There is no fixed legal deadline for the NBI to finish investigating a cybercrime complaint — the case-building stage alone can run anywhere from a few weeks to several months, largely depending on how quickly banks, telcos, or platforms respond to data requests. Once the NBI endorses the case to the prosecutor, preliminary investigation has its own timeline: the respondent gets a period to answer, and complaints are generally meant to be resolved within about 60 days from filing, though this is often extended.
Cybercrime complaints move through two distinct stages that are often confused as one: the NBI’s own investigative case-build, and the preliminary investigation once the case reaches a prosecutor. Neither stage has a single fixed deadline that guarantees resolution by a certain date, which is why timelines you hear about — anywhere from a few weeks to over a year — can all be accurate for different cases.
What Happens After You File
A cybercrime complaint can be filed with the NBI Cybercrime Division either online through its e-complaint portal or in person at NBI headquarters or a regional office with a cybercrime unit. Filing itself does not require a fee for a criminal complaint. Whichever route you use, you will need a notarized complaint-affidavit describing the incident, identifying the offender to whatever extent you can, and attaching your evidence — screenshots, transaction records, account details, and any communications with the offender or the platform involved.
Once received, a duty officer conducts an initial interview, logs the complaint, and assigns a case or reference number. From there, an investigator is assigned to build the case, which usually involves:
- Reviewing and authenticating the digital evidence you submitted
- Requesting subscriber information or transaction records from telcos, banks, e-wallets, or platforms
- Coordinating with the platform or service provider where the offense occurred, which can be a local company or one based overseas
- Conducting digital forensics on devices or accounts, where warranted
- Preparing the case for referral to the Department of Justice or the appropriate prosecutor’s office once enough evidence has been gathered
Who You Are Dealing With at Each Stage
The investigator assigned to your case is not the same person who eventually decides whether to file charges — that decision belongs to the prosecutor, not the NBI. The NBI’s role is investigative: gathering, authenticating, and organizing evidence into a case that a prosecutor can act on. This distinction matters because complainants sometimes expect the NBI itself to file charges or make an arrest, when in reality its output is typically a referral or an endorsement that then goes through the separate preliminary investigation process described further below. Understanding this division of labor helps set realistic expectations for what progress looks like at each stage — a case that is moving normally can still look, from the outside, like very little is happening while records requests and verification work continue in the background.
Is Going to the NBI Your Only Option
The NBI Cybercrime Division is not the only avenue for a cybercrime-related complaint. Depending on the nature of the offense, a complainant may also coordinate with the PNP Anti-Cybercrime Group, or file a complaint-affidavit directly with the city or provincial prosecutor’s office without first going through the NBI. Filing directly with the prosecutor skips the NBI case-build stage entirely and moves straight into preliminary investigation, which can be faster where the complainant already has strong, well-organized evidence, but it also forgoes the benefit of the NBI’s subpoena and forensic capabilities for gathering evidence the complainant does not yet have. Many complainants choose to file with the NBI first precisely because the offender’s identity, device, or account details are not yet fully established.
The One Concrete Timeline Written Into Law
The Cybercrime Prevention Act (RA 10175) does put specific numbers on parts of the evidence-gathering process, which is useful because it tells you what investigators can realistically expect from service providers:
- Data preservation: service providers must preserve traffic data and subscriber information for a minimum of six months from the date of the transaction, and preserve content data for six months from the date they receive a preservation order from law enforcement. This period can be extended once for another six months.
- Disclosure of data: once a court issues an order compelling disclosure, the service provider must turn over the requested subscriber information, traffic data, or relevant data within 72 hours of receiving the order.
- Custody of seized computer data: where computer data has been examined pursuant to a warrant, it must be deposited with the court within 48 hours after the expiration of the period allowed for examination.
These figures explain a lot of the variability in how long a case takes. If the respondent used a local telco or a Philippine bank, records can usually be obtained relatively quickly once the proper court order is secured. If the trail leads to a platform or server based abroad, the NBI may need to go through international cooperation channels, which are not bound by the 72-hour rule and can add months to the process.
Factors That Speed Up or Slow Down the Investigation
A handful of factors consistently make the difference between a case that moves in weeks and one that drags on for a year or more:
- How complete your evidence is at filing. Complaints that arrive with clear screenshots, transaction references, account names, and a chronological narrative require less back-and-forth than complaints built around vague recollections.
- Whether the offender is identifiable. Cases where the account, phone number, or bank details point to a specific, traceable person move faster than cases involving anonymous accounts, fake identities, or accounts registered with fraudulent information.
- Where the servers or accounts are located. Domestic platforms and local financial institutions generally respond within the statutory windows once ordered. Foreign platforms may require formal requests for international cooperation, which take considerably longer and are outside the NBI’s direct control.
- Case volume and complexity. The Cybercrime Division handles a wide range of offense types — online fraud, identity theft, harassment, hacking, child protection cases — and higher-priority or higher-volume cases can affect how quickly any individual case is worked.
- Your responsiveness. Complainants who respond promptly to requests for additional affidavits, documents, or clarifications keep their case moving; delays on the complainant’s side extend the timeline just as much as delays anywhere else.
After NBI Endorsement: the Preliminary Investigation Clock
Once the NBI has built its case and refers it to the prosecutor (or once you file a complaint-affidavit directly with the prosecutor’s office alongside your NBI referral), the case enters preliminary investigation under the Rules of Criminal Procedure. The prosecutor issues a subpoena, and the respondent is given a period to file a counter-affidavit. Complaints at this stage are generally meant to be resolved within about 60 days of filing, though prosecutors’ offices routinely request extensions for justifiable reasons, particularly in cases involving voluminous digital evidence.
If the prosecutor finds probable cause, an Information is filed in the appropriate cybercrime court, and the case proceeds toward arraignment and trial — a stage that can, on its own, run well over a year depending on the court’s docket and the complexity of the evidence involved.
A Realistic Overall Estimate
Putting the stages together, complainants should generally expect:
- NBI case-build stage: a few weeks for straightforward cases with clear evidence and identifiable local offenders, up to several months where records must be sourced from multiple institutions or from platforms based abroad.
- Preliminary investigation: roughly two to several months, factoring in the counter-affidavit period and common extensions.
- Trial, if a case is filed: commonly a year or more, as with most Philippine criminal litigation.
These estimates assume a domestic case without multiple foreign platforms involved and without unusual complications such as a jurisdictional challenge from the respondent or a case being reassigned mid-investigation. Complex, high-value fraud cases involving several intermediary accounts or cross-border remittances tend to sit at the longer end of every stage described above, simply because more institutions must be asked for records and more responses have to be waited on before the picture is complete.
There is no shortcut around this reality: cybercrime cases involve evidence that, by nature, sits with third parties — banks, telcos, platforms — and the pace of the investigation is often set by how quickly those parties respond once legally compelled to do so.
What You Can Do to Avoid Unnecessary Delay
Bring a complete, well-organized set of evidence when you file. Keep copies of everything you submit. Respond quickly to any follow-up requests from the investigator or the prosecutor's office. And where the amounts or harm involved are significant, consider having counsel review your complaint-affidavit before filing, since a well-drafted affidavit that anticipates the elements the prosecutor will look for tends to move through preliminary investigation with fewer clarificatory rounds.
Frequently Asked Questions
Does filing online through the NBI portal take longer than filing in person? Not inherently. Both methods result in the same intake process and case assignment; what matters more for speed is the completeness of your evidence and how quickly you respond to any follow-up requests from the assigned investigator.
What if the person who scammed or harassed me is based overseas? Cases involving offenders or platforms based abroad generally take longer because obtaining records requires international cooperation channels rather than the 72-hour domestic disclosure period under the Cybercrime Prevention Act, and this step is largely outside the NBI's direct control.
Can I follow up on the status of my complaint? Yes. You can generally follow up using your case or reference number issued at filing; keeping in touch with the assigned investigator or the prosecutor's office once your case is endorsed helps you stay informed and can help move things along.
Is there a fee to file a cybercrime complaint with the NBI? No filing fee is required to lodge a criminal complaint with the NBI Cybercrime Division. You will typically shoulder ancillary costs like notarizing your affidavit and securing certified copies of supporting documents.
This commentary is for general informational purposes only and does not constitute legal advice. For guidance specific to your situation, please consult a licensed attorney.
If you have questions about your rights or options under Philippine law, our firm is available to assist. You may reach us via Viber or WhatsApp, call us at 0995 433 5550, or send an email to vivasnobles@gmail.com. We look forward to hearing from you.