Quick answer

If someone is using your name, photos, personal details, or organization’s identity through a fake social media account, act immediately:

Preserve the account, posts, messages, links, and transaction records before they disappear.
Secure your email, social media, mobile number, and financial accounts.
Report the impersonating profile and its harmful content through the platform’s official reporting tools.
Report suspected criminal conduct to the NBI Cybercrime Division or the PNP’s nearest anti-cybercrime unit.
If personal data was unlawfully processed or disclosed, consider a separate complaint with the National Privacy Commission (NPC).
Contact the affected bank or e-wallet immediately if money or account access is involved. Call 911 if there is an immediate threat to life or safety.

A “fake account” is not automatically a crime simply because it uses an invented identity, a similar name, or satire. It may become computer-related identity theft when someone intentionally acquires, uses, misuses, transfers, possesses, alters, or deletes another person’s identifying information, without right, through a computer system. Fraud, threats, defamatory posts, unauthorized data processing, and other acts may create additional liability depending on the evidence.

What Philippine law covers

Computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, without right.

“Identifying information” can include a name or number that, alone or together with other information, identifies a specific person. Whether a particular username, photograph, business name, phone number, or combination of details satisfies the law depends on how it was used and the surrounding evidence.

For offenses under Section 4(b), the law provides imprisonment of prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000, up to an amount commensurate with the damage, or both. If identity theft has not yet caused damage, the law provides for a penalty one degree lower. The Supreme Court upheld the identity-theft provision in Disini v. Secretary of Justice.

The following distinctions matter:

An account openly identified as parody, commentary, or fan content is not automatically identity theft.
Merely sharing a name with someone is not enough by itself.
A deceptive account that copies a person’s identity and contacts friends for money presents a much stronger identity-theft and fraud issue.
Proof of financial loss is not necessarily required before identity theft can be reported, although actual damage affects the applicable penalty and may support other charges.
The account owner’s intent and whether the use was “without right” remain factual questions for investigators, prosecutors, and courts.

Other offenses may apply

Depending on what the account did, authorities may also examine:

Estafa or computer-related fraud, if deception caused—or was intended to cause—financial loss;
Forgery or falsification, if fabricated electronic records or documents were made or used dishonestly;
Cyberlibel, if the account published a legally defamatory imputation through a computer system;
Threats, coercion, extortion, or harassment, when supported by the required elements;
Unauthorized access, if the offender took over an existing account or entered a system without authority; or
Violations of special laws involving children, sexual exploitation, intimate images, stalking, banking, or financial accounts.

These are not interchangeable labels. For example, an insulting fake profile is not necessarily cyberlibel, and an impersonating account is not necessarily estafa unless the required deception, reliance, and damage can be established. Describe the conduct and evidence accurately instead of choosing charges yourself.

Data Privacy Act implications

Using another person’s name, image, contact information, identification document, or other personal data may also raise issues under the Data Privacy Act of 2012, Republic Act No. 10173. The Act regulates unauthorized processing and processing for unauthorized purposes, among other violations.

NPC jurisdiction is not automatic in every personal dispute. It depends on the type of data, the processing involved, the respondent’s role, applicable lawful bases, statutory exclusions, and other facts. An NPC complaint is also separate from a criminal complaint filed with law enforcement.

What to preserve before reporting the account

Capture evidence before blocking the account or requesting its removal. A takedown may protect you, but it can also make publicly visible evidence harder to retrieve.

Preserve:

The complete profile URL, not just the display name;
The username, account handle, profile or page ID if visible, and profile description;
Full-page screenshots and a screen recording showing how you reached the profile;
Each relevant post, story, reel, advertisement, comment, or message;
The direct URL of each post or piece of content;
Visible dates and times, including your device’s date and time;
Messages sent to you, relatives, customers, coworkers, or friends;
Phone numbers, email addresses, payment links, QR codes, bank or e-wallet details, and delivery addresses used by the offender;
Receipts, transaction reference numbers, statements, and notices of unauthorized transactions;
Platform report confirmations and ticket numbers;
Emails or text messages about password resets, logins, or account changes;
Names and contact details of witnesses or recipients of the impersonator’s messages; and
A short chronology stating when the account was discovered and what happened afterward.

Keep the original files. Avoid cropping, annotating, filtering, or repeatedly re-saving the only copy. Store a backup in a separate secure location. If possible, export the relevant conversation through the platform without deleting anything.

Electronic records are not automatically accepted merely because they appear in a screenshot. Their authenticity, integrity, reliability, source, and context may have to be established under the Supreme Court’s Rules on Electronic Evidence. Record who captured the evidence, when it was captured, what device was used, and whether the files were altered.

Do not hack the account, install spyware, impersonate the suspect, publish the suspect’s private information, or threaten retaliation. Those actions may be unlawful and may compromise the investigation.

Secure your accounts and warn likely targets

If the fake account may have been created using information taken from a compromised account:

Change the password of your email account first, then your social media and financial accounts.
Use a clean, updated device where possible.
Enable multi-factor authentication, preferably through an authenticator app or another secure method.
Review active sessions and sign out unfamiliar devices.
Remove unknown connected applications and review recovery email addresses and phone numbers.
Save evidence of suspicious logins before deleting sessions.
Contact your mobile provider if your SIM suddenly stops working or you suspect SIM takeover.
Tell close contacts, customers, or coworkers not to send money, disclose one-time passwords, or follow payment instructions from the fake account.

A brief warning from your genuine account can help, but do not repost the impersonator’s private information or unverified accusations. State the fake account’s exact handle and advise people to report it.

Report the account to the social media platform

Use the platform’s impersonation category when available. Report both the account and any individual posts, messages, advertisements, or payment solicitations that violate separate rules.

Official reporting pages include:

The platform may request identification to verify that you are the person being impersonated. Submit identification only through the platform’s verified app, website, or help center. Redact information only if the official form permits it; never post your ID publicly or send it to the impersonating account.

Save the report number, confirmation email, date, and time. If the first report is rejected, review the stated reason and appeal through the official process with clearer links and evidence. Having several friends mass-report the profile is not a substitute for a complete report from the person being impersonated.

A platform report may result in removal or restriction, but it is not a criminal complaint and does not guarantee that subscriber information will be disclosed. Platforms generally release protected account information only through valid legal processes or applicable emergency procedures.

Report suspected crime to law enforcement

NBI Cybercrime Division

The NBI’s official procedure allows members of the public to seek investigative assistance from its Cybercrime Division. The process may include a preliminary interview, completion of a sworn complaint sheet, sworn statements from the complainant and witnesses, submission of supporting documents, and examination of a relevant device.

You may:

Use the NBI Online Complaint page;
Go to the NBI Cybercrime Division or an appropriate NBI regional or district office; or
Consult the NBI’s official Cybercrime Division procedure.

The NBI lists ccd@nbi.gov.ph for its Cybercrime Division on its official divisions directory. Verify contact details on the NBI website before sending sensitive documents.

An online submission may begin the referral or assessment process, but be prepared to appear, identify your evidence, execute a sworn statement, and present the device containing the original records.

PNP anti-cybercrime units

You may also go to the nearest PNP station and ask for referral to the appropriate anti-cybercrime unit or the Philippine National Police Anti-Cybercrime Group. Bring your identification, evidence folder, chronology, and details of any financial transactions.

A blotter entry records an incident but may not by itself complete a criminal complaint. Ask:

Whether you need to execute a complaint-affidavit or sworn statement;
Which investigator and office will handle the case;
What reference or case number has been assigned;
Whether your device must be examined; and
How to submit additional evidence without altering the originals.

The DOJ Office of Cybercrime can also act on complaints and referrals concerning cybercrime. Its current contact information is available on the DOJ Office of Cybercrime website.

Why prompt reporting matters

Philippine law provides mechanisms for preserving, disclosing, searching, seizing, and examining computer data through law-enforcement orders and cybercrime warrants. Some provider-held traffic data and subscriber information are subject to statutory retention or preservation periods, but data may still be overwritten, deleted, or become difficult to trace.

Do not wait for a platform’s final decision before reporting an ongoing scam, threat, account takeover, or financial loss. Different offenses also have different prescriptive periods, so there is no single safe deadline for every fake-account case.

When to file with the National Privacy Commission

Consider an NPC complaint when the incident involves a privacy violation or personal data breach within the Data Privacy Act—for example, an organization unlawfully disclosed information later used for impersonation, or a covered person or entity refuses to address unlawful processing.

Under the 2021 NPC Rules of Procedure, as amended, the usual rule is that the complainant must first:

Inform the personal information controller, personal information processor, or concerned entity of the violation in writing; and
Show that it failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. Waiver is discretionary and should not be assumed.

A formal NPC complaint generally must be written, signed, verified, and supported by the material facts, evidence, correspondence with the respondent, requested relief, and a certification against forum shopping. It must ordinarily be notarized. The NPC provides the current complaint form and filing instructions, including filing in person, by courier, or by authorized email transmission. Filing fees may apply, subject to the exemptions and possible waiver stated in the rules.

If another action involving the same issues is later filed or discovered, the NPC rules require the complainant to report that fact within five calendar days. Obtain legal advice if parallel criminal, civil, or administrative proceedings are contemplated.

If money or a financial account is involved

Report an unauthorized or fraudulent transaction to the bank, e-wallet, card issuer, or other financial institution immediately through its official fraud channel. Ask it to:

Secure or temporarily restrict the affected account;
Record the transaction as disputed;
Preserve transaction and access records;
Provide a complaint or reference number; and
Explain the documents and deadlines under its dispute process.

Do not rely solely on a social media report or police complaint. Financial institutions have their own security and dispute procedures, and delay may reduce the available protective options.

If the institution does not resolve the concern, follow the Bangko Sentral ng Pilipinas process. BSP guidance requires consumers to raise the matter first through the institution’s financial consumer assistance mechanism before escalating it through the BSP Consumer Assistance Mechanism.

Never send an additional “verification payment,” “recovery fee,” or one-time password to someone claiming they can return the money.

Common mistakes to avoid

Reporting before saving evidence. The account or content may disappear immediately.
Saving only screenshots. Preserve URLs, usernames, timestamps, original messages, transaction records, and witnesses.
Assuming a takedown identifies the offender. Platform removal and law-enforcement identification are separate processes.
Sending IDs through messages or unofficial forms. Use only verified government or platform channels.
Confronting the operator. This can trigger deletion of evidence, retaliation, or further deception.
Calling every fake account “identity theft.” Focus on the exact conduct, information used, deception, and resulting harm.
Paying a scammer to stop. Preserve the demand and report it instead.
Deleting a compromised account immediately. Secure it and preserve its records first, unless continued access presents an immediate safety risk.
Editing the only evidence copy. Keep the original files and work from duplicates.
Treating a police blotter as the entire case. Confirm whether a sworn complaint and supporting evidence have been formally received.

When help is urgent

Call the nationwide emergency hotline 911 when there is a crime in progress or an immediate threat to life or safety. Seek prompt law-enforcement and legal assistance when the impersonator:

Threatens violence, kidnapping, sexual harm, or self-harm;
Targets a child or circulates child sexual abuse or exploitation material;
Demands money under threat of releasing intimate images or private data;
Has taken over your email, mobile number, bank, or e-wallet account;
Is actively collecting money from victims;
Uses fabricated government, court, medical, or financial documents;
Publishes your address or real-time location;
Impersonates a public official, business, school, or regulated professional in a way that puts others at risk; or
Continues creating replacement accounts after takedowns.

A lawyer can help when the operator is known, large losses occurred, several jurisdictions are involved, a preservation request may be needed, or you are considering criminal, civil, and NPC proceedings at the same time.

Frequently asked questions

Can I report a fake account even if no one has lost money?

Yes. You may report impersonation to the platform and give the evidence to law enforcement. Under the Cybercrime Prevention Act, lack of damage affects the penalty for computer-related identity theft but does not necessarily prevent investigation of the underlying conduct.

Is using my photograph enough to prove identity theft?

Not automatically. Investigators will consider the photograph together with the name, profile details, messages, purpose, intent, authority, and other identifying information. Preserve the complete context.

Should I message the fake account before reporting it?

Usually no. Contact may warn the operator and cause evidence to be deleted. Preserve the account and report it through official channels. Follow an investigator’s advice if controlled communication is necessary.

Can I ask the platform for the offender’s name or IP address?

You may ask, but platforms ordinarily will not disclose protected subscriber or traffic information directly to a private complainant. Law enforcement may seek preservation or disclosure through the legal process required by Philippine law and the platform’s applicable procedures.

Can a friend or relative file for me?

A friend can help preserve and report content, but formal complaints may require your own sworn statement. For an NPC complaint, a representative generally needs a special power of attorney. Parents may represent a minor with proof of relationship, while a guardian must present the required court order.

What if the offender is abroad?

Report the matter in the Philippines and give investigators every available account, payment, and location detail. Cross-border identification and evidence requests require official processes and may take longer. Do not assume that an overseas account is beyond investigation.

Does an NPC complaint replace an NBI or PNP complaint?

No. The NPC addresses Data Privacy Act matters. The NBI and PNP investigate possible crimes. The same incident may justify more than one process, but jurisdiction, evidence, filing requirements, and remedies differ.

How long should I keep the evidence?

Keep it securely for as long as the platform report, financial dispute, investigation, prosecution, or related civil or administrative proceeding remains possible or pending. Do not dispose of the original device or files without first consulting the investigator or lawyer handling the matter.

Official legal and reporting resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The applicable offense, venue, remedy, and filing requirements depend on the evidence and circumstances. Laws, rules, agency procedures, and official reporting channels were checked against available primary and official sources as of 3 August 2026.