Quick answer

If someone creates a social media account that deliberately uses your name, photos, identity details, or organizational identity without authority, preserve the evidence first, report the account to the platform, secure your legitimate accounts, and—if the impersonation appears fraudulent, harmful, threatening, or otherwise criminal—report it promptly to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division (NBI-CCD).

Philippine law expressly criminalizes computer-related identity theft. Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person. The law contemplates liability even where damage has not yet occurred, although its penalty provision treats the absence of damage differently. The Supreme Court upheld this offense as constitutional in Disini v. Secretary of Justice. (Lawphil)

A fake account is not automatically a criminal case simply because it resembles another account. The facts still matter. A parody, fan page, account using a coincidentally similar name, or other non-deceptive use may be very different from an account deliberately presenting itself as you in order to deceive people. Criminal liability depends on the actual conduct, the information used, whether the use was "without right," the person's intent, and any related acts such as fraud, hacking, threats, falsification, or defamatory publication.

First: preserve the fake account before trying to have it removed

The most common mistake is reporting the account immediately and then discovering that the profile, messages, or posts disappeared before useful evidence was saved.

Before blocking or reporting the account, where it is safe to do so, preserve:

the complete profile URL, not merely the displayed username;
the username or handle and any visible account or profile ID;
screenshots showing the entire profile, including the profile photo, cover photo, bio, followers or friends, and identifying details;
screenshots and direct links to individual posts, stories, videos, advertisements, or comments;
messages sent by the fake account to you or to other people;
dates and approximate times when the account, posts, or messages were discovered;
screenshots showing the account asking for money, passwords, OTPs, identification documents, or other information;
bank, e-wallet, cryptocurrency, remittance, or payment details supplied by the impersonator;
transaction receipts if anyone sent money;
email or SMS notifications connected with the incident;
names and contact details of people who received messages from the fake account;
copies of your legitimate social media profiles and documents that can establish that you are the person being impersonated; and
the platform's acknowledgment, reference number, or decision after you report the account.

Keep the original files. Avoid cropping, annotating, filtering, or repeatedly re-saving the only copy of a screenshot or video. If possible, retain an untouched copy and make a separate working copy.

This can matter because social media information may later be deleted, deactivated, or changed. Philippine cybercrime procedures allow law-enforcement authorities, subject to the applicable legal requirements, to seek preservation and disclosure of computer data from service providers. RA 10175 requires preservation of certain subscriber and traffic data for minimum periods and permits preservation orders for content data; disclosure of protected data for an investigation generally requires the appropriate court warrant. (eLibrary)

For that reason, early reporting can be important even when you already have screenshots. Screenshots may show what happened, but information held by the platform may be needed to investigate who operated the account.

Secure your real accounts immediately

Determine whether you are dealing with a new fake account or whether somebody actually took over your genuine account.

If your real account has been accessed without permission:

Change its password immediately.
Change the password of the connected email account as well.
Sign out unknown or unrecognized sessions and devices.
Enable two-factor authentication.
Remove unknown recovery email addresses, phone numbers, linked applications, or devices.
Check whether the attacker changed privacy, payment, advertising, business-page, or administrator settings.
Change reused passwords on other important accounts.
Contact your telecommunications provider promptly if you suspect a SIM-swap or unauthorized SIM replacement.
Check bank and e-wallet accounts if the compromised email address or mobile number is used for financial authentication.

Unauthorized access to a computer system is itself an offense under Section 4(a)(1) of RA 10175, separate from computer-related identity theft where the facts establish the latter offense. Mobile phones and smartphones are included within the law's concept of computer systems. (Lawphil)

For a compromised Facebook account, Meta directs users to its hacked-account recovery process. (Facebook)

Report the fake account to the social media platform

Platform reporting and a criminal complaint serve different purposes.

Reporting to the platform is primarily intended to obtain restriction, removal, suspension, or correction of the account or content. Reporting to Philippine authorities allows investigators to determine whether a crime was committed and, where justified, seek information that an ordinary user cannot obtain.

Use the platform's official reporting mechanism and select the most accurate category available, such as impersonation, pretending to be someone, fake account, scam, or harassment.

Do not send a copy of your government ID to the fake account itself. If the platform legitimately requests identity verification, submit it only through the platform's official application, website, or help-center process.

For example, TikTok provides a specific impersonation-reporting process and may require identification in some cases. X likewise accepts impersonation reports and states that accounts deceptively posing as another individual, group, or organization may violate its authenticity rules.

Platform rules can be broader or narrower than Philippine criminal law. Removal of an account does not itself prove that a Philippine crime occurred, and a platform's refusal to remove an account does not prevent law enforcement from investigating conduct that may violate Philippine law.

Report criminal identity theft to the PNP Anti-Cybercrime Group

RA 10175 designates the Philippine National Police and National Bureau of Investigation as the principal law-enforcement authorities for cybercrime cases. (Lawphil)

For the PNP, the specialized unit is the PNP Anti-Cybercrime Group.

The PNP-ACG's official contact directory lists its Cyber Response Unit at:

Complaint email: complaint@acg.pnp.gov.ph
Contact number: 0968 878 3561
PNP-ACG trunkline: (02) 8723-0401, local 7490

The directory also lists Regional Anti-Cybercrime Units and provincial or district cyber-response teams for different areas of the Philippines. Because government contact information can change, verify the current unit before sending sensitive documents. (PNP ACG)

When reporting, clearly explain:

who is being impersonated;
when you discovered the fake account;
the exact URL or handle;
which photos, names, IDs, business details, or other identifying information were used;
what the fake account represented itself to be;
whether it contacted other people;
whether anybody sent money or disclosed information;
whether threats, harassment, defamatory statements, or fraudulent transactions occurred; and
whether you know or suspect who operates the account and, if so, the factual basis for that suspicion.

Avoid presenting guesses as facts. If you merely suspect a particular person, say so and explain why.

You may also report to the NBI Cybercrime Division

The NBI Cybercrime Division accepts requests for investigative assistance from members of the public.

Its current Citizen's Charter states that a complainant may proceed to the Cybercrime Division to file a complaint or request an investigation. The process includes completing a complaint sheet, a preliminary interview, and—where applicable—the execution of sworn statements or submission of prepared affidavits and supporting documents. The NBI may also examine a device relevant to the investigation. Its Citizen's Charter lists no fee for this investigative assistance. (National Bureau of Investigation)

The NBI currently lists its main office at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, with hotline (02) 8523-8231. It also maintains regional and district offices. (National Bureau of Investigation)

The NBI also maintains an official online complaint page, although an investigator may still require personal appearance, identification, affidavits, devices, or original supporting evidence as the particular case develops. (National Bureau of Investigation)

CICC is another official cybercrime reporting channel

The Cybercrime Investigation and Coordinating Center (CICC) is the inter-agency coordinating body created under RA 10175. Among its statutory functions are coordinating cybercrime-prevention measures and extending immediate assistance for suppression of real-time cybercrime through appropriate mechanisms. (Lawphil)

CICC's official public materials identify 1326 as its cybercrime hotline. They also list:

Globe: 0966 976 5971
DITO: 0991 481 4225
Smart: 0947 714 7105

CICC materials encourage prompt reporting of online scams and cyber incidents. (CICC)

For a criminal investigation that may require warrants, identification of an anonymous account holder, forensic examination, or eventual prosecution, expect involvement of the appropriate law-enforcement and prosecutorial authorities.

When can a fake account amount to computer-related identity theft?

Section 4(b)(3) of RA 10175 applies to the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another, without right. The implementing rules define identifying information broadly to include such information as a person's name, date of birth, driver's-license number, passport number, tax-identification number, biometric data, electronic identifiers, telecommunications identifying information, and access-device information. (eLibrary)

The Supreme Court in Disini upheld the constitutionality of the identity-theft provision and described the law as targeting unauthorized acquisition or use of identifying information. (Lawphil)

A stronger identity-theft complaint may exist, for example, where somebody deliberately creates a profile purporting to be you and uses your identity to:

obtain money or goods;
solicit loans or investments;
deceive your relatives, customers, employees, or business contacts;
collect personal or financial information;
open or control other accounts;
impersonate you in business transactions;
distribute fabricated communications in your name; or
otherwise cause or attempt to cause harm through the unauthorized use of your identity.

RA 10175 expressly extends computer-related identity theft to identifying information belonging to a juridical person as well. Businesses and organizations therefore should also preserve and report deceptive accounts misusing their corporate identity. (Lawphil)

The penalty prescribed generally for Section 4(b) offenses is prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. Section 4(b)(3) further provides that where no damage has yet been caused, the penalty imposable is one degree lower. The precise penalty in a particular prosecution must be determined from the charge, applicable law, and facts established in the case. (Lawphil)

Other crimes may be involved

Do not assume that "identity theft" is the only possible charge.

Depending on what the fake account actually did, investigators and prosecutors may consider other offenses. Examples can include:

illegal access if the offender hacked an account;
computer-related forgery or fraud where false electronic data or unauthorized manipulation is used fraudulently;
offenses under the Revised Penal Code where the account is used to defraud another person;
cyber libel if legally actionable defamatory material is published through a computer system;
threats, coercion, harassment, or other offenses where their statutory elements are present; or
violations of special laws involving personal data, intimate images, children, financial accounts, or other protected interests.

RA 10175 itself separately recognizes illegal access, computer-related forgery, computer-related fraud, computer-related identity theft, and online libel. Whether any one of them applies requires an element-by-element examination of the evidence. (Lawphil)

This is also why a victim should describe what happened rather than insisting that investigators use a particular criminal charge.

When the Data Privacy Act may also apply

Unauthorized use of personal information can also raise issues under Republic Act No. 10173, the Data Privacy Act of 2012, depending on who processed the information, what information was involved, the purpose and circumstances of processing, and the statutory exceptions.

The DPA regulates the processing of personal data and contains criminal provisions covering, among other matters, unauthorized processing, processing for unauthorized purposes, unauthorized access or intentional breach, and certain unauthorized disclosures. (Lawphil)

If the circumstances constitute a privacy violation within the NPC's jurisdiction, a data subject may file a complaint with the National Privacy Commission.

Ordinarily, the NPC's Rules of Procedure require the complainant first to inform the personal information controller, processor, or concerned entity in writing and allow it an opportunity to act. If there is no timely or appropriate action, or no response within 15 calendar days from receipt, the exhaustion requirement may be satisfied. The NPC may waive the requirement for good cause or in serious cases involving risk of harm, including specified circumstances where urgent or adequate relief is unavailable. (Privacy Commission)

The NPC currently requires a notarized complaint-assisted form or verified complaint with supporting evidence and witness affidavits, filed through authorized channels. Its website states that a new Complaint-Affidavit template took effect on July 1, 2025, so use the current form rather than an old downloaded copy. (Privacy Commission)

An NPC complaint is not a substitute for immediately reporting an ongoing cybercrime to the PNP or NBI.

What if the fake account is already gone?

You can still report the incident.

Provide whatever evidence remains, including:

screenshots;
the former username or URL;
direct-message copies;
email notifications from the platform;
messages received by friends or customers;
payment records;
witness affidavits; and
dates and times when the account was active.

Do not assume that deleting the public profile means every relevant record has disappeared. Service providers may retain subscriber, traffic, or content information subject to their own systems and applicable Philippine law, and investigators can use the cybercrime-warrant procedures available to them when the legal requirements are satisfied. (eLibrary)

If the fake account is asking people for money

Treat the matter as both an identity problem and a possible financial-fraud emergency.

Immediately:

Warn family, employees, clients, or other likely targets through a trusted channel.
Publish a brief notice from your genuine account identifying which account is authentic.
Tell recipients not to send money, disclose OTPs, or click links sent by the fake account.
If money has already been transferred, contact the receiving and sending bank, e-wallet, or payment provider immediately and ask what fraud-response measures are available.
Preserve the receiving account number, QR code, mobile number, transaction reference, recipient name displayed by the payment service, and receipts.
Report the incident promptly to cybercrime authorities.

Do not negotiate with the impersonator for the return of stolen money or pay a supposed "verification," "release," or "recovery" fee.

Do not secretly record private calls just to create evidence

Screenshots of written messages and preservation of existing electronic communications are different from secretly recording a private spoken conversation.

Republic Act No. 4200 generally prohibits secretly recording a private communication or spoken word without authorization from all parties, subject to statutory exceptions. Even a participant in the conversation can fall within the prohibition. Do not create a separate legal problem while gathering evidence. (eLibrary)

If investigators propose an undercover communication, controlled delivery, entrapment operation, or other evidence-gathering technique, follow their instructions instead of improvising your own operation.

Common mistakes to avoid

Reporting before saving the URL and evidence. A successful takedown can make later documentation more difficult.

Only taking a screenshot of the profile picture. Preserve the URL, username, posts, messages, dates, payment information, and other identifiers.

Publicly accusing a suspected person without proof. The operator behind an account may not be the person you initially suspect. Public accusations can create separate legal problems.

Hacking the fake account to discover who owns it. Unauthorized access is itself prohibited by RA 10175. Let investigators use lawful investigative processes. (Lawphil)

Paying someone who promises to "trace the IP address" instantly. Only limited technical information is visible to ordinary users. Subscriber and traffic information held by service providers normally requires lawful investigative procedures.

Deleting messages after taking one screenshot. Retain the original conversation and device where practicable.

Assuming a barangay blotter or platform report alone starts a cybercrime investigation. For a serious cybercrime, make a report to an appropriate law-enforcement cybercrime unit and retain the complaint or reference details.

Waiting for actual financial loss. RA 10175 expressly contemplates computer-related identity theft where damage has not yet occurred. Early reporting may also improve the chances that volatile electronic evidence can be preserved. (Lawphil)

When help is urgent

Seek immediate police or emergency assistance if the impersonation is accompanied by:

threats of violence;
stalking or disclosure of your current location;
attempts to lure you or another person to a meeting;
extortion or demands for money;
ongoing unauthorized bank or e-wallet transactions;
publication or threatened publication of intimate images;
exploitation or sexual abuse involving a child;
unauthorized control of your email, mobile number, or financial accounts; or
an active scam in which other people are presently sending money to the impersonator.

For an immediate threat to life, safety, or property, the Philippines' nationwide emergency number is 911. (eLibrary)

Practical evidence checklist for your complaint

Before going to the PNP-ACG or NBI, organize one folder containing:

a short chronological statement of what happened;
your valid identification;
the fake profile's URL and username;
screenshots and screen recordings;
copies or exports of messages;
direct URLs to offending posts;
proof that the identity, photograph, business, or organization being copied belongs to you or the entity you represent;
names and contact details of witnesses or recipients;
transaction records and payment details, if any;
the platform-report confirmation;
proof of any attempts to warn the platform or concerned entity;
evidence of account hacking, such as security alerts or login notifications; and
a list of the devices and accounts potentially compromised.

Bring the relevant device if investigators request it. The NBI's current process specifically contemplates sworn statements, affidavits, supporting documents, and examination of devices relevant to the investigation. (National Bureau of Investigation)

FAQ

Is creating a fake Facebook account automatically identity theft?

No. The existence of a fake or duplicate account alone does not automatically establish every element of a criminal offense. Computer-related identity theft requires intentional conduct involving identifying information belonging to another and use or other covered conduct without right. The purpose, representations made, information used, and surrounding circumstances matter. (Lawphil)

Can I report the account even if nobody has lost money?

Yes. Do not wait for financial loss. Section 4(b)(3) expressly addresses the situation in which no damage has yet been caused. (Lawphil)

Should I report to Facebook, TikTok, X, or another platform first?

Preserve the evidence first. You can then report to the platform and law enforcement in parallel where the circumstances warrant it. A platform report is useful for takedown purposes but is not the same as a criminal complaint.

Should I report to PNP-ACG or NBI?

Either is legally appropriate for cybercrime reporting. RA 10175 specifically assigns cybercrime law enforcement responsibilities to both the PNP and NBI. You do not ordinarily need to file duplicate complaints with every agency unless an investigator advises otherwise. (Lawphil)

What if I do not know who created the account?

You may still report it. Give investigators the URLs, usernames, messages, transaction information, and other available evidence. Identifying an unknown operator may require information obtainable only from service providers through lawful investigative procedures.

Can I force Facebook or another foreign platform to reveal the person's identity myself?

Ordinarily, an individual user cannot compel disclosure simply by asking customer support. Philippine law provides procedures through which law-enforcement authorities may obtain relevant computer data pursuant to the required legal process and court warrants. International cooperation may also become necessary where evidence or service providers are abroad. (eLibrary)

Can a company report a fake account copying its business identity?

Yes. RA 10175's computer-related identity-theft provision expressly refers to identifying information belonging to another person whether natural or juridical. Trademark, fraud, platform-policy, or other issues may also arise depending on the conduct. (Lawphil)

Do I need a lawyer before reporting?

Not necessarily. Members of the public can directly seek assistance from the PNP-ACG, NBI, or appropriate government channel. Legal assistance becomes particularly useful when substantial financial losses occurred, several offenses may be involved, the suspected offender is known, preservation or international evidence issues arise, the victim is a business or public figure, or a formal complaint-affidavit must be prepared.

Official sources and reporting resources

This article provides general Philippine legal information and is not individualized legal advice. The proper complaint, respondent, offense, venue, evidence, and procedural steps depend on the specific facts and available records. Laws, agency procedures, contact details, and platform reporting systems were checked against official sources as of August 25, 2026.