CyberCode.ph · Philippines

What Happens After You Report Cybercrime in the Philippines? Investigation, Preservation and Warrants

Last updated October 6, 2026 · Practical privacy, cybersecurity and technology-law guidance
Laptop representing a cybercrime investigation after a report is filed

Last materially reviewed: September 6, 2026

Direct Answer

After you file, investigators preserve data, identify accounts and apply for cybercrime warrants to obtain subscriber information. The case then goes to a public prosecutor for preliminary investigation under Rule 112: you file a complaint-affidavit, the respondent gets ten days to answer, and the prosecutor either files an Information in court or dismisses. Timelines are measured in months.

Key Takeaways

  • Reporting to the police or NBI is not the same as filing a criminal case. The complaint later moves to a prosecutor, who decides whether an Information is filed in court.
  • Under Section 14 of RA 10175, disclosure of subscriber information requires a court warrant, and the provider must comply “within seventy-two (72) hours from receipt of the order.”
  • The Rule on Cybercrime Warrants (A.M. No. 17-11-03-SC, effective 15 August 2018) creates four warrants — WDCD, WICD, WSSECD and WECD — each effective for a court-fixed period not exceeding ten days, extendible by not more than ten.
  • Rule 112 gives the respondent ten days to file a counter-affidavit and the prosecutor ten days after the investigation ends to determine probable cause.
  • Section 13 preserves traffic data and subscriber information for a minimum of six months from the transaction, so delay destroys cases.
  • Dismissal at preliminary investigation for lack of probable cause is a normal outcome. Filing does not guarantee prosecution.
  • Inquest applies only where someone was lawfully arrested without a warrant; everything else is a regular preliminary investigation.

On This Page

Stage-by-Stage Snapshot

Timings appear only where a source fixes them; where a stage has no legally fixed period, that is stated rather than guessed.

Stage What happens Timing What you should do
1. Intake and docketing Incident recorded, interview taken, jurisdiction assessed Same day Get the reference and investigator’s name in writing
2. Preservation Preservation request to the provider, bank or platform Traffic data and subscriber information: minimum six months from the transaction; content data six months from receipt of the order; one-time six-month extension possible Ask whether a request went out, and to whom
3. Identification Accounts, devices, providers and money trails mapped No fixed period — usually where the months go Report anything new
4. Cybercrime warrant Application to a designated cybercrime court for a WDCD, WICD, WSSECD or WECD Not exceeding ten days, extendible by not more than ten Ask whether one has been applied for
5. Disclosure and forensics Provider discloses the ordered data; seized data examined and deposited sealed with the court Disclosure within seventy-two hours of receipt of the order; deposit within forty-eight hours after the warrant period expires Stay reachable; do not wipe a device you copied from
6. Complaint-affidavit filed Sworn narrative and annexes filed with the City or Provincial Prosecutor No fixed period, but evidence ages This is your document — draft it carefully
7. Preliminary investigation Subpoena, counter-affidavit, possible clarificatory hearing Officer acts within ten days of filing; ten days to counter; hearing set within ten and terminated within five; determination within ten after it ends Attend and answer
8. Resolution and Information Resolution forwarded and acted on; if probable cause is found an Information is filed Forwarded within five days, acted on within ten of receipt; judge evaluates within ten days of filing Ask for a copy of the resolution
9. Arraignment and trial The accused is arraigned and tried No fixed period; months to years Preserve originals — you may testify

Governing Law and Authorities

Republic Act No. 10175 supplies the investigative powers. Section 10 designates the NBI and the PNP; Section 13 sets the preservation periods; Section 14 makes disclosure warrant-dependent and imposes the seventy-two-hour compliance period; Section 15 caps an extension of the examination period at “no case for a period longer than thirty (30) days from date of approval by the court”; Section 16 requires examined data to reach the court sealed “within forty-eight (48) hours after the expiration of the period fixed therein”; and Section 18 is the exclusionary rule — “any evidence procured without a valid warrant or beyond the authority of the same shall be inadmissible for any proceeding before any court or tribunal.”

The Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, adopted 3 July 2018 and effective 15 August 2018, supplies the procedure for reaching computer data.

Rule 112 of the Revised Rules of Criminal Procedure supplies everything after the police. Preliminary investigation determines “whether there is sufficient ground to engender a well-founded belief that a crime has been committed and the respondent is probably guilty thereof,” and is required where the penalty is “at least four (4) years, two (2) months and one (1) day without regard to the fine” — a threshold most RA 10175 offences clear.

The DOJ Office of Cybercrime sits across all three as the designated Central Authority for international mutual assistance and extradition in cybercrime. Its published functions include acting on complaints and referrals, issuing preservation orders, administering oaths, issuing subpoenas and issuing forensic guidelines. It is a coordinating and prosecutorial-support office, not a walk-in desk — that is what the PNP Anti-Cybercrime Group and the NBI Cybercrime Division are for.

The Pipeline, Element by Element

Docketing

Section 14 conditions disclosure on a valid complaint officially docketed and assigned for investigation. Until your report is a docketed complaint, there is nothing on which to build a warrant application.

Preservation

Under Section 13, traffic data and subscriber information are preserved “for a minimum period of six (6) months from the date of the transaction,” content data “for six (6) months from the date of receipt of the order,” and law enforcement “may order a one-time extension for another six (6) months.” Preservation freezes the data; it does not hand it over.

The complaint-affidavit

This document starts the prosecution stage, and it is yours: a sworn first-person narrative saying who you are, what happened in dated sequence, what each annex proves, and what offence you say was committed. A vague affidavit with a bundle of unexplained screenshots is the commonest reason a solid-looking complaint dies at preliminary investigation.

Subpoena, counter-affidavit, resolution

Rule 112 requires the investigating officer, within ten days of filing, either to dismiss the complaint or issue a subpoena. The respondent has ten days from receipt to submit a counter-affidavit. A clarificatory hearing, if needed, is set within ten days of it and terminated within five. Probable cause is determined within ten days after the investigation concludes; the resolution is forwarded within five days and acted on within ten days of receipt.

Cybercrime Warrants and Why They Matter to You

The Rule creates four instruments. Knowing which one your case needs tells you why it is slow.

Warrant What it authorises Why a complainant cares
WDCD — Warrant to Disclose Computer Data “An order to disclose and accordingly, require any person or service provider to disclose or submit subscriber’s information, traffic data, or relevant data” The one that puts a name behind an anonymous account. Almost every scam and impersonation case turns on it
WICD — Warrant to Intercept Computer Data Authorises “(a) listening to, (b) recording, (c) monitoring, or (d) surveillance of the content of communications” Rare in ordinary victim cases; used against ongoing organised activity
WSSECD — Warrant to Search, Seize and Examine Computer Data “An order authorizing law enforcement authorities to search a particular place for items to be seized and/or examined” Reaches a suspect’s own devices once identified
WECD — Warrant to Examine Computer Data Where a device is obtained “via a lawful warrantless arrest, or by any other lawful method,” authorities “shall first apply for a WECD before searching” Explains why a seized phone is not simply opened and read on the spot

Applications are filed “before any of the designated cybercrime courts of the province or the city where the offense or any of its elements has been committed.” Each warrant is effective for a court-fixed period “which shall not exceed 10 days from its issuance,” extendible “for not more than 10 days.” Those short windows are why investigators want your evidence complete before applying. The consequence for you is Section 18: an investigator who declines to open a device “until we have the warrant” is protecting your case, not stalling it.

Exceptions: Inquest, and Matters That Leave This Path

Inquest versus regular preliminary investigation

These are not alternatives you choose between. Rule 112 Section 7 applies only “when a person is lawfully arrested without a warrant involving an offense which requires a preliminary investigation.” In that case the complaint or information “may be filed by a prosecutor without need of such investigation provided an inquest has been conducted in accordance with existing rules.” Inquest is a fast, custody-driven review that exists because the constitutional clock on detention is running.

Before the complaint or information is filed, the arrested person may still ask for a preliminary investigation, but must “sign a waiver of the provisions of Article 125 of the Revised Penal Code, as amended, in the presence of his counsel”; notwithstanding the waiver “he may apply for bail and the investigation must be terminated within fifteen (15) days from its inception.” After an information is filed without a preliminary investigation, the accused may, “within five (5) days from the time he learns of its filing,” ask for one. For most victims none of this applies, because there was no arrest.

Matters that leave the criminal path

  • Personal-data complaints go to the National Privacy Commission, which requires a notarised complaint-assisted form or a verified complaint with evidence and witnesses’ affidavits, and decides within thirty calendar days whether to give the complaint due course.
  • Organisational security incidents are reported to CERT-PH for response, which is not a prosecution.
  • Recovery of money runs through your issuer’s dispute process, a civil action, or restitution attached to a conviction — not through the investigation.
  • Regulatory outcomes such as an advisory or a cease-and-desist order come from the SEC, DTI or BSP, not the prosecutor.

The cybercrime reporting directory maps each of these to the right office.

Hypothetical Philippine Scenarios

These are illustrative hypotheticals, not real cases.

Hypothetical A: the account behind the scam

Ana loses PHP 42,000 to an online seller. The unit dockets her complaint, sends a preservation request to the e-wallet provider, and applies for a WDCD for the subscriber information behind the receiving account. The provider discloses within seventy-two hours of receipt. A name emerges — but it is a money mule, and the investigation must now link the mule to whoever ran the listing. Ana’s case slows for reasons unrelated to her diligence.

Hypothetical B: dismissal at preliminary investigation

Ben files against a named respondent for online libel. The counter-affidavit shows the account was created after the post appeared, with platform records to prove it. The prosecutor finds no probable cause and dismisses. Ben’s complaint was honest; his identification was wrong. This is the filter preliminary investigation exists to be, and why the WDCD stage matters before the affidavit stage.

Hypothetical C: an arrest changes the road

A suspect is caught withdrawing funds and lawfully arrested without a warrant. Because there is custody, the case goes to inquest rather than a regular preliminary investigation, and his seized phone is not read on the spot — authorities must first apply for a WECD. The complainant is asked for a sworn statement that same day, which is why you keep your chronology and annexes ready.

Evidence and Documentation

The screenshot and the record behind it

A screenshot is a picture of a screen; it can be cropped, staged or edited, and a competent counter-affidavit will say so. The underlying record is what the platform, bank or mail server holds: the account’s data export, the message with full headers, the log entry, the statement of account, the platform’s written reply to your abuse report. Bring both — the screenshot for readability, the record for weight. See are screenshots admissible evidence and electronic evidence preservation.

Building the annexes

  • Letter every annex and reference it from the affidavit body at the point it proves something.
  • Headers and exports, not forwards. A forwarded email loses the routing path identifying the sender’s server.
  • Transaction records: reference numbers, destination account or wallet, exact timestamps, your issuer’s statement and the dispute ticket.
  • Account identifiers: permanent URL and numeric profile ID, which survive a display-name change.
  • Chain of custody: note who handed what to whom and when.

What You Actually Do, Step by Step

  1. Write down your reference and the investigator’s name before leaving the counter on filing day.
  2. Ask whether a preservation request has been sent, and to which provider. If not, say what data exists and where.
  3. Keep every original intact. Do not delete accounts, threads or devices while a case is open.
  4. Follow up in writing with your reference number. Fortnightly is reasonable; daily is not.
  5. Report anything new — further contact, new accounts, new victims. New activity can revive a stalled attribution.
  6. Draft the complaint-affidavit when the investigator says the file is ready, with counsel if you can, lettering the annexes.
  7. File it at the Office of the City or Provincial Prosecutor and keep a date-stamped received copy.
  8. Watch the ten-day marks: the officer acts within ten days of filing, the respondent has ten days to counter.
  9. Attend any clarificatory hearing, set within ten days of the counter-affidavit and terminated within five.
  10. Ask for the resolution in writing. If it dismisses your complaint, a petition for review is the recognised route and has its own deadlines — take advice quickly.
  11. Pursue recovery separately through your issuer’s dispute process or a civil claim.

Realistic Outcomes

A minority of cases produce an identified, reachable suspect and a filed Information within months. A larger group stalls at attribution: false registration details, money cashed out through mules, or an offshore provider whose data must be sought through mutual legal assistance — which is why the DOJ Office of Cybercrime exists as Central Authority, and why those cases run far longer.

A real proportion of complaints are dismissed at preliminary investigation for want of probable cause. That is not a finding that you lied; it is a finding that the evidence, as presented, does not engender a well-founded belief that this respondent probably committed the offence. Misidentification and an affidavit asserting more than the annexes prove are the usual causes.

Even a conviction is not a refund. Civil liability can attach, but the money must still exist to be recovered. What the process does deliver reliably is preservation before the six-month window closes, a documented official record, and a warrant-based route to identifying an offender that no private effort can replicate.

Common Mistakes

  • Treating the police report as the case. The complaint-affidavit before the prosecutor is where the case is made.
  • Deleting accounts or threads once it “feels handled.” Preservation by the provider does not preserve your own copy.
  • Filing an affidavit that argues instead of narrating. Dates, facts and annexes persuade; adjectives do not.
  • Missing the counter-affidavit stage. What the respondent filed tells you exactly where your evidence is thin.
  • Chasing by phone only, which leaves no trail if you later need to show diligence.
  • Publicly naming the suspect, which can prejudice the case and invite a counter-complaint for online libel.
  • Waiting for the criminal case before disputing the transaction. Issuer dispute windows are far shorter than criminal timelines.
  • Assuming silence means inaction. Warrant applications and provider correspondence are not shared with complainants while in progress.

Case-Progress Tracker

Keep one page per case. Fill in dates as they happen; blanks are your follow-up list.

Milestone Date Reference / who Next check
Incident date and date discovered ______ ______ Starts the six-month preservation window
Bank or e-wallet dispute lodged ______ Ticket no. Issuer’s stated response time
Report filed with PNP-ACG or NBI ______ Reference no. and investigator Two weeks
Preservation request confirmed sent ______ Provider named Two weeks
Warrant applied for (WDCD / WSSECD / WECD) ______ Court Ask at each follow-up
Provider disclosure received ______ ______ Seventy-two hours from receipt of the order
Complaint-affidavit filed with the prosecutor ______ Docket no. Ten days for the officer to act
Subpoena issued to respondent ______ ______ Ten days for the counter-affidavit
Resolution issued ______ Copy obtained? Review deadline if dismissed
Information filed in court ______ Criminal case no. Judge evaluates within ten days

Frequently Asked Questions

How long will my case take?

No single period governs a cybercrime case end to end. Individual stages have fixed periods — ten days for a counter-affidavit, seventy-two hours for provider disclosure — but attribution has none, and that is usually where the months go.

Can my case be dismissed even if I am telling the truth?

Yes. Preliminary investigation asks whether the evidence supports probable cause against this respondent, not whether you are honest. Misidentification and thin annexes are the usual causes.

What is the difference between inquest and preliminary investigation?

Inquest applies only where a person was lawfully arrested without a warrant and is in custody. Everything else goes through a regular preliminary investigation under Rule 112.

Can evidence the police obtained improperly still be used?

No. Section 18 of RA 10175 provides that evidence procured without a valid warrant or beyond its authority “shall be inadmissible for any proceeding before any court or tribunal.”

Do I need a lawyer?

Not to report. Strongly advisable for the complaint-affidavit and preliminary investigation, where drafting decides whether probable cause is found.

What if the offender is abroad?

The case becomes an international cooperation matter. The DOJ Office of Cybercrime is the designated Central Authority for mutual assistance and extradition in cybercrime, and those requests take considerably longer than domestic ones.

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.