Quick answer

Preserve the evidence before the account or posts disappear, then report the profile and each harmful post or message through the platform’s impersonation tools. If someone is using your identity without authority—especially to scam people, access accounts, threaten you, damage your reputation, or obtain money—also report the incident promptly to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation (NBI).

These are separate remedies:

A platform report seeks removal or restriction of the account.
A criminal complaint asks authorities to identify and prosecute the offender.
A National Privacy Commission (NPC) complaint may address unlawful processing or misuse of personal data.
A bank or e-wallet complaint is urgent if money or a financial account is involved.

A platform takedown does not automatically start a criminal case, and a police report does not guarantee immediate removal.

Is a fake account automatically identity theft?

Not always.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 punishes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

The implementing rules treat identifying information broadly, including names, birth dates, passport or driver’s-license numbers, tax identification numbers, biometric data, electronic identifiers, telecommunications information, and access devices. A profile that appropriates another person’s name, photographs, contact details, credentials, or business identity for an illegitimate purpose may therefore amount to computer-related identity theft.

However, the facts still matter. In Disini v. Secretary of Justice, the Supreme Court explained that identity information must be taken or used for an illegitimate purpose. Merely using an alias, operating an anonymous account, reporting on publicly disclosed information, or maintaining a clearly identified parody or fan account is not automatically criminal identity theft.

Likewise, “cybersquatting” under the Cybercrime Prevention Act concerns the bad-faith acquisition of an internet domain name under the statutory conditions. It should not be used as a catch-all label for every copied social-media username.

What penalties may apply?

For computer-related identity theft, the statutory penalty is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law provides for a penalty one degree lower. The actual charge and sentence depend on the evidence, allegations in the criminal information, applicable penalty rules, and the court’s findings.

Other laws may apply to the same conduct:

Hacking an existing account may constitute illegal access.
Altering data or creating inauthentic electronic records may involve computer-related forgery or fraud.
Defamatory posts may constitute cyber libel, depending on their content and the available defenses.
A fake account used to obtain financial credentials or control a bank or e-wallet account may fall under the Anti-Financial Account Scamming Act.
Gender-based threats, sexual remarks, cyberstalking, online identity theft, or impersonation intended to harm a victim’s reputation may fall under the Safe Spaces Act. Gender-based online sexual harassment carries prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both.
Non-consensual sharing of qualifying intimate recordings may violate the Anti-Photo and Video Voyeurism Act.
Sexual exploitation, grooming, or sexualized material involving a child may fall under the Anti-OSAEC and Anti-CSAEM Act.

These laws have different elements. Do not assume that every copied photo, offensive post, or false statement proves every offense.

What to do immediately

1. Preserve the account before reporting it

Capture enough information to show what existed, where it appeared, and when you saw it:

The complete profile URL—not only the display name
The username, account handle, profile name, and visible account ID
Profile and cover photos, biography, contact details, and links
URLs of individual posts, stories, videos, advertisements, or listings
Messages sent by the account, including the surrounding conversation
Dates, times, and the time zone shown on your device
Names of people contacted or deceived by the impersonator
Report confirmations, ticket numbers, and platform emails
Receipts, transaction references, destination accounts, and bank or e-wallet notices
Statements from witnesses who received messages or demands

Take uncropped screenshots and, where useful, a screen recording showing how you navigated from the account to the relevant content. Retain the original files; do not annotate, filter, compress, or overwrite your only copy. Save a second copy on another secure device or storage location.

Screenshots can be evidence, but they are not automatically conclusive. Under the Rules on Electronic Evidence, the party relying on a private electronic document must establish its authenticity, integrity, and reliability. Keeping the original files, URLs, context, and a witness who personally captured or received the material can help.

2. Report the impersonating account to the platform

Use both the profile-reporting function and the platform’s dedicated impersonation form when available:

Report individual scam posts, threats, intimate images, advertisements, and messages as well as the account itself. Select the most accurate category; “impersonation,” “fraud,” “harassment,” and “intimate-image abuse” may follow different review routes.

Upload identification only through the platform’s genuine help center or in-app process. Check the domain carefully. Never send an ID, password, PIN, one-time password, recovery code, or selfie-with-ID to an account claiming it can “verify” or recover your profile.

3. Secure your own accounts

If your real account may have been compromised:

Secure the recovery email and mobile number first.
Change passwords from a device you reasonably believe is safe.
Use a unique password for every important account.
Sign out unknown devices and revoke unfamiliar apps or sessions.
Turn on multi-factor authentication, preferably through an authenticator app or security key when supported.
Save new recovery codes securely.
Check whether forwarding rules, recovery addresses, or administrator roles were changed.
Warn contacts through a trusted channel not to send money or information to the fake account.

If your SIM was lost, stolen, or taken over, notify your telecommunications provider immediately. Under the SIM Registration Act, the provider must deactivate a lost SIM within 24 hours after receiving the end-user’s report. Ask the provider to protect the number from unauthorized replacement or porting.

How to make a criminal report

The Cybercrime Prevention Act designates the PNP and NBI as the law-enforcement authorities responsible for cybercrime investigations. You may approach:

The nearest police station, which can refer the case to a regional anti-cybercrime unit
The PNP Anti-Cybercrime Group
The NBI, including its cybercrime investigators
The CICC National Anti-Scam Hotline at 1326 for reporting, assistance, and referral; the DICT also lists 1326@dict.gov.ph for feedback or complaints

For a formal complaint, be prepared to provide:

A valid government-issued ID
A clear chronological statement of events
The date you discovered the account and each material incident
The exact identifying information copied or misused
An explanation of why the use was unauthorized
The harm caused or attempted, including financial loss and persons deceived
The URLs and preserved electronic evidence
Transaction records, if money was requested or transferred
Witness information and affidavits, when available
Information about a possible offender, clearly separating verified facts from suspicion

Authorities or prosecutors may require a sworn complaint-affidavit and additional copies or forms. Ask for a receiving copy, complaint number, blotter entry, or other reference that shows when the report was made.

Report promptly. Under Section 13 of the Cybercrime Prevention Act, service providers must preserve traffic data and subscriber information for a minimum of six months from the transaction, while content data is preserved for six months from receipt of a lawful preservation order. Law enforcement may order a one-time six-month extension. A private complainant cannot compel disclosure of another user’s subscriber records; authorities ordinarily need the proper legal process and, for disclosure, a court warrant.

If money or a financial account is involved

Contact the sending and receiving bank, e-wallet, card issuer, or payment provider immediately through its official fraud channel. Give the transaction reference, amount, date, recipient details, and police or cybercrime reference number if already available. Request that the transaction be treated as disputed and ask what protective measures are available.

Under the Anti-Financial Account Scamming Act and BSP Circular No. 1215, supervised institutions may temporarily hold disputed funds for no more than 30 calendar days, unless a competent court extends the period, while coordinated verification is conducted. This does not guarantee that money will be recovered, particularly if it has already left the financial system.

Complain first to the institution’s Financial Consumer Protection Assistance Mechanism. If its response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. BSP is a second-level consumer recourse; criminal investigation remains with law enforcement.

When an NPC complaint may help

Consider the National Privacy Commission route when your personal data was unlawfully collected, used, disclosed, retained, or otherwise processed, or when an organization failed to address a privacy violation within its responsibility. The NPC process is distinct from a criminal identity-theft complaint and may not, by itself, identify an anonymous account owner.

Under the 2021 NPC Rules of Procedure, as amended, you generally must:

Notify the personal information controller, processor, or concerned entity in writing.
Allow it to act on the complaint.
Show that it did not take timely or appropriate action, or that it failed to respond within 15 calendar days after receiving your written notice.

The NPC may waive these steps for good cause or a serious Data Privacy Act violation, including circumstances involving grave and irreparable harm or the absence of an adequate remedy.

Use the NPC’s current complaint instructions and form. A formal complaint ordinarily must be verified or notarized and supported by evidence, relevant correspondence, witness affidavits if any, a valid ID, the requested relief, and a certification against forum shopping. Filing fees may apply, subject to the NPC’s rules and exemptions.

Do not accidentally damage your case

Common mistakes include:

Reporting or blocking the account before saving its URLs and content
Submitting only cropped screenshots with no date, context, or source
Deleting messages, resetting the affected device, or erasing login notices
Publicly naming a suspected offender without sufficient evidence
Assuming the person shown in the profile photo controls the account
Paying an unofficial “hacker,” “tracker,” or recovery agent
Trying to access the fake account without permission
Sending more personal documents to the impersonator
Filing inconsistent versions of the incident with different agencies
Treating a platform report as a substitute for a criminal complaint

The Supreme Court has emphasized that a social-media name and photograph alone may not prove who owns, controls, or authored content from an account. Relevant proof may include admissions, eyewitness testimony about account use, private information known to the offender, distinctive language, conduct consistent with earlier posts, provider records, and device-forensic or geolocation evidence. See the Supreme Court’s guide on proving the identity of a social-media account user.

When help is urgent

Call 911 or go to the nearest police station immediately if there is a credible threat of violence, stalking, extortion, kidnapping, or an ongoing attempt to obtain money or access an account.

Seek urgent legal and law-enforcement help when:

The impersonator is asking your contacts for money
A bank, e-wallet, loan, SIM, or government account was opened or accessed in your name
Your ID, signature, biometrics, or financial credentials were exposed
The account is publishing intimate material or threatening to do so
The offender appears to know your home, workplace, or current location
The victim is a child
The fake account is being used as part of domestic or intimate-partner abuse
Defamatory posts may require a cyber-libel complaint

For child abuse, exploitation, grooming, or sexualized content, contact law enforcement and the MAKABATA Helpline 1383. Executive Order No. 79 establishes 1383 as the central, 24/7 reporting system for child-protection concerns.

Do not delay a possible cyber-libel case. In its 8 April 2026 resolution in Causing v. People, the Supreme Court held that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. Other offenses have different prescriptive periods, and disputes may arise over when prescription began or was interrupted.

Frequently asked questions

Can I report an account even if I do not know who created it?

Yes. State that the offender is unknown and provide every fact that could help identify the account, including URLs, messages, payment destinations, telephone numbers, email addresses, witnesses, and suspected connections. Do not present a guess as an established fact.

Should I ask friends to mass-report the profile?

Trusted contacts may make truthful platform reports, especially if they received scam messages. Preserve the evidence first. Coordinated false or misleading reports can complicate the record and may violate platform rules.

Can police force a platform to disclose the account owner immediately?

Not merely on a private request. Subscriber, traffic, and content data are subject to preservation, warrant, jurisdictional, and provider procedures. Platforms based abroad may also require international cooperation. Early reporting gives investigators a better opportunity to preserve records before they are deleted.

Is a screenshot enough to win a case?

Not necessarily. It can support a complaint, but authenticity, context, authorship, integrity, and the elements of the alleged offense must still be established. Preserve the original electronic material and identify the person who captured or received it.

Can I sue the platform because it did not remove the account immediately?

Platform liability depends on the specific facts, notices sent, contractual terms, applicable Philippine law, and the platform’s role in the alleged processing or publication. A failed or delayed takedown does not automatically establish liability. Preserve the notice and response and obtain individualized legal advice.

Does account removal end the criminal case?

No. Removal may stop further harm, but it does not erase conduct that already occurred. Keep the takedown confirmation and continue cooperating with investigators.

Can a business report impersonation?

Yes. Computer-related identity theft covers identifying information belonging to natural or juridical persons. A business should preserve proof of its legal identity, official pages, trademarks if relevant, customer complaints, fraudulent transactions, and evidence showing public confusion.

Disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any complaint’s outcome. Charges, venue, evidence requirements, and remedies depend on the actual posts, account records, documents, parties, and harm involved. Procedures and contact channels were checked against official sources through 6 August 2026.