Quick answer

If someone is pretending to be you, your business, or another person on social media, take these steps immediately:

Preserve the account and its activity as evidence before requesting removal.
Report the profile and each harmful post or message to the platform under “impersonation,” “fake account,” “fraud,” or the closest available category.
Secure your real accounts, email, mobile number, and financial accounts.
Report possible cybercrime to the PNP Anti-Cybercrime Group or NBI Cybercrime Division, especially if the account is deceiving people, soliciting money, threatening anyone, publishing private information, or using stolen credentials.
Contact your bank or e-wallet immediately if money, account credentials, or financial transactions are involved.
Consider a National Privacy Commission complaint when personal data was unlawfully collected, disclosed, or used, or when an organization failed to address a privacy violation.

A fake or anonymous account is not automatically a crime. The legal issue depends on what information was used, whether the use was authorized, what the account represented, and what harm or deception occurred.

When a fake account may amount to identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

An account may fall within this provision when, for example, it deliberately uses another person’s or organization’s identifying information to make users believe that the account is genuine. Relevant information may include a name, photograph, logo, contact details, identification document, account credentials, or a combination of details that identifies the victim.

The law does not make every duplicate name, anonymous profile, fan page, parody, or mistaken account criminal. Important questions include:

Did the account actually use identifying information belonging to someone else?
Was the use intentional and without permission or other lawful basis?
Was the account presented in a way intended to deceive?
Did anyone suffer damage, financial loss, reputational harm, threats, harassment, or unauthorized access?

The prosecution must prove the elements of the offense; the victim does not decide guilt merely by labeling an account “fake.” The Supreme Court upheld the computer-related identity-theft provision in Disini v. Secretary of Justice.

For computer-related identity theft, Republic Act No. 10175 provides imprisonment of prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law provides a penalty one degree lower. Actual charging and sentencing depend on the evidence and the court’s findings.

Other laws may apply to what the account does

The account’s conduct may support other complaints even when identity theft cannot be established. Depending on the facts, possible issues include:

Illegal access, if the offender entered your real account, email, phone, or computer system without right.
Computer-related forgery or fraud, if fabricated electronic data was meant to be accepted as authentic or was used in a fraudulent scheme.
Cyberlibel, if the account published defamatory allegations satisfying the legal elements of libel. A false profile by itself is not automatically cyberlibel.
Financial-account scamming, if deception was used to obtain credentials or control a bank, card, or e-wallet account. The Anti-Financial Account Scamming Act, Republic Act No. 12010, also penalizes specified money-muling and social-engineering activities.
Gender-based online sexual harassment, which can include online identity impersonation, cyberstalking, sexual threats, unauthorized sharing, and posting lies to harm a victim’s reputation when the statutory requirements are present. See the Safe Spaces Act, Republic Act No. 11313.
Photo or video voyeurism, when covered intimate recordings or images are taken, copied, distributed, or published under the circumstances prohibited by Republic Act No. 9995.
Online sexual abuse or exploitation of a child, or child sexual abuse or exploitation material, under Republic Act No. 11930.
Threats, extortion, estafa, falsification, or other offenses, depending on the messages, transactions, and purpose of the account.

These laws have different elements. The same incident should not be forced into every possible offense; investigators and prosecutors must match the evidence to the correct law.

Preserve evidence before seeking removal

A platform may remove an account quickly, which protects users but can also make publicly accessible evidence harder to recover. Capture what you can lawfully access before blocking the account or requesting takedown.

Preserve:

The profile’s complete URL, exact username or handle, display name, and visible account identifier.
Full-page screenshots showing the profile, browser address bar or app context, and date and time.
A screen recording that starts outside the account, opens the profile, and scrolls through relevant posts, comments, followers, contact details, and messages.
Direct URLs for each relevant post, image, video, advertisement, or message.
Uncropped copies of profile photographs, cover images, posts, stories, and advertisements.
Messages in their original conversation context, including sender, recipient, dates, and timestamps.
Email notices, login alerts, password-reset messages, and platform security notifications.
Platform report confirmations, case numbers, automated replies, and follow-up correspondence.
Names and contact details of people who received messages, paid money, or were misled.
Receipts, transaction reference numbers, destination account details, QR codes, phone numbers, and bank or e-wallet communications.
A short chronological account of when the profile was discovered, what it did, whom it contacted, and what action you took.
Proof that you are the person or authorized representative being impersonated, but disclose identification documents only through verified official channels.

Keep the original files. Do not crop, annotate, enhance, rename, or repeatedly re-save your only copy. Make a separate working copy if you need to highlight something. Retain the device on which important messages or login alerts were received, and ask witnesses to preserve their original copies.

Do not attempt to break into the fake account, obtain passwords, secretly intercept private communications, or publicly identify an unverified suspect. Those actions may be unlawful, expose innocent people, or damage the credibility of your evidence.

Report the account to the platform

From the fake profile, open the menu—usually represented by three dots or a “Share” button—and choose Report, followed by Impersonation, Pretending to be someone else, Fake account, or the closest available reason.

Use the platform’s dedicated form when available:

Report both the account and any separately reportable posts, advertisements, messages, or payment solicitations. Use the victim’s own account or the platform’s designated authorized-representative process whenever possible. Submit only the identification information the official form requires, and verify the site’s domain before uploading an ID.

Platform removal is separate from a criminal or privacy complaint. A removed profile may still be investigated if evidence and provider records remain available.

Report possible cybercrime to the PNP or NBI

Republic Act No. 10175 assigns cybercrime law enforcement to the Philippine National Police and National Bureau of Investigation. You may approach:

The PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the nearest police station for referral.
The NBI Cybercrime Division or an NBI regional or district office. The NBI provides an official online complaint page and office directory.
The Cybercrime Investigation and Coordinating Center, through the National Anti-Scam Hotline 1326 or 1326@dict.gov.ph, for assistance or referral. A CICC report may not replace the sworn complaint or personal appearance an investigating agency later requires.

The NBI Citizen’s Charter for computer-crime assistance states that a complainant may proceed to the Cybercrime Division, complete a complaint sheet, undergo an interview and initial investigation, execute sworn statements or submit prepared affidavits, and present relevant supporting documents or devices. The service is listed without a fee.

Bring or prepare:

A government-issued ID, if available.
A printed and digital copy of your evidence.
A clear timeline and list of affected persons.
Your real profile URL and the impersonating profile’s URL.
Copies of platform reports and responses.
Transaction records if money was requested or transferred.
Names and contact details of witnesses.
An affidavit or written narrative, if already prepared.

Tell the investigator precisely what you personally know. Separate facts from suspicions—for example, “This account sent my customer this message” rather than “I know my former employee created it” unless you have reliable evidence.

Ask for a copy or reference number for your complaint and the name or unit handling it. A police or barangay blotter can help document when an incident was reported, but it is not necessarily the same as a formal cybercrime investigation or complaint for prosecution.

Why prompt reporting matters

Under Section 13 of Republic Act No. 10175, service providers must preserve the integrity of traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, and law enforcement may order one extension for another six months.

This does not mean a victim can personally compel a platform to disclose subscriber information. Disclosure generally requires lawful process, including the applicable court-issued cybercrime warrant. Prompt reporting gives investigators an opportunity to consider preservation and warrant procedures before relevant records are lost under ordinary retention practices.

Ask the investigator whether a preservation request or cybercrime-warrant application should be considered. The decision and legal application belong to the authorized agency.

If money or financial credentials are involved

Contact your bank, card issuer, or e-wallet through its verified 24/7 fraud-reporting channel immediately. Do not wait for the platform or police to respond.

Provide:

Transaction reference number.
Amount, date, and time.
Source and destination accounts.
Recipient name as displayed.
Screenshots of the solicitation and payment instructions.
Police, NBI, or CICC reference number when available.

Under Republic Act No. 12010 and BSP Circular No. 1215, BSP-supervised institutions may temporarily hold funds involved in a qualifying disputed transaction and conduct coordinated verification. The initial holding under the BSP rules is generally no more than five calendar days; the total temporary-holding period may not exceed 30 calendar days unless extended by a court. A report does not guarantee that funds remain available or will be returned.

If the institution’s response is unsatisfactory, use the BSP Consumer Assistance channels as the second-level recourse after first complaining to the institution.

Change exposed passwords immediately, starting with the email account used for password recovery. Enable multi-factor authentication, sign out unknown sessions, review recovery information, and contact the mobile provider if your SIM or phone number may have been compromised.

When to involve the National Privacy Commission

The National Privacy Commission is appropriate when the incident involves a possible violation of the Data Privacy Act—for example, unauthorized processing or disclosure of personal data, misuse of an identification document, or an organization’s failure to protect or properly address the misuse of personal information.

The NPC is not a substitute for the PNP or NBI. It handles privacy violations and data breaches; law-enforcement agencies investigate crimes.

Before filing a formal NPC complaint, the 2021 NPC Rules of Procedure, as amended, generally require the complainant to:

Inform the personal information controller, processor, or concerned entity in writing about the violation or breach; and
Show that it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

Keep proof of delivery and the recipient’s response. The NPC may waive these requirements for good cause or for a serious violation or breach, including circumstances involving grave and irreparable damage, lack of an adequate remedy, or patently illegal action. Explain and prove the grounds if requesting a waiver.

A formal complaint must satisfy the NPC’s requirements, including verification, supporting evidence, relevant correspondence, and a certification against forum shopping. The NPC’s current instructions say to use its complaint form, have it notarized, and submit it personally, by courier, or by scanned email to the address stated on its formal complaint page. Check the current complaint mechanics and fee schedule before filing.

Protect other people without spreading the fake account

Warn people who are reasonably at risk, such as family members, customers, employees, or professional contacts. Keep the warning factual and limited:

State that the identified account is not authorized.
Link to your verified or genuine account.
Tell recipients not to send money, codes, credentials, or documents.
Give an official contact method for verification.
Ask recipients to preserve suspicious messages and report them privately.

Avoid publicly accusing a named person unless the identification is verified and publication is legally justified. Reposting the fake account’s defamatory, private, or intimate content may increase the harm and can create separate legal risks.

Common mistakes to avoid

Reporting before preserving evidence. The account may disappear before URLs, messages, and transaction details are recorded.
Keeping only cropped screenshots. Cropping can remove the username, URL, timestamp, and surrounding context needed to authenticate the material.
Deleting a hacked account immediately. Secure it first and preserve login notices, sessions, messages, and settings where safely possible.
Using unofficial recovery agents. Anyone asking for passwords, one-time PINs, recovery codes, remote access, or advance payment may be conducting another scam.
Paying an impersonator to remove the account. Payment may encourage further demands and does not guarantee deletion.
Confronting a threatening suspect. This can escalate danger and warn the offender to destroy evidence.
Mass-reporting without accurate information. Use truthful reports and the proper category; malicious financial reporting that causes funds to be held can itself be punishable under Republic Act No. 12010.
Assuming a platform report automatically starts a criminal case. File separately with the PNP or NBI when criminal conduct may be involved.
Forwarding intimate material or images of a child. Preserve the URL, account details, and report confirmation without redistributing the material. Follow law-enforcement instructions on handling any existing file.

Get urgent help when

Call 911 or go to the nearest police station immediately if there is a credible threat of physical harm, stalking at your home or workplace, coercion, an abduction threat, or an emergency involving a child.

Make an urgent PNP or NBI report when the account:

Is actively soliciting or receiving money.
Has taken over your email, phone, bank, or e-wallet.
Is publishing your address, workplace, travel details, or identification documents.
Is threatening violence, blackmail, or release of intimate material.
Is contacting a child for sexual purposes.
Is distributing intimate images, sexual deepfakes, or child sexual abuse or exploitation material.
Is impersonating an official, business, professional, or family member to defraud others.
Is rapidly deleting posts, changing usernames, or moving victims to other accounts.

Consult a Philippine lawyer promptly if you need an injunction, damages, advice on a prosecutor’s complaint, representation in an NPC case, or help responding to a subpoena, counter-complaint, or legal demand. Legal advice is particularly important when the suspect’s identity is disputed or publication, employment, family, or business records are involved.

Frequently asked questions

Can I report the account if I do not know who created it?

Yes. Give investigators the username, complete URL, account identifiers, messages, phone numbers, payment details, and every other reliable lead. Do not guess the offender’s identity. Lawful disclosure of subscriber information may require a cybercrime warrant or other authorized process.

Is using my photograph automatically identity theft?

Not necessarily. The context, intent, authority, identifying effect, and surrounding conduct matter. Unauthorized use may also raise privacy, harassment, intellectual-property, or civil-law issues even when the criminal elements of identity theft are not established.

Do I need a lawyer to make the initial report?

Generally, you may report directly to the platform, PNP, NBI, CICC, bank, or e-wallet without a lawyer. Counsel becomes especially useful for formal affidavits, an NPC case, disputed identification, extensive financial loss, urgent court relief, or related civil and criminal proceedings.

Should I message the fake account and demand deletion?

Only if doing so is safe and strategically appropriate. Do not confront an account making threats or extortion demands. For an NPC complaint, written notice to the concerned entity is generally required, but this can often be sent through the platform’s official reporting or privacy channel. Preserve proof of receipt. The NPC may waive prior notice in qualifying serious cases.

Can I ask the platform to reveal the account owner?

You may ask, but platforms generally will not disclose protected subscriber data to a private complainant merely upon request. Investigators can pursue disclosure through the legal procedures and court warrants applicable to computer data.

What if the platform removes the account before police investigate?

Deletion does not automatically end the matter. Your preserved evidence, witness copies, transaction records, and provider-held data may still be relevant. Give investigators the removed account’s former URL, username, report number, and approximate dates of activity.

Is there one deadline for all identity-theft reports?

No. Criminal prescription, platform retention, financial-dispute procedures, and NPC requirements are different. Do not wait for the outer legal deadline. Platform and provider records can disappear, and disputed funds can be transferred quickly. For an NPC complaint, remember the general 15-calendar-day response period after written notice, subject to the NPC’s waiver rules.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and legal conclusions can depend on the evidence, platform, parties, and documents involved. Official sources and reporting information were checked as of August 2, 2026.