lists across thirteen offence-specific categories	5, plus one for every respondent	As applicable to the offence
Where the victim or the offender is a minor: birth certificate or affidavit of age, and a certificate of discernment under RA 9344 where required	As applicable	Documentary

The page records office hours of Monday to Friday, 8:00 a.m. to 4:30 p.m., with no noon break. Note the copy rule in particular: “five copies plus the number of respondents” means a complaint against three people needs eight sets, not five. People are sent home over this.

The Office of Cybercrime. Section 23 of RA 10175 creates an Office of Cybercrime within the DOJ. On its own site the Office describes itself as the “Central Authority in all matters relating to international mutual assistance and extradition for cybercrime and cyber-related matters” and as the “focal agency in formulating and implementing law enforcement investigation and prosecution strategies.” That matters for cases with an offshore element — a foreign platform, an overseas payment rail, a suspect abroad — because mutual legal assistance is how evidence held outside the Philippines is lawfully obtained. It is not a walk-in complaint desk either.

First-contact incident summary: copy into your own notes

Use this preparation aid when contacting a provider or reporting desk. It is not an official complaint form, affidavit or filing. Keep it on your own device and share sensitive records only through a verified receiving channel.

What happened: [Describe the incident in a few factual sentences.]
When: [Date, time and time zone; when you discovered it.]
Where: [Platform, website or service; relevant profile or transaction identifiers.]
Money or account access affected: [Amount and transaction reference, if applicable; describe any lost access.] Never include a password, PIN or one-time code.
Evidence available: [Original messages, full-context screenshots, URLs, payment records and login alerts; note where you saved them.]
Actions already taken: [Provider or agency contacted, date, reference number and response.]
Next question for the receiving desk: [What documents or sworn statements do I need, where do I submit them, and how do I follow up?]

You do not need to finish these notes before seeking urgent help. Keep original records intact; mark uncertain facts as uncertain rather than guessing.

What Evidence Should You Preserve Before Reporting?

There is a legal reason to be careful here, not just a practical one. Section 18 of RA 10175 provides that “any evidence procured without a valid warrant or beyond the authority of the same shall be inadmissible for any proceeding before any court or tribunal.” Evidence that you lawfully hold — your own messages, your own account records, your own transaction history — is not caught by that rule, which is precisely why the material you preserve yourself is often the most useful thing in the file. Material obtained by going around a platform’s controls or into someone else’s account can be worse than useless.

Preserve the following before you block, delete, reinstall or factory-reset anything.

complete screenshots showing dates, usernames and surrounding context;
full URLs and profile links;
original emails and headers where available;
chat exports, SMS records and call logs;
bank, e-wallet, card or cryptocurrency transaction records;
receipts, invoices, order confirmations and advertisements;
account login alerts and password-reset notices;
device logs or security alerts;
the scammer’s phone number, email address, account name and payment destination;
a chronological timeline of what happened; and
copies of reports already filed with a platform, bank, telecom or regulator.

Do not crop or edit the only copy. Keep originals and create working copies for submission. For a practical preservation workflow, use the Electronic Evidence Checklist Philippines.

The Reporting Sequence, Step by Step

Make yourself safe first. If there is an immediate physical threat, contact 911 or local police.
Preserve the evidence. Save messages, URLs, account identifiers, transaction records, attachments and timestamps.
Secure compromised accounts. From a known-clean device, change passwords, revoke unknown sessions and enable multi-factor authentication.
Contact the financial provider immediately if money is involved. Ask about freezing, recalling, disputing or flagging the transaction where available.
File the criminal complaint with the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. Section 10 of RA 10175 makes the NBI and the PNP the law-enforcement authorities for the Act. For an online scam you may also call the Inter-Agency Response Center hotline 1326, a joint channel of the CICC, the DICT, the NPC and the NTC (Philippine Information Agency, 31 December 2025), but that report is a referral route, not a criminal complaint.
Prepare a simple written timeline. Include dates, amounts, accounts, names, platforms and the actions already taken.
Provide original or best-available evidence when requested.
Keep the case or reference number. Record investigator names, office, dates and follow-up instructions.
File parallel reports when necessary. Platform, NPC, bank, telecom or sector-regulator action may be separate from the criminal investigation.

Clocks and Deadlines That Actually Bite

“Report quickly” is advice everyone gives and nobody quantifies. RA 10175 quantifies it, and the numbers are the strongest argument for filing this week rather than next month.

Clock	Length	Source	Why it matters to you
Service providers preserve traffic data and subscriber information	Six months from the date of the transaction	RA 10175 Sec. 13	This is the one that decides cases. See the note below this table.
Content data preservation, once ordered	Six months from receipt of the law-enforcement order, extendable once by six months	RA 10175 Sec. 13	Content is preserved only after an order is served — which cannot happen until someone has your complaint.
Preservation after evidence is used	Until the case is terminated	RA 10175 Sec. 13	Once the material is in evidence and the prosecutor transmittal is documented, retention no longer expires.
Disclosure of data on a court warrant	72 hours	RA 10175 Sec. 14	A person or service provider ordered to disclose subscriber information, traffic data or relevant data must do so within 72 hours.
Extension of an examination	Up to 30 days, with court approval	RA 10175 Sec. 15	Forensic examination of a seized system is time-boxed.
Deposit of examined data with the court	48 hours after the warrant expires	RA 10175 Sec. 16	Sealed, with an affidavit of access and a certification that no unauthorised duplicate was made.
Before an NPC complaint about a company	15 calendar days	2021 NPC Rules of Procedure (NPC Circular No. 2021-01)	You must first tell the organisation in writing, and it must fail to act or fail to respond within 15 calendar days, before the Commission will take your complaint.
Non-compliance with a law-enforcement order	Per offence	RA 10175 Sec. 20	Failure to comply is punished under Presidential Decree No. 1829 by imprisonment or a ₱100,000 fine, or both, for each and every non-compliance — which is the leverage behind a preservation request.

Why the six-month preservation clock decides cases: The records that identify who was behind an account or a transfer are retained for six months by default. Report inside that window and the trail may still exist; report long after it and there may be nothing left to obtain lawfully.

What this page does not state. How long you have to file a complaint before the offence prescribes is a separate question with a separate answer for each offence, and no single deadline covers cybercrime generally. For data-privacy matters the NPC’s own rules apply Act No. 3326, which varies by offence. For cyber libel the prescriptive period has been contested in its own right, and we deal with it separately in cyber libel prescription. Do not read the six-month preservation period as a limitation period — they are unrelated.

Online Scam: What Should You Do Before Waiting for Police?

After an online scam in the Philippines involving a money transfer, contact the bank or e-wallet immediately before waiting for a police investigation. Provide the receiving account, amount, transaction reference, and time, then ask what fraud-hold, recall, dispute, or account-freeze procedures are available. Preserve the payment records and include them in the cybercrime report. Use the dedicated Online Scam Complaint Procedure Philippines for the fuller recovery-and-reporting workflow.

Use the dedicated Online Scam Complaint Procedure Philippines for a fuller recovery-and-reporting workflow.

Do You Need to Report to More Than One Agency?

Often, yes. Different organizations have different powers. A police or NBI report develops the criminal case; a bank or e-wallet may act on funds; a platform can suspend an account or preserve records under its processes; the NPC handles data-privacy matters; and other regulators may have sector-specific jurisdiction.

One report does not automatically replace the others. The practical question is what result you need: stop the scam, recover or freeze funds, preserve evidence, identify the offender, remove harmful content, protect personal data or pursue prosecution.

What Happens After You Report?

After a cybercrime report is filed in the Philippines, an investigator may screen the complaint, request a sworn statement or clarification, examine documents or devices, trace accounts or transactions, seek preservation of electronic records, coordinate with service providers, or refer the matter for further investigation or prosecution. A report is not the same as a filed criminal case and does not guarantee recovery, identification, or prosecution. Evidence quality and preservation can materially affect the next steps.

A report is not the same as a filed criminal case, and filing does not guarantee recovery, identification of the offender or prosecution. The quality and preservation of evidence can materially affect what investigators can do next.

Six Worked Scenarios

Abstract routing advice collapses the moment a real incident has two or three things wrong with it at once. These are the combinations that come up most.

1. ₱180,000 sent to a “supplier” who has stopped replying

Call the bank or e-wallet first and ask what fraud-hold, recall or dispute process is open to you, quoting the receiving account, amount, reference number and exact time. Keep whatever reference they give you. Then file with the NBI Cybercrime Division or the PNP-ACG: the likely provision is Sec. 4(b)(2) computer-related fraud, and estafa committed through information and communications technology carries a penalty one degree higher under Sec. 6. Do not wait for the bank to finish before reporting — the six-month preservation clock on the receiving account’s records is already running. See online estafa.

2. Your Facebook account is posting things you did not write

Recover the account through the platform, revoke sessions and change the password from a device you trust — but screenshot the login alerts, the unfamiliar sessions and the posts before you clean up, because recovery deletes the evidence of the intrusion. The conduct is Sec. 4(a)(1) illegal access, and it is reportable whether or not money was lost. See a hacked Facebook account and unauthorised account access.

3. Someone has built a profile using your photos and your name

This is Sec. 4(b)(3) computer-related identity theft — the intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, without right. Report the profile to the platform for takedown and file the criminal complaint separately; the platform report is not a complaint. Where the impersonation is sexual, misogynistic, homophobic or transphobic in character, Sec. 12 of the Safe Spaces Act also bites and Sec. 13 routes it to the PNP-ACG by name. See fake accounts and impersonation and whether catfishing is a crime.

4. Your company’s files are encrypted and there is a ransom note

Do not wipe or rebuild the affected machines before the evidence is captured — the ransom note, the encrypted samples, the logs and the timeline are the case. The conduct engages Secs. 4(a)(3) and 4(a)(4). If personal data was involved, a separate National Privacy Commission clock starts at 72 hours from knowledge or reasonable belief, and that one runs whether or not you report the crime. See ransomware response, malware attacks and breach notification through the DBNMS.

5. Your number stopped working and then your bank account emptied

Treat it as two incidents on one timeline. The telco and the bank both need to hear from you within hours, and both will generate records you will want in the complaint. The criminal filing goes to the NBI or the PNP-ACG. See who bears the loss in SIM-swap fraud.

6. A company leaked your data and you want someone punished

This is usually not a cybercrime complaint at all. Unless someone accessed the company’s systems without right, the wrong is the organisation’s failure under the Data Privacy Act, and it goes to the National Privacy Commission — after you have written to the organisation and it has failed to act or respond within 15 calendar days. See filing an NPC complaint, the evidence an NPC complaint needs and what the NPC can and cannot do.

Common Reporting Mistakes

deleting the conversation before saving it;
sending only cropped screenshots without URLs or account identifiers;
waiting days before notifying a bank after a transfer scam;
resetting or wiping a device before preserving relevant evidence;
assuming a platform report is the same as a police or NBI complaint;
filing a long narrative without a clear timeline, amounts and identifiers; and
losing complaint or ticket reference numbers;
reporting to a coordinating body and assuming an investigation has therefore started;
arriving at the prosecutor’s office with five copies of a complaint-affidavit against three respondents, when the requirement is five plus one for each respondent;
factory-resetting or reinstalling a compromised device to “clean” it before the evidence is captured;
waiting months, on the assumption that records are kept indefinitely, when traffic data and subscriber information are preserved for six months from the transaction; and
trying to obtain evidence by accessing an account or system you have no right to access, which risks both inadmissibility under Sec. 18 and an offence of your own under Sec. 4(a)(1).

Frequently Asked Questions

How to file a cyber crime complaint in the Philippines?

In two stages. Preserve your evidence, then execute a sworn complaint sheet at the NBI Cybercrime Division or the PNP Anti-Cybercrime Group, the two law-enforcement authorities named in Section 10 of RA 10175. The matter then goes to a prosecutor as a complaint-affidavit for preliminary investigation, together with an Investigation Data Form in two copies certified under oath, and the complainant’s and witnesses’ affidavits in five copies plus one for every respondent. The NBI Citizen’s Charter entry for this service records no fee.

What are the steps for filing a cybercrime complaint in the Philippines?

Preserve the evidence first; secure your accounts and call the bank the same day if money moved; write a dated chronology with amounts and account identifiers; swear the complaint at the NBI or the PNP-ACG and keep the reference number; then prepare the complaint-affidavit and supporting documents for the prosecutor, counting five copies plus one for each respondent. File parallel reports with the bank, the platform, the telco or the National Privacy Commission where those match the harm. The full sequence is set out under how to file a cyber crime complaint.

How do I report cybercrime in the Philippines?

Report it in person and under oath to the National Bureau of Investigation Cybercrime Division or the Philippine National Police Anti-Cybercrime Group. Section 10 of RA 10175 makes those two bodies responsible for enforcing the Act and requires each to run a dedicated cybercrime unit. Either is a valid first filing; say so if you have already reported the same incident elsewhere.

What is hotline 1326, and is calling it the same as reporting a crime?

A Philippine Information Agency release dated 31 December 2025 describes 1326 as the Inter-Agency Response Center hotline, a joint channel of the CICC, the DICT, the NPC and the NTC, for reporting online selling scams and similar conduct. It is a referral and coordination route. It is not a criminal complaint, and it does not by itself put an investigator on your case.

Does the CICC investigate cybercrime?

Not under RA 10175. Sections 24 to 26 give the Cybercrime Investigation and Coordinating Center coordination, monitoring, planning, international-cooperation and recommendation functions. No complaint-intake, investigative, arrest, warrant or prosecution power appears in them.

Should I go to the NBI or the PNP?

Both are law-enforcement authorities under the same section, so neither is wrong. In practice, proximity and the nature of the case decide it: regional PNP anti-cybercrime units are more widely distributed, while the NBI publishes a specific Cybercrime Division intake process. For gender-based online sexual harassment, Sec. 13 of the Safe Spaces Act designates the PNP Anti-Cybercrime Group by name.

Does it cost anything to file?

The NBI Citizen’s Charter entry for investigative assistance to victims of computer crimes records no fee and a total processing time of one hour and ten minutes.

Do I need a lawyer to report?

No. The published intake processes are designed for members of the public, and NBI personnel assist with the complaint sheet. A lawyer becomes materially useful at the preliminary-investigation stage, where the filing is documentary and exacting.

Will I have to swear to my statement?

Yes. The NBI complaint sheet is sworn, and the Department of Justice requires a complaint-affidavit or sworn statement, plus sworn statements from witnesses, before a prosecutor conducts preliminary investigation.

How long do I have before the records disappear?

Section 13 of RA 10175 requires service providers to preserve traffic data and subscriber information for six months from the date of the transaction. That is a retention rule, not a deadline to file, but it is the practical reason to report early: after six months the records that identify the account holder may lawfully be gone.

Can I report an attempted scam even if I did not lose money?

Yes. Attempted phishing, malicious links, impersonation and scam accounts can still be reported, particularly where the activity may target other people.

Should I block the scammer immediately?

Preserve the evidence first when it is safe. Once the relevant messages, profile links, account information and payment details are saved, blocking can reduce further contact.

Can screenshots be used?

Yes, but screenshots are stronger when supported by original messages, URLs, account identifiers, transaction records and other evidence showing authenticity and context. Keep the originals — a cropped screenshot with no URL, timestamp or account handle is the weakest thing in most files.

What if the person behind it is outside the Philippines?

Report it anyway. Section 23 of RA 10175 creates an Office of Cybercrime within the Department of Justice, which describes itself as the Central Authority for international mutual assistance and extradition in cybercrime and cyber-related matters. Evidence held by a foreign platform or bank is obtained through that channel, and the request has to originate from an investigation — which means from a complaint you have filed.

What should I bring to the office?

A written chronology with dates, amounts, account names and platform names; government-issued identification; the original device or evidence if it is requested; and printed or digital copies of the supporting records. If you have already prepared an affidavit, bring it — it shortens the intake. Nothing in the published NBI checklist makes any of these mandatory, but every one of them speeds up the interview.

Related Cybercode Guides

Official Sources

Related: If what happened to you was a fake online job or a “like and earn” task app, the lane you report in depends on whether an overseas placement was involved — see job or task scam in the Philippines.

Verification Log

Sources rechecked as of: October 9, 2026. What was read, what each source yielded, and what could not be read and is therefore not asserted anywhere on this page.

RA 10175, Sections 10, 11, 13, 14, 18, 20, 21, 23, 24 and 26 — re-read on the Senate Legislative Digital Resource. Section 10 names the NBI and the PNP as the law-enforcement authorities; Section 13 requires traffic data and subscriber information to be preserved for a minimum of six months from the date of the transaction; Section 14 gives 72 hours to comply with a disclosure order issued on a court warrant; Section 18 makes evidence procured without a valid warrant inadmissible; Section 26 lists the CICC’s coordination, monitoring, planning, international-cooperation and recommendation functions, and no investigative power.
NBI Citizen’s Charter, “Investigative Assistance for Victims of Computer Crimes (CCD)” — re-read. Who may avail: general public. Checklist of requirements: none. Fees: none. Total processing time: 1 hour 10 minutes. The four published steps, and the fact that the complaint sheet is sworn, are as described above.
Department of Justice, filing of a complaint for preliminary investigation — re-read. Investigation Data Form (NPS INV Form No. 1) in 2 copies, duly accomplished and certified under oath; complaint-affidavit and each witness affidavit in 5 copies plus one for every respondent; supporting documents across thirteen offence-specific categories; office hours Monday to Friday, 8:00 a.m. to 4:30 p.m. with no noon break.
Disini, Jr. v. Secretary of Justice, G.R. No. 203335 — Supreme Court E-Library entry 56650. Confirmed En Banc and dated 18 February 2014, not the 11 February 2014 that circulates widely; the Court struck down Section 19. The date shown on this page was corrected accordingly on this run, and the citation now points to the E-Library.
RA 11313, Safe Spaces Act, Sections 12 and 13 — read from the Senate Legislative Digital Resource copy of the Act. Section 13 provides that the PNP Anti-Cybercrime Group “shall receive complaints of gender-based online sexual harassment and develop an online mechanism for reporting real-time gender-based online sexual harassment acts and apprehend perpetrators.” Approved 17 April 2019.
National Privacy Commission, mechanics for complaints — re-read. Before the Commission will take a complaint, the complainant must have informed the respondent in writing of the violation and must attach proof of having done so; the complaint may proceed where the respondent does not act appropriately or does not respond within fifteen calendar days of receipt. The Commission attributes this to its 2021 Rules of Procedure. The narrower rule-and-section pinpoint previously printed on this page could not be confirmed and has been replaced with the instrument-level citation.
Philippine Information Agency release, 31 December 2025 — re-read. Describes Inter-Agency Response Center Hotline 1326 as the government’s 24/7 central number for reporting online selling scams, jointly run by the CICC, the DICT, the NPC and the NTC, and records that enforcement is handled by the PNP Anti-Cybercrime Group and the NBI Cybercrime Division.
Could not be read on 9 October 2026, so nothing on this page rests on them: the Official Gazette copy of RA 10844 and the Senate PDF of the same Act, both of which refused access, so the reference to its Section 15(b) is now unlinked text rather than a sourced citation; the National Privacy Commission’s “filing a complaint” page, which does not itself state the fifteen-day prerequisite; and the CICC website, whose contact details are therefore still not republished here.

About This Guide

Author: Cybercode.ph Editorial Team.

This guide has not been reviewed by a named external legal reviewer, and Cybercode does not attribute review to a person who has not carried it out. Instead of a reviewer’s name, we publish the verification log above, which records every source read for this update, what each one yielded, and — just as importantly — what could not be read and is therefore not asserted anywhere on this page.

Corrections. If something here is wrong or has gone out of date, the source to check it against is named in the log. Agency contact details, office locations and intake procedures change without notice; confirm them on the agency’s own site immediately before you travel or file.

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.