Quick answer

If someone is using your name, photos, business identity, contact details, or other identifying information in a fake social media account, preserve the evidence first, report the account to the platform, secure any compromised accounts, and promptly report the incident to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

A deceptive account may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. However, a duplicate name, parody, fan account, or profile using a similar image is not automatically a crime. Liability depends on facts such as intentional use of another person’s identifying information, lack of authority, deception, and the resulting or intended harm.

If money, bank accounts, e-wallets, threats, sexual material, or a child is involved, do not wait for the platform to respond. Contact the appropriate institution and law-enforcement agency immediately.

What Philippine law covers

Computer-related identity theft

Republic Act No. 10175 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

Identifying information may include a person’s name, photograph, address, contact number, date of birth, occupation, employer, signature, account credentials, identification numbers, or a combination of details that identifies the person. The Supreme Court recognized this offense and upheld the provision in Disini v. Secretary of Justice.

The law does not require completed financial loss in every case. It expressly provides for a penalty one degree lower when no damage has yet been caused. For offenses under Sections 4(a) and 4(b), the stated principal penalty is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The actual charge and penalty depend on the proven acts, applicable defenses, and the court’s judgment.

Other offenses may apply

Depending on what the account is doing, authorities may also examine possible:

Computer-related fraud or forgery under Republic Act No. 10175;
Estafa, threats, coercion, extortion, falsification, or another offense under the Revised Penal Code;
Cyberlibel, if the account publishes defamatory statements meeting the legal elements;
Gender-based online sexual harassment under the Safe Spaces Act, which specifically covers certain harmful online impersonation;
Violations of the Data Privacy Act of 2012, where personal information was processed without a lawful basis or privacy rights were violated;
Financial-account offenses under the Anti-Financial Account Scamming Act; or
Child-protection and sexual-abuse laws when a minor or sexual content is involved.

These offenses have different elements. Describe the facts accurately instead of insisting on a particular charge; investigators and prosecutors determine the legally supportable offense.

A fake account is not automatically a criminal case

The strongest identity-theft reports ordinarily involve an account that:

Uses your actual name, images, identification details, business identity, or credentials;
Represents itself as you rather than as commentary, parody, or a fan account;
Contacts your family, customers, employer, or friends as though it were you;
Solicits money, loans, passwords, one-time PINs, investments, intimate images, or personal information;
Opens accounts or enters transactions in your name;
Publishes damaging statements while pretending to be you; or
Continues the deception after being told that it has no authority.

By contrast, a shared name, an obviously labeled parody, legitimate reporting or commentary, or authorized management of an account may produce a different legal result. Publicly visible information is not necessarily free for deceptive use, but public availability alone does not establish every element of a crime.

What to do immediately

1. Preserve the evidence before the account disappears

Capture evidence before blocking or reporting the account, unless delaying creates an immediate safety risk.

Save:

The complete profile, including username, display name, profile photograph, biography, follower count, and account creation information if shown;
The exact profile URL—not only the displayed username, which can be changed;
URLs and copies of individual posts, stories, reels, advertisements, marketplace listings, comments, and livestreams;
Messages, call logs, voice messages, email notifications, and transaction instructions;
Screenshots showing the date, time, account handle, and surrounding context;
A screen recording showing how you reached the profile or content;
Platform acknowledgment emails and report reference numbers;
Names and contact details of people approached by the impersonator;
Receipts, bank or e-wallet transaction records, delivery records, loan notices, and demand letters; and
A written chronology stating when you discovered each event and what action you took.

Keep untouched master copies. Do not crop, annotate, rename repeatedly, or compress the only copy. Preserve the original device and export original messages or account data where the platform permits. Record who captured each item, on what device, and when.

Electronic evidence must still be authenticated. Under the Supreme Court’s Rules on Electronic Evidence, the person offering an electronic document bears the burden of proving its authenticity. Screenshots are useful, but they may not by themselves prove who operated the account.

2. Determine whether this is impersonation or a hacked account

A duplicate profile is an impersonation case. If someone took control of your real account, use the platform’s account-recovery process immediately.

For a suspected compromise:

Secure the connected email account first.
Change passwords from a trusted device.
Sign out unknown sessions and remove unfamiliar recovery emails, phone numbers, applications, and devices.
Turn on multi-factor authentication, preferably through an authenticator app or security key.
Save recovery codes somewhere offline.
Check whether the attacker changed privacy, advertising, payment, or messaging settings.
Warn contacts through a verified channel that they should not send money or information.

For Facebook, use Meta’s official hacked-account recovery page.

3. Report the profile and its harmful content to the platform

Report both the account and any individual posts, advertisements, or messages that violate separate rules. A report against the profile may not automatically review every post.

Official reporting pages include:

Platforms may request a government-issued ID. Submit it only through the platform’s verified application or official help page. Do not send an unredacted ID to the suspected impersonator, unofficial “support agents,” random social media pages, or anyone demanding payment for removal.

Preserve the evidence before asking friends to mass-report. Coordinated reporting may cause the profile to disappear before investigators can document it.

4. File a cybercrime report

Republic Act No. 10175 designates the NBI and PNP as the principal law-enforcement authorities for cybercrime cases.

You may:

File through the NBI Online Complaint page;
Visit the NBI Cybercrime Division or an appropriate NBI regional or district office. The NBI Citizen’s Charter describes the preliminary interview, sworn complaint sheet, collection of supporting documents, witness statements, and possible examination of relevant devices;
Contact or visit the PNP Anti-Cybercrime Group or a PNP regional anti-cybercrime unit; or
Report through the Cybercrime Investigation and Coordinating Center or Hotline 1326 for assistance and coordination.

For an in-person report, bring a valid ID, your chronology, printed and digital copies of the evidence, transaction records, names of witnesses, and the device containing the original messages if investigators need to inspect it. Ask for the complaint, docket, or reference number and the investigator’s official contact details.

If you do not know the offender’s real identity, say so. An unknown suspect does not prevent an initial report. Provide every legitimate lead, such as usernames, URLs, phone numbers, email addresses, payment accounts, delivery details, and the dates and times of communications.

5. Ask about prompt data preservation

Tell the investigator if the account is being deleted, renamed, or actively used to harm people. Ask whether a preservation request or cybercrime warrant should be pursued.

Under Section 13 of Republic Act No. 10175, traffic data and subscriber information relating to communication services must generally be preserved for at least six months from the transaction. Content data is preserved for six months from a law-enforcement preservation order, subject to a possible one-time extension and other rules. Disclosure of subscriber or traffic information ordinarily requires lawful process, including the appropriate court warrant.

This six-month period is not a reason to wait. Data may be overwritten, placed outside Philippine control, or become harder to connect to the account. Victims generally cannot compel a platform to disclose another user’s identity on their own.

If money or a financial account is involved

Contact the bank, e-wallet, card issuer, lender, or payment provider through its official 24-hour fraud channel immediately. Request:

Blocking of compromised credentials or cards;
A formal fraud or unauthorized-transaction case number;
Investigation of the receiving account and transaction chain;
Preservation of account and transaction records; and
Temporary holding of disputed funds and coordinated verification, when legally available.

Under Republic Act No. 12010 and BSP Circular No. 1215, covered financial institutions may temporarily hold disputed funds. The BSP rules contemplate an initial holding of up to five calendar days and a total holding period of no more than thirty calendar days unless extended by a court. A hold depends on the statutory and regulatory conditions and does not guarantee recovery.

Report first to the institution. If its response remains unresolved, escalate through the BSP Consumer Assistance Mechanism.

If identity theft may have produced an unauthorized loan or credit account, obtain your credit report and dispute inaccurate entries through the Credit Information Corporation’s Online Dispute Resolution System. The CIC cannot simply erase lender-submitted information without the dispute and verification process.

When a National Privacy Commission complaint may help

An NPC complaint may be appropriate when the incident involves unlawful processing, disclosure, retention, or inadequate protection of your personal information. It is separate from a criminal complaint and is not a substitute for reporting immediate threats, fraud, or extortion to law enforcement.

Under the 2021 NPC Rules of Procedure, as amended, an affected data subject—or an authorized representative—may file a complaint.

As a general rule, you must first notify the personal information controller, processor, platform, or other concerned entity in writing and give it an opportunity to act. The exhaustion requirement is met when it fails to take timely or appropriate action or does not respond within fifteen calendar days after receiving your written notice.

The NPC may waive that requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of a plain and adequate remedy, or patently illegal action.

A formal complaint should be written, verified, properly notarized, and accompanied by supporting evidence, relevant correspondence, witness affidavits when available, and a certification against forum shopping. The NPC’s filing instructions and complaint form provide the current submission options. Filing fees may apply, subject to exemptions or waiver under the amended rules.

What to include in your complaint-affidavit

Write in chronological order and stick to facts you personally know. Include:

Your full name, address, contact information, and relationship to the impersonated person or business.
The exact username, profile URL, platform, and date you discovered the account.
The identifying information copied or misused.
Why the account was not authorized.
Specific posts, messages, transactions, or representations made in your name.
The people contacted or deceived and what they can testify about.
Any financial, reputational, employment, privacy, or safety harm.
Steps already taken with the platform, bank, employer, or other organization.
All known links to the suspected operator, clearly distinguishing facts from guesses.
A list of attached evidence, with short descriptions and dates.

If a statement came from another person, identify that person and, where practicable, obtain their own affidavit. Do not present rumor as personal knowledge.

Common mistakes to avoid

Deleting the messages or resetting the device. Secure the account, but preserve original evidence first when safely possible.
Reporting only to the platform. A takedown may stop public harm but does not automatically begin a criminal investigation.
Waiting for financial loss. The identity-theft provision expressly contemplates cases where no damage has yet occurred.
Publicly naming an unverified suspect. Misidentification can expose another person to harm and may create separate legal problems.
Hacking back or trying to trace the suspect illegally. Give technical identifiers to investigators instead.
Sending money to “verify,” “unlock,” or remove the account. Legitimate agencies do not require payment to an alleged offender.
Sharing an unredacted ID publicly. Provide sensitive documents only through verified official channels.
Submitting cropped screenshots without URLs or context. Capture the full profile, content, date, handle, and surrounding conversation.
Assuming the account’s display name identifies its operator. Usernames, phone numbers, payment accounts, and profile images may themselves be stolen.
Using several inconsistent narratives. Keep one accurate chronology and disclose corrections promptly.

When help is urgent

Act immediately if:

The account threatens violence, stalking, abduction, or disclosure of your home or workplace;
Someone is demanding money, passwords, sexual images, or continued contact;
Money is moving through a bank or e-wallet;
Government IDs, account credentials, SIM information, or financial records were exposed;
Intimate images are being threatened or distributed;
A child is being impersonated, contacted, groomed, or sexually exploited;
The impersonator is issuing instructions to employees, customers, or relatives; or
You are receiving loan demands, legal notices, or collection messages for transactions you did not make.

For an immediate threat to life or physical safety, call the nationwide Unified 911 emergency hotline. For financial fraud, contact the institution’s official fraud channel before spending time preparing a complete narrative; supplementary documents can follow.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Report it against an unknown person and provide the profile URL, usernames, phone numbers, email addresses, payment accounts, timestamps, and other leads. Law enforcement may seek platform or service-provider information through lawful process.

Can I report identity theft even if no one lost money?

Yes. Section 4(b)(3) of Republic Act No. 10175 covers intentional unauthorized use or possession of identifying information, and the statute expressly addresses cases where no damage has yet occurred. Whether the available evidence proves the offense remains a matter for investigators, prosecutors, and ultimately the court.

Is every account using my photograph illegal?

Not necessarily. Context matters. Authorized use, reporting, commentary, a clearly disclosed fan or parody account, or an incidental appearance may be treated differently from an account deceptively representing itself as you.

Should I report to the platform or the police first?

Preserve the evidence, then do both. If there is immediate danger, financial loss, extortion, sexual abuse, or risk to a child, contact law enforcement and the relevant financial institution immediately; do not wait for platform action.

Can I force Facebook, TikTok, Instagram, or X to identify the user?

Ordinarily, a private complainant cannot compel disclosure simply by requesting it. Subscriber, traffic, and content data are subject to privacy rules, foreign-platform procedures, and lawful orders or cybercrime warrants. Give investigators enough information to identify the correct account and time period.

What if the fake account was created abroad?

Philippine jurisdiction may still exist when an element occurred in the Philippines, a relevant computer system was wholly or partly situated here, damage was caused to a person in the Philippines, or other jurisdictional grounds under Republic Act No. 10175 apply. Cross-border evidence collection can take longer and depends on the country, platform, and available legal-cooperation mechanisms.

Will a police report automatically remove the account or return stolen money?

No. Platform removal, criminal investigation, prosecution, and financial recovery are separate processes. A prompt, well-documented report improves the chance of preserving evidence and disputed funds but does not guarantee a takedown, arrest, prosecution, or reimbursement.

Official references

This article provides general legal information, not legal advice for a particular case. Applicable charges, deadlines, jurisdiction, and remedies depend on the evidence and surrounding facts. Official legal and procedural sources were last checked on 3 August 2026.