Cybercrimes Modus Operandi and How to Prevent

Them
PLT MARLON P FLORES
Chief, Fraudulent Bank Transaction Section, Cyber Financial Crime Unit (CFCU), PNP ACG
The PNP Anti-Cybercrime Group
RA 10175 ALSO KNOWN AS
“CYBERCRIME PREVENTION ACT OF 2012”

CHAPTER IV
ENFORCEMENT AND IMPLEMENTATION

Section 10. Law Enforcement Authorities. — The National Bureau

of Investigation (NBI) and the Philippine National Police (PNP)
shall be responsible for the efficient and effective law enforcement
of the provisions of this Act. The NBI and the PNP shall organize a
cybercrime unit or center manned by special investigators to
exclusively handle cases involving violations of this Act.
The PNP Anti-Cybercrime Group
PNP – ACG was activated on MARCH 20, 2013:

Criminal
Investigation and
Detection Group
(CIDG)

ATCCD

Authority:
NAPOLCOM RESOLUTION NO. 2013-220 dated February 27, 2013; and GENERAL ORDER
NO. DPL-12-09 dated February 27, 2013.
The PNP Anti-Cybercrime Group

NAPOLCOM Resolution No. 2018-

DPL GO NO.18-09
526
Laws on Cybercrime Related Laws
R.A. 10175 – CYBERCRIME PREVENTION ACT
It is an act defining cybercrime, providing for the following:
○Prevention
○Investigation
○Suppression
○Imposition of Penalties

OTHER LAWS RELATING TO CYBERCRIME

◉RA. 8792 – E-Commerce Act of 2000
◉RA. 8484 – Access Devices Regulation Act of 1998
◉RA. 9775 – Anti Child Pornography Act of 2009
◉RA. 9995 – Anti Photo and Video Voyeurism Act of 2009
◉Revised Penal Code (RPC) and other Special Laws committed by,
through or with the use of ICT
The PNP Anti-Cybercrime Group
Actual
PCOs: Authorized Variance PCOs: Detailed
Personnel
PBGEN 1 1 0 PBGEN 0
PCOL 28 16 -12 PCOL 1
PLTCOL 27 28 1 PLTCOL 1
PMAJ 60 18 -42 PMAJ 1
PCPT 61 10 -51 PCPT 1
PLT 58 50 -8 PLT 1
Sub-Total 235 123 -112 Sub-Total 5 Non-Organic
PNCOs: PNCOs: Personnel, 89
PEMS 4 17 13 PEMS 5
PCMS 21 22 1 PCMS 2
Organic
PSMS 54 9 -45 PSMS 1
Personnel, 692
PMSg 72 19 -53 PMSg 4
PSSg 97 42 -55 PSSg 22
PCpl 243 61 -182 PCpl 31
Pat 162 399 237 Pat 18
Sub-Total 653 569 -84 Sub-Total 83
NUP: 0 0 0 NUP: 1
Sub-Total Sub-Total 1
Grand Total 888 692 -196 Grand Total 89

Current Total Personnel Strength: 692

to 76.01 Million Filipino online users
PNP ACG to Online Population Ratio: 1:109,841
https://datareportal.com/reports/digital-2022-philippines
PNP ACG Presence Nationwide:
16 Regional Anti-Cybercrime Social Media
Units Account RACU COR
Unit Location RACU 1
Facebook: Racu Juan Acg RACU 2
RACU 1 Camp Florendo, San
1 Fernando City, La Union
RACU 3
RACU 2 Camp Marcelo A Adduru, Facebook: Racu-Two
2 Tuguegarao City Tuguegarao

RACU CBAO Bldg., Utility Rd., DPS Facebook: Racu Cordillera RACU 4A
3 RACU 5
COR Compound, Baguio City

RACU 3 Camp Olivas, City of San

4 Facebook: Racu Tres RACU 4B
Fernando, Pampanga
RACU 8
RACU 4- Camp Vicente Lim, Calamba Facebook: RACU
5 A City, Laguna CALABARZON RACU 7
RACU 6
RACU 4- Camp Navarro, Calapan City,
6 Facebook: RACU MIMAROPA
B Oriental Mindoro

RACU 5 CIDG Building Camp Ola, RACU 13

7 Facebook: Racu-Five Kasurog RACU 10
Legaspi City
RACU 9
RACU 6 Camp. Delgado, Fort San RACU 11
8 Facebook: Racu Six
Pedro, Iloilo City
RACU BAR
RACU 7 Cebu PPO Compound Doña Facebook: -Acg Visayas
Modesta Gaisano St., Sudlon (CyberCop)
RACU 12
Lahug Cebu City -NegOr Crt
9
Facebook: -BoholCyber
ResponseTeam 7
PNP ACG Presence Nationwide:

16 Regional Anti-Cybercrime Units Social Media Account

RACU COR

RACU 8 Camp Kangeleon, Palo, Facebook: Regional Anti-Cybercrime Unit 8 RACU 1

10 Leyte Instagram: @racueight RACU 2
Twitter: racu8pnpacg
RACU 3
RACU 9 CIDG9 Camp Batalla,
Justice RT Lim Boulevard,
Facebook: Regional Anti-Cybercrime Unit 9 – PNP ACG
11 Zamboanga City
RACU 9
RACU 4A RACU 5
RACU Camp Alagar, Lapasan,
12 10 Cagayan De Oro City Facebook: PNP-Anti Cybercrime Group 10 RACU 4B
RACU 8
RACU 11RCIDU Camp Leonor,
11 Davao City Facebook: Racu Onse
13
Twitter: Racu XI- Davao RACU 6 RACU 7

RACU Camp Fermin G Lira Jr., Facebook: RACU Dose (Anti-Cybercrime Unit Twelve)
14 12 General Santos City Instagram: racu_dose PNP ACG
RACU 13
Twitter: PNP ACG (RACU 12)
RACU 10
RACU Camp Rodriguez, Libertad, Facebook: Racu Trese RACU 9
15 13 Butuan City Instagram: racu_13 RACU 11
Twitter: @13_raco
RACU BAR
RACU Camp Pendatun, Parang , Facebook:
BAR Maguindanao https://www.facebook.com/racu.barmm/
Instagram: RACU 12
16
https://twitter.com/racubar_pcr
Twitter:
https://www.instagram.com/racubar.pcr/
8
 PNP ACG Presence Nationwide
18 Provincial Anti-Cybercrime Teams
PCRTs Covering RACU Location
1. Santiago CRT RACU 2 Santiago City Police Office, Isabela.
2. Tarlac PCRT RACU 3 Camp General Francisco S Macabulos, Tarlac City

3. Rizal PCRT Rizal PPO Hqs, Camp Geronimo, Dolores, Tatay, Rizal,
RACU 4A
Cavite PPO, General E Topacio St, Poblacion 1 - A, Imus, 4103
4. Cavite PCRT RACU 3 RACU 2
Cavite
5. Palawan and Puerto Princesa Camp Higinio A. Mendoza Sr., Tiniguiban, Puerto Princesa
RACU 4B
PCRT City, Province of Palawan
6. Masbate PCRT Camp Bonny Serrano, Masbate City, Masbate RACU 5
2nd Floor of Youth Center Mayon Avenue, Dayangdang, Naga RACU 4A
7. Camarines sur PCRT
City

8. Camarines Norte PCRT RACU 5 Provincial Capitol Compound, Daet, Camarines Norte RACU 4B

9. Catanduanes PCRT San Isidro Village, Virac, Catanduanes

10. Sorsogon PCRT Camp Salvador C Escudero Sr., Brgy Sampaloc, Sorsogon City
RACU 7
11. Bohol PCRT Bohol PPO Hqs, Camp Dagohoy, Tagbilaran City, Bohol RACU 13
RACU 7
12. Negros Oriental PCRT Negros Oriental PPO, Camp Fernandez, Sibulan, Negros
(Sibulan) Oriental
2nd Flr, Old Provincial Hospital, Provincial Capitol Compound,
13. Bukidnon PCRT
Malaybalay City, Bukidnon RACU 10
14. Iligan City Cyber Response 3rdFlr, Legislative Bldg., Iligan City Hall, Buhanginan Hills,
RACU 10
Team (Lanao Del Norte) Pala-o, Iligan City
Camp General Bonifacio Aranas, Brgy. Baylao, Mambajao,
15. Camiguin PCRT
Camiguin
RACU 11
16. Davao City Cyber Response
RACU 11 WCPD Bldg., CM.Recto St., Poblacion District Davao City
Team
RACU 12
17. Sultan Kudarat PCRT RACU 12 Tacurong City Police Station, Tacurong City, Sultan Kudarat

18. Surigao del Norte PCRT RACU 13 Surigao del Norte Provincial Police Office
PNP ACG Presence Nationwide:
Cyber Response Unit
5 District Anti-Cybercrime Teams
Unit Location Social Media Account
1) Northern Caloocan City Hall, 9th Cyber Response Unit
District Anti- Ave., East Grace Park,
Facebook: Pnp Sdact
(NCR AOR)
Cybercrime Caloocan City
Team *
2) Eastern Eastern Police District Facebook: Edact Acg ACG
District Anti- Hqs, Caruncho Ave., Instagram: Edact2020 NHQ
Cybercrime Malinao, Pasig City
Twitter: EdactAcg N-DACT QC-DACT
Team
3) Quezon City Quezon City Police M-DACT E-DACT
District Anti- District Hqs, Camp
Facebook: Qcdact Acg S-DACT
Cybercrime Karingal, Sikatuna
Team Village, Quezon City
4) Southern 2nd Floor, Old Southern
District Anti- Police District Bldg.,
Facebook: Manila Dact
Cybercrime Fort Bonifacio, Taguig
Team * City
*5)AllManila District
are operational Manila Police District
Anti- Hqs, UN Avenue, Ermita Facebook: Ndact Acg
Cybercrime , Manila Twitter: @ndact1925
Team
Cybercrime Situation
Cybercrime Situation
1973
or
34.4%
400
or
8000 1231 7.5%
or
1816 30%
7000 or
79.37%
6000
351
or
5000 839
18.12%
or
4000 76.41% 7708 7849
558
3000 391
or
5335 5735
103.33%
or
2000
262.42% 4104

1937 2288
1000
149 1098
540
0
Mar to 2014 2015 2016 2017 2018 2019 2020 2021 Jan-Aug
Dec 2013 25, 2022
Comparative Statistics (January to August 25, 2021 vs January to August 25, 2022)
1400
Monthly Cybercrime Trend
1308
1249
1200 1194

1000
937 940
911

800 789 802

742 728
654 669 672
600 586 569
487
400

200

0
JANUARY FEBRUARY MARCH APRIL MAY JUNE JULY AUGUST

2021 2022
Top 5 Most Prevalent Cybercrime (January 1 to August 25, 2021)

2000
1800
1600
1400
1200
1980
1000
800
890
600
400 655
451 379
200
0
Art. 315, RPC – Sec. 4 (c) 4, RA Sec. 4 (b) 3, RA Sec. 4 (a) 1, RA RA 8484 (Access
Swindling / Estafa 10175 (Online 10175 (Computer 10175 (Illegal Device Act)
Libel) Related Identity Access)
Theft)
Top 5 Most Prevalent Cybercrime (January 1 to August 25, 2022)

3500
3000
2500
2000
3272
1500
1000 982
964 807
500 521
0
Art. 315, RPC – Sec. 4 (b) 3, RA Sec. 4 (a) 1, RA Sec. 4 (c) 4, RA RA 8484 (Access
Swindling / Estafa 10175 (Computer 10175 (Illegal 10175 (Online Device Act)
Related Identity Access) Libel)
Theft)
Cybercrime Situation
Comparative Crime Solution Efficiency

9000
8000
48.48% CSE = 75.83% 7849
7000
6000
5952
5000
5107 Solved Cases
4000 Crime Volume
3000
2000 CSE = 27.35%

1000 1397
0
JAN-AUG 25, 2021 JAN-AUG 25, 2022

17
Cybercrime Situation
Comparative Crime Clearance Efficiency
9000
8000
7849
7000 50.99% CCE=81.42%

6000 6391
5000 5107 Cleared Cases
4000 Crime Volume
3000
CCE=30.43%
2000
1000 856

0
JAN-AUG 25, 2021 JAN-AUG 25, 2022

18
 Paradigm Shift of Crime
TRADITIONAL CRIMES
TO CYBERCRIMES

FRAUD/SCAMS/ESTAFA O
LIBEL
THREATS N
EXTORTION
ROBERRY
L
IDENTITY THEFT I
BULLYING
ILLEGAL RECRUITMENT N
VAWC
HUMAN TRAFFICKING E
PORNOGRAPHY (ILLEGAL)
TERRORISM

19
Modus Operandi
 Social Engineering

https://terranovasecurity.com/what-is-social-engineering/
21
 Extortion Scam
▪ Pretending to be a New Peoples Army or a Group of Gun For Hire
▪ Most of the victim here is a known personalities and establishments
▪ Where they personal, office number was posted on their social media
account/s
▪ Thru the use of social engineering the scammer will get the said number
and thereafter, will call the person or establishment by pretending to be a
NPA and then will threatened them which will resort for the extortion for
the demand of money
▪ Since, the victim were being terrified, they will give/send money for the
said scam and thereafter get the money they will asked for another and
another.
Modus Operandi Cyber Financial Fraud

Bank Syndicate Modus

Phishing is a cybercrime in which a target or targets

are contacted by email, telephone or text message by
someone posing as a legitimate institution to lure
individuals into providing sensitive data such as
personally identifiable information, banking and credit
card details, and passwords.
Tips against Phishing

1. Do not click any suspicious links.

2. Protect your computer with anti-virus software, spyware filters,
email filters and firewall programs.
3. You can verify a website’s authenticity by looking for “https:” at the
beginning of the internet address.
4. Contact the financial institution immediately and report your
suspicions.
5. Do not reply to any email that requests your personal information.
6. For suspicious links, you may check www.virustotal.com
Modus Operandi Cyber Financial Fraud

Bank Syndicate Modus

Vishing is a cybercrime that
uses phone calls to steal
personal confidential information
and access to bank accounts
from victims.
Modus Operandi Cyber Financial Fraud

LOVE SCAM/ROMANCE SCAM

Is also known as an online
dating scam. A person is tricked into
believing they’re in a romantic
relationship with someone they met
online. In fact, their “other half” is a
cybercriminal using a fake identity
to gain enough of their victim’s trust
to ask — or blackmail — them for
money.
Modus Operandi Cyber Financial Fraud

INVESTMENT SCAM
Investment fraud involves the illegal sale or purported sale of financial
instruments. The typical investment fraud schemes are characterized by offers of low- or
no-risk investments, guaranteed returns, overly-consistent returns, complex strategies,
or unregistered securities. Examples of investment fraud include advance fee
fraud, Ponzi schemes, and pyramid schemes.
Modus Operandi Cyber Financial Fraud

EMPLOYMENT SCAM
Employment scams are a criminal form
perpetrated by individuals or organizations
posing as recruiters or hiring agencies
offering or promising attractive jobs and
big money to people seeking for job
opportunities.
Modus Operandi Cyber Financial Fraud

BUSINESS EMAIL COMPROMISED

▪ Is an exploit in which the attacker
gains access to a corporate email
account and spoofs the owner's
identity to defraud the company or its
employees, customers or partners of
money. An attacker simply creates an
account with an email address that is
very similar to one on the corporate
network. BEC are also known as man-
in-the email attacks.
Modus Operandi Cyber Financial Fraud

FAKE RECEIPT/LEGIT BUYER SCAM

▪ In this type of scam, the cybercriminal/s will pretend
as a legit buyer of particular goods offered at the
online selling platform in which the unknown
perpetrator places his/her order in the weekend and
makes the seller believe that his/her order was
already paid thru online banking by sending a fake
online banking receipt reflecting in it that his
payment was already transferred to the account of
victim.
Modus Operandi Cyber Financial Fraud

ACCOMODATION/TRAVEL AND TOURS SCAM

▪ In this type of scam, the cybercriminal/s
will pretend as a legitimate establishment
offering services such as processing of
online accommodation in hotels,
restaurants, and resorts.
▪ The victim will later discover that the
service they availed is a scam upon
checking-in at the establishment.
 HOW TO IDENTIFY A SCAM
• A company is contacting you out of the blue
• You’re being rushed
• Your bank is asking you for your PIN number and
personal information
• The letter or email you have received is full of
sketchy spelling and bad grammar
• The website you’re on doesn’t have a secure link
 HIGHJACK PROFILE/ID THEFT SCAM
Is an infiltration to a particular social media account in which after gaining
access in it, the unknown perpetrator will send messages to its relatives
and friends asking a favor to send or lend him/her for some money due to
some urgent needs:

Examples:
1. Members of the family are sick and in need of large amount of money
2. In urgent need of money to be used in investment. Most of the victims
are OFWs, PNP personnel, Military in Training etc
Identity Theft - is when someone uses your personal data —
name, Social Security number, birthdate, etc. — to impersonate
you, most commonly for financial gain.

Tips:

• Take caution in public. Identity thieves are creative. They will

steal information while looking over your shoulder or listening to
your phone conversations. This is a commonly overlooked
source of identity theft.
• Protect your computer. Password-protect your computer but also
individual documents containing account numbers, bank
information or other confidential information.
• Do not ignore your trash. Identity thieves go through dumpsters
to find names, addresses and/or account information. Get into
the habit of shredding papers containing any of this information.
A cross-cutting shredder is recommended for preventing identity
theft. These can be purchased at your local office products store
or online.
 5 Ways to protect yourself from Cyberattacks

1. CHECK IF YOU’VE ALREADY BEEN INVOLVED IN A DATA BREACH

Visit haveibeenpwned.com and change those passwords for any accounts that it suggests
may have been compromised.

2. CHECK THE STRENGTH OF YOUR PASSWORDS

Test the strength of your passwords at howsecureismypassword.net (use something
similar to your original password to test its strength).

When choosing a password, remember: the longer it is, the stronger it is. A strong
password is at least 12 characters long and hard to guess.

Using a sentence is a great way to create a long password that you’ll never forget.
 5 Ways to protect yourself from Cyberattacks
3. AVOID THESE PASSWORDS
The following passwords are considered the most common and easiest to
crack – so if you’ve got any of these or similar variations, you should seriously
considering changing them – quickly!

123456 (or any chronologically-ordered numbers)

987654321
123123
QWERTY
111111
password
 5 Ways to protect yourself from Cyberattacks

4. TRUST NO ONE (ON EMAILS)

This may sound a bit extreme – but always be on the lookout for deceitful
emails and compromised web pages (spam and phishing). Interacting with
these puts your information at risk and can download viruses.

Remember:
•don't open email from unknown email addresses
•trash attachments in unexpected emails
•avoid risky clicks – instead type the address into your browser.
 5 Ways to protect yourself from Cyberattacks
5. SECURE YOUR DEVICE
If your mobile device is unsecured, lost or stolen, it could be used to access
your info, your money or steal your identity and irreplaceable data like
photos or messages. Secure your devices by:
•installing anti-virus software
•setting a password, gesture or fingerprint that must be entered to unlock
•setting the device to require a password before applications are installed
•leaving Bluetooth hidden when not in use and disabling automatic
connection to networks
•enabling remote locking and/or wiping functions, if your device supports
them.
II Strategies Adopted to Address Cybercrimes
1. Dissemination/Posting of Infographics
II. Strategies Adopted to Address Cybercrimes
2. Issuance of Cyber Bulletin
THANK YOU AND
GOOD DAY