Quick answer

If someone is using your name, photos, personal information, or business identity in a fake social media account:

Preserve the evidence before blocking or reporting it. Save the profile URL, username, screenshots, messages, posts, dates, transaction records, and names of people contacted.
Report the profile and each harmful post or message to the platform using its impersonation or fraud-reporting process.
Secure your real accounts. Start with your email, then social media, bank, e-wallet, and mobile accounts. Change passwords, end unfamiliar sessions, remove unknown recovery details, and enable multi-factor authentication.
Warn your contacts through a trusted channel that the account is fake. State only verified facts and do not publicly accuse an unverified suspect.
Report the incident to the government. Call the 24/7 CICC Inter-Agency Response Center at 1326, use the eGovPH reporting feature, or contact the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
If money or financial credentials are involved, contact your bank or e-wallet’s official 24/7 fraud channel immediately. Ask it to secure the account, record a disputed transaction, trace the transfer, and consider temporarily holding any remaining funds.

Call 911 or go to the nearest police station immediately if there are credible threats, stalking, extortion, sexual exploitation, exposure of a home address, danger to a child, or an immediate risk of physical harm.

Is a fake account automatically identity theft?

Not necessarily. A fake, anonymous, parody, fan, or commentary account is not automatically a criminal offense. The account’s purpose, presentation, information used, and resulting harm all matter.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or organization, without right.

In Disini v. Secretary of Justice, the Supreme Court upheld this offense and explained that identity information must be taken or used for an illegitimate purpose. Merely accessing or sharing information that a person has made public is not, by itself, identity theft.

A criminal case becomes more likely where the account:

Presents itself as the victim rather than as obvious parody or commentary;
Uses the victim’s identity to request money, loans, passwords, one-time PINs, or documents;
Deceives employers, customers, relatives, or government offices;
Opens accounts or enters transactions in the victim’s name;
Damages the victim’s finances, reputation, relationships, employment, or safety; or
Is connected with hacking, fraud, forgery, threats, extortion, harassment, or defamatory posts.

For computer-related identity theft, RA 10175 prescribes prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The identity-theft provision states that the penalty is one degree lower if no damage has yet been caused. Liability and the correct penalty still depend on proof of every element and the court’s findings.

If someone took control of your genuine account, that may involve illegal access, not merely a fake account. If the impostor used fabricated electronic records or manipulated transactions, computer-related forgery or fraud may also be considered. Investigators and prosecutors should determine the proper offense from the evidence rather than from the label used in the initial report.

What to do immediately

Preserve first, then report and block

Reporting may cause the account or content to disappear. Before doing so, record:

The exact profile URL, username, display name, and account ID if visible;
The account’s profile photo, biography, creation information, followers, and linked accounts;
Every fraudulent post, advertisement, comment, story, video, and message;
The date, time, and time zone when each item was seen or received;
Phone numbers, email addresses, payment links, QR codes, bank or e-wallet details, and delivery addresses used;
Messages from people who were contacted or deceived;
Transaction receipts and reference numbers;
Platform-report acknowledgments and government case numbers; and
Any facts that may identify the operator, such as repeated phrases, private information known only to a few people, or connections with earlier incidents.

Take full-screen screenshots that show the account name, content, and surrounding context. When practical, make a screen recording showing how you navigated from the profile to the relevant post or conversation. Save received files in their original format.

Keep one untouched evidence folder. Make separate working copies for highlighting or annotation. Do not crop, alter, rename, or overwrite the only copy of a file. Do not factory-reset a device or delete conversations until an investigator advises that they are no longer needed.

Screenshots are useful but do not automatically prove who operated an account. Under the Rules on Electronic Evidence, a person presenting a private electronic document must establish its authenticity and reliability. The Supreme Court’s guide on proving control of a social media account identifies potentially relevant proof such as admissions, eyewitness evidence of account use, private knowledge reflected in posts, language associated with the operator, provider or forensic records, and related conduct.

Secure your real identity and accounts

Using a device you reasonably believe is safe:

Change the password of your primary email account first. Email often controls password recovery for other services.
Change affected social media and financial passwords. Use a different, strong password for every important account.
Sign out other sessions and remove unfamiliar devices.
Check whether the recovery email, mobile number, security questions, or linked applications were changed.
Enable multi-factor authentication, preferably through an authenticator app, passkey, or hardware key when available.
Save login alerts and records of unfamiliar devices or locations.
Freeze affected cards or accounts through official channels.
Scan devices for malware and update the operating system and applications.

Type official web addresses yourself or use the institution’s verified application. Fake “support agents” often approach victims after they post publicly about an account problem.

If your SIM was lost, stolen, or taken over, report it immediately to your telecommunications provider. Under the SIM Registration Act and its implementing rules, providers must bar a reported lost or stolen SIM immediately and deactivate it within the applicable 24-hour period. Ask the provider to secure the number against unauthorized replacement or porting.

Warn people without spreading the scam

Use your genuine account, a verified business page, group chat, email, or another trusted channel. A simple notice is usually enough:

An account using my name and photos is not mine. I am not requesting money, passwords, codes, or documents through that account. Please do not transact with it. Preserve any messages you received and send them to me privately.

Avoid reposting sensitive IDs, payment QR codes, intimate material, or active phishing links. Do not name a suspected operator unless the identity is established and publication is legally appropriate.

Report the account to the platform

Report both the profile and the specific fraudulent content. Keep the confirmation email, report number, and screenshots showing when the report was filed.

Official reporting pages include:

The platform may ask the person being impersonated—or an authorized representative—to verify identity. Upload identification only through an official platform domain or application. Redact information that the form does not require when the platform permits it.

If your genuine account was taken over, use the platform’s hacked or compromised account recovery process, not only its impersonation form.

A platform report may remove an account, but it is not a criminal complaint and does not ordinarily identify the operator or recover money. Conversely, a police report does not guarantee immediate platform removal. Use both processes when the facts justify them.

How to make a government report

CICC and the 1326 hotline

The government’s Inter-Agency Response Center accepts reports of impersonation, phishing, scams, and other cybercrime through:

Hotline 1326, available 24/7;
The reporting feature in the eGovPH application;
The CICC online reporting page; or
Email to 1326@dict.gov.ph.

The official government guidance describes 1326 as a central reporting and referral channel, while criminal enforcement remains with agencies such as the PNP and NBI. See the government advisory on Hotline 1326.

PNP Anti-Cybercrime Group

Contact the PNP Anti-Cybercrime Group or use its contact directory to locate the appropriate regional anti-cybercrime unit. A nearby police station may also receive an urgent report and coordinate with the cybercrime unit.

Explain whether the matter involves:

A cloned profile only;
Takeover of your genuine account;
Solicitation of money or credentials;
Fraudulent loans, purchases, or contracts;
Threats, extortion, stalking, or sexualized content; or
A child or person at immediate risk.

NBI Cybercrime Division

The NBI Cybercrime Division lists ccd@nbi.gov.ph as its official email address. Use it to coordinate or ask where to submit the complaint, but expect that a formal investigation may require sworn statements or an appearance.

The NBI’s Citizen’s Charter for computer-crime victims states that a complainant may proceed to the Cybercrime Division, complete a complaint sheet, undergo an initial interview, execute sworn statements or submit prepared affidavits, provide supporting documents, and permit examination of a relevant device when necessary. The charter lists no service fee for these initial steps.

The current NBI contact page identifies its main office at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, and provides links to regional and district offices.

What to submit

Prepare a short chronological statement covering:

Who you are and which genuine account, name, photograph, or business identity belongs to you;
When and how you discovered the fake account;
The fake account’s URLs, usernames, and connected contact or payment details;
Why its use of your identity was unauthorized;
What the account said or did;
Who received messages or relied on the deception;
Any financial, reputational, employment, emotional, or safety harm;
Steps already taken with the platform, bank, telco, or other institution; and
A numbered list of evidence.

If the operator is unknown, say so. Identify the respondent by the account name or handle and supply every available lead. Do not guess a real person’s identity.

Ask for an acknowledgment or case reference number. If the account may soon disappear, ask the investigator whether prompt data preservation should be requested. Section 13 of RA 10175 requires service providers to preserve traffic data and subscriber information for at least six months from the transaction and allows law-enforcement authorities to order preservation of specified content data for six months, with a possible one-time six-month extension. Disclosure of protected account data ordinarily requires legal process and a court-issued warrant; a private complainant cannot simply demand an IP address or subscriber identity from the platform.

If money, a bank account, or an e-wallet is involved

Contact the institution holding the source account through its official 24/7 fraud-reporting channel immediately. Do not wait for a platform response or a completed police investigation.

Give the institution:

Your name and source-account details;
The transaction reference number;
Amount, date, and exact time;
Beneficiary institution, account, number, or wallet;
A concise explanation of the impersonation or account takeover; and
Supporting messages, screenshots, and receipts.

Ask for a case number and written acknowledgment. Request that the institution:

Secure or restrict the compromised account;
Treat the transfer as a disputed transaction;
Trace the transaction chain;
Coordinate with receiving institutions; and
Consider temporarily holding funds that remain in the financial system.

Under the Anti-Financial Account Scamming Act, Republic Act No. 12010, financial institutions may temporarily hold funds involved in qualifying disputed transactions and must conduct coordinated verification. The law covers transactions that appear unusual, lack clear economic purpose, arise from an unlawful source or activity, or were facilitated through a social-engineering scheme.

The BSP regulations implementing the temporary-hold process provide for:

An initial hold of up to five calendar days;
Submission by the source-account owner of a sworn complaint, affidavit, police report, or other supporting document within that initial period when an extended hold is sought, subject to the applicable industry protocol;
A possible extension of up to 25 additional calendar days when reasonable grounds and further verification justify it; and
A maximum total hold of 30 calendar days, unless a competent court extends it.

A hold is not automatic, does not guarantee recovery, and may be ineffective if the funds have already been withdrawn or moved outside the covered system. That is why reporting within minutes or hours is materially better than waiting.

If the institution’s first-level complaint mechanism does not resolve the matter, escalate it through the BSP Consumer Assistance Mechanism. The current BSP filing guide requires consumers to complain first to the supervised institution. An unresolved complaint may then be elevated through the BSP Online Buddy or, where BOB is unavailable, through the prescribed form sent to consumeraffairs@bsp.gov.ph, with proof of the earlier complaint.

If your identity was used for a loan or credit account

Notify the lender in writing as soon as possible. Dispute the application and request that it:

Stop collection activity against you while the dispute is investigated;
Preserve the application, identity-verification records, device and access logs, submitted IDs, signatures, and disbursement details;
Provide a written case reference and result; and
Correct information it reported to credit databases if the account was not yours.

Obtain your CIC credit report and review it for unfamiliar accounts. The Credit Information Corporation’s Online Dispute Resolution System permits disputes concerning erroneous, misleading, incomplete, or outdated credit data. A CIC credit report is required; under the published dispute guidelines, a report obtained more than 30 calendar days earlier must be replaced with a current report before filing the dispute.

When to file a privacy complaint

Consider a complaint with the National Privacy Commission when the incident involves unlawful collection, use, disclosure, retention, or inadequate protection of personal data—particularly where a company, platform, lender, employer, agency, or other personal-information controller is involved.

The NPC does not replace the police, trace a suspect for you, or automatically remove a fake profile. A privacy complaint may run alongside appropriate platform, financial, or criminal reporting.

Under the amended NPC Rules of Procedure, a complainant generally must first notify the personal-information controller, processor, or concerned entity in writing and allow it to take appropriate action. The NPC may give due course when the entity does not act appropriately or does not respond within 15 calendar days from receipt.

The NPC may waive that exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal action.

A formal complaint must ordinarily be verified, supported by evidence, and accompanied by the required certification and attachments. The NPC’s complaint mechanics and formal complaint page provide the current form, filing modes, and fee information. Complaints may be coordinated through complaints@privacy.gov.ph. Disclose related cases or complaints already filed with other courts or agencies.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and content;
Waiting several days before notifying a bank or e-wallet;
Assuming a username or profile photo proves who operated the account;
Editing the only copy of a screenshot or deleting the original conversation;
Publicly accusing a suspected person without reliable proof;
Threatening, baiting, hacking, tracking, or attempting to access the impostor’s account;
Paying a supposed “account recovery agent” found in comments or direct messages;
Sending IDs, passwords, or one-time PINs to unofficial support accounts;
Treating a barangay or police blotter entry as a complete cybercrime complaint;
Treating a platform report as a substitute for financial or criminal reporting;
Reposting intimate, exploitative, or child-related material as “proof”; and
Filing an exaggerated or knowingly false financial-fraud report. RA 12010 separately penalizes malicious reporting that results in funds being held.

When legal help is urgent

Consult a lawyer or seek immediate law-enforcement assistance where:

The account is threatening violence, revealing your address, or encouraging others to find you;
The operator is extorting money or threatening to release private material;
Intimate images, sexual deepfakes, or content involving a child are being distributed;
A significant transfer, loan, property transaction, or business loss occurred;
Government IDs, signatures, biometrics, tax information, or financial credentials were used;
An employer, school, customer, or government office acted on the fake account;
The platform or institution refuses to preserve critical evidence;
The suspected operator is a current or former intimate partner, employer, public officer, or person with access to sensitive records; or
You are considering civil damages, an injunction, or a criminal complaint close to a possible prescriptive deadline.

There is no single filing deadline for every offense arising from a fake account. Different crimes have different prescriptive periods. For example, the Supreme Court has held that cyberlibel prescribes in one year from discovery by the offended party or the proper authorities. Identity theft, fraud, threats, and privacy violations follow different rules. Do not delay while trying to classify the offense yourself.

Frequently asked questions

Can I report the account if I do not know who created it?

Yes. Preserve the handle, URL, communications, payment details, and every available identifying lead. Law enforcement may seek provider records through the required preservation, disclosure, and warrant procedures.

Can I report an account impersonating a friend or relative?

You may report it to the platform as a bystander. For a formal criminal or privacy complaint, the person whose identity was used should ordinarily provide a statement or authorize a representative. Preserve messages sent directly to you because you may also be a witness or fraud victim.

Is using my photograph without permission always computer-related identity theft?

No. Context and purpose matter. Unauthorized use may violate platform rules or other laws, but criminal identity theft requires proof of the statutory elements and an illegitimate purpose. Obvious news reporting, commentary, or properly disclosed parody raises different issues from a profile deceptively presenting itself as you.

Should I message the fake account?

Usually not. Preserve the evidence, report it, and block it afterward. Contact may alert the operator to delete evidence, move money, intensify harassment, or send malicious links. If communication is needed for an investigation, follow the investigator’s instructions.

How long must a platform take to remove the account?

There is no general Philippine statutory deadline guaranteeing removal of an ordinary impersonation account. Platform review times vary. Continue preserving new activity and update the platform and investigator if the account changes its username or creates replacements.

Can the police immediately obtain the account’s IP address?

Not merely because a complaint was made. Subscriber, traffic, and content data are subject to preservation, relevance, jurisdiction, and court-warrant requirements under RA 10175 and the Rule on Cybercrime Warrants.

Does filing a report guarantee that stolen money will be returned?

No. Recovery depends on whether funds remain traceable and available, the financial institutions’ verification, the evidence, and any later legal process. Immediate reporting gives the best practical chance of a hold or recovery.

Should I delete my real account?

Usually not. Deleting it may remove evidence and make it harder for contacts or the platform to distinguish the genuine account. Secure it, limit unnecessary public information, and keep it available unless investigators or a safety professional advise otherwise.

Official references and services

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and legal conclusions may change according to the evidence, documents, platform, institution, location, and applicable offense. Official sources and reporting channels were checked on August 3, 2026.