Quick answer

If someone created an account that pretends to be you, your business, or your organization:

Preserve the evidence before the account disappears.
Secure your email, social-media, mobile, and financial accounts.
Report the impersonating account through the platform’s official reporting tool.
Report suspected crime to the CICC, NBI Cybercrime Division, or PNP Anti-Cybercrime Group—especially if the account solicits money, threatens people, publishes private data, or damages your reputation.
Call the affected bank, e-wallet, card issuer, or telco immediately if money, OTPs, a SIM, or financial credentials are involved.

A platform report requests takedown or restriction. It is not a substitute for a criminal complaint. Likewise, reporting to the police does not automatically remove the account. These steps can be taken at the same time.

Do not wait for the fake account to cause financial loss. Under the Cybercrime Prevention Act of 2012, computer-related identity theft may exist even when no damage has yet occurred, although the absence of damage affects the possible penalty.

Is every fake account identity theft?

No. A fake, anonymous, parody, fan, or role-playing account is not automatically the crime of identity theft.

Section 4(b)(3) of Republic Act No. 10175 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or organization, without right. The Supreme Court upheld this provision in Disini Jr. v. Secretary of Justice.

For a criminal case, investigators and prosecutors will examine facts such as:

Whether the account used your name, photographs, address, contact details, employer, identification data, or other information that identifies you;
Whether the information actually belongs to you or your organization;
Whether its use was intentional and without authority;
Whether the account was designed to make people believe that it was really you;
What the account posted, requested, or represented;
Whether anyone sent money, disclosed credentials, entered a contract, or suffered reputational or other harm; and
Whether the account was clearly identified as parody, commentary, or a fan account rather than presented as authentic.

Using the same common name, criticizing someone, or operating under a pseudonym does not by itself prove identity theft. Conversely, copying a person’s profile, photographs, work history, and contacts to solicit money or obtain confidential information is substantially stronger evidence of impersonation and possible criminal conduct.

The victim may be a natural person, a corporation, or another juridical entity. Exact charges and penalties depend on the evidence and should be determined by prosecutors and courts, not by the label used in a platform report.

Other laws may also apply

Depending on what the fake account does, investigators may consider offenses other than computer-related identity theft, including:

Computer-related fraud or forgery under Republic Act No. 10175;
Estafa, threats, coercion, or libel under the Revised Penal Code, including the effect of using information and communications technology;
Unlawful processing, disclosure, or misuse of personal information under the Data Privacy Act of 2012;
Online gender-based sexual harassment under the Safe Spaces Act;
Unauthorized publication of intimate recordings under the Anti-Photo and Video Voyeurism Act;
Violence against women and their children, including conduct causing psychological harm by a spouse, former spouse, dating partner, or former dating partner, under Republic Act No. 9262; or
Financial-account scamming and money-mule offenses under the Anti-Financial Account Scamming Act.

A fake account is not automatically cyber libel merely because it is deceptive. Libel requires a public and malicious defamatory imputation and has its own elements, defenses, venue rules, and deadline.

Preserve evidence before reporting or blocking

Capture enough information to identify the account and show what it did. One isolated screenshot may be useful, but it is often inadequate by itself.

Preserve:

The full profile URL, not only the display name;
The username, handle, account ID, or page ID if visible;
Profile and cover photographs;
The “About,” account-transparency, contact, employment, and location sections;
Every relevant post, story, reel, advertisement, comment, or marketplace listing;
Direct messages and the surrounding conversation, not only selected lines;
Payment instructions, QR codes, bank or e-wallet details, mobile numbers, email addresses, and transaction references;
Names and contact details of people approached by the fake account;
Reports from friends, clients, employees, or relatives who received messages;
Dates and times, including your time zone;
Evidence showing your genuine account or identity;
The platform’s report confirmation, reference number, and later responses; and
Proof of loss or harm, such as receipts, account statements, rejected applications, client complaints, or warning messages sent to your contacts.

Take full-screen screenshots showing the browser address bar or account handle. A screen recording that navigates from the profile to the relevant posts or messages can preserve context. Save original files without cropping, annotation, filters, or compression; make edited copies separately if you need to highlight something.

Keep the device on which you personally saw or received the content. Back it up, but do not factory-reset it. If an investigator retains a device, ask for an acknowledgment or inventory.

The Rules on Electronic Evidence recognize electronic documents and accurate readable printouts, but admissibility still requires proper authentication. Investigators may therefore need testimony from the person who saw the account, received the messages, made the payment, or produced the screenshots.

Secure your real accounts

If the impersonator created a separate account, your genuine account may still be safe. If your real account was taken over, use the platform’s compromised-account recovery process immediately.

In either situation:

Secure your primary email account first.
Change reused or exposed passwords to unique passwords.
Turn on multi-factor authentication, preferably through an authenticator app or security key where available.
Review active sessions and sign out unknown devices.
Check whether recovery email addresses, phone numbers, forwarding rules, or app passwords were changed.
Remove unfamiliar connected applications.
Change financial PINs or credentials if banking information may have been exposed.
Ask your telco to investigate immediately if your SIM suddenly stopped working or you suspect a SIM swap.
Warn close contacts through a channel they already recognize.

Do not use a phone number, email address, or “support link” supplied by the fake account. Open the platform, bank, e-wallet, or telco’s official app or website yourself.

Report the account to the platform

First preserve evidence, then use the reporting option on the fake profile and on any harmful posts or messages. Select impersonation, pretending to be someone, scam, or the closest accurate category.

Official reporting guidance includes:

Some platforms allow reports without an account; others give priority to the person being impersonated or an authorized representative. A platform may request identification. Upload it only through the platform’s official form—not through a direct message from someone claiming to be support.

Report the profile itself and, where possible, each scam, threat, private-information disclosure, or abusive post. Save the confirmation before closing the page.

Where to report in the Philippines

What you need	Where to report	What to expect
Fast cybercrime or scam assistance and referral	CICC Hotline 1326, the CICC reporting page, or the eGovPH app’s reporting feature	Initial assistance, coordination, or referral. Ask whether a separate sworn complaint with the NBI or PNP is required.
Criminal investigation	NBI online complaint, NBI Cybercrime Division, or an NBI regional or district office	Interview, complaint sheet, sworn statement, collection of supporting documents, and possible examination of relevant devices.
Police investigation or an urgent safety concern	PNP Anti-Cybercrime Group, the nearest cybercrime response unit, or the nearest police station	Blotter or complaint documentation, investigation, evidence preservation, and referral as appropriate. Call 911 for an immediate threat to life or physical safety.
Misuse or exposure of personal data by a company, employer, platform, lender, school, agency, or other data handler	National Privacy Commission	Administrative privacy proceedings; possible sanctions, damages, or referral for prosecution when warranted.
Unauthorized transfer or payment	The originating bank, e-wallet, card issuer, or other financial institution	Account protection, transaction dispute, tracing, and possible temporary holding of identifiable disputed funds.

The NBI’s current Citizen’s Charter for computer-crime victims states that the service is available to the general public, carries no listed fee, and involves a complaint sheet, preliminary interview, sworn statements, supporting documents, and examination of a relevant device where necessary.

A barangay blotter may help document local threats or harassment, but it does not replace reporting to an agency equipped to investigate subscriber records and digital evidence.

What to include in a criminal complaint

Prepare a clear chronological account:

Your full name, contact details, and relationship to the identity being copied;
The genuine account, business page, or identifying information;
When and how you discovered the fake account;
Every known username and URL;
The specific information copied or misused;
What the account represented itself to be;
Who received messages or relied on the impersonation;
Any money, data, credentials, documents, opportunities, or reputation affected;
What you did to secure accounts and request takedown;
The identity of a suspected offender, if known, and the factual basis for that suspicion; and
The investigation or relief you are requesting.

Attach an indexed set of evidence and identify witnesses. Bring a valid government-issued ID and copies of your documents. A company or organization should bring proof of the entity’s identity and the representative’s authority.

If you do not know the offender’s legal name, report the account as operated by an unknown person and provide every available digital identifier. Do not guess. Investigators may seek subscriber or traffic information through the procedures and judicial warrants provided by law.

Ask for a docket, complaint, incident, or reference number. Record the investigator’s name, office, and instructions. A report is not complete merely because you sent a social-media message to an agency page.

Ask promptly about preserving provider data

Social-media content and account records can disappear when an account is deleted, renamed, or suspended.

Section 13 of Republic Act No. 10175 provides for preservation of traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from a law-enforcement preservation order, with a possible one-time six-month extension. Disclosure of protected provider records ordinarily requires the legal process specified by the law and the Rule on Cybercrime Warrants.

A victim cannot simply demand confidential subscriber records from a platform. Tell the investigator immediately that the account may be deleted and ask whether a preservation request or cybercrime warrant is appropriate. Do not assume that a takedown report preserves evidence for a criminal case.

If money was sent or an account was accessed

Contact the originating bank, e-wallet, card issuer, or other financial institution immediately through its official fraud channel. Give:

The transaction date and exact time;
Amount and currency;
Transaction reference;
Source and destination account information;
Screenshots of the fake account and payment request;
The police, NBI, or CICC reference, if already available; and
A sworn complaint or affidavit if requested.

Under BSP Circular No. 1215, a BSP-supervised institution may initially hold identifiable disputed funds for up to five calendar days while coordinated verification is conducted. Total temporary holding may extend to 30 calendar days, unless further extended by a competent court. When an extended hold is sought, the source-account owner may need to provide an affidavit, sworn complaint, police report, or other supporting document within the initial holding period.

These rules do not guarantee that funds remain available or will be returned. Speed matters because money may be withdrawn or transferred through several accounts.

If the institution’s internal complaint mechanism does not resolve the concern, follow the current BSP Consumer Assistance Mechanism. BSP generally expects the consumer to complain to the financial institution first.

When a National Privacy Commission complaint is appropriate

Consider an NPC complaint when the incident involves unlawful processing, disclosure, insecure handling, or misuse of personal information by an identifiable respondent—such as a business, employer, lender, school, government office, platform, or other data handler.

The NPC route is not automatically the best remedy for every anonymous fake account. The Data Privacy Act has scope and statutory exceptions, including certain personal, family, or household processing. The NPC may also dismiss a complaint when the parties cannot be identified or traced despite diligent effort, when the facts do not involve a privacy violation, or when the evidence is insufficient. Criminal investigation may therefore be the more practical first route for an unidentified impersonator.

Under the NPC’s 2021 complaint procedure, the complainant generally must first:

Inform the respondent in writing about the privacy violation or personal-data breach;
Give the respondent an opportunity to address it; and
Show that the respondent failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

Proof of that notice and receipt must be attached. The formal complaint must use the required notarized Complaint-Assisted Form or be a verified complaint, with supporting evidence and witness affidavits. Current filing instructions and fees should be checked on the NPC filing page. The NPC currently lists complaints@privacy.gov.ph as its complaint email.

An authorized representative may file for a data subject, but the NPC requires appropriate authority, such as a special power of attorney. Additional corporate authorization is required when a juridical entity acts as representative.

Important deadlines

There is no single deadline covering every fake-account case.

Platform report: File immediately after preserving evidence. Platform rules do not create a universal Philippine legal filing period.
Financial dispute: Report immediately. The BSP’s five-day initial holding process is an institution-side protection measure, not permission to wait five days.
NPC complaint: The usual exhaustion step involves the respondent’s failure to act appropriately or respond within 15 calendar days after receiving written notice.
Provider evidence: Relevant records may be subject to six-month preservation periods, so early law-enforcement involvement matters.
Cyber libel: If the fake account contains allegedly defamatory posts, the Supreme Court’s April 2026 resolution in Causing v. People holds that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. Whether a particular complaint is timely can require evidence.
Other crimes: Prescription depends on the particular offense, penalty, date of commission or discovery, and acts that legally interrupt the period.

Do not assume that an account’s continued visibility makes every offense “continuing,” or that a later share automatically restarts a deadline. Obtain prompt legal advice when publication occurred months ago or several possible offenses are involved.

What happens after reporting

The platform may remove, restrict, label, or retain the account—or conclude that its policies were not violated. Request reconsideration through the official appeal channel if the first decision appears to overlook clear impersonation evidence.

For a criminal report, an investigator may:

Interview the complainant and witnesses;
Require sworn statements or affidavits;
Examine submitted documents or a relevant device;
Coordinate with other agencies;
Request preservation of computer data;
Apply for a cybercrime warrant; and
Refer the completed investigation to the appropriate prosecutor.

The prosecutor, not the complainant or investigator, determines whether probable cause supports filing a criminal case. The accused must be given the process required by law. A report does not guarantee identification, arrest, prosecution, conviction, takedown, or recovery of money.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and contents;
Keeping only cropped screenshots with no username, date, or context;
Deleting messages, wiping the phone, or closing the genuine account;
Assuming a platform report is already a police complaint;
Waiting for money to be lost before reporting identity misuse;
Confronting the suspected operator and prompting deletion of evidence;
Trying to hack, deceive, or impersonate the offender in return;
Paying an unverified “hacker,” “recovery agent,” or supposed government fixer;
Sending IDs or OTPs to someone claiming to be platform support;
Publicly naming a suspected offender without reliable evidence;
Republishing private, sexual, or harmful content while trying to warn others;
Giving investigators conclusions without explaining the supporting facts; and
Filing exaggerated or knowingly false allegations.

A public warning should be factual and limited: identify your genuine account, state that the listed account is unauthorized, tell people not to transact with it, and provide a safe way to verify communications. Avoid accusing a particular person unless the identification is established and publication is legally necessary.

When help is urgent

Seek immediate assistance when:

The account threatens violence, follows your movements, publishes your home address, or creates an immediate physical danger;
A child is being groomed, exploited, threatened, or depicted in sexual material;
Intimate images are being distributed or used for blackmail;
The impersonator controls your email, mobile number, bank, e-wallet, or government-service account;
Money was transferred or a loan or account was opened in your name;
The conduct involves a current or former intimate partner and is causing fear or psychological harm;
The account is approaching clients, employees, patients, students, or vulnerable relatives; or
Passports, government IDs, signatures, biometrics, medical records, or financial documents were exposed.

For immediate danger, call 911 or go to the nearest police station. If child sexual-abuse material is involved, preserve the account URL and report it without downloading, forwarding, or further distributing the material. If a current or former intimate partner is responsible, ask the police, a VAW desk, or counsel whether a protection order under Republic Act No. 9262 is available.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Give investigators the exact account URL, handles, messages, transaction records, phone numbers, and other identifiers. State that the operator is unknown instead of naming someone based on suspicion.

Can a friend or employee report for me?

A witness may report what they personally received or observed. Platforms differ on whether a third party can request an impersonation takedown. The impersonated person or a properly authorized representative should usually submit the principal report. For an NPC complaint filed by a representative, appropriate written authority is required.

Do I need a lawyer to make the first report?

Generally, no. A person may report directly to the CICC, NBI, PNP, platform, or financial institution. Legal help becomes especially important when there is substantial loss, an urgent protection-order issue, an approaching prescriptive deadline, a business dispute, a cross-border suspect, or uncertainty about whom to accuse.

Are screenshots enough?

They are useful but may not be sufficient. Preserve URLs, surrounding context, original files, the device, witnesses, and transaction records. Electronic evidence must still be authenticated.

Can I force the platform to reveal the account owner?

Ordinarily, a private user cannot compel disclosure of confidential subscriber or traffic information. Investigators may seek it through the warrants and legal procedures applicable to computer data.

Should I message the fake account and demand deletion?

Usually, preserve evidence and report first. A confrontation may prompt the operator to erase evidence, change usernames, threaten witnesses, or move funds. Follow an investigator’s advice if controlled communication is considered useful.

What if the account has already been removed?

You can still report it. Submit the saved URL, screenshots, messages, report confirmation, witness details, and transaction records. Tell investigators when the account disappeared and whether it reappeared under another name.

What if no one has lost money?

Report serious impersonation anyway. Republic Act No. 10175 expressly contemplates computer-related identity theft where no damage has yet been caused. Evidence of intended deception, copied identifiers, attempted transactions, or messages to contacts may still be important.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and legal conclusions may change depending on the documents, platform, respondent, location, and alleged offense. Official sources and procedures were last checked on August 3, 2026.