What to preserve if you’ve been victimized by online crime and want to pursue prosecution

Being victimized by an online crime can leave people unsure about what to do next. But before deleting messages, blocking accounts or clearing conversations, cybercrime prosecutors said victims should first preserve the digital evidence connected to the incident.

That evidence can help investigators establish what happened and may later be needed if the case proceeds to prosecution.

Atty. Chris Maño of the Department of Justice Office of Cybercrime (DOJ-OOC) said victims should keep the information they have connected to the incident, including messages and screenshots.

“Preserve the evidence that they have. Screenshots, messages, don’t delete,” Maño said.

He explained that one of the challenges in investigating cybercrime is attribution, or identifying the person behind an online account, computer or mobile phone used in committing an offense.

“We know that there’s a victim, there’s a crime committed, but who the criminal is, it’s hard to prove because these crimes happen behind the computer, these crimes happen behind the cellphone, and nobody really saw the person committing the crime,” he said.

What should you preserve?

Victims should keep as much of the original digital trail as possible, including the screenshots and messages cited by Maño, along with other records directly connected to the incident.

Even conversations containing sensitive or embarrassing information should not immediately be deleted if they may be relevant to the complaint.

“Regardless if it will show that it’s shameful for you that you get victimized, don’t delete,” Maño said.

“Keep it because at the end of the day, when we go to prosecution, we will need those original evidence. We will need everything.”

Keeping the original records intact can give investigators more information to work with when reviewing the circumstances of the incident.

Report the incident

After preserving the available evidence, victims should report what happened to the proper authorities.

“If you are a victim of a cybercrime, it really actually depends on what kind of cyber crime. But generally, you have to report,” Maño said.

Depending on the nature of the incident, victims may seek assistance from the Philippine National Police Anti-Cybercrime Group (PNP-ACG), National Bureau of Investigation (NBI), Cybercrime Investigation and Coordinating Center (CICC), or the DOJ Office of Cybercrime.

The CICC can also be reached through its 1326, national anti-scam and cybercrime hotline, which receives cybercrime-related complaints and reports and helps coordinate appropriate assistance.

Victims should be ready to provide the records they preserved and explain how the incident happened.

Stay involved after reporting

Filing a complaint may only be the beginning of the process.

Maño said authorities sometimes encounter complainants who initially report an incident but later stop responding when asked to appear or provide additional information.

He urged victims to continue cooperating with investigators and prosecutors as the case develops.

“So persistence. You have to keep it up with us because we will be there. We will be there to help you. So help us too,” Maño said.

Victims may also be asked to provide testimony or additional evidence during the investigation or prosecution.

“The evidence will come from you, the testimony will come from you, so we need your help as victims for us to be able to properly prosecute cybercrimes,” he added.

Be cautious about moving conversations

Maño also advised people to be careful when someone they are dealing with online asks them to move their conversation to an encrypted messaging platform.

“Criminals often go to messaging platforms that are encrypted. Don’t go there,” he said.

He explained that encrypted communications can make evidence gathering more difficult even when investigators use digital forensic tools.

The advice does not mean encrypted messaging platforms are inherently suspicious, but victims should be cautious about moving a conversation away from its original platform, particularly when dealing with an unknown or suspicious account.

For anyone who becomes a victim of an online crime, the practical steps are straightforward: preserve the available evidence, report the incident and continue cooperating with authorities.

What may appear to be an ordinary message or account detail could later help investigators piece together what happened and identify the person behind the crime.