Quick answer

If someone is using your name, photos, account details, business identity, or other identifying information without authority, preserve the evidence first, secure any compromised accounts, report the profile through the platform’s impersonation channel, and promptly report the incident to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

For immediate intake or referral, you may also call the government’s Cybercrime Investigation and Coordinating Center hotline at 1326 or use the CICC reporting portal. If money or a financial account is involved, contact the bank or e-wallet immediately—before waiting for the platform or police to act.

A platform report seeks removal or restriction of the account. A report to law enforcement starts the process for identifying the operator and determining whether criminal charges are supported. These are separate remedies, and you may pursue both.

When a fake account may be identity theft

A fake, anonymous, parody, fan, or pseudonymous account is not automatically a crime. The surrounding facts matter.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, computer-related identity theft is the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person. The Supreme Court upheld this provision in Disini v. Secretary of Justice.

A case is more likely to require criminal investigation when the account:

Presents itself as you or your organization, rather than clearly identifying itself as parody, commentary, or a fan account;
Uses your name, photograph, signature, identification details, contact information, account credentials, or business information without permission;
Messages relatives, customers, co-workers, or the public as though it were you;
Solicits money, loans, investments, donations, passwords, one-time PINs, or personal information;
Publishes damaging statements, threats, sexual content, or fabricated conversations in your name;
Was created after your real account was hacked or taken over; or
Causes financial loss, reputational harm, harassment, loss of access, or other measurable damage.

Publicly visible information is not necessarily authority to impersonate its owner. Conversely, similarity of names or the mere existence of an unofficial account does not by itself establish criminal liability. Intent, lack of authority, the way the identity was used, and the available evidence must still be proved.

Upon conviction, computer-related identity theft ordinarily carries prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the Act provides for a penalty one degree lower. Other offenses may apply depending on what the account did.

For example, hacking the genuine account may constitute illegal access; manipulating computer data to cause loss may constitute computer-related fraud; and using an impersonation account for deceit, threats, extortion, defamatory publication, sexual harassment, or intimate-image abuse may engage the Revised Penal Code or another special law. Gender-based online sexual harassment can include impersonating a victim online when the statutory circumstances under the Safe Spaces Act, Republic Act No. 11313, are present.

Preserve the evidence before reporting the account

A fake profile can be renamed, edited, blocked, or deleted within minutes. Save evidence before asking friends to mass-report it or confronting its operator.

Preserve the following where available:

Full screenshots of the profile, including the display name, username or handle, profile and cover photographs, biography, follower information, and date and time captured;
The exact profile URL and URLs of relevant posts, reels, stories, advertisements, comments, or listings;
Screenshots and exports of direct messages, including the participants, dates, times, attachments, and surrounding conversation;
A screen recording showing how you navigated from the platform to the account and relevant content;
Copies of emails, SMS messages, login alerts, password-reset notices, and security notifications;
Payment demands, bank or e-wallet account details, QR codes, receipts, transaction references, and the names of people who sent money;
Copies of the photographs, documents, or posts taken from your genuine account;
The platform’s acknowledgment, report number, and later takedown decision;
A dated chronology stating when you learned of the account, what it did, who was contacted, and what harm followed; and
Names and contact details of witnesses or recipients who are willing to provide their own screenshots and sworn statements.

Keep the original files. Do not crop, annotate, compress, or repeatedly forward the only copy. Make separate working copies if you need to mark important portions. Preserve the phone or computer on which relevant messages or security alerts were received, and do not factory-reset it while an investigation may require examination.

Do not circulate intimate images or child sexual material while gathering evidence. Preserve the URL, account information, dates, and surrounding messages, then show the material directly to trained investigators on the device. Unnecessary downloading or forwarding can compound the harm and create additional legal issues.

Secure yourself and warn likely targets

After preserving what you can:

Change the password of your email account first, followed by social media, banking, e-wallet, shopping, cloud-storage, and messaging accounts. Use unique passwords.
Enable multi-factor authentication, preferably through an authenticator app or passkey where available.
Review active sessions, recovery email addresses, phone numbers, connected applications, forwarding rules, and unfamiliar devices.
Sign out unknown sessions and revoke suspicious third-party access.
If your SIM may have been compromised, contact the telecommunications provider through its official channel.
Warn family, friends, employees, customers, or clients through a verified channel. Give them the exact fake handle and tell them not to send money, codes, IDs, or personal information.
If government IDs or financial details were exposed, notify the issuing agency or financial institution and follow its replacement, blocking, or fraud-monitoring procedure.

Do not negotiate with the impersonator, pay a supposed “takedown fee,” click links they send, or reveal additional information to prove your identity.

Report the account to the platform

Use the platform’s built-in Report function and select the option closest to “impersonation,” “pretending to be someone,” “fake account,” or “account compromise.” Report individual posts or messages as well when they involve scams, threats, sexual content, or other separate violations.

Official reporting pages include:

A platform may request proof of identity. Upload an ID only through the platform’s verified application or website, check the address carefully, and provide only what the official form requires. Never send an ID, selfie, password, or verification code to the fake account or to a person claiming privately to be platform support.

Removal can stop continuing harm, but it does not identify the operator or replace a criminal complaint. Save the account URL, evidence, and report confirmation even if the account disappears.

Report to Philippine cybercrime authorities

Republic Act No. 10175 designates the PNP and NBI as the principal law-enforcement authorities for cybercrime cases.

PNP Anti-Cybercrime Group

You may report through the nearest PNP-ACG office or the PNP-ACG Complaint Action Center. Current government-published contact numbers are:

(02) 8723-0401 local 7491
0961-829-8083
0915-589-8506

PNP rules direct personnel to attend to cybercrime reports received through walk-in, hotline, SMS, electronic complaint, referral, or other means and to refer them to an investigator. The PNP guidelines on reporting cybercrime incidents also emphasize that deleted accounts and delayed victim cooperation can prevent identification when relevant data is no longer available.

National Bureau of Investigation

You may go to the NBI Cybercrime Division or an appropriate regional cybercrime office. The NBI’s Citizen’s Charter for victims of computer crimes states that the service is open to the general public and has no fee. NBI personnel assist with the complaint sheet, preliminary interview, sworn statements, supporting documents, and examination of a relevant device. The NBI also publishes a regional and district office directory and its main contact page.

You do not need to know the offender’s legal name before reporting. Identify the respondent as unknown if necessary and provide every available lead: username, URLs, phone numbers, email addresses, payment accounts, transaction references, linked profiles, and names of recipients.

CICC hotline and reporting portal

For centralized intake or referral, call 1326 or use the CICC reporting portal. CICC can help route a cybercrime report, while investigation and the filing of charges may still be handled by the PNP, NBI, or prosecutors.

If you report to more than one office, disclose all earlier reports and reference numbers. This helps authorities coordinate and avoids inconsistent or duplicative complaints.

What to bring or submit

Prepare a folder containing:

A valid government-issued ID;
Your current contact details and address;
A short, chronological incident summary;
Printed and electronic copies of the evidence;
The genuine account’s URL and proof that the identity belongs to you;
The fake account’s exact URL, username, and any previous usernames;
A list of affected people and potential witnesses;
Proof of damage, such as lost funds, canceled transactions, business records, customer complaints, or expenses incurred;
Platform, bank, telecommunications-provider, or e-wallet report numbers; and
The device containing original messages or login alerts, if investigators request to examine it.

Tell the investigator clearly whether you merely want the incident recorded, want the account removed, or are willing to execute a sworn complaint and cooperate with an investigation. A police entry, CICC referral, platform report, and formal criminal complaint are not the same thing.

Why prompt reporting matters

Under Section 13 of Republic Act No. 10175, service providers must preserve traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, with a possible one-time six-month extension. These periods do not guarantee that a deleted post, story, message, or overseas-platform record will remain obtainable.

Subscriber information and other protected computer data are not ordinarily released directly to a victim. Under Section 14, disclosure for an officially docketed investigation requires a court warrant. The Rule on Cybercrime Warrants governs preservation, disclosure, interception, search, seizure, and examination of computer data.

Report promptly so investigators can assess whether a preservation request or warrant is necessary. Do not wait for the end of a supposed six-month period, and do not assume that reporting to the platform stops any legal prescriptive period.

If money was sent or an account was used

Contact the sending and receiving bank, e-wallet, card issuer, or payment service immediately through its official fraud channel. Ask it to:

Secure or block the affected account or instrument;
Record the transaction as disputed or fraudulent;
Attempt to hold, trace, or recover the funds where legally and operationally possible;
Preserve account and transaction records; and
Give you a complaint or case reference number.

The Bangko Sentral ng Pilipinas advises consumers to report identity theft and suspicious transactions immediately to the bank or financial institution. If the institution is BSP-supervised and its own complaint process does not resolve the matter, you may escalate through the BSP Consumer Assistance Mechanism. BSP assistance is a second-level recourse and does not replace a police or NBI complaint.

Reporting quickly improves the possibility of tracing or holding funds, but recovery is not guaranteed.

When a National Privacy Commission complaint may help

Consider the National Privacy Commission when the incident involves misuse, unauthorized processing, disclosure, or inadequate protection of personal data—particularly where an identifiable organization, platform, employer, lender, service provider, or other personal-information controller is involved. The Data Privacy Act of 2012 is not a substitute for a criminal identity-theft complaint or an urgent platform takedown request.

As a general rule, before filing with the NPC, you must notify the respondent or concerned entity in writing and allow it to address the privacy violation. You may proceed if it does not take timely or appropriate action or gives no response within 15 calendar days from receipt. The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm.

A formal NPC complaint must follow the prescribed form and content, be verified or use the complaint-assisted form, include evidence and proof of prior written notice, and generally be notarized. The NPC accepts filing personally, by registered mail, courier, or authorized email. Review the current NPC complaint mechanics and formal filing instructions before submission.

Common mistakes to avoid

Reporting or mass-reporting the account before saving its URL and contents;
Keeping only cropped screenshots that omit the username, date, or surrounding conversation;
Deleting messages, security alerts, or transaction records after blocking the account;
Factory-resetting a relevant device;
Assuming that a platform takedown automatically starts a police investigation;
Expecting police to obtain an IP address or subscriber identity without lawful process;
Publicly accusing or doxing a suspected person without reliable evidence;
Communicating with the impersonator in a way that alerts them to destroy evidence;
Sending an ID or verification code through unofficial forms or private messages;
Paying strangers who promise guaranteed tracing, arrest, or account removal; and
Abandoning the complaint after the account is removed when victims or witnesses still suffered loss.

When help is urgent

Seek immediate police assistance or call 911 if the account is linked to a credible threat of physical harm, stalking, abduction, or an unfolding emergency.

Report without delay when:

Money is currently being transferred;
Your genuine account, email, SIM, or financial account has been taken over;
The offender is demanding money or sexual material;
Intimate images or sexually explicit deepfakes are being threatened or distributed;
A child is being impersonated, groomed, exploited, or depicted sexually;
The account is publishing home addresses, live locations, IDs, or other information that creates a safety risk; or
The impersonator is contacting customers, employers, government offices, or financial institutions in your name.

For gender-based abuse, intimate-partner violence, or cases involving women or children, you may also ask for the PNP Women and Children Protection Desk. Tell investigators at once if a protection order, emergency safety plan, or specialized handling may be needed.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Report it as an unknown respondent and provide digital and financial leads. The operator’s identity may require platform cooperation, a preservation request, a subpoena where legally available, or a court-issued cybercrime warrant.

Is using my photograph enough to prove identity theft?

Not automatically. A photograph can be identifying information, but criminal liability depends on the complete circumstances—including intentional use, absence of authority, impersonation, purpose, and resulting or intended harm. Preserve and report the account even if the final legal classification is still uncertain.

Are screenshots admissible evidence?

Screenshots can be useful, but they may not be sufficient by themselves. URLs, original files, device data, witness testimony, platform records, transaction documents, and proof connecting the account to its operator can strengthen authentication and the overall case.

Should I report to the platform or the police first?

Preserve the evidence first. You may then report to the platform and authorities in parallel. If there is an immediate safety threat, active account takeover, sextortion, child exploitation, or ongoing financial loss, contact police and the relevant financial or telecommunications provider immediately.

Can a friend or relative file for me?

A friend can alert the platform or authorities, but the victim and direct witnesses will usually need to cooperate and execute sworn statements for a criminal case. For an NPC complaint, a representative generally needs a special power of attorney. A parent representing a minor may submit the child’s birth certificate; a guardian may need the relevant court order.

Does removal of the fake account end the case?

No. Removal may stop continuing harm, but it does not erase prior conduct or losses. Keep the evidence, takedown notice, and all official reference numbers, and ask the assigned investigator whether further affidavits or documents are required.

What if the account operator or platform is outside the Philippines?

Report the incident locally if it affects you in the Philippines. Philippine authorities may assess jurisdiction and seek international cooperation where legally available, but overseas records and cross-border processes can take longer. The outcome depends on the location of the parties, systems, evidence, and acts involved.

This article provides general Philippine legal information, not legal advice for a particular case. The correct offense, forum, deadlines, and remedies depend on the evidence and surrounding facts. Official legal and procedural sources were last checked on 10 August 2026.