CyberCode.ph · Philippines

Sextortion in the Philippines: What Victims Should Do First

Last updated October 4, 2026 · Practical privacy, cybersecurity and technology-law guidance
Cybercrime threat and data theft concept for sextortion victim guidance in the Philippines

Sextortion is blackmail involving real, stolen, manipulated or claimed intimate images. Demands can be for money, sexual content, sexual acts or control over a relationship. The responsibility belongs to the person making the threats. Sending an image, trusting someone or having paid already does not make you responsible for the abuse. eSafety’s sextortion guidance.

Evidence and action

A threat or demand

Keep the message text, deadline, username, profile link and payment destination. Report even if you cannot tell whether the person has an image. If money moved, make a separate urgent report to the payment provider.

An image already shared

Record the post or page URL and account details. Report the specific content as intimate-image abuse or sexual exploitation. Platform removal, search-result removal and a criminal complaint are separate actions.

A child or immediate safety risk

Contact police or child-protection support promptly. Do not make extra copies of child sexual imagery. If the person can reach you physically or monitors your device, use a safer device and make a safety plan before changing access.

What to Do If This Happens to You

  1. Get to a safe place and tell someone you trust. A trusted friend, family member, counselor or social worker can help you make calls and keep track of reports. Do not meet the person alone to bargain for deletion.
  2. Do not send more money, images or sexual content. Paying cannot guarantee deletion or stop further demands. If you have already complied, you can still seek help. You do not owe the person another explanation or a final message. Official safety guidance on responding to sextortion.
  3. Save a small set of useful facts, if safe. Record the threat, account/profile link, dates, payment request and any post URL. Follow the safe-evidence checklist; do not export an entire chat containing child sexual imagery.
  4. Report and stop further contact in the safest way available. When safe, use the service’s report function for the threatening account, messages and any posted content. Then block or restrict contact if safe. You can block immediately when needed; gathering a perfect evidence bundle is not a condition for protecting yourself. Avoid deleting the account or message history while you seek advice. NCMEC’s reporting and blocking guidance.
  5. Secure compromised accounts from a safer device. Protect your main email and recovery options, use unique passwords, enable two-factor authentication and check logged-in devices. If you suspect someone close to you monitors access, read the safety note below before changing settings.
  6. Start the appropriate help routes now. Contact police for threats or exploitation, the bank/e-wallet for money sent, and the platform for abuse or removal. These routes can run alongside one another. Keep each report reference and the next step you were given.

If the person is a partner, ex-partner or someone nearby

Blocking, reporting, changing a password or leaving a shared account can alert an abusive person and increase danger. If that is a risk, use a device and email they cannot access, and plan the changes with a trusted person or support worker. Muting may be less noticeable than blocking. Do not confront the person to retrieve their phone or force them to delete files. eSafety’s domestic-abuse online safety checklist.

Tell police or a social worker about offline threats, stalking, shared housing and access to your children or devices. Ask what protective measures fit your situation; a platform report alone does not address physical danger.

If You Already Paid Through a Bank or E-Wallet

Contact the provider immediately using its official app, website or verified support number. Explain that the transfer was made under a blackmail demand. Give the amount, time, transaction/reference number and receiving account details; ask whether the transfer can be stopped, recalled, traced or handled through the disputed-funds process. Describe accurately what happened, including whether you made the transfer yourself or someone accessed your account. BSP guidance on reporting suspicious transactions.

  • GCash: its published route is Transactions → select the transaction → Get Help → Report as scam. Follow the current ticket instructions and keep the reference. GCash expressly states that return of scammed funds is not guaranteed. GCash’s official scam-reporting steps.
  • Maya, another e-wallet, a bank or a transfer service: open the provider’s own app or official support site. Do not use a “refund agent” introduced by the blackmailer or a search advertisement. Ask what information and police documentation the provider needs.
  • If the institution does not resolve your complaint: use the BSP Consumer Assistance Mechanism for a BSP-supervised institution, with your complaint history and reference.

RA 12010 and BSP rules provide a process for temporarily holding qualifying disputed funds. The statutory period may not exceed 30 calendar days unless extended by a court. A hold is not an automatic refund, and a report does not guarantee that money remains available to recover. Ask the provider to assess the facts promptly. BSP AFASA booklet, Section 7 and implementing rules.

If You Are Under 18 or the Image Was Made When You Were Under 18

Tell a safe adult or child-protection professional as soon as you can. If a parent or caregiver is involved in the abuse or would put you at risk, choose another trusted adult, school counselor, social worker or police officer. You do not have to handle this alone.

Under RA 11930, a child’s consent is not a defense to the prohibited abuse or exploitation. Section 22 specifically treats a child who produces self-generated sexualized material as a victim rather than an offender. This is a reason to seek protection, not to accept the blackmailer’s claim that you cannot report. RA 11930, Sections 5 and 22.

Do not download, screenshot, forward, email or make backup copies of sexual imagery of a child to collect evidence. Do not ask friends to send it to you. Keep the threat text, URLs and identifiers without reproducing the image, and ask a verified investigator how to handle an existing device or file. Official evidence-safety guidance.

Take It Down can help when you were under 18 in the image, even if you are an adult now. Use only an eligible file already on the device where it was originally made; do not download or transfer one to use the service. It creates a digital fingerprint on the device rather than uploading the image. If you do not have the original device/file, seek help through its linked CyberTipline route and Philippine authorities. Take It Down eligibility and safety instructions.

In the Philippines, MAKABATA Helpline 1383 accepts reports of violence against children. You can also approach a PNP Women and Children Protection Desk or a local social welfare office. DSWD’s published 1383 reporting information. For immediate danger, use 911.

Preserve Evidence Without Spreading the Image

You can make a useful initial report without possessing or sending the intimate image. Start with a short chronological record:

  • The platform, username, profile URL and visible account identifier
  • The threat and demand, including the deadline and whom they threatened to contact
  • The date, time and time zone of each important message
  • Payment instructions, receipts, transaction references and amounts
  • Links to any posted material, the account that posted it and when you noticed it
  • Relevant login alerts and the reference numbers from platform, bank and police reports

If safe, capture non-explicit messages with the account name and time visible. If the screen includes child sexual imagery, do not capture it; write down the surrounding details instead. Some apps notify another user about screenshots. Do not keep engaging to obtain better evidence. eSafety’s guidance on evidence and safety.

Keep existing devices and records secure. Do not alter originals, publicly post “proof,” upload intimate material to an AI tool, or send it to a supposed hacker. Ask the investigator about a safe evidence handover before emailing files or copying them to a USB drive. A text-only chronology and receipts are easier to share safely than a complete chat export.

Report the Content and Limit Further Sharing

1. Report the account, threat and actual post

When safe, use the platform’s in-app report control. If an abuser may retaliate, follow the safety-planning note first. Select the most accurate available category, such as sexual exploitation, threats to share intimate images, or non-consensual intimate imagery. Explain both the demand and any distribution. Report each known post URL, not only the account profile, and keep the report number or confirmation. Menu labels and appeal options vary. Meta prohibits sextortion and threats to share intimate images; its official sextortion information describes its safety tools and linked support resources.

If contacts receive a message, you can ask them: “Please do not forward or reply to it. Report the message/account and send me only the account name, link and time.” Do not ask them to resend the intimate file.

2. Use the age-appropriate image-matching service

StopNCII.org: if you are an adult and were 18 or older in the intimate image, check its eligibility rules. You must be depicted and have access to the file. The tool generates a hash on your device and shares that fingerprint with participating companies, rather than uploading your image. Eligible synthetic or manipulated intimate images of you can also be included. StopNCII eligibility and how it works.

Take It Down: use this route for an image made when you were under 18, following the original-device and no-download instructions above. Take It Down FAQ.

These tools can help participating services detect matching content on supported public or unencrypted surfaces. They do not erase the offender’s device, cover every site or encrypted chat, or guarantee that edited versions will be detected. Continue reporting known posts. StopNCII limitations; Take It Down limitations.

3. Request search-result removal separately

If the material appears in Google Search, use Google’s personal sexual-image removal process, which includes real non-consensual images and fake sexual images using your likeness. For child sexual imagery, use Google’s child-abuse-image reporting route; provide the relevant URLs without downloading or creating copies. Removing a Google result does not remove the original website’s content.

If the Image Is Fake or They Only Claim to Have One

An old password, address or list of contacts in a threat does not by itself prove that someone controls your device. Do not click their “proof” link, install their software or send a real intimate image to satisfy the demand. Check account security directly through the official app or website. eSafety on false hacking claims.

Manipulated and AI-generated images can still be used to harm or blackmail someone. Preserve the threat and relevant URLs, state that the image is fabricated in reports, and use the platform’s applicable intimate-image and impersonation processes. A genuine source photograph or other ordinary record may help explain the manipulation; do not circulate the fake sexual image to prove the point. The FBI has documented extortion using altered ordinary photos. FBI advisory on manipulated images.

How to Protect Yourself From Further Contact

  • Protect your email first. Check recovery addresses, forwarding rules and unfamiliar sessions; then review social, cloud-storage and financial accounts. Use a unique password and two-factor authentication where available. Google’s compromised-account checklist; FTC account-recovery guidance.
  • Reduce what strangers can see. Review public friend/follower lists, workplace and school details, phone/email discoverability, tags and location-sharing settings. Limit who can message or add you to groups.
  • Treat new accounts cautiously. A blackmailer may return under another name. You do not need to answer to find out whether it is the same person.
  • Do not share passwords, PINs or one-time codes. Do not install remote-access software for someone offering deletion or recovery.
  • Make changes safely if someone close is monitoring you. Shared accounts and devices need a safety plan; the same security action can have different consequences in an abusive household.

For account access and shared-device checks, see eSafety’s account-safety checklist. These precautions reduce opportunities for abuse; they do not make a victim responsible for another person’s actions.

Which Philippine Laws May Apply?

“Sextortion” describes the conduct. The possible offenses depend on the threat, demand, image, age, relationship and method used. You can explain what happened to investigators without choosing the exact criminal charge yourself.

Recording, copying and sharing are different acts

RA 9995 prohibits specified non-consensual recording of sexual activity or private areas where there is a reasonable expectation of privacy. It separately addresses copying, sale/distribution and publication/broadcast of covered material. Consent to recording does not by itself authorize those later acts; Section 3(d)’s definition also expressly addresses written consent for sharing-related conduct. Not every embarrassing photo or fabricated image automatically satisfies this law’s elements. RA 9995, Sections 3(d) and 4.

Section 5 provides imprisonment of three to seven years, a fine of ₱100,000 to ₱500,000, or both at the court’s discretion. Those penalties are for a proven violation, not a promise about the outcome of a report. RA 9995, Section 5.

Threats, online harassment and child exploitation

  • Threats and unlawful account access: Revised Penal Code provisions on threats and the cybercrime rules may be relevant. RA 10175 addresses illegal access and qualifying offenses committed through information and communications technology. The facts determine the charge and penalty analysis. Revised Penal Code, Articles 282–283; RA 10175, Sections 4 and 6.
  • Gender-based online sexual harassment: the Safe Spaces Act covers specified online threats, sexual-content sharing, cyberstalking and related conduct. PNP ACG receives complaints under its implementing provisions. PCW’s text of RA 11313, Article II.
  • Children: RA 11930 has specific child-exploitation offenses, victim protections and duties for internet intermediaries. It also covers certain depictions presented as children, including computer-generated material. RA 11930, Sections 3–5.
  • Abuse within a qualifying relationship: RA 9262 may apply to violence against a woman or her child where the woman is a spouse or former spouse, has or had a dating or sexual relationship with the perpetrator, or has a common child with them. Covered conduct includes specified coercion, threats and psychological abuse; this is not a rule for every relationship. Ask a lawyer, police officer or social worker whether an appropriate protection order is available. RA 9262, Sections 3, 5 and 8–10.

There are special removal and preservation duties for child sexual abuse or exploitation material under RA 11930, including its notice-based takedown provisions. Ask investigators about that route. It would be inaccurate to say that all removal depends exclusively on a platform’s voluntary decision or a court order. The law’s requirements do not guarantee that every reported copy will disappear. RA 11930, Section 9(a).

Practical Examples in the Philippines

These are hypothetical examples, not reported cases or predictions.

  • A video-call threat with a GCash demand: a person in Cebu receives a demand for ₱20,000 and a screenshot of their contacts. Record the threat and payment details safely, report the account, and contact PNP ACG or NBI. If any amount was sent, contact the provider immediately.
  • An ex-partner demands a meeting: someone in Davao is told an old private image will be posted unless they meet alone. Treat the meeting demand as a safety issue. Get support, explain the offline risk to police and plan account changes before alerting the person.
  • A 16-year-old is threatened after sending an image: help the teenager reach a safe adult and child-protection support. Record the account and threat without copying the image. Use the child-specific reporting and Take It Down instructions.
  • An AI-edited picture is sent to coworkers: preserve the account and post links, report the threat and fake sexual image, and ask recipients not to forward it. State clearly that it is fabricated; a removal request and an investigation have different purposes.

Where to Get Help in the Philippines

Immediate danger: call 911 or go to the nearest police station. For a child, seek a safe adult and child-protection assistance promptly.

  • PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (02) 8723-0401, local 7491. Ask for the current complaint route and the appropriate regional unit.
  • NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38. Ask how to lodge a formal complaint and arrange safe evidence handling.

These PNP/NBI details are published in the 18 March 2026 joint government advisory, page 3. Start with a brief description and non-image identifiers; do not attach intimate files to an initial email. Verify current office arrangements before traveling.

For preparation and filing steps, see where and how to report cybercrime in the Philippines. Take the records you have; do not delay asking for help because a file, identity or document is missing. Ask the receiving office what else is needed and how to follow up.

Avoid Recovery Scams and Unsafe Shortcuts

Be wary of unsolicited “hackers,” deletion agents or recovery services promising to erase every copy, recover all your money or force the offender to stop. Pressure, advance fees, requests for credentials or intimate files, and instructions to avoid police are warning signs. The FBI has warned about businesses using deceptive tactics against sextortion victims seeking help. FBI warning on paid sextortion assistance.

Do not hack back, publish suspected account-holder details or pay a second person who promises a guaranteed fix. An account name or payment recipient alone may not identify the person behind the threats. A qualified lawyer can explain legal options, but no legitimate adviser can promise an arrest, total deletion or recovery.

Your Next-Step Checklist

  • I have a safe way to contact someone who can help
  • I have stopped sending money or material
  • I have recorded the threat, account details and known URLs without copying child sexual imagery
  • I have reported any payment to the provider and kept the transaction reference
  • I have reported the account and known posts, and chosen a safe way to stop contact
  • I have checked the appropriate StopNCII or Take It Down route if eligible
  • I have contacted police or child-protection support and noted the next step

What You Can Realistically Expect

Stopping contact, protecting accounts, reporting content and preserving usable details can reduce harm and support an investigation. Removal may succeed on one service while copies remain elsewhere. Identifying an offender, pursuing a case and recovering money depend on the evidence, available records, jurisdiction and other facts. A screenshot or report receipt alone does not guarantee any particular outcome.

If a new account or post appears, update the relevant report with its identifiers and URL. Keep a simple log rather than repeatedly searching for images yourself. Ask a trusted person to help with non-explicit administrative tasks if checking notifications is overwhelming.

Frequently Asked Questions

Will paying make them delete the image?

There is no reliable way to verify or enforce that promise. Do not send more money or content. If you already paid, report the transaction promptly and seek help; payment does not prevent you from reporting the abuse.

Should I block them now?

You can block or restrict contact when it is safe. Save basic details first if you can do so safely, but do not remain in contact just to collect evidence. Where a partner or someone nearby may retaliate, use the safety-planning approach above.

Can I report if I sent the image voluntarily?

Yes. Consent to creation or sending an image does not by itself authorize blackmail or every later use. Explain the facts to the investigator; the applicable law depends on the material and conduct involved.

What if the person is overseas or using a fake account?

Report what you know, including account links and payment details. Identification and cross-border evidence can be difficult. Do not assume the display name or claimed location is genuine, and do not investigate or confront the person yourself.

Can anyone guarantee permanent removal?

No. Platform reports, image-matching tools and search removal each have limits. Use the relevant routes together and be cautious of anyone selling certainty.

Sources

Philippine law: RA 9995; RA 10175; RA 11313; RA 11930; RA 9262; BSP’s AFASA statute and implementing rules.

Safety and service instructions: the claim-level links above lead to Philippine agency publications, the providers’ own help pages, NCMEC, StopNCII, eSafety and FBI advisories. International safety guidance is used for practical precautions, not as a statement of Philippine law or eligibility for a foreign government’s complaint service.

Sources rechecked as of: 2026-10-04

Disclaimer

General educational information, not legal advice or an attorney-client relationship. Procedures and platform tools can change. Ask a qualified Philippine lawyer or the relevant authority about your situation.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.