Scam or Hack Triage: What to Do First
Scammed, hacked or threatened online? Answer one or two questions and get an action plan: what to do right now, what not to do, what evidence to keep, where to report in order, and which laws may apply.
Get your action plan
How to use this tool
- 1Pick what happened to you. Choose the closest match.
- 2Answer one follow-up question if the tool asks. Some answers change where you should report.
- 3Get your action plan, then copy, print or share it.
Your action plan has 7 parts:
- Do this now
- Don’t
- Keep this evidence
- Where to report, in order
- Timing
- Laws that may apply
- Read next
It takes under a minute. The plan is general legal information, not legal advice, and it does not file a report for you.
Runs in your browser. Nothing you choose is saved or sent to Cybercode.ph.
From what happened to what to do next
Pick your situation
Choose the closest of ten options, from unauthorized transactions to lending-app harassment.
Answer one follow-up
Four situations ask one more question, such as how you paid, because it changes the safest route.
Read your plan
Seven colour-coded parts: do this now, don’t, evidence, where to report, timing, laws and guides.
Act and keep a copy
Copy or print the branded plan for your bank, the platform, the police or the NPC.
The rules behind each result
Each situation maps to the Philippine law most likely to apply and the first place to report. Laws marked “may apply” in the tool depend on your facts. Sources for every row are listed below.
| Situation | Main law | Report first to | Timing |
|---|---|---|---|
| Unauthorized bank or e-wallet transaction | RA 12010 (AFASA); RA 10175, Sec. 4(b)(2) | Your bank or e-wallet, then BSP if unresolved | Disputed funds can be held for no more than 30 calendar days unless a court extends it |
| Money sent to a scammer | Estafa through ICT (RA 10175, Sec. 6); RA 12010 | The bank or app you paid from, then CICC 1326 | No fixed reporting deadline verified; act the same day |
| Hacked account | RA 10175, Secs. 4(a)(1) and 4(b)(3) | The platform’s official recovery page | No fixed reporting deadline verified |
| SIM stopped working | RA 11934; RA 12010 | Your telco, then your banks and e-wallets | Same 30-day cap on holding disputed funds |
| Clicked a phishing link | RA 12010, Sec. 4 (social engineering) | The bank or app whose details you entered | No fixed reporting deadline verified |
| Sextortion | RA 9995, Sec. 4; RA 11313, Sec. 12; RA 11930 if a child is involved | PNP Anti-Cybercrime Group or NBI Cybercrime Division | No fixed reporting deadline verified |
| Photo, personal details or fake account posted | RA 9995, RA 11313, RA 10173 or RA 10175, depending on what was posted | The platform, then the NPC or police | NPC complaints follow a 15-day written-notice step |
| Lending app harassment | SEC MC No. 18, s. 2019; RA 10173 | SEC and the NPC | NPC complaints follow a 15-day written-notice step |
| Company leaked your data | RA 10173 | The company’s data protection officer, then the NPC | The company has 72 hours to notify the NPC of a notifiable breach |
| Business or website hacked | RA 10175; RA 10173 if personal data is involved | NPC (if personal data), DICT CERT-PH, then police | 72 hours to notify the NPC of a notifiable breach |
What this tool cannot do
Decide liability
It does not decide whether a crime was committed or who is liable. That depends on facts an investigator or court has to weigh.
File for you
Every report is made by you, directly with the bank, platform or agency.
Replace official contacts
Agency contacts and procedures change. Confirm the current route through the linked guides and official pages.
Replace legal advice
For a serious loss, threat or business breach, speak to a lawyer or the Public Attorney’s Office.
Frequently asked questions
Is there a deadline to report a scam in the Philippines?
No fixed legal deadline for an individual to report a scam or hack to the CICC, PNP or NBI was verified. But under RA 12010, Section 7, a bank or e-wallet can hold funds in a disputed transaction for no more than 30 calendar days unless a court extends it, so report to your bank or e-wallet the same day.
What is the 1326 hotline?
1326 is a 24/7 government hotline for reporting scams. It is run by the Inter-Agency Response Center of the Cybercrime Investigation and Coordinating Center, working with DICT, NTC, the NPC, and the PNP and NBI as its law enforcement arm. For immediate danger, call 911.
Do I have to contact the company before filing with the NPC?
Usually, yes. Under the NPC’s 2021 Rules of Procedure, you must first inform the company or person in writing. You can file if they do not act properly or do not reply within 15 calendar days. The NPC can waive this for good cause or a serious violation, such as one causing grave and irreparable damage.
Should I pay someone threatening to post my intimate images?
No. Paying does not guarantee the images are deleted. Keep screenshots of the threats and the account, stop replying and report it. Sharing sexual images without consent is prohibited under RA 9995, Section 4, even if the recording was consensual, and the Safe Spaces Act tasks the PNP Anti-Cybercrime Group with receiving online sexual harassment complaints.
Does the tool save what I choose?
No. The tool runs in your browser and does not store or send your answers. The share buttons send only the link to this tool. If you copy or print your plan, that copy stays with you.
Sources
Every deadline, route and law in the tool traces to these official sources. Sources rechecked as of 29 September 2026.
Continue with the relevant Cybercode topic
General legal information, not legal advice. See our terms and disclaimer.