How to Report Identity Theft and Fake Social Media Accounts

Quick answer

If someone creates a fake Facebook, Instagram, TikTok, X, messaging, or other social-media account using your name, photographs, contact details, or other identifying information without authority, the conduct may amount to computer-related identity theft under Republic Act No. 10175, the Cybercrime Prevention Act of 2012. The law covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. It applies to identifying information belonging to both individuals and juridical persons such as corporations. (Lawphil)

But the existence of a fake or duplicate account does not automatically establish a crime or identify who created it. The circumstances matter. A parody, fan account, account with a coincidentally similar name, or another account that does not unlawfully use another person's identifying information may present a different legal issue. The prosecution must also ultimately establish who controlled or accessed the offending account and who authored the relevant posts or messages. The Supreme Court has specifically recognized how easily fake social-media accounts can be created and has required reliable direct or circumstantial evidence linking an accused person to an account or its contents. (eLibrary)

If you discover an account impersonating you, the safest course is to preserve the evidence first, report the account to the platform, secure your legitimate accounts, and promptly report serious impersonation to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI CyberCrime Division. The Cybercrime Investigation and Coordinating Center (CICC) also accepts cybercrime reports and operates Hotline 1326. (PNP ACG)

When a fake social-media account may amount to identity theft

Section 4(b)(3) of R.A. No. 10175 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or juridical entity, without right. (Lawphil)

The implementing rules define identifying information broadly. It can include a person's name, date of birth, driver's license or passport number, tax identification number, biometric information, electronic identification numbers or addresses, routing codes, telecommunications information, and access-device information. (eLibrary)

The Supreme Court, in Disini v. Secretary of Justice, also observed that ordinary identifying information can include a person's name, citizenship, residence address, contact number, place and date of birth, spouse's name, occupation, and similar information. The Court upheld the constitutionality of the computer-related identity-theft provision. (eLibrary)

Examples that may justify investigation include a person who:

• creates an account in your name and uses your photograph while pretending to be you;
• messages your relatives, clients, employees, or friends while representing that the messages came from you;
• uses your identity to solicit money, obtain loans, sell products, collect payments, or induce transfers;
• creates a fake company page that impersonates an actual business;
• uses copies of your identification documents or other personal information to establish online accounts;
• changes an account's identity information after gaining unauthorized access; or
• uses an impersonation account to threaten, harass, defraud, or damage you.

The precise criminal charge depends on what actually happened. Impersonation may exist alongside other offenses—for example, computer-related fraud, offenses committed through information and communications technology, cyberlibel, or other special-law violations—if their separate legal elements are proved. R.A. No. 10175 itself recognizes that cybercrime liability may coexist with liability under the Revised Penal Code or other special laws, subject to applicable constitutional and statutory limitations. (Lawphil)

A fake account is evidence, not proof of who made it

Do not assume that knowing who dislikes you—or even recognizing the photographs, wording, or personal information used by an account—is enough to prove who operates it.

In a recent Supreme Court decision involving Facebook evidence, the Court emphasized the ease with which dummy accounts can be created and provided guideposts for establishing ownership of or access to a social-media account and authorship of posts or messages. Account ownership, access, and authorship may be established through direct or circumstantial evidence, but they must actually be proved. (eLibrary)

This distinction is especially important when the suspect denies creating the account. Investigators may need information that an ordinary user cannot obtain, such as subscriber information, login records, traffic data, linked email addresses, or other provider-held information.

Under R.A. No. 10175, law-enforcement authorities can require preservation of relevant computer data. Disclosure of subscriber information, traffic data, or other relevant data generally requires a court warrant and must relate to a valid complaint officially docketed and assigned for investigation. Once the proper warrant and disclosure order are served, the law requires the person or service provider concerned to submit the specified data within the statutory period. (eLibrary)

The Supreme Court has likewise confirmed that the Rule on Cybercrime Warrants provides the mechanism through which investigators may obtain relevant computer data using judicially issued warrants. (eLibrary)

That is one reason prompt formal reporting can be more important than trying to identify the offender yourself.

What to do immediately after discovering the fake account

1. Preserve the account before trying to have it removed

Take evidence while the account, posts, messages, comments, or advertisements are still visible.

Preserve, where available:

• the complete profile URL;
• username or handle;
• display name;
• profile and cover photographs;
• account or page ID if visible;
• screenshots of the entire profile;
• screenshots of posts, comments, stories, advertisements, or messages;
• dates and times shown on the platform;
• names of people contacted by the fake account;
• URLs of individual posts;
• messages sent to victims or witnesses;
• phone numbers, email addresses, bank accounts, e-wallet numbers, QR codes, or payment instructions used;
• transaction receipts if anybody sent money;
• security alerts or login notifications received on your real account; and
• the platform's acknowledgment or reference number after you report the account.

Whenever practical, retain the original electronic files and make a screen recording showing how you navigated from the account profile to the offending posts or messages. Avoid relying only on heavily cropped screenshots.

Electronic evidence can be admitted in Philippine proceedings, but authenticity remains important. Under the Rules on Electronic Evidence, the person relying on a private electronic document bears the burden of establishing its authenticity, including through evidence demonstrating its integrity and reliability. The Supreme Court has specifically reiterated that screenshots are not automatically exempt from authentication requirements. (Lawphil)

2. Do not alter or destroy evidence

Do not edit screenshots to remove inconvenient portions, delete relevant conversations, or discard the device on which messages were received.

You can create working copies for sharing, but preserve an untouched version whenever possible.

Also avoid trying to hack the fake account, guess its password, seize control of it, or retaliate by creating another impersonation account. Unauthorized access to a computer system is itself regulated by the Cybercrime Prevention Act. (Lawphil)

3. Report the impersonation to the social-media platform

Use the platform's official reporting mechanism for impersonation, fake accounts, scams, harassment, or compromised accounts.

Where possible:

1. report the specific profile;
2. separately report fraudulent posts or messages;
3. state that the account is impersonating you or your organization;
4. provide identification only through the platform's legitimate verification process; and
5. save the acknowledgment email, ticket number, or screenshot showing that the report was submitted.

Platform removal and a criminal investigation are different processes. Having an account removed does not necessarily identify its operator or determine criminal liability.

4. Secure your legitimate accounts

If there is any possibility that the offender obtained information by accessing your real account:

• change your password using a trusted device;
• use a password that is not reused elsewhere;
• activate multi-factor authentication;
• review logged-in devices and sessions;
• remove unfamiliar recovery emails or phone numbers;
• inspect connected applications;
• secure the email account attached to your social-media accounts; and
• change passwords on other services if the same credentials were reused.

If your genuine account was actually taken over, use the platform's compromised-account recovery procedure in addition to reporting the impersonator.

5. Warn people who may be targeted

If the fake account is soliciting money or contacting your clients, relatives, employees, customers, or friends, publish a measured warning through your legitimate channels.

State enough to prevent further harm without publicly accusing a particular person unless you have reliable evidence. A false public accusation can create separate legal problems.

If money has already been transferred, preserve the transaction details and contact the relevant bank or e-wallet provider immediately as well as law enforcement.

Where to report identity theft in the Philippines

PNP Anti-Cybercrime Group

R.A. No. 10175 designates the PNP and NBI as the principal law-enforcement authorities responsible for enforcing the Cybercrime Prevention Act. (Lawphil)

The PNP-ACG maintains regional and district cybercrime units throughout the country. Its current official contact directory lists the Cyber Response Unit's complaint email as complaint@acg.pnp.gov.ph and publishes contact details for regional Anti-Cybercrime Units and local Cyber Response Teams. (PNP ACG)

When reporting, bring or submit a concise chronological statement together with the evidence you preserved.

NBI CyberCrime Division

The NBI's current Citizen's Charter provides an investigative-assistance process for victims of computer crimes. A complainant may proceed to the CyberCrime Division to file a complaint or request an investigation. The process may involve completion of a complaint sheet, a preliminary interview, sworn statements from the complainant or witnesses, submission of supporting documents, and examination of devices relevant to the investigation. The NBI states that the same procedure may apply to cases handled by its regional cybercrime centers. (National Bureau of Investigation)

The NBI also publishes current contact information and locations for its main, regional, and district offices. (National Bureau of Investigation)

CICC Hotline 1326

The Cybercrime Investigation and Coordinating Center maintains Hotline 1326 for cybercrime and online-scam reporting. CICC materials also list report@cicc.gov.ph as a reporting channel. (CICC)

CICC can therefore be an additional reporting channel, particularly when impersonation is being used for online fraud. For a criminal investigation requiring cybercrime warrants or formal law-enforcement action, the PNP-ACG and NBI remain particularly important because R.A. No. 10175 expressly assigns them law-enforcement responsibilities. (Lawphil)

What should your complaint contain?

Prepare a simple chronological narrative rather than merely submitting a folder of screenshots.

Identify:

• who you are;
• which account is genuinely yours;
• the URL and identifying details of the fake account;
• when you first discovered it;
• what personal information was copied;
• what the fake account claimed to be;
• whom it contacted;
• what posts or messages it made;
• whether it asked for money or information;
• whether anybody relied on the impersonation;
• whether there was financial or reputational harm;
• whether there are threats, harassment, stalking, or sexual content;
• the identity of any suspected operator and, importantly, the factual basis for that suspicion; and
• the witnesses, documents, devices, and electronic records available.

Separate what you personally know from what another person merely told you.

If a friend received messages from the fake account, preserve that person's screenshots and ask the person to retain the original conversation. Investigators may later need the recipient's testimony or device.

Why reporting promptly matters

Computer evidence can be deleted, accounts can be deactivated, usernames can change, and messages may disappear. The Supreme Court has expressly acknowledged that Facebook accounts, posts, and private messages can be deleted and that dummy accounts can readily be created. (eLibrary)

R.A. No. 10175 therefore contains specific preservation rules. Subscriber information and traffic data must generally be preserved by service providers for at least six months from the transaction, while content data must be preserved for six months from receipt of a law-enforcement preservation order. Law enforcement may order a one-time extension for another six months. Where preserved computer data is used as evidence and the required transmittal to the prosecutor is furnished to the provider, preservation may continue until termination of the case. (eLibrary)

A victim does not personally issue these statutory preservation orders. Promptly giving investigators the exact URLs, usernames, dates, account identifiers, and other available information helps them determine what data should be preserved and whether a cybercrime warrant should be sought.

Is barangay conciliation required first?

For a complaint specifically involving computer-related identity theft under Section 4(b)(3) of R.A. No. 10175, prior barangay conciliation is not required merely because the parties happen to live in the same municipality.

The Local Government Code excludes from the Katarungang Pambarangay system offenses punishable by imprisonment exceeding one year or a fine exceeding ₱5,000. Computer-related identity theft carries penalties substantially above those limits. (Lawphil)

Different rules may apply if the controversy involves separate, lesser offenses or purely civil claims, so the characterization of the actual complaint still matters.

What is the penalty for computer-related identity theft?

Under Sections 4(b)(3) and 8 of R.A. No. 10175, computer-related identity theft generally carries prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. The identity-theft provision further states that when no damage has yet been caused, the penalty imposable is one degree lower. (Lawphil)

The precise penalty in a particular case depends on the charge proved, the facts found by the court, and whether additional or different offenses are involved.

What if the fake account is being used to harass or sexually target someone?

A separate law may apply.

The Safe Spaces Act, R.A. No. 11313, expressly includes online identity theft and online impersonation within its provisions on gender-based online sexual harassment when the surrounding conduct falls within the statute. Section 12 covers, among other conduct, online threats, cyberstalking, unauthorized sharing of specified material, impersonating a victim's identity online, and posting lies about a victim to damage reputation in the context addressed by the law. (Lawphil)

The law specifically assigns the PNP Anti-Cybercrime Group responsibility for receiving complaints of gender-based online sexual harassment. (Lawphil)

This does not mean every fake account is automatically a Safe Spaces Act offense. The facts must satisfy that law's particular requirements.

When the National Privacy Commission may also be relevant

A fake account is primarily a cybercrime issue when it involves criminal identity theft, fraud, harassment, or related conduct. But a separate data-privacy issue may arise when personal information has been unlawfully collected, processed, disclosed, or otherwise mishandled—for example, where an organization holding your personal information improperly disclosed it and that information was then misused.

The Data Privacy Act gives data subjects the right to complain to the National Privacy Commission concerning violations affecting their personal information. (Privacy Commission)

NPC proceedings have their own procedural requirements. Under the NPC's current complaint guidance, a complainant generally must first inform the respondent in writing of the alleged privacy violation and allow an opportunity to address it. Ordinarily, the NPC requires proof that the respondent failed to take timely or appropriate action or failed to respond within 15 calendar days, subject to exceptions recognized under the NPC rules. Formal complaints must comply with the NPC's prescribed form and evidentiary requirements. (Privacy Commission)

That NPC exhaustion requirement is not a prerequisite to reporting suspected computer-related identity theft to the PNP or NBI. These are separate remedies with different purposes.

Common mistakes to avoid

Reporting only after the fake account disappears. Preserve evidence before requesting removal whenever doing so is safe.

Submitting only a cropped profile photo. Capture the URL, username, posts, messages, dates, and surrounding context.

Assuming the identity of the offender. Explain why you suspect somebody, but distinguish evidence from speculation.

Deleting your own conversations. Messages received from the offender may become important evidence.

Editing screenshots. Keep original copies and avoid annotations on the only copy you have.

Publicly naming a suspected offender without adequate evidence. This may complicate the dispute and could create separate legal exposure.

Paying an impersonator to stop. If the offender is demanding money, preserve the demand and seek law-enforcement assistance.

Thinking a platform takedown ends the case. Account removal addresses the platform account; it does not by itself determine who created it or whether a crime occurred.

Waiting for a barangay certificate before reporting serious identity theft. Computer-related identity theft carries penalties outside the ordinary Katarungang Pambarangay threshold. (Lawphil)

When legal or police help is urgent

Seek immediate law-enforcement assistance rather than relying solely on a platform report when the fake account is:

• threatening physical harm;
• demanding money or property;
• extorting you;
• actively deceiving people into sending money;
• using stolen identification documents;
• accessing or attempting to access your real accounts;
• publishing private or sexual material;
• targeting a child;
• stalking you or revealing your location;
• impersonating you in communications with banks, employers, clients, government agencies, or business partners; or
• continuing to cause substantial financial, professional, or reputational damage.

If money or financial credentials are involved, notify the affected bank, e-wallet, card issuer, or other financial institution immediately in addition to reporting the cybercrime.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. The inability to identify the operator yourself is not a reason to abandon the complaint. Provide the account URLs, usernames, screenshots, messages, witnesses, and any other identifying clues available. Investigators can determine whether legal grounds exist to seek provider-held information through the procedures established by R.A. No. 10175 and the Rule on Cybercrime Warrants. (eLibrary)

Is using my picture enough to constitute identity theft?

Not automatically. The complete circumstances must be examined. R.A. No. 10175 concerns the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. The use of your name, photograph, contact information, or other identifying details to represent that another account is actually you can be highly relevant, but criminal liability remains dependent on proof of the statutory requirements. (Lawphil)

What if the person says the account is only a parody?

Calling an account a parody does not automatically create immunity, but neither does every account using a similar name amount to identity theft. Investigators and ultimately the courts must examine what identifying information was used, whether the use was without right, what the account represented to others, and what conduct accompanied it.

Should I report the account to Facebook or another platform before going to the police?

You can normally do both. Preserve the evidence before requesting takedown whenever possible. If there are threats, extortion, ongoing fraud, compromised accounts, or danger to a person, do not delay law-enforcement reporting merely while waiting for the platform to respond.

Can screenshots be used as evidence?

Yes, electronic documents are recognized by Philippine law, but screenshots must still satisfy applicable rules on admissibility and authentication. Preserve complete, reliable copies and retain the device and underlying conversations where possible. (Lawphil)

Can the police obtain information identifying the person behind the account?

Potentially. R.A. No. 10175 and the Rule on Cybercrime Warrants provide procedures for obtaining subscriber information, traffic data, and other relevant computer data. Disclosure generally requires judicial authorization and a valid complaint under investigation; it is not something a private complainant can compel merely by demanding the information from the platform. (eLibrary)

What if no one has lost money yet?

The absence of completed financial loss does not necessarily make the matter legally irrelevant. Section 4(b)(3) itself expressly addresses computer-related identity theft where no damage has yet been caused and provides for a lower penalty in that circumstance. (Lawphil)

Official sources and reporting information

• Cybercrime Prevention Act of 2012 — R.A. No. 10175: Official text on Lawphil
• Supreme Court decision in Disini v. Secretary of Justice: Supreme Court E-Library decision
• Rules and Regulations Implementing R.A. No. 10175: Supreme Court E-Library copy
• PNP Anti-Cybercrime Group contact directory: PNP-ACG official contact page
• NBI investigative assistance for computer-crime victims: NBI CyberCrime Division Citizen's Charter
• CICC cybercrime reporting information: Cybercrime Investigation and Coordinating Center
• National Privacy Commission complaint guidance: NPC mechanics for complaints
• Safe Spaces Act — R.A. No. 11313: Official text on Lawphil
• Rules on Electronic Evidence — A.M. No. 01-7-01-SC: Supreme Court rules on Lawphil

This article provides general Philippine legal information and is not a substitute for advice based on the specific facts, documents, electronic evidence, and procedural posture of an individual case. Laws, agency procedures, contact details, and platform processes can change. Sources and procedures were checked as of August 25, 2026.