Quick answer

If someone created a social media account using your name, photos, business identity, or other identifying information, first preserve the evidence, then report the account through the platform’s impersonation channel. Report promptly to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or National Bureau of Investigation Cybercrime Division (NBI-CCD) if the account is being used to deceive people, solicit money, damage your reputation, threaten or harass you, obtain personal information, or access other accounts.

A fake or duplicate profile is not automatically a criminal case. Under the Cybercrime Prevention Act, investigators must establish intentional, unauthorized use of another person’s identifying information for an illegitimate purpose. The account’s content, conduct, intent, and resulting harm all matter.

If anyone is in immediate danger, call 911 or contact the nearest police station. If money or a financial account is involved, notify the bank, e-wallet, or payment provider immediately—before waiting for the platform or police to respond.

When a fake account may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

Identifying information can include a person’s name, photograph, address, contact number, birth details, occupation, family information, account credentials, government identifiers, and similar data. A company or other juridical person can also be a victim.

In Disini v. Secretary of Justice, the Supreme Court upheld this offense and explained that the prohibited use must be for an illegitimate purpose. The Court also said that merely acquiring and disseminating information that a user made public is not, by itself, identity theft. The surrounding conduct therefore matters: copying a public photograph is different from using that photograph and the victim’s name to pose as the victim, collect money, obtain confidential information, or cause harm. See the Supreme Court’s decision in Disini.

A clearly labeled parody, fan, commentary, or namesake account is not automatically a crime merely because it uses a similar name. It may still violate a platform rule, intellectual-property right, privacy right, or another law, depending on what it publishes and whether users are likely to be deceived.

Computer-related identity theft is ordinarily punishable by prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law directs that the imposable penalty be one degree lower. The actual charge and penalty can only be determined from the evidence and the circumstances of the case.

Depending on what the fake account does, other offenses may also be considered, such as:

Illegal access, if someone entered your real account without permission
Computer-related fraud or estafa, if deception caused financial loss
Cyberlibel, if the account published defamatory statements
Grave threats, coercion, harassment, extortion, or offenses under special laws
Data Privacy Act violations, where a covered person or organization unlawfully processed or disclosed personal data
Financial-account offenses where deception or stolen identifying information was used to access or misuse a financial account

Do not select the criminal charge yourself. Describe the acts accurately and let investigators and prosecutors determine which law applies.

Preserve the evidence before seeking takedown

A fast takedown protects people, but it can also remove information investigators need. Preserve what you can before reporting the account, unless viewing or saving the material would expose someone to immediate danger or involve illegal sexual content.

Save the following:

The complete profile URL—not only the displayed name
Exact username, handle, account ID, display name, and profile description
Screenshots showing the entire screen, including the address bar, date, time, and surrounding context
A screen recording that starts from the platform homepage or search results and opens the account, posts, and messages
URLs and unedited copies of individual posts, stories, advertisements, videos, or marketplace listings
Direct messages, comments, call logs, email headers, and voice messages
Dates and times when the account appeared, contacted anyone, changed names, or made demands
The fake account’s phone numbers, email addresses, payment links, bank or e-wallet details, QR codes, and delivery information
Receipts, transaction reference numbers, account statements, and reports made to financial providers
Messages from friends, customers, relatives, or other people who were deceived
Your genuine profile and original copies of photographs or documents that were copied
Platform acknowledgment emails, report numbers, and takedown decisions
A chronological written account of what happened and how you discovered it

Keep original files. Avoid cropping, annotating, filtering, renaming, or repeatedly converting them. Make backup copies, but retain the phone or computer on which the messages were received. The Rules on Electronic Evidence require electronic evidence to be authenticated; a person who participated in or personally observed a communication may also be needed to establish it.

Do not factory-reset the device, delete messages, close a compromised account, or surrender the only copy of a file without first making a secure backup and consulting the investigator.

Secure your real accounts

If the fake account is separate from your genuine account, change the passwords of your email and social media accounts anyway. The impersonator may possess information obtained through phishing or a data breach.

Use a clean, trusted device and:

Change the password of your primary email account first.
Use unique passwords for social media, banking, and e-wallet accounts.
Sign out unknown devices and terminate active sessions.
Enable multi-factor authentication, preferably through an authenticator app or passkey.
Review recovery email addresses, mobile numbers, connected applications, forwarding rules, and recent login activity.
Contact your mobile provider if your SIM suddenly stopped working or you suspect a SIM swap.
Inform close contacts that the fake account is not yours and that they should not send money, OTPs, documents, or personal information.
Post a short warning from your genuine account, but avoid publicly accusing an unverified suspect.

If your real account was taken over—not merely copied—use the platform’s official account-recovery process. Never pay a supposed “account recovery agent” or provide an OTP to someone who contacts you through chat.

Report the account to the platform

Open the fake profile and choose Report, then select Pretending to be someone, Impersonation, or the closest available option. Report the specific fraudulent posts and messages as well as the account itself.

Official reporting resources include:

Platform interfaces change, so use the service’s official app or help center if a link has moved. A platform may request identification or proof that you represent the person, business, minor, or deceased person being impersonated. Upload identification only through the official app or the platform’s genuine domain.

Ask affected friends or customers to submit truthful reports based on what they personally saw. Do not organize false reports or instruct people to claim they were impersonated when they were not.

A platform report requests moderation or takedown. It does not automatically create a Philippine criminal complaint.

Where to report in the Philippines

Channel	Best used for	Current official route
PNP Anti-Cybercrime Group	Criminal investigation, impersonation, fraud, hacking, threats, and other cyber-enabled offenses	Email acg@pnp.gov.ph, call (02) 3414-1560 or 0998-598-8116, or go to the nearest PNP-ACG office or police unit. The contact details appear in the BSP’s government scam-reporting directory.
NBI Cybercrime Division	Cybercrime investigation, particularly cases requiring technical or wider investigation	Email ccd@nbi.gov.ph or call (02) 8523-8231 to 38, local 3455, or (02) 8252-6228. Check the NBI office directory before visiting.
CICC Inter-Agency Response Center	Initial reporting and referral, including impersonation and online scams	Call 1326. Government guidance describes it as a 24/7 central reporting number; reports may also be made through the eGovPH app. See the official government advisory.
National Privacy Commission	Complaints involving misuse or mishandling of personal data by a covered controller, processor, platform, business, employer, agency, or other concerned entity	Follow the NPC complaint procedure.
Bank or e-wallet, then BSP	Unauthorized transfers, account access, or a provider’s handling of a fraud complaint	Report first to the institution and retain its reference number. If unresolved, use the BSP Consumer Assistance Mechanism.

The PNP’s cybercrime-reporting guidelines provide that reports received through walk-in, SMS, hotline, e-complaint, referral, or other means should be attended to and referred to an investigator. An electronic or telephone report may still need to be formally recorded and supported by a sworn statement and evidence.

The NBI Citizen’s Charter for computer-crime complaints likewise provides for an interview, a sworn complaint sheet or prepared affidavit, supporting documents, witness statements, and examination of a relevant device when appropriate.

When reporting:

Bring or submit a concise timeline and organized copies of the evidence.
State exactly which information was copied and how the account represented itself.
Identify every person contacted, deceived, threatened, or asked for money.
Disclose any related report already filed with another agency.
Request and retain the complaint, blotter, or reference number.
Record the assigned investigator’s name and official contact details.
Ask whether investigators need your original device or a formal request to preserve platform records.

Authorities cannot lawfully reveal an account owner merely because someone requests it. Subscriber information, traffic data, and other records may require a properly docketed investigation, preservation process, or court-issued cybercrime warrant.

Filing a privacy complaint with the NPC

The NPC route is useful when the problem concerns unlawful processing, disclosure, security, correction, blocking, or removal of personal data under the Data Privacy Act of 2012. It is not automatically the correct forum for every anonymous fake profile. The Act’s scope, exemptions, the identity of the person or organization controlling the data, and the specific processing activity must be evaluated.

Under the 2021 NPC Rules of Procedure, as amended, a complainant generally must first:

Inform the personal information controller, processor, or concerned entity of the violation in writing.
Give it an opportunity to act.
Show that it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

Keep proof that the notice was received, including support tickets, emails, delivery records, and platform responses.

The NPC may waive these exhaustion requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. A waiver is discretionary; explain and prove why immediate NPC action is necessary.

A formal complaint should be verified and must identify the parties—or, if the respondent is unknown, state the circumstances that may lead to identification. It should include the material facts, requested relief, correspondence, supporting documents, witness affidavits when available, and a certification against forum shopping. Use the NPC’s current complaint-assisted form and follow its instructions on notarization, copies, filing fees, and permitted filing channels.

An anonymous operator who cannot be identified or traced can create a procedural problem before the NPC. In that situation, a criminal report to the PNP or NBI may be especially important because investigators can seek records through lawful processes.

If money or financial accounts are involved

Call the bank, e-wallet, card issuer, or payment provider immediately using the number in its official app, website, or the back of the card. Ask it to:

Block or secure the affected account
Stop or recall a transaction if still possible
Preserve account, device, and transaction records
Investigate the recipient or beneficiary account
Issue a fraud-report reference number
Provide written confirmation of the report

Do not wait for a social media takedown. A removed profile does not reverse a transfer.

If the institution is supervised by the Bangko Sentral ng Pilipinas and its response remains unresolved, escalate through the BSP’s second-level Consumer Assistance Mechanism. The BSP requires proof that the concern was first reported to the financial institution, including its reference number. The BSP directory of institutional consumer-assistance channels can help locate the correct contact.

How quickly should you report?

There is no single reporting deadline that applies to every fake-account incident. Different criminal, civil, privacy, and platform processes have different limitation rules. Report immediately rather than trying to calculate the longest possible period.

Under Section 13 of Republic Act No. 10175, service providers must preserve specified traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, subject to the law’s rules on extension and pending cases. These periods are not six-month deadlines for victims. They explain why delay can make identification and evidence recovery harder.

Seek legal advice promptly if the conduct occurred months or years ago. The proper prescriptive period depends on the exact offense, its penalty, when it was discovered, whether the conduct continued, and other facts.

Common mistakes to avoid

Reporting the profile before saving its URLs, posts, messages, and payment details
Keeping only cropped screenshots that omit the username, timestamp, or context
Editing or annotating the only copy of electronic evidence
Assuming a mass-reporting campaign is the same as a criminal complaint
Deleting conversations, resetting the device, or deactivating the genuine account too soon
Paying the impersonator to remove the account or return access
Sending an OTP, password, selfie, or ID to an unsolicited “support agent”
Publicly naming a suspected offender without reliable evidence
Hacking, tracking, threatening, or impersonating the suspected offender in return
Waiting for actual financial loss before reporting attempted deception
Filing inconsistent accounts with several agencies without disclosing the earlier reports
Assuming that use of the same name or a public photograph, standing alone, proves a crime

When help is urgent

Contact law enforcement and the relevant service provider immediately when:

The account threatens physical harm, abduction, stalking, or violence
Someone is currently sending money or disclosing OTPs or credentials
Your email, mobile number, bank, e-wallet, or government account has been accessed
The impersonator is applying for loans, opening accounts, or entering contracts in your name
A child is being contacted, groomed, threatened, or sexually exploited
Intimate images or sexually explicit deepfakes are being distributed or used for blackmail
The account is directing people to meet, deliver property, or visit a location
Evidence is being deleted or the operator is rapidly changing account names

For intimate or child sexual-abuse material, do not download, repost, or circulate the material merely to prove that it exists. Preserve URLs, account details, and lawful screenshots of the surrounding page, then obtain immediate guidance from the PNP or NBI.

Frequently asked questions

Can I report a fake account even if nobody lost money?

Yes. Lack of financial loss does not prevent a platform report or police report. Republic Act No. 10175 expressly contemplates computer-related identity theft where no damage has yet occurred, although it provides for a lower imposable penalty in that situation. Evidence of intent and unauthorized use remains necessary.

Should I report to both the platform and the police?

If the conduct may be criminal, report to both. The platform can restrict or remove the account; the PNP or NBI can investigate the person behind it. One process does not replace the other.

Is a police or barangay blotter enough?

A blotter entry can document that an incident was reported, but it does not by itself guarantee a cybercrime investigation or platform takedown. For investigation, contact the PNP-ACG, an appropriate police investigative unit, or the NBI-CCD and provide the available electronic evidence.

Can I force the platform to tell me who owns the account?

Generally, not through an ordinary user request. Subscriber and traffic information is protected and ordinarily obtained by law-enforcement authorities through the procedures and warrants required by Republic Act No. 10175 and the Rule on Cybercrime Warrants.

What if the fake account is outside the Philippines?

Report it locally if you are in the Philippines, damage occurred here, or relevant conduct or computer systems have a Philippine connection. Republic Act No. 10175 contains jurisdiction and international-cooperation provisions, but obtaining foreign platform records can take time and may require assistance through the DOJ Office of Cybercrime.

Can a company report impersonation?

Yes. Republic Act No. 10175 covers identifying information belonging to natural and juridical persons. The company should preserve proof of its registered name, trademarks where relevant, official pages, customer complaints, fraudulent solicitations, and evidence showing who is authorized to file for it.

Should I hire a lawyer?

A lawyer is especially useful when there is serious reputational or financial harm, multiple possible offenses, an urgent need for protective or injunctive relief, a complicated NPC complaint, a foreign platform, or uncertainty about affidavits and electronic evidence. Free legal assistance may be available from the Public Attorney’s Office for qualified persons.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the account’s content, purpose, operator, evidence, resulting harm, and applicable platform procedures. Laws and official procedures were checked against available primary and government sources as of 10 August 2026.