A READER wrote in a panic last month. She had just lost P45,000 to a fake investment app that promised “guaranteed” returns in seven days. Her first question was not “how do I get my money back,” but “which office do I even go to?” She had heard of the PNP, the NBI, the DICT, and something called CICC, and had no idea which one was hers to call.
That confusion is understandable. Even government agencies sometimes blur the line between two words that sound alike, but mean very different things: cybersecurity and cybercrime.
Getting this distinction right is not an academic exercise. It determines whether a citizen wastes precious hours at the wrong window while a scammer moves the money further out of reach.
Here it is in plain terms. Cybersecurity is about prevention. Cybercrime is about response.
Think of cybersecurity as the lock on the door, the guard at the gate, the CCTV camera watching the street. It is everything done before a crime happens — building strong systems, setting safety standards, warning the public about new scam tactics, and helping institutions defend themselves against attack. The lead agency for this in the country is the Department of Information and Communications Technology (DICT) through its Cybersecurity Bureau and its National Computer Emergency Response Team. Their job, under the law that created DICT, is to build collective defenses and issue the national plan that guides how government and industry protect themselves.
Cybercrime, on the other hand, is about what happens after the lock has already been picked — when the money is gone, the account is hacked, or the scam has already claimed a victim. This is police and investigative work, not systems work. It falls to the Philippine National Police’s Anti-Cybercrime Group, the National Bureau of Investigation’s Cybercrime Division, and the Department of Justice’s Office of Cybercrime, which coordinates cooperation with other countries when the criminal is operating from abroad.
The simplest way to put it: DICT protects the house; the PNP and NBI catch the burglar.
So where does a victim actually go?
If money has already been lost — through a fake investment scheme, an online seller who never delivered, a “love scam,” or any fraud conducted through a phone, computer, or app — the first stop should be the police or the investigators, not the technology department. Two doors are open: the PNP Anti-Cybercrime Group is usually the fastest option, especially for cases that are local in nature. It has walk-in stations and is built to receive complaints quickly.
The NBI Cybercrime Division is often the choice for more complicated cases — large sums, multiple victims, or a scammer who appears to be operating from outside the Philippines. In-person filing is strongly preferred here too, because the integrity of the evidence — screenshots, transaction records, chat logs — matters enormously to how quickly a case can move.
If a bank or e-wallet was involved in moving the stolen funds, the police report should not be the only step. Victims should go directly to their bank or e-wallet provider as well. These institutions can move to freeze or trace funds far faster than waiting for a criminal referral to work its way through the system. Every hour matters when money is moving through digital accounts.
If the case involves an investment scheme specifically — the kind promising impossible returns — a parallel complaint should also be filed with the Securities and Exchange Commission’s Enforcement and Investor Protection Department. It has the authority that the police do not, particularly over unregistered investment solicitations.
And for anyone who simply wants to flag a suspicious website, a phishing email, or a scam app not yet fallen for — no money lost, just a warning to give — that is when DICT and its National Computer Emergency Response Team become the right address. That is cybersecurity work: stopping the next victim before there is one.
Why this confusion persists — and why fixing it matters:
Part of the public’s confusion is understandable, because the laws themselves layer these responsibilities in ways that even careful readers find dense. The Cybercrime Prevention Act of 2012 created the law enforcement structure. The DICT Act of 2016 later gave DICT the lead role in national cybersecurity planning. An inter-agency body called the Cybercrime Investigation and Coordinating Center sits in between, coordinating policy rather than receiving complaints directly. None of this is intuitive to an ordinary citizen standing at a counter, holding a phone full of screenshots, wondering where to go.
There are, in fact, bills filed in Congress about restructuring parts of this system — creating new bodies, clarifying old ones, closing gaps that have opened as scams have grown more sophisticated. That is a conversation worth having in a future column. But citizens should not have to wait for Congress to act before they know where to knock today.
So here is the one line worth remembering: If money has been lost or a scam has already claimed a victim online, the call is to the PNP or the NBI — not DICT. Report to the bank at the same time. And if what remains is only a warning to give, not a loss to report, that is when DICT’s cybersecurity desk is the one listening.
In a crisis, knowing the right door saves more than time. It can save the money, and sometimes, it can save the next person from becoming a victim, too.
