Quick answer
If someone creates a social media account using your name, photos, personal details, or other identifying information and pretends to be you, preserve the evidence first, report the account to the platform, and file a cybercrime complaint with the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division (NBI-CCD). The Cybercrime Investigation and Coordinating Center (CICC) also receives cybercrime reports and can help coordinate appropriate action. (PNP ACG)
Philippine law specifically punishes computer-related identity theft: intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting another person's identifying information without right. The implementing rules define identifying information broadly enough to include a person's name and various government, electronic, telecommunications, and access-device identifiers. Whether a particular fake account amounts to this crime still depends on the actual information used, the manner of impersonation, intent, and other facts. (Judiciary eLibrary)
Do not wait for the fake account to cause financial loss before reporting it. Republic Act No. 10175 expressly contemplates identity-theft cases in which no damage has yet occurred, although the prescribed penalty is lower in that situation. (Judiciary eLibrary)
Is every fake social media account illegal?
No. A fake, anonymous, parody, fan, or pseudonymous account is not automatically computer-related identity theft simply because the person behind it is not using his or her real name.
The important distinction is whether the person intentionally used or misused identifying information belonging to someone else without right. Under the implementing rules of the Cybercrime Prevention Act, identifying information includes a name or number that may identify a specific person, including a name, birth date, driver's-license number, passport number, tax identification number, biometric information, electronic identification information, telecommunications identifiers, and access-device information. (Judiciary eLibrary)
A profile that copies your real name and photograph, represents itself to other people as you, messages your contacts as though it were you, solicits money in your name, or uses your personal information to deceive others presents a much stronger identity-theft issue than an account using a completely invented persona.
The Supreme Court upheld the constitutionality of the computer-related identity-theft provision in Disini v. Secretary of Justice. (Judiciary eLibrary)
Other offenses may also apply depending on what the fake account does. A defamatory post may raise cyberlibel issues; fraudulent solicitation may involve fraud or financial-account scamming; threats, extortion, stalking, sexual harassment, unauthorized intimate images, or illegal access may trigger separate laws. The exact charge should therefore be based on the conduct proved by the evidence rather than merely on the existence of a fake profile. (Judiciary eLibrary)
What is the penalty for computer-related identity theft?
Computer-related identity theft is an offense under Section 4(b)(3) of Republic Act No. 10175. Section 8 provides, for offenses under Sections 4(a) and 4(b), prision mayor, or a fine of at least ₱200,000 up to a maximum amount commensurate with the damage incurred, or both. If no damage has yet been caused in an identity-theft case, Section 4(b)(3) provides that the penalty is one degree lower. (Lawphil)
Those provisions describe the statutory penalties. The charge actually filed, the applicable penalty, and any civil liability will depend on the allegations proved and on whether other offenses are involved.
How to report the fake account or identity theft
Preserve the evidence before asking for takedown. Capture the fake profile's complete username or handle, profile URL, account ID if visible, display name, photographs, biography, posts, comments, direct messages, and the dates and times you discovered them. Save evidence of people who were contacted or deceived. If money was requested or transferred, preserve transaction receipts, reference numbers, recipient account details, phone numbers, email addresses, and conversations. Whenever practical, retain full screenshots rather than heavily cropped images and keep the original electronic files.
Secure your genuine accounts if compromise is possible. Change passwords, sign out unknown sessions, enable multi-factor authentication, review recovery email addresses and phone numbers, and check whether unauthorized posts or messages were sent from your real account. If your email or social media account itself was accessed without permission, tell investigators that fact because illegal access is separately punishable under the Cybercrime Prevention Act. (Lawphil)
Report the impersonating account to the social media platform. Use the platform's impersonation or fake-account reporting procedure. Give the platform enough information to distinguish your legitimate account from the impersonator. Some platforms may request identification. A platform takedown can limit further harm, but it is not a substitute for a criminal complaint when prosecution or identification of the offender is necessary. TikTok, for example, expressly provides an impersonation-reporting process through the profile reporting function and its online form.
File a cybercrime complaint promptly. You may approach the PNP Anti-Cybercrime Group or one of its regional cybercrime units. The PNP-ACG currently publishes a Cyber Response Unit contact and regional contacts on its official website. You may alternatively file with the NBI Cybercrime Division. The NBI's Citizen's Charter states that victims of computer crimes may proceed to the Cybercrime Division, where a complaint sheet is prepared and sworn to and the complainant undergoes an initial interview and investigation. The NBI also maintains an online complaint facility. (PNP ACG)
You may also report the incident to the CICC. The CICC's official anti-scam material directs victims to report cyber incidents through hotline 1326 and publishes
report@cicc.gov.phas a reporting address. CICC coordinates cybercrime response, while criminal investigation may ultimately be undertaken by the appropriate law-enforcement agency. (CICC)If money or a bank/e-wallet account is involved, contact the financial institution immediately. Do not wait for the criminal investigation to finish. The BSP tells consumers to immediately report suspicious transactions to their bank or e-money issuer. If the institution does not adequately resolve the complaint, the consumer may escalate through the BSP's Consumer Assistance Mechanism after first obtaining the institution's complaint reference number. (Bureau of the Treasury) Republic Act No. 12010, the Anti-Financial Account Scamming Act, also establishes mechanisms for disputed financial transactions, including temporary holding and coordinated verification of disputed funds. (Judiciary eLibrary)
Consider a National Privacy Commission complaint when personal data has been unlawfully processed or disclosed. The NPC route is separate from a PNP or NBI criminal complaint. Under the NPC's current rules, a complainant ordinarily must first notify the personal information controller, processor, or concerned entity in writing and allow it an opportunity to act. If there is no timely or appropriate action, or no response within 15 calendar days, the exhaustion requirement may be satisfied. The NPC may waive this requirement for good cause or serious violations involving sufficient risk of harm. (National Privacy Commission) The NPC has used a new Complaint-Affidavit template since 1 July 2025, so use the current form rather than an old copy circulating online. (National Privacy Commission)
What evidence should you preserve?
The single most useful item is often the exact URL or unique account identifier of the fake profile. A display name alone may not be enough because usernames can be changed and several accounts can use the same display name.
Preserve the profile as it appeared before removal, including photographs copied from you, the biography, username, profile URL, posts, stories, reels or videos, messages, comments, follower information relevant to the impersonation, and any statements in which the account expressly represented itself as you.
Also preserve communications from people who were contacted. If a friend received a message saying, for example, that "you" urgently needed money, ask that person to retain the original conversation rather than merely forwarding a cropped screenshot.
For financial scams, preserve the amount, date and time of transfer, transaction reference number, destination bank or e-wallet, account name or number shown by the service, and correspondence with the bank or e-wallet provider.
Keep copies of platform-report acknowledgments, police or NBI reference numbers, emails, and follow-up correspondence. If an email was involved, preserving the original message and headers may be more useful than a screenshot alone.
Avoid editing the only copy of an electronic file. Keep originals and make separate working copies for annotation.
Why reporting quickly matters
Cybercrime evidence can be time-sensitive. Under Republic Act No. 10175 and its implementing rules, subscriber information and traffic data maintained by service providers are subject to statutory preservation periods, and law enforcement has procedures for ordering preservation and obtaining computer data through lawful court process. Content data can likewise be made subject to preservation orders. (Judiciary eLibrary)
The Supreme Court's Rule on Cybercrime Warrants provides judicial procedures for obtaining and examining computer data during cybercrime investigations. (Judiciary eLibrary) Investigators, rather than private complainants, ordinarily use these compulsory processes. This is one reason an early, properly documented complaint can matter when the offender is anonymous and the victim needs subscriber or technical records to help establish who controlled the account.
Do not assume that deleting the fake account or obtaining a platform takedown means all underlying records will remain available forever.
What if the fake account is being used to scam people?
Tell both the platform and law enforcement that the account is actively soliciting money and provide examples.
Republic Act No. 12010 specifically addresses financial-account scamming. Among other things, it penalizes specified money-muling activities, including opening a financial account under a fictitious name or using another person's identity or identification documents, and covers defined social-engineering schemes aimed at obtaining sensitive identifying information and gaining unauthorized control of financial accounts. (Judiciary eLibrary)
For disputed transfers, the law authorizes temporary holding of funds subject to BSP regulations for a period not exceeding 30 calendar days, unless extended by a competent court. This does not mean every complaint automatically produces a freeze or refund; the financial institution must apply the governing AFASA and BSP procedures to the particular transaction. (Judiciary eLibrary)
Because money can be moved rapidly through several accounts, the bank or e-wallet should be notified immediately even while the cybercrime complaint is being prepared.
What if the fake account is harassing or humiliating you?
The legal analysis may extend beyond ordinary identity theft.
The Safe Spaces Act, Republic Act No. 11313, expressly recognizes gender-based online sexual harassment, which can include online identity theft and, in the circumstances covered by the law, impersonating a victim's identity online or posting lies about the victim to harm the victim's reputation. The law designates the PNP Anti-Cybercrime Group to receive complaints involving gender-based online sexual harassment, with CICC coordination. (Judiciary eLibrary)
If the impersonator is sending threats, stalking you, demanding money, circulating intimate photographs or videos, or using the account as part of abuse by a present or former intimate partner, tell investigators the complete circumstances rather than reporting only "fake account." Different facts can support different offenses and protective remedies.
Can the National Privacy Commission remove a fake account?
The NPC's role is primarily the enforcement of the Data Privacy Act and protection of data-subject rights. A privacy complaint may be appropriate where your personal information was unlawfully collected, used, disclosed, or otherwise processed. The NPC has authority to receive complaints, investigate Data Privacy Act violations, adjudicate matters affecting personal information, and issue appropriate orders within its statutory powers. (National Privacy Commission)
For a straightforward anonymous impersonation case where the immediate objective is identifying and prosecuting the person behind the account, the PNP-ACG or NBI-CCD is generally the more direct criminal-investigation route. Where a company, organization, platform operator, employer, lender, or other identifiable entity is implicated in improper handling of personal data, an NPC complaint may provide an additional and distinct remedy.
Common mistakes that can weaken a complaint
Reporting the profile and losing all evidence. Platform removal is useful, but first save enough material to show what the account looked like, what it did, and how it impersonated you.
Saving only the display name. Preserve the URL, handle, account identifier, and other identifying features because display names can be changed easily.
Submitting heavily cropped screenshots. Investigators may need context, timestamps, URLs, usernames, and surrounding conversation.
Deleting messages because they are upsetting. Preserve relevant communications before blocking or deleting them.
Arguing with the impersonator. Engagement may warn the offender that a complaint is coming and may prompt deletion of evidence. Do not attempt to "hack back." Unauthorized access to another computer system can itself constitute a cybercrime. (Lawphil)
Publicly naming an unverified suspect. Suspicion based on writing style, a photograph, IP-location rumors, or what another person told you is not necessarily proof of who controlled an account. Premature public accusations can create separate legal problems.
Waiting for the platform to identify the offender for you. Platforms generally do not simply release subscriber information to a private complainant on demand. Philippine cybercrime procedure provides lawful preservation and disclosure mechanisms that investigators can pursue. (Judiciary eLibrary)
When legal or law-enforcement help is urgent
Seek immediate assistance when the impersonator is threatening physical harm, stalking you, extorting money, soliciting funds from your contacts, accessing your genuine accounts, using government identification or financial credentials, distributing intimate material, targeting a child, or rapidly creating replacement accounts after takedowns.
Urgent reporting is also appropriate if people are already transferring money because they believe the fake account belongs to you. Notify the affected financial institutions at once in addition to filing the cybercrime complaint.
If the identity theft is affecting employment, business transactions, professional reputation, loans, contracts, immigration records, financial accounts, or government identification, legal advice may also be useful in determining whether preservation letters, affidavits, formal demands, civil remedies, privacy proceedings, or additional criminal charges are appropriate.
Frequently asked questions
Can I report a fake account even if I do not know who created it?
Yes. Many cybercrime complaints begin with an unknown account operator. Give investigators the exact account URL or identifier, messages, dates, transaction information, and every other available lead. Cybercrime procedures exist for obtaining relevant subscriber and computer data through lawful processes where the legal requirements are met. (Judiciary eLibrary)
Should I report the account to Facebook, Instagram, TikTok, or another platform before going to the police?
You can do both. Preserve the evidence first. Platform reporting addresses removal or platform enforcement; a PNP or NBI complaint addresses possible criminal investigation. One does not automatically replace the other.
Do I need to suffer financial loss before identity theft can be reported?
No. Section 4(b)(3) of the Cybercrime Prevention Act expressly provides for situations in which no damage has yet been caused, although the prescribed penalty is lower. (Judiciary eLibrary)
Is using my photograph enough to prove computer-related identity theft?
Not necessarily by itself. Liability depends on the overall evidence showing intentional acquisition, use, misuse, possession, transfer, alteration, or deletion of identifying information belonging to another without right. A copied photograph combined with your name, biography, contacts, messages pretending to be you, or fraudulent representations may provide substantially more context.
Can I demand that the social media company disclose who owns the fake account?
You can report the account and provide information, but compulsory disclosure of subscriber or computer data ordinarily requires the applicable legal process. Republic Act No. 10175 and the Rule on Cybercrime Warrants provide mechanisms by which law-enforcement authorities can seek preservation and judicially authorized disclosure or examination of relevant computer data. (Judiciary eLibrary)
What if the fake account has already been deleted?
You can still report the incident. Provide whatever screenshots, URLs, messages, witnesses, emails, notifications, transaction records, and platform correspondence remain. Deletion can make investigation harder, which is why prompt preservation and reporting are important.
Can I file with both the PNP or NBI and the National Privacy Commission?
Potentially, yes. They perform different functions. A cybercrime complaint may seek criminal investigation, while an NPC complaint concerns violations of data-privacy law. Whether both are appropriate depends on the facts and the respondent involved.
Official sources
The statutory text of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) is available from the Supreme Court E-Library. Supreme Court E-Library — Republic Act No. 10175
The Department of Justice Office of Cybercrime publishes the implementing rules of Republic Act No. 10175. DOJ Office of Cybercrime — RA 10175 Implementing Rules
The Supreme Court's Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, governs important procedures involving preservation, disclosure, interception, search, seizure, and examination of computer data. (Judiciary eLibrary)
Current PNP Anti-Cybercrime Group contact details, including its Cyber Response Unit and regional units, are published on the PNP-ACG website. PNP Anti-Cybercrime Group — Contact Us
The NBI publishes information on its Cybercrime Division and its procedure for assisting victims of computer crimes. NBI — Investigative Assistance for Victims of Computer Crimes
For privacy violations, consult the National Privacy Commission's current complaint procedures and forms. National Privacy Commission — File a Complaint
The statutory text of the Anti-Financial Account Scamming Act, Republic Act No. 12010, is available through the Supreme Court E-Library. Supreme Court E-Library — Republic Act No. 12010
For financial scams involving BSP-supervised institutions, the BSP publishes official guidance on where consumers should report suspicious transactions and how to escalate complaints. Bangko Sentral ng Pilipinas — Where to Report Scammers
General-information disclaimer
This article provides general legal information about Philippine law and is not a substitute for legal advice based on the complete facts, documents, identities of the parties, platform involved, and available electronic evidence. Criminal, civil, privacy, financial, and protective remedies may overlap, and the proper complaint or charge depends on what the evidence establishes.
Sources and procedures checked as of 23 August 2026.