CyberCode.ph · Philippines

What Happens After You Report Cybercrime in the Philippines? Investigation, Preservation and Warrants

Last updated September 3, 2026 · Practical privacy, cybersecurity and technology-law guidance
Laptop representing a cybercrime investigation after a report is filed

Last materially reviewed: September 3, 2026

Direct Answer

After a cybercrime complaint is filed, investigators first assess and docket the complaint, preserve available evidence, identify the relevant accounts or service providers, interview witnesses, and determine what legal process is needed to obtain additional computer data. Depending on the case, law enforcement may issue preservation orders, apply for cybercrime warrants, request disclosure of subscriber or traffic data, conduct forensic examination, and eventually refer the case for prosecutorial action.

Primary authorities: RA 10175, its Implementing Rules and Regulations, and the Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC.

Key Takeaways

  • Filing a report does not automatically mean a criminal case is immediately filed in court.
  • Investigators may first verify facts, accounts, devices, transactions and witnesses.
  • RA 10175 allows preservation of certain computer data for at least six months under the statutory framework.
  • Disclosure of subscriber, traffic or relevant data generally requires a court warrant and a valid complaint officially docketed and assigned for investigation.
  • Cybercrime warrants are specifically designed for preservation, disclosure, interception, search, seizure and examination of computer data.
  • The DOJ Office of Cybercrime reviews and supports investigation and prosecution strategy.

Decision Snapshot

Stage Possible action
Intake Complaint is assessed and documented.
Preservation Investigators may seek preservation of relevant computer data.
Identification Accounts, devices, service providers and transaction trails are mapped.
Legal process Investigators may apply for the appropriate cybercrime warrant.
Forensics Devices or digital records may be examined and authenticated.
Prosecutor referral Evidence may be transmitted for evaluation and prosecution.

What Happens First?

The investigating agency checks whether the complaint falls within its authority, records the incident, interviews the complainant and identifies immediate evidence that should not be lost. That may include account data, platform records, bank records, transaction IDs, messages, logs or devices.

Why Is Data Preservation Important?

Digital records can be overwritten, deleted or retained only for limited periods. Section 13 of RA 10175 requires preservation of traffic data and subscriber information for a minimum of six months from the transaction, and content data for six months from receipt of a law-enforcement preservation order. A one-time six-month extension may also be ordered. See Section 13 of RA 10175.

Can Investigators Obtain Subscriber Information?

Yes, but the process is legally controlled. Under Section 14 of RA 10175 and its IRR, law enforcement must secure a court warrant before ordering disclosure of subscriber information, traffic data or relevant data in relation to a valid complaint officially docketed and assigned for investigation. The provider must then disclose the ordered data within 72 hours of receipt of the order. See the RA 10175 IRR.

What Are Cybercrime Warrants?

The Supreme Court’s Rule on Cybercrime Warrants establishes procedures for warrants tailored to computer data, including preservation, disclosure, interception, search, seizure and examination. These warrants help ensure that digital investigations stay within constitutional and procedural limits.

What Does the DOJ Office of Cybercrime Do?

The DOJ Office of Cybercrime acts as a central authority for cybercrime matters. Its functions include acting on complaints and referrals, facilitating preservation and production of data, issuing preservation orders, assisting with evidence collection, prescribing chain-of-custody and forensic forms, and coordinating investigation and prosecution strategy. See DOJ Office of Cybercrime functions.

What Should the Victim Do While the Case Is Being Investigated?

  • Keep the original evidence intact.
  • Do not delete accounts or conversations unless necessary for safety and after preserving records.
  • Keep complaint reference numbers.
  • Respond promptly to investigator requests.
  • Document new contact from the suspect.
  • Keep bank, e-wallet or platform dispute records.
  • Avoid publicly posting details that could compromise the investigation.

For evidence handling, see Electronic Evidence Preservation Philippines.

Frequently Asked Questions

Does reporting automatically identify the offender?

No. Attribution may require subscriber information, transaction records, platform data, forensic analysis or other evidence.

How quickly will a cybercrime case be resolved?

There is no universal timeline. Complexity, provider cooperation, cross-border evidence and the number of parties involved can all affect the investigation.

Can investigators preserve data before it disappears?

Yes. RA 10175 and its IRR provide a preservation framework for relevant computer data.

Can illegally obtained computer data be used in court?

RA 10175 contains an exclusionary rule for evidence obtained without a valid warrant or beyond the authority of the warrant.

Related Cybercrime Guides

Official Sources

General educational information only.