Quick answer

If someone is using your name, photos, documents, contact details, or other identifiers to pose as you online:

Preserve the evidence before the account or posts disappear.
Report the profile and each harmful post or message to the platform.
Secure your real accounts, email, mobile number, and financial accounts.
Report to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division if your identity was used without authority, especially for scams, harassment, threats, loans, purchases, or reputational harm.
Call 911 immediately if there is a credible threat to life, safety, or property. If money or an account is at risk, contact the bank, e-wallet, lender, or telecommunications provider at once.

A fake, anonymous, parody, or duplicate account is not automatically a crime. The surrounding facts matter. Under the Cybercrime Prevention Act of 2012, computer-related identity theft involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person or organization.

Actual financial loss is not required for the offense to be possible, although the law provides a lower penalty when no damage has yet been caused. Whether a particular account meets the legal elements depends on what information was used, whether its use was authorized, how the account was presented, and what the operator did with it.

When a fake account may violate Philippine law

Several laws may apply to the same conduct. The proper charge is determined by investigators and prosecutors based on the evidence.

Conduct	Possible legal issue	Important qualification
Someone intentionally uses your identifying information without authority	Computer-related identity theft under Section 4(b)(3), Republic Act No. 10175	A similar name or image alone does not automatically establish every element. Context, authorization, account content, and evidence linking the account to an operator matter.
Your personal data is collected, copied, disclosed, or used without a lawful basis	Data Privacy Act of 2012	The Act has scope limitations and exceptions, including certain personal, family, household, journalistic, artistic, literary, and research activities. The National Privacy Commission determines whether the Act applies.
Impersonation forms part of targeted gender-based or sexual harassment	Safe Spaces Act	The online conduct must fall within the law’s definition of gender-based online sexual harassment; not every impersonation case does.
The account solicits money, goods, passwords, OTPs, or account access by deception	Computer-related fraud, estafa, access-device offenses, or other financial crimes	The applicable offense depends on how the deception was carried out, whether property or access was obtained, and what damage resulted.
The account posts defamatory accusations	Cyberlibel may be considered	A negative or false statement is not automatically libel. Publication, identification, defamatory imputation, malice, privilege, and other defenses or elements must be assessed.
The account sends threats, stalks, extorts, or publishes private sexual material	Threats, coercion, robbery or extortion-related offenses, the Safe Spaces Act, or laws protecting intimate images and children	The content, victim’s age, relationship of the parties, demands made, and circumstances determine which law applies.

Computer-related identity theft is punishable under Section 8 of Republic Act No. 10175 by prisión mayor—generally six years and one day to 12 years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The statute provides for a penalty one degree lower if no damage has yet been caused.

Unauthorized processing under the Data Privacy Act carries different penalties depending on whether ordinary or sensitive personal information is involved. For example, unauthorized processing of personal information is punishable by one to three years’ imprisonment and a ₱500,000 to ₱2 million fine; for sensitive personal information, the range is three to six years and ₱500,000 to ₱4 million. These penalties apply only when the prosecution proves the particular statutory offense.

Under the Safe Spaces Act, gender-based online sexual harassment can include online identity theft or impersonating a victim to harm the victim’s reputation when done within the gender-based harassment covered by the law. The penalty is prisión correccional in its medium period—generally two years, four months, and one day to four years and two months—or a ₱100,000 to ₱500,000 fine, or both. Qualified circumstances can increase the penalty.

Step 1: Deal with immediate danger or financial risk

Do not wait for a platform takedown if the account is being used for an active crime.

For a credible threat, stalking near your home or workplace, planned violence, or another emergency, call the Philippines’ Unified 911 emergency service and go to the nearest police station.
If money was sent or an unauthorized transaction occurred, contact the bank or e-wallet through its official fraud channel immediately. Ask whether the transaction or recipient account can still be restricted, traced, recalled, or disputed. Keep the reference number.
If a loan, credit card, financial account, or e-wallet was opened in your name, notify the institution in writing that you dispute the application or account. Request copies of the application and records that the institution may lawfully provide.
If your SIM stopped working unexpectedly or password-reset messages suggest a SIM swap, contact your telecommunications provider immediately.
If the account is using your workplace or business identity, alert the organization’s security, legal, data-protection, or fraud team.
If intimate images are involved, report them promptly to the platform and law enforcement. The Anti-Photo and Video Voyeurism Act may apply depending on how the material was created and shared.
If a child may be sexually exploited, contact law enforcement immediately. Preserve account names, URLs, and report references, but do not download, forward, repost, or circulate suspected child sexual abuse material. Republic Act No. 11930 provides special protections against online sexual abuse or exploitation of children.

Step 2: Preserve evidence before reporting or blocking

Take screenshots, but do not rely on screenshots alone when more complete evidence is available.

Preserve:

The full profile URL, username, display name, account ID if visible, profile photo, biography, creation information, and follower or friend details relevant to the impersonation.
Screenshots showing the full screen, address bar or profile path, and the device’s date and time.
A screen recording that begins outside the profile, navigates to it, and opens the relevant posts or messages.
Direct messages, comments, posts, stories, advertisements, payment requests, voice notes, videos, and call logs.
Original email messages and attachments. Retain complete email headers where available.
Password-reset notices, login alerts, security emails, and records of unknown devices or sessions.
Transaction receipts, account numbers, mobile numbers, QR codes, wallet addresses, delivery records, and names used by the operator.
Messages from people who were contacted or deceived by the account. Ask them to retain their own originals.
Your authentic profile, earlier posts, photographs, records, or documents showing that the copied information belongs to you.
Platform report confirmations, ticket numbers, takedown notices, and every response.
A chronological log stating when you discovered the account, what it did, who was contacted, what harm occurred, and what action you took.

Keep the original files. Avoid cropping, annotating, recompressing, or repeatedly forwarding the only copy. Make at least one secure backup. Do not factory-reset a relevant device, delete the conversation, or close your real account before saving needed records and completing account recovery.

If you must give a device to investigators, ask how it will be documented and whether you can retain a copy of essential personal files. Never alter another person’s device or account to obtain evidence.

Step 3: Report the profile and content to the platform

Report both the account and any separate posts, advertisements, or messages that violate platform rules. Use the impersonation category when available and explain specifically:

Whom the account is pretending to be;
Which identifiers, photographs, or documents were copied;
How viewers are being misled;
Whether the account is requesting money or information;
Whether threats, harassment, sexual material, or private information are involved; and
The URL of the authentic account, if one exists.

Official reporting pages include:

The platform may request proof of identity. Submit it only through the platform’s official app or help center. Do not send your password, OTP, recovery code, or full identification document to an account claiming to be “support.”

A platform report is not the same as a police complaint. Removal may stop the immediate public harm, but it does not identify the operator or decide criminal or civil liability. Platform review times and outcomes vary, and Philippine law does not impose one universal takedown deadline for every impersonation report.

Step 4: Secure your real accounts

If your genuine account was accessed or taken over, use the platform’s compromised-account recovery process in addition to reporting impersonation.

From a device you reasonably believe is secure:

Change the password of the email account connected to your social media.
Change affected social-media and financial passwords. Use a different password for every important account.
Enable multi-factor authentication, preferably through an authenticator app or security key when available.
Review active sessions and sign out unknown devices.
Remove unfamiliar recovery emails, mobile numbers, applications, and browser extensions.
Save recovery codes in a secure offline location.
Check email forwarding rules and deleted or archived messages.
Ask close contacts to verify unusual requests through a different channel.
Publish a short warning through your authentic account if doing so will not increase your safety risk.

Do not publicly post your government ID, specimen signature, address, birth date, police affidavit, or unredacted complaint merely to prove that you are the victim.

Step 5: Report to the PNP, NBI, or CICC

Republic Act No. 10175 designates the Philippine National Police and National Bureau of Investigation as the principal law-enforcement authorities for cybercrime.

You may:

File through the PNP Anti-Cybercrime Group e-Complaint page or approach the nearest PNP station or regional cybercrime unit. If the online page is unavailable, file in person.
Submit an initial report through the NBI Online Complaint page or go to the NBI Cybercrime Division or an appropriate regional office.
Call the government’s CICC anti-scam and cybercrime hotline at 1326, or use the current contact information published by the Department of Information and Communications Technology, for incident referral and coordination.

The NBI’s published Cybercrime Division procedure includes completing a complaint sheet, undergoing a preliminary interview, executing a sworn statement or submitting an affidavit, and providing relevant documents or devices for examination.

Prepare a clear complaint package containing:

Your identifying and contact information;
The fake account’s URLs, usernames, mobile numbers, and email addresses;
A chronological statement of facts based on personal knowledge;
Copies of preserved digital evidence;
Proof that the copied identity or account belongs to you;
Details of money, property, opportunities, or reputation affected;
Names and contact details of witnesses;
Platform and financial-institution report numbers; and
Any known facts that may identify the operator.

If the operator is unknown, say so. Do not guess. State the available leads, such as payment accounts, delivery addresses, mobile numbers, linked profiles, email addresses, or persons who directly communicated with the account.

Ask for proof that your complaint was received, such as a reference, docket, blotter, or complaint number. Keep copies of everything submitted. An initial police, NBI, or CICC report may lead to investigation, but it does not by itself guarantee prosecution. A criminal case ordinarily requires sufficient evidence and evaluation by the proper prosecutor and court.

How authorities can obtain account records

Victims usually cannot compel a platform to disclose the account holder’s subscriber data themselves.

Under the Cybercrime Prevention Act and court rules, law-enforcement officers may seek preservation and, when legally required, a court-issued cybercrime warrant for disclosure, search, seizure, interception, or examination of computer data. The Supreme Court has emphasized that disclosure under Section 14 of Republic Act No. 10175 requires judicial intervention in Disini v. Secretary of Justice.

The law provides minimum preservation periods for certain traffic data and subscriber information and permits preservation orders and extensions in appropriate investigations. This does not guarantee that every platform retains every post or identifying record for the same period. It also does not mean that an ordinary platform report automatically creates a Philippine legal preservation order. Report promptly so investigators can assess whether preservation or warrant procedures are necessary.

Step 6: Consider a National Privacy Commission complaint

A complaint to the National Privacy Commission may be appropriate when your personal information was unlawfully collected, disclosed, copied, or used and the conduct falls within the Data Privacy Act.

Before filing, the amended 2021 NPC Rules of Procedure generally require you to:

Inform the personal information controller, processor, or concerned entity in writing about the privacy violation or data breach; and
Allow it to take appropriate action.

Ordinarily, the NPC will not give the complaint due course if the entity appropriately acts or if fewer than 15 calendar days have passed since it received your written notice. The NPC may waive this requirement for good cause or serious cases, including grave and irreparable damage, lack of an adequate remedy, or patently illegal conduct.

A formal complaint must generally be written, signed, verified, and supported by evidence. It should identify the respondent or provide circumstances that may lead to identification; explain the facts and requested relief; attach correspondence with the respondent; include supporting documents and witness affidavits, if any; and contain the required certification against forum shopping.

The NPC’s filing instructions and complaint form allow filing personally, by registered mail, courier, or authorized email. The complaint form should be notarized, and applicable filing fees or exemptions should be checked before submission.

An NPC proceeding is separate from a criminal investigation. If there is fraud, a threat, extortion, stalking, or another suspected crime, also report to the PNP or NBI.

Special deadlines and situations requiring prompt legal advice

Do not assume that every online offense has the same filing period.

The Supreme Court has held that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. The Court reaffirmed that rule in its 2026 resolution in Causing v. People. Seek legal advice promptly if defamatory posts are involved.
An offense under Section 12 of the Safe Spaces Act—gender-based online sexual harassment—is declared imprescriptible by that law. Prompt reporting remains important for safety and evidence.
NPC complaints ordinarily require prior written notice and the 15-calendar-day response period, subject to the exceptions discussed above.
Platform policies have their own procedures but do not create one uniform Philippine legal filing deadline.
Other crimes and civil actions have different prescriptive periods. The correct period may depend on the offense, the date of discovery, interruptions of prescription, and procedural steps already taken.

Urgent legal assistance is especially advisable when the account operator is known, multiple victims lost money, the account is still soliciting funds, a child is involved, intimate material is being circulated, the victim is being stalked, the account is affecting employment or credit, or a court order may be needed.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and contents.
Keeping only cropped screenshots with no username, date, time, or context.
Deleting messages, security notices, or transaction records after making a report.
Paying an impersonator, “recovery agent,” or supposed platform employee.
Sending an OTP, password, recovery code, or unredacted ID through direct message.
Hacking, guessing passwords, secretly accessing devices, or creating another fake account to retaliate.
Publicly accusing a suspected person without sufficient evidence.
Posting the fake account repeatedly in a way that spreads the scam or private material.
Asking others to submit false or exaggerated reports. Witnesses should make truthful, independent reports based on what they personally saw.
Assuming account removal means the evidence or operator’s records will remain available.
Using a copyright report merely because you appear in a photograph. The copyright may belong to the photographer or another rights holder; impersonation and privacy reporting routes may be more appropriate.
Waiting for financial loss before acting. The identity-theft provision recognizes that an offense may exist even before damage occurs.

Frequently asked questions

Can I report an anonymous account if I do not know who operates it?

Yes. Preserve the URLs, usernames, linked accounts, payment details, mobile numbers, email addresses, and communications. In your complaint, identify the respondent as unknown and provide only facts that may help investigators identify the operator.

Is copying my name and profile photo automatically identity theft?

Not automatically. It may be strong evidence of impersonation, but criminal liability depends on all statutory elements and the surrounding facts. A clearly labeled parody, fan, commentary, or fictional account may present different issues from an account deliberately represented as your authentic profile.

Can the police make the platform reveal the operator?

Law enforcement may seek records through legally authorized preservation and cybercrime-warrant procedures. Disclosure is not automatic, and useful records may be unavailable, incomplete, outside the Philippines, or associated with false information.

Should I confront the person I suspect?

Usually not if there are threats, extortion, stalking, financial fraud, or a risk that evidence will be destroyed. Preserve the evidence and let investigators decide whether contact, surveillance, or another lawful step is appropriate.

Do I need a lawyer to make an initial report?

No lawyer is generally required to submit a platform report or approach the PNP or NBI. Legal assistance can be valuable when preparing sworn allegations, identifying the correct respondents and causes of action, responding to counter-allegations, seeking damages or an injunction, or dealing with short prescriptive periods.

Can someone report on behalf of the victim?

Platform rules vary. Under the NPC rules, a representative generally needs a special power of attorney. A parent may represent a minor with proof of relationship, while a court-appointed guardian should provide the appropriate court order. Criminal complaints and sworn statements may still require the victim’s participation when the victim has personal knowledge of essential facts.

What if the impersonator is abroad?

Philippine cybercrime jurisdiction may still exist when an element occurred in the Philippines, a computer system wholly or partly situated here was used, or damage was caused to a person who was in the Philippines at the time. Obtaining foreign records and enforcing legal process may require international cooperation and can take longer.

Does reporting to the platform file a criminal case?

No. A platform report asks the company to enforce its policies. A criminal investigation requires a separate report to law enforcement and, if the evidence supports it, proceedings before the prosecutor and court.

What if the account disappears after I report it?

Give investigators the preserved profile URL, username, screenshots, recordings, report confirmation, and any linked payment or contact information. A deleted or disabled public profile does not necessarily mean that all provider records have been erased, but recovery or disclosure depends on retention and lawful process.

What should I tell friends and customers?

Use your verified or previously established channels. State briefly that the identified account is unauthorized, tell people not to send money or information, provide the link to your authentic account, and ask anyone contacted by the impostor to preserve the complete conversation and report it.

Official sources and reporting links

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The applicable law, offense, venue, deadline, and remedy depend on the evidence and specific circumstances. Official sources and procedures were checked as of 28 July 2026.