Quick answer

If someone is using your name, photos, business identity, documents, or account details without permission, preserve the evidence first, then:

Report the fake profile and each harmful post or message through the social-media platform.
Secure your real accounts, email, mobile number, financial accounts, and government records.
Report suspected crime promptly to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. You may also start through the CICC cybercrime-reporting page.
Contact your bank, e-wallet, telco, employer, or government ID issuer immediately if its account or document is involved.
Consider a National Privacy Commission complaint if personal data was misused and the responsible entity failed to address your written request.

A fake account is not automatically criminal identity theft. Liability depends on what information was used, whether the use was intentional and without right, its purpose, the harm caused, and the available proof. A clearly labeled parody or fan account, for example, raises different issues from an account designed to deceive people, obtain money, harass someone, or damage a reputation.

What to do immediately

1. Preserve the account before reporting it

A platform may remove the account or content after a report, taking useful evidence with it. Before clicking “Report,” save:

The complete profile URL, username, display name, account ID if visible, and QR code if the platform provides one
Full-screen screenshots showing the account name, date and time, captions, comments, and browser address bar
A screen recording that opens the profile, scrolls through it, and shows the URL
Copies of posts, stories, advertisements, messages, voice notes, videos, and livestream recordings lawfully available to you
Links and screenshots of every separate account or post involved
The dates and times you discovered the material and received each message
Names and contact details of people who received messages or sent money
Transaction references, recipient account details, receipts, bank alerts, delivery records, and marketplace listings
Email notifications, password-reset notices, login alerts, and available email headers
Copies of your genuine profile and older material showing that the name, photograph, biography, or branding belongs to you or your organization
Every platform report number, police reference number, email acknowledgment, and response

Keep the original files. Make backed-up copies, but do not crop, annotate, filter, rename, or edit the only copy. Record who collected each item and when. Electronic evidence must still be authenticated and shown to be reliable under the Supreme Court’s Rules on Electronic Evidence.

The Supreme Court has also explained that account ownership or authorship may be proved through direct or circumstantial evidence, including admissions, observed use, information known only to the suspect, distinctive language, device or service-provider records, geolocation, account history, and other conduct linking the person to the account. A name and photograph alone may not conclusively identify the operator. See XXX v. People, G.R. No. 274842, October 22, 2025.

2. Secure the accounts that control your identity

If there is any sign that your genuine account was hacked:

Change the password of the connected email account first.
Use the platform’s official hacked-account recovery process.
Sign out unknown sessions and remove unfamiliar devices, recovery addresses, phone numbers, apps, and browser extensions.
Turn on multi-factor authentication, preferably with an authenticator app or security key.
Change any reused passwords.
Ask your mobile provider about possible SIM replacement or SIM-swap activity.
Review bank, e-wallet, shopping, cloud-storage, and government-service accounts connected to the same email or mobile number.

Do not follow “support” links sent by the suspected impostor. Open the platform, bank, or agency website yourself.

3. Warn people without destroying evidence

Tell close contacts, employees, customers, or suppliers that the account is unauthorized. Give them the exact fake username and instruct them not to send money, disclose codes, or click links.

Keep the warning factual. Do not publicly identify a suspected operator unless the identification is verified. Doxxing, threats, and unsupported accusations can create safety and legal problems of their own.

Where to report

Situation	Report to	Purpose
Fake or impersonating profile	The platform	Account review, restriction, or removal
Hacking, identity theft, fraud, threats, extortion, or coordinated harassment	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Criminal investigation and evidence preservation
Help routing a cybercrime report	CICC complaint center	Intake, assistance, and referral
Misuse of personal data	Responsible entity first, then the National Privacy Commission when appropriate	Data-subject remedies and privacy enforcement
Unauthorized bank or e-wallet activity	The institution immediately; BSP if unresolved	Transaction investigation and financial-consumer assistance
Immediate danger	Unified 911 and the nearest police station	Emergency response
Sexual exploitation or abuse involving a child	MAKABATA Helpline 1383, police, or NBI	Child protection and urgent investigation

These routes serve different purposes. A platform report may remove content but does not replace a criminal complaint. A police report does not automatically remove an account. An NPC case is not a substitute for calling the bank about an unauthorized transfer.

How to report the fake account to the platform

Report both the account and any separate posts, advertisements, or messages that violate platform rules. Select “impersonation” or “pretending to be someone” where available, rather than a generic spam category.

Official reporting pages include:

Facebook and X provide ways to report impersonation even if you do not have an account. Some platforms will act only on a report from the person impersonated, a parent or guardian, or an authorized representative. Businesses may need to provide registration or trademark documents.

If the form requests identification, submit it only through the platform’s genuine help center. Cover information the form does not require where the platform permits. Save the submission confirmation.

Removal is not guaranteed. Platforms distinguish deceptive impersonation from accounts that clearly identify themselves as parody, commentary, fan, or unaffiliated accounts.

How to make a law-enforcement report

The Cybercrime Prevention Act of 2012 designates the PNP and NBI as cybercrime law-enforcement authorities. You may approach a PNP Anti-Cybercrime Group office or NBI regional, district, or cybercrime office. The CICC reporting page and public hotline 1326 may also be used for initial assistance; check the page for current service notices and alternative channels.

Bring:

A valid ID and your contact details
A chronological written account
The fake account’s URLs and usernames
Original electronic files and backed-up copies
Screenshots, messages, witness details, and transaction records
Proof that the identity or business information is yours
Copies of platform reports and responses
A list of the harm already caused or threatened
The suspected person’s details, if known, together with the basis for the identification

State facts rather than legal conclusions. Explain exactly what information was used, how the account represented itself, who was deceived, what was requested or obtained, and what loss, reputational injury, distress, or security risk resulted.

You may be asked to execute a sworn complaint-affidavit or witness statement and later provide additional records. Ask for the complaint or docket number and the investigator’s official contact details.

Tell the investigator promptly if platform data may disappear. Under Republic Act No. 10175, service providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. Disclosure of subscriber, traffic, or relevant data generally requires a court-issued warrant. The procedure is governed by the Supreme Court’s Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC.

A private person ordinarily cannot compel a platform to reveal an account holder’s IP address or registration information. Give the identifiers to the investigator so lawful preservation and disclosure procedures can be considered.

When the conduct may be a crime

Computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another natural or juridical person’s identifying information without right.

If damage has been caused, the prescribed penalty is prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the imposable penalty is one degree lower. Whether legally recognized “damage” exists is a matter for the prosecutor and court based on the evidence.

In Disini v. Secretary of Justice, the Supreme Court upheld this offense but clarified that it concerns identifying information taken or used for an illegitimate purpose. Merely acquiring or disseminating information that the user personally made public is not, by itself, identity theft. A fake profile’s design, representations, messages, purpose, and resulting harm therefore matter.

Other possible offenses

Depending on the facts, the same incident may involve:

Illegal access, if someone entered your genuine account without right
Computer-related forgery or fraud, if inauthentic computer data was created or used for a dishonest scheme, or unauthorized computer activity caused damage with fraudulent intent
Estafa or another fraud offense, if people were induced to part with money or property
Cyberlibel, if the fake account’s original author published a malicious defamatory imputation
Threats, coercion, extortion, stalking, or other offenses under the Revised Penal Code or special laws
Unauthorized processing, access, or disclosure under the Data Privacy Act
A social-engineering scheme under the Anti-Financial Account Scamming Act, if deception was used to obtain sensitive identifying information and gain unauthorized access to a financial account
Gender-based online sexual harassment under the Safe Spaces Act, which expressly includes certain online impersonation, privacy invasion, sexual threats, unauthorized sharing, and reputation-harming lies
Violations of the Anti-Photo and Video Voyeurism Act where covered intimate recordings are involved
Online sexual abuse or exploitation of children under Republic Act No. 11930

Not every unpleasant, anonymous, parody, fan, duplicate, or misleading account satisfies these offenses. Each crime has elements that must be alleged and proved, including the accused’s identity.

Filing a privacy complaint

Consider the National Privacy Commission route when your personal information was collected, copied, published, disclosed, or otherwise processed in violation of the Data Privacy Act, especially when a platform, company, employer, school, service provider, or other responsible entity failed to address the misuse.

Under the NPC’s amended Rules of Procedure, a complainant generally must first:

Inform the personal information controller, processor, or concerned entity of the violation in writing.
Give it an opportunity to act.
Show that it failed to take timely and appropriate action or did not respond within 15 calendar days of receiving the written notice.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm or the absence of an adequate remedy.

A formal complaint must meet prescribed requirements, including verification and a certification against forum shopping. The NPC’s current instructions say to use its complaint form, have it notarized, pay the applicable fee unless exempted or waived, and submit it through an authorized mode. Check the NPC formal-complaint page before filing because forms, fees, addresses, and authorized email channels can change.

If money or a financial account is involved

Contact the bank, credit-card issuer, remittance company, or e-wallet through its official fraud or consumer-assistance channel immediately. Ask it to:

Block compromised access and credentials
Record the transaction as disputed or unauthorized
Preserve transaction, device, login, recipient, and communication records
Provide a complaint reference number
Explain what additional affidavit or police report it requires

Do not delete the app or reset the affected device until essential records are preserved, unless leaving it active creates an immediate security risk.

If the institution does not satisfactorily resolve the complaint, the BSP Consumer Assistance Mechanism is a second-level recourse for BSP-supervised institutions. The BSP requires consumers to complain to the institution first. Current escalation methods include the BSP Online Buddy and the alternatives listed in the BSP complaint guide.

A BSP complaint does not replace a criminal report, and reporting does not guarantee that transferred funds can be recovered.

Important deadlines

There is no single reporting deadline for every fake-account or identity-theft case. The applicable prescriptive period depends on the offense, its penalty, when it was committed or discovered, and what legal filing interrupts prescription.

Act quickly because:

Platform content and device records can disappear.
Some service-provider data is subject to the six-month preservation framework discussed above.
Financial institutions may have contractual dispute-notification periods.
NPC complaints normally require a prior written notice and a 15-calendar-day opportunity to respond.
Cyberlibel has an especially short prescriptive period. The Supreme Court confirmed in Causing v. People, G.R. No. 258524, April 8, 2026 that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents.

Do not assume that a platform report, email, social-media post, or informal hotline call stops a criminal prescriptive period. If defamatory content, substantial loss, or an older incident is involved, consult a prosecutor or lawyer immediately about the proper filing.

When help is urgent

Call Unified 911 or go to the nearest police station when the fake account is connected to an immediate threat, stalking, planned violence, abduction, extortion, or disclosure of a home, school, or live location.

For sexual abuse, exploitation, grooming, or sexual material involving a child, do not forward or repeatedly download the material. Preserve the link and basic reporting details, then report immediately to police, NBI, or MAKABATA Helpline 1383.

Obtain legal help urgently when:

The suspect is a current or former intimate partner
Intimate images, deepfakes, or sexual threats are involved
A child or vulnerable adult is targeted
The account is impersonating a public official, company, school, or licensed professional
Money, loans, credit, SIM registration, or government benefits were obtained in your name
You are receiving subpoenas, collection demands, or complaints arising from the impostor’s acts
The platform has refused removal despite continuing serious harm
The incident may involve cyberlibel’s one-year period

Common mistakes to avoid

Reporting the profile before saving its URL, content, and messages
Keeping only cropped screenshots
Deleting the conversation, email, or affected account after taking one screenshot
Paying an alleged hacker, “account tracer,” recovery agent, or takedown service
Trying to hack, trick, or secretly access the fake account
Secretly recording private calls without legal advice; recording can raise issues under the Anti-Wiretapping Act
Publicly threatening or falsely accusing a suspected operator
Posting an unredacted government ID to prove that the account is fake
Sending passwords, PINs, one-time codes, or full card details to “support”
Relying solely on mass reports by friends
Assuming account removal identifies the offender or preserves evidence
Assuming a barangay entry, platform report, or hotline inquiry is already a formal criminal complaint

What may happen after a report

The platform may request identification, restrict the account, require profile changes, remove particular content, suspend the account, or find no policy violation.

Law enforcement may interview witnesses, request additional records, seek preservation, apply for a cybercrime warrant, conduct device forensics, or refer the complaint to a prosecutor. A report does not automatically result in arrest, prosecution, conviction, damages, or recovery of money.

The prosecutor evaluates whether the evidence identifies the respondent and establishes the elements of an offense under the applicable DOJ-NPS rules. If a case proceeds, the prosecution must still prove guilt beyond reasonable doubt.

FAQ

Can I report a fake Facebook account if I do not have Facebook?

Yes. Facebook provides an impersonation-reporting route for people without accounts. Save the fake profile’s exact URL first.

Is using my photograph automatically identity theft?

Not necessarily. The law considers the information used, whether it was acquired or used without right, the purpose, and the harm. Unauthorized use may still violate platform rules, privacy law, intellectual-property rights, or another law even when the criminal elements of identity theft are not established.

Should I message the fake account?

Usually not. Contact may alert the operator, trigger deletion, or expose you to more manipulation. Preserve the evidence and let the platform or investigator handle contact. If an investigator proposes an operation, follow official instructions.

Can the police make the platform disclose who created the account?

Potentially, but disclosure ordinarily requires lawful process, including an appropriate cybercrime warrant. Available records may also be limited by retention periods, foreign jurisdiction, inaccurate registration data, or the suspect’s technical methods.

Can I file against an unknown person?

You may report even if you do not know the operator. Provide every available account identifier and fact that could assist identification. Do not guess a name merely to complete the complaint.

Will reporting remove the account immediately?

Not always. Platform review, evidence preservation, privacy proceedings, and criminal investigation are separate processes. Continue documenting new activity and retain all report numbers.

Primary and official resources

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. The correct remedy depends on the account, communications, documents, harm, parties, and evidence. Laws, procedures, and official reporting channels were checked through August 1, 2026.