Quick answer
If someone creates a fake social media account using your identity, photographs, name, contact details, or other identifying information, preserve the evidence before the account disappears, report the account through the platform’s impersonation or abuse system, and report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) or NBI Cybercrime Division (NBI-CCD) when the circumstances indicate identity theft, fraud, threats, harassment, account hacking, or another crime. You may also report cybercrime incidents to the Cybercrime Investigation and Coordinating Center (CICC).
Under Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another person or juridical entity. The Supreme Court upheld this provision in Disini v. Secretary of Justice. (Lawphil)
A fake account, however, is not automatically proof that a criminal offense has been established. Investigators and prosecutors must examine what identifying information was used, whether its use was without right, who controlled the account, and what the account was used to do. An impersonation account used to solicit money, deceive contacts, damage a person's reputation, threaten someone, or take over another account generally presents a much more serious evidentiary picture than a profile that merely resembles someone.
What Philippine law treats as computer-related identity theft
Republic Act No. 10175 expressly criminalizes the unauthorized use or misuse of another person's identifying information through computer systems. In Disini, the Supreme Court explained that identifying information ordinarily includes such information as a person's name, citizenship, address, contact number, place and date of birth, spouse's name, occupation, and similar data. The Court sustained the constitutionality of the identity-theft provision. (eLibrary)
Section 8 of RA 10175 provides, for computer-related offenses under Section 4(b), a penalty of prision mayor or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. Prision mayor ordinarily runs from six years and one day to twelve years. For computer-related identity theft, the statute expressly states that if no damage has yet been caused, the penalty is one degree lower. (Lawphil)
The absence of financial loss therefore does not necessarily mean that there is nothing to report. The statute itself contemplates a situation in which identifying information was unlawfully used but damage has not yet occurred.
A fake profile may also involve other offenses depending on what the impersonator actually does. Examples can include computer-related fraud, illegal access when a genuine account was hacked, cyber libel when the offender authors defamatory material online, threats, harassment, or conventional fraud offenses. The correct charge depends on the evidence and should not be assumed simply from the existence of a suspicious profile. RA 10175 separately defines illegal access, computer-related fraud, computer-related forgery, identity theft, and cyber libel. (Lawphil)
Fake account versus hacked account
These situations should be distinguished because the immediate response is different.
A fake or impersonation account is a separate account created or operated so that other people may believe it represents you. Preserve the profile URL, username, photographs, posts, messages, and evidence showing how the account is presenting itself.
A hacked or taken-over account is your genuine account that another person has accessed without authority. Secure the associated email address and mobile number immediately, change passwords from a trusted device, terminate unfamiliar sessions where possible, activate multi-factor authentication, and use the platform's official account-recovery procedure. Unauthorized access to a computer system is itself an offense under Section 4(a)(1) of RA 10175. (Lawphil)
The DOJ Office of Cybercrime has specifically advised victims of compromised Facebook accounts to use Meta's recovery mechanisms and, where a cybercrime complaint is warranted, to proceed to the NBI Cybercrime Division or PNP Anti-Cybercrime Group. (Cybercrime Division)
What to do as soon as you discover the fake account
Preserve the evidence before asking for removal. Capture the entire profile, including its username, display name, profile URL, photographs, biography, follower information where relevant, posts, comments, messages, and any payment instructions. Save screenshots and, where useful, a screen recording showing you navigating to the actual account rather than relying only on cropped images. Record the date and approximate time when you found each item.
Save evidence showing what the impersonator did. Preserve direct messages sent to your friends, relatives, clients, customers, coworkers, or other victims. If the account requested money, retain bank or e-wallet account details, QR codes, phone numbers, transaction references, receipts, payment confirmations, and communications relating to the request. Ask recipients to retain the original messages on their devices instead of merely forwarding screenshots to you.
Preserve proof of your genuine identity and genuine account. Your legitimate profile URL, earlier posts, account registration information available to you, government identification where appropriate, business records, and witnesses familiar with your real account may help distinguish the genuine account from the impersonator.
Report the account to the social-media platform. Use the platform's specific impersonation, fake-account, fraud, harassment, or hacked-account reporting mechanism. Do this after preserving the important evidence because removal of the account may make publicly accessible material unavailable. A platform report can lead to a takedown, but it is not the same as filing a criminal complaint.
Secure the accounts that could be used to take over your identity. Change compromised or reused passwords, particularly for your primary email account. Enable multi-factor authentication. Check recovery email addresses, mobile numbers, logged-in sessions, and unfamiliar devices. If your SIM, email, online banking, or e-wallet may also have been compromised, contact the relevant provider promptly.
File a cybercrime report when criminal conduct is involved or reasonably suspected. You may approach the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Give investigators a chronological narrative, the URLs and usernames involved, copies of your evidence, the identities of witnesses or other victims, financial records if money was involved, and whatever reliable information you have about the suspected operator. Do not manufacture a suspect merely because you have a personal suspicion.
Ask about preservation of provider data if identification of the account operator is important. RA 10175 provides mechanisms through which law-enforcement authorities can require preservation of computer data and, with the necessary judicial authority, obtain relevant subscriber or other computer data. Because provider records can be time-sensitive, early reporting can materially improve the chances that useful electronic evidence remains available. (Lawphil)
If money has been transferred, contact the bank or e-wallet immediately as well. Give the financial institution the transaction references and explain that the transfer arose from impersonation or fraud. A cybercrime complaint does not replace the need to seek immediate assistance from the institution holding or receiving the funds.
Where to report identity theft and fake accounts
PNP Anti-Cybercrime Group
The PNP-ACG investigates cybercrime and maintains regional anti-cybercrime units. Its current official contact directory lists the Cyber Response Unit at complaint@acg.pnp.gov.ph, mobile number 0968 878 3561, and the PNP-ACG hotline at (02) 8723-0401 local 7490. Regional contact details are also published by the PNP-ACG. (PNP ACG)
If the impersonation involves an immediate threat, active extortion, ongoing transfer of money, or another rapidly developing offense, do not wait for the fake profile to be removed before seeking police assistance.
NBI Cybercrime Division
The NBI's current Citizen's Charter states that members of the general public may proceed to the Cybercrime Division to request investigative assistance. The process includes an initial interview, preparation of a sworn complaint sheet, execution or submission of sworn statements, collection of supporting documents, and, when relevant, examination of a device connected with the investigation. The NBI lists ccd@nbi.gov.ph as the Cybercrime Division's email address. (National Bureau of Investigation)
The NBI's current main-office contact page identifies its main office at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, while its website separately lists regional and district offices nationwide. Check the NBI's official website before travelling because office assignments and locations can change. (National Bureau of Investigation)
Cybercrime Investigation and Coordinating Center
The CICC coordinates government efforts against cybercrime. Its official public materials identify 1326 as its cybercrime hotline and report@cicc.gov.ph as a reporting email address. CICC reporting can be useful for cybercrime intake and coordination, particularly for online scams. (CICC)
For an incident that requires investigation of a particular offender, however, be prepared to execute a formal complaint and provide evidence to the appropriate law-enforcement agency.
DOJ Office of Cybercrime
The DOJ Office of Cybercrime is the central authority for cybercrime-related international cooperation and also has authority under the implementing rules to act on complaints or referrals and facilitate investigation, evidence preservation, production of data, and prosecution. Its official contact page currently lists cybercrime@doj.gov.ph and (02) 8524-8216. (Cybercrime Division)
This can become particularly relevant when electronic evidence or a service provider is located outside the Philippines, although ordinary victims will commonly begin with the PNP-ACG or NBI-CCD.
Why preserving the URL matters
A screenshot showing a name and photograph is useful, but it may not uniquely establish which online account produced the material. Whenever possible, preserve the complete profile URL and the URL of individual posts. Also record the username exactly as displayed because usernames can later be changed.
For Facebook, Meta itself advises complainants to provide links identifying the material being reported. The same basic principle is useful in a criminal investigation: investigators need information that helps them locate and identify the relevant computer data, not simply an image detached from its online source. (Facebook)
Do not intentionally modify evidence. Keep original screenshots and files in addition to any copies you annotate for explanation. Preserve the original messages on the phones or computers where they were received when practicable.
Can investigators obtain information behind an anonymous account?
Potentially, yes, but identification is not automatic.
RA 10175 requires preservation of traffic data and subscriber information relating to communication services for a minimum period of six months from the transaction. Content data may be preserved for six months from receipt of a law-enforcement preservation order, and law enforcement may order a one-time extension for another six months. Disclosure of protected computer data generally involves judicial process under RA 10175 and the Supreme Court's Rule on Cybercrime Warrants. (Lawphil)
The success of an investigation nevertheless depends on the records that actually exist, whether the relevant provider retains them, whether the account information is genuine, the use of VPNs or other concealment techniques, jurisdictional issues, and cooperation obtainable from service providers. A victim should therefore avoid assuming that a username, mobile number, or profile photograph conclusively identifies the person who operated the account.
What if the fake account has already been deleted?
Report it anyway if you preserved meaningful evidence or other people still have messages from the account. Deletion of the public-facing profile does not necessarily establish that all associated provider records have disappeared.
Give investigators the former username, complete or partial profile URL, approximate dates of activity, screenshots, message threads, associated email addresses or mobile numbers, financial-account information, and details of witnesses who interacted with the profile. Prompt reporting is particularly important because electronic records are not retained indefinitely and law-enforcement preservation mechanisms work prospectively on data that remains available.
Data Privacy Act complaints
Identity misuse may also raise issues under Republic Act No. 10173, or the Data Privacy Act of 2012. The Act regulates the processing of personal information and penalizes specified forms of unauthorized processing and other unlawful handling of personal data. Whether a particular impersonation case falls within those provisions depends on the facts, applicable lawful bases, statutory exclusions, and the role of the person or organization processing the information. (Lawphil)
A complaint before the National Privacy Commission (NPC) is therefore a possible additional remedy when the case genuinely involves misuse of personal data or a violation by a personal information controller, processor, or concerned entity. It is not a substitute for a PNP or NBI complaint when the objective is criminal investigation of an identity thief.
Under the NPC's 2021 Rules of Procedure, a complainant generally must first inform the personal information controller, processor, or concerned entity in writing of the alleged privacy violation and give it an opportunity to take appropriate action. The exhaustion requirement is satisfied when no timely or appropriate action is taken or there is no response within 15 calendar days from receipt of the written notice. The NPC may waive the requirement for good cause or in serious cases where the risk of harm justifies immediate Commission action.
The NPC's current website states that a formal complaint should use its prescribed complaint form, be notarized, and may be submitted personally, by courier, or by scanned email to complaints@privacy.gov.ph. The NPC announced a new Complaint-Affidavit template effective 1 July 2025, so use the form currently posted on the Commission's website rather than an old downloaded copy. (Privacy Commission)
There is no reason to wait for financial damage
A common mistake is to assume that nothing can be reported until someone loses money. RA 10175's identity-theft provision expressly contemplates cases in which no damage has yet occurred and prescribes a lower penalty in that situation. (Lawphil)
If a fake profile is actively contacting your relatives, clients, coworkers, or customers while pretending to be you, early action may prevent losses and also preserve stronger evidence of how the account was being used.
Do not rely only on mass reporting
Friends and followers may help report an impersonation account to the platform, but hundreds of platform reports are not a substitute for evidence identifying the unlawful conduct.
For a criminal complaint, the useful materials are the profile and post URLs, messages demonstrating impersonation or deception, financial or contact information supplied by the offender, records of resulting losses or harm, witnesses, and any facts reliably connecting a person to operation of the account. A well-organized evidence package is generally more useful than a large collection of repetitive screenshots.
Common mistakes that can weaken the response
One recurring mistake is having the account removed before saving its URL and content. Others include keeping only heavily cropped screenshots; deleting original conversations; confronting the suspected offender and causing evidence to disappear; publicly accusing a particular individual without sufficient proof; paying an impersonator or extortionist to make the problem stop; giving passwords or OTPs to someone claiming to be an investigator; and factory-resetting a compromised device before investigators have determined whether examination may be useful.
It is also important not to confuse the account's display name with proof of the operator's identity. A fake account can use another person's name, photograph, SIM, email address, or financial account. Each digital identifier must be investigated rather than simply assumed to belong to the offender.
How quickly should you report?
RA 10175 does not impose a general rule requiring an identity-theft victim to submit a police or NBI complaint within 24, 48, or 72 hours. That does not mean delay is harmless.
Electronic evidence can disappear quickly, provider records are subject to retention periods, victims may continue sending money to an impersonator, and offenses are eventually subject to legal periods of prescription. Violations punished under special laws are generally governed by Act No. 3326 when the special statute supplies no different prescriptive rule, with the applicable period depending on the penalty prescribed for the particular offense. (Lawphil)
The practical rule is therefore simple: preserve the evidence and report promptly rather than calculating how long you can safely wait.
When legal or law-enforcement help is urgent
Seek immediate assistance when the impersonator is currently asking people to transfer money, has obtained access to your real account or email, is demanding payment to stop publishing information, is threatening physical harm, is publishing or threatening to publish intimate material, is targeting a child, is using stolen government or financial credentials, or is continuing to contact victims while pretending to be you.
These circumstances may involve offenses beyond identity theft and may require preservation requests, financial-account intervention, protective measures, or other time-sensitive investigative steps.
FAQ
Is using my name and photograph on a fake Facebook account automatically computer-related identity theft?
Not automatically. Those facts can be important evidence, but criminal liability ultimately depends on proof of the statutory elements, including intentional acquisition or use of identifying information belonging to another without right. The account's purpose and conduct, the information used, and evidence identifying its operator all matter. (Lawphil)
Can I file a complaint even if nobody has lost money?
Yes. Actual monetary loss is not an indispensable reason to wait. Section 4(b)(3) expressly provides for a lower penalty where no damage has yet occurred. (Lawphil)
Do I need to know who created the account before I report it?
No. Give investigators the information you actually possess. Do not invent or overstate the identity of a suspect. One purpose of a cybercrime investigation is to determine whether available computer data, witnesses, devices, payment information, subscriber records, or other evidence can identify the operator.
Should I report the account to Facebook, Instagram, TikTok, or another platform first?
Preserve the evidence first, then report the account through the platform without unnecessary delay. Platform reporting and criminal reporting serve different purposes: one seeks action by the platform, while the other can lead to investigation and prosecution.
Can the police demand the account owner's private data from a social-media company simply because I complained?
Not merely on your request. Philippine law provides judicial and law-enforcement procedures for preservation, disclosure, interception, search, seizure, and examination of computer data. The Supreme Court's Rule on Cybercrime Warrants governs the relevant warrant procedures. (eLibrary)
Should I file with both the NBI and PNP?
Either agency can be an appropriate starting point. Filing identical formal complaints in several offices can create unnecessary duplication, so inform each agency if the same incident has already been formally reported elsewhere. CICC may also assist with cybercrime reporting and coordination.
What if the fake account is operated from another country?
Report it in the Philippines if the conduct affects you here. RA 10175 provides Philippine jurisdiction in specified circumstances, including where an element occurs in the Philippines, a relevant computer system is situated wholly or partly here, or damage is caused to a person who was in the Philippines when the offense was committed. The law also provides for international cooperation in cybercrime matters. (Lawphil)
Official sources
Republic Act No. 10175 — Cybercrime Prevention Act of 2012
Supreme Court decision in Disini v. Secretary of Justice
PNP Anti-Cybercrime Group contact directory
NBI Cybercrime Division — investigative assistance for computer-crime victims
Cybercrime Investigation and Coordinating Center
Republic Act No. 10173 — Data Privacy Act of 2012
National Privacy Commission — filing a formal complaint
General-information disclaimer
This article provides general Philippine legal information, not legal advice for a specific case. The proper complaint, offense, evidence, venue, and remedy depend on the actual account activity, the information used, the identity and location of the persons involved, available electronic records, and any resulting harm. Where money, safety, account access, intimate material, or rapidly disappearing digital evidence is involved, obtain individualized legal or law-enforcement assistance promptly.
Sources and procedures checked as of 25 August 2026.