Quick answer

If someone is using your name, photos, personal details, or organization’s identity through a fake social media account, preserve the evidence first, report the account through the platform’s impersonation process, and promptly file a complaint with the Philippine National Police Anti-Cybercrime Group (PNP ACG) or the National Bureau of Investigation Cybercrime Division (NBI CCD) when the account is being used to deceive, scam, threaten, harass, defame, or otherwise harm someone.

A platform report may remove the account, but it is not a police report and does not identify or prosecute the operator. Conversely, a criminal complaint does not automatically take the account down. For serious cases, do both in parallel.

If money, bank accounts, e-wallets, government IDs, SIM cards, intimate images, threats, stalking, or a child are involved, treat the matter as urgent.

When a fake account may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s or juridical entity’s identifying information, without right.

Identifying information may include a person’s name, birth date, address, contact information, government identification numbers, biometrics, and other data capable of identifying that person. A business, corporation, or other juridical entity may also be a victim.

A social media account may fall within this offense when, for example, its operator intentionally uses another person’s name, photograph, personal details, or credentials without authority for an illegitimate purpose. Common examples include:

Soliciting money or investments while pretending to be the victim
Contacting the victim’s relatives, customers, employees, or friends
Opening or promoting financial accounts using the victim’s identity
Publishing posts or sending messages as though they came from the victim
Using the account for harassment, threats, sexual abuse, or reputational harm
Taking control of the victim’s genuine account and changing its details

Not every fictitious, anonymous, fan, commentary, or parody account is automatically criminal identity theft. In Disini v. Secretary of Justice, the Supreme Court explained that identity information must be used for an illegitimate purpose and that merely acquiring or disseminating information made public by the person is not, by itself, identity theft. Whether a particular account is criminal depends on its purpose, presentation, conduct, authorization, and resulting harm.

Platform rules may nevertheless prohibit an account even when the available facts are insufficient to establish a crime.

Possible legal consequences

The statutory penalty for computer-related identity theft that has caused damage is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, Republic Act No. 10175 provides for a penalty one degree lower. The actual charge and sentence depend on the proven facts and the court’s application of the law.

Other offenses may apply instead of, or alongside, identity theft when their separate elements are present, such as:

Illegal access, computer-related forgery, or computer-related fraud under Republic Act No. 10175
Estafa, threats, coercion, falsification, or other offenses under the Revised Penal Code
Cyber libel, particularly when the fake account’s original author publishes defamatory statements
Violations of the Data Privacy Act of 2012
Gender-based online sexual harassment under the Safe Spaces Act
Violence against women and their children under Republic Act No. 9262, when the required relationship, conduct, and harm are present
Laws protecting children or prohibiting online sexual abuse, exploitation, and child sexual abuse or exploitation materials

These laws are not interchangeable. Investigators and prosecutors must determine which elements the evidence actually supports.

Where to report

Your immediate objective	Where to report
Remove or restrict the fake account	The social media platform’s official impersonation or account-reporting process
Identify and investigate the operator	PNP ACG, the nearest PNP station for referral, or NBI CCD/Cybercrime Regional Center
Address unlawful personal-data processing	The platform, organization, or other data controller first; then the National Privacy Commission when appropriate
Stop unauthorized financial activity	The bank, e-wallet, card issuer, lender, or payment provider immediately
Escalate an unresolved complaint against a BSP-supervised institution	Bangko Sentral ng Pilipinas Consumer Assistance Mechanism
Respond to immediate threats or danger	911 or the nearest police station
Report gender-based online sexual harassment	PNP ACG or a PNP Women and Children Protection Desk
Protect a child from sexual exploitation or abuse	Police or NBI immediately; do not redistribute the material

The PNP’s cybercrime-reporting guidelines provide that cybercrime incidents received through walk-in reports and official remote reporting channels should be attended to and referred to an investigator. Check the PNP ACG website for its current regional offices and reporting channels.

The NBI accepts requests for investigation through its Cybercrime Division and Cybercrime Regional Centers. Its published procedure includes an interview, preparation of a sworn complaint sheet or affidavit, collection of supporting documents and witness statements, and, when relevant, examination of a device. Consult the NBI Cybercrime Division Citizen’s Charter and NBI regional-office directory.

Choose one primary law-enforcement agency unless an investigator directs otherwise. If you have already reported the same incident elsewhere, disclose that fact and provide the existing reference number.

What to do, step by step

1. Preserve the account before reporting or blocking it

Record the account as it presently appears. Capture:

The complete profile and exact profile URL
Username, handle, display name, profile photograph, bio, and account ID if visible
Every relevant post, story, advertisement, comment, or marketplace listing
Messages sent by the account, including the sender’s profile and the date and time
Links, phone numbers, email addresses, QR codes, bank or e-wallet details, and payment instructions
Names of people contacted or deceived
Transaction confirmations, receipts, reference numbers, and account statements
Threats, sexual content, defamatory statements, and other harmful material
Platform report confirmations and case numbers

Take screenshots and, when useful, a continuous screen recording showing how you reached the profile from the platform. Keep the original, unedited files. If you need to mark or crop an image, work on a copy and retain the untouched original.

Write down when and how you discovered the account. Include the time zone. Ask recipients of fraudulent messages to preserve their own copies rather than merely forwarding screenshots to you.

Do not log into the fake account, guess its password, install tracking software, or attempt to obtain private data unlawfully. Such actions may compromise evidence and expose you to liability.

2. Secure your real accounts and contact points

If there is any possibility that your genuine account, email, phone number, or device has been compromised:

Change passwords using a trusted device
Use a different, unique password for every important account
Sign out unknown sessions and remove unfamiliar devices or connected applications
Enable multi-factor authentication, preferably through an authenticator app or passkey where available
Secure the email address and mobile number used for account recovery
Review forwarding rules, recovery addresses, and recent login activity
Contact your telecommunications provider if your SIM suddenly loses service or appears to have been replaced
Notify your employer’s or organization’s IT or security team if work credentials are involved

If the offender took over your genuine profile, use the platform’s hacked-account recovery process. An impersonation report alone may not restore access to the real account.

3. Report the account to the platform

On most platforms, open the fake profile, select the menu or three-dot icon, choose Report, and select the option for impersonation, pretending to be someone else, fake identity, scam, or account compromise. Interfaces change, so follow the current prompts.

Official reporting resources include:

Provide a direct link to your authentic account or another reliable way to establish your identity. If the platform requests identification, upload it only through the platform’s official form—not through a direct message, comment, or link sent by the suspected impostor.

Report specific harmful posts or messages separately when the platform offers distinct categories for scams, threats, harassment, nonconsensual intimate imagery, or child-safety violations. Save every confirmation.

4. Warn people who may be targeted

Using your genuine account or another verified channel, tell family members, friends, customers, employees, or business partners that the identified profile is unauthorized. State the exact username and link, explain that it must not be trusted, and advise recipients not to send money, disclose OTPs, or click links.

Keep the warning factual. Avoid publicly accusing a named suspect unless you have reliable evidence and legal advice.

5. File a law-enforcement complaint

Bring or submit:

A chronological written narrative
The fake account’s URL and identifying details
Copies of screenshots, recordings, messages, and files
Details of victims, witnesses, recipients, and transactions
Proof that the name, image, organization, or account belongs to you
Platform report numbers and responses
Bank, e-wallet, telecommunications, or other incident reports
Any information that may lawfully help identify the operator

State clearly what happened, when it happened, what information was used, how the account misrepresented itself, whom it contacted, and what harm or risk resulted. Distinguish what you personally know from what another person told you.

Ask for the complaint or incident reference number. Tell the investigator immediately if the account or messages are likely to disappear and ask whether a preservation request to the service provider is appropriate.

Under Republic Act No. 10175, service providers within the law’s reach must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. Do not assume that every platform retains every item indefinitely.

Subscriber, traffic, and content data are generally not something a private complainant can compel a platform to disclose. Law enforcement may seek the necessary court-authorized disclosure under the Rule on Cybercrime Warrants.

6. Report financial misuse immediately

If the impostor has obtained money, accessed an account, opened an account in your name, or circulated your bank or e-wallet details:

Contact the institution through its official fraud or consumer-assistance channel
Request appropriate blocking, security review, or account restrictions
Dispute unauthorized transactions in writing
Preserve the institution’s acknowledgment and ticket number
Change compromised credentials and payment PINs
Report the incident to PNP ACG or NBI

Institution-specific reporting periods can be short. Do not wait for the social media platform or police investigation before notifying the bank or e-wallet provider.

A complaint against a BSP-supervised institution must ordinarily be raised with that institution first. Unresolved concerns may then be escalated through the BSP Consumer Assistance Mechanism.

7. Consider a National Privacy Commission complaint

A privacy complaint may be appropriate when a platform, employer, business, government office, or other personal information controller unlawfully processes your data, refuses to correct or remove false or unauthorized personal information, or fails to respond properly to a privacy violation.

The Data Privacy Act gives data subjects qualified rights to dispute inaccurate data and seek its correction, blocking, removal, or destruction. Its application to an individual acting only in personal, family, or household affairs may be limited, so an NPC complaint is not automatically the correct remedy for every anonymous fake account.

Under the current NPC Rules of Procedure, as amended, you generally must first notify the personal information controller, processor, or concerned entity in writing. A complaint may proceed if it takes no timely or appropriate action or does not respond within 15 calendar days of receiving the written notice. The NPC may waive this exhaustion requirement for good cause or a serious violation involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

A formal NPC complaint must comply with prescribed requirements, including verification, supporting evidence, relevant correspondence, affidavits when applicable, requested relief, and a certification against forum shopping. It may be filed personally, by registered mail, courier, or authorized email. Use the NPC’s current complaint instructions and form.

Important deadlines and timing

There is no general rule requiring a victim to report computer-related identity theft within 24 or 72 hours. However, delay can result in deleted content, recycled phone numbers, lost transaction records, or unavailable subscriber data.

Criminal, civil, and administrative claims have different prescriptive periods, and the calculation may depend on the offense, date of commission or discovery, identity of the offender, interruption of prescription, and procedural history. Seek legal advice promptly if the incident is old or a filing deadline may be approaching.

For an NPC complaint, observe the 15-calendar-day prior-notice rule unless a waiver is justified. For gender-based online sexual harassment under Section 12 of the Safe Spaces Act, the law states that the action is imprescriptible, but prompt reporting remains important for protection and evidence preservation.

Situations requiring urgent help

Contact police immediately when the account is connected with:

A credible threat of violence, kidnapping, suicide coercion, or physical confrontation
Stalking, doxxing, or disclosure of a home, workplace, or child’s location
Extortion or demands made under threat of publishing private material
A compromised bank, e-wallet, credit card, SIM, email, or government account
Nonconsensual intimate images or sexually explicit manipulated media
Sexual harassment or impersonation intended to humiliate someone because of sex, gender, sexual orientation, or gender identity
Grooming, sexual exploitation, or images involving a child

The Safe Spaces Act specifically includes online impersonation within gender-based online sexual harassment when it forms part of the conduct covered by the law. PNP ACG is designated to receive such complaints. Ordinary impersonation without the required gender-based or sexual context should not automatically be characterized as a Safe Spaces Act violation.

If child sexual abuse or exploitation material is involved, do not download, resend, repost, or circulate it to prove that it exists. Preserve the URL, account details, date, and circumstances, and report it immediately to police or the NBI.

Common mistakes to avoid

Reporting the account before preserving its URL and contents
Keeping only cropped screenshots with no username, date, or context
Assuming that multiple platform reports automatically create a criminal case
Publicly confronting the operator and causing the account or evidence to disappear
Sending an OTP, password, payment, or identification document to someone claiming to provide “account recovery”
Paying unofficial “hackers” or takedown services
Trying to access the fake account without authority
Altering original files or deleting conversations after taking screenshots
Filing identical complaints with several agencies without disclosing the earlier reports
Waiting for a platform decision before notifying a compromised bank, e-wallet, telco, employer, or customer
Naming a suspected operator publicly without sufficient evidence
Assuming that account removal proves who operated it or establishes criminal guilt

What may happen after a report

A platform may remove, restrict, label, or retain the account depending on its rules and evidence. It may also decline the report, particularly where the account is clearly presented as commentary, parody, or a fan account.

Law enforcement may interview the complainant and witnesses, review devices and records, request preservation of platform data, and apply for cybercrime warrants where necessary. If sufficient evidence identifies a respondent and supports an offense, the matter may proceed to preliminary investigation before a prosecutor. Filing a report does not guarantee arrest, prosecution, conviction, damages, or immediate takedown.

The NPC may dismiss an insufficient complaint, facilitate proceedings, issue compliance or enforcement orders, impose appropriate administrative sanctions, award indemnity in matters affecting personal data, or recommend criminal prosecution to the Department of Justice.

Depending on the evidence, a victim may also have civil remedies under Articles 19, 20, 21, and 26 of the Civil Code. A lawyer should assess whether damages, injunctive relief, or another remedy is legally and practically available.

Frequently asked questions

Can I report the account even if no one has lost money?

Yes. Financial loss is not required before you submit a platform or police report. Republic Act No. 10175 expressly contemplates identity theft where no damage has yet been caused, although the statutory penalty is lower. Investigators must still determine whether the required intent, unauthorized use, and other elements are present.

Is a screenshot enough?

A screenshot is useful but may not be sufficient by itself to identify the operator or prove the full context. Preserve the exact URL, account details, messages, original files, timestamps, witnesses, transaction records, and platform acknowledgments.

Can I obtain the operator’s name or IP address directly from the platform?

Usually not. Platforms protect subscriber and traffic information and ordinarily disclose it only through valid legal process. Philippine investigators may seek a preservation order and court-authorized disclosure when the legal requirements are met.

Can someone report an account impersonating a relative or friend?

Platforms commonly allow reports concerning another person, but the victim’s cooperation and proof of identity may be required. For an NPC complaint, an adult representative generally needs a special power of attorney. Parents or guardians may represent minors subject to the current NPC rules.

What if the account is labeled “parody” or “fan”?

A clear label is relevant but not conclusive. The overall presentation and conduct matter. A genuinely non-deceptive parody or commentary account is different from an account that uses a disclaimer as cover while soliciting money, contacting victims, or deliberately creating confusion.

What if the person operating the account is outside the Philippines?

You may still report the incident. Republic Act No. 10175 contains jurisdictional rules covering certain offenses involving Philippine computer systems, Filipino nationals, or damage to a person in the Philippines. Identification, evidence collection, and enforcement abroad may require platform cooperation and international assistance through Philippine authorities.

Do I need a lawyer?

A lawyer is not required merely to make a platform, police, NBI, bank, or privacy report. Legal assistance is advisable when there are substantial financial losses, multiple victims, intimate images, threats, an identified suspect, possible civil action, overlapping complaints, or an approaching filing deadline.

Official legal and procedural sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The correct remedy and offense depend on the account’s contents, purpose, operator, evidence, and resulting harm. Laws, procedures, contact details, and platform interfaces were checked against current official sources on August 10, 2026.