Quick answer

If someone is using your name, photos, personal details, or business identity through a fake social media account, preserve the evidence first, report the account to the platform, and promptly file a report with the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. If personal data was unlawfully processed, you may also complain to the National Privacy Commission. If money or a financial account is involved, notify the bank or e-wallet provider immediately.

A fake account is not automatically a crime. Parody, fan, commentary, and pseudonymous accounts may be lawful when they do not deceptively assume another person’s identity. However, an account may amount to computer-related identity theft when it intentionally acquires or uses another person’s identifying information without right. Fraud, hacking, threats, defamation, harassment, or misuse of intimate images may create separate liability.

Do not wait for the account to disappear. Usernames, posts, messages, and provider records can be changed or deleted quickly.

What Philippine law covers

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 punishes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, without right.

Identifying information may include a person’s name, address, contact number, date and place of birth, occupation, and similar data. In Disini v. Secretary of Justice, the Supreme Court upheld the identity-theft provision and explained that it regulates specific unauthorized acts involving another person’s identifying data. Actual financial loss is not essential in every case: the statute expressly provides a lower penalty if no damage has yet been caused. Read the Supreme Court decision.

For computer-related identity theft, the prescribed penalty is prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The applicable penalty is one degree lower when no damage has yet been caused. The final charge and penalty depend on the proven acts and circumstances.

A fake account may also involve:

Illegal access, if the offender took over or entered your real account without authority;
Computer-related fraud or estafa, if the account deceived people into sending money or property;
Cyberlibel, if it published a malicious defamatory imputation;
Grave threats, coercion, extortion, or other offenses under the Revised Penal Code;
Unauthorized processing or disclosure under the Data Privacy Act;
Gender-based online sexual harassment under the Safe Spaces Act;
Unauthorized recording or distribution of intimate images under the Anti-Photo and Video Voyeurism Act; or
Child-protection offenses when a minor or child sexual abuse or exploitation material is involved.

These offenses have different elements, defenses, penalties, and filing periods. Do not assume that every impersonation case fits all of them.

Act immediately if there is danger or ongoing loss

Call 911 or go to the nearest police station immediately if the account is making credible threats, revealing a home address, arranging an attack, blackmailing someone, targeting a child, or distributing intimate material.

If money, cards, loans, or an e-wallet are involved:

Contact the bank, card issuer, lender, or e-wallet through its verified channel.
Ask it to secure the account, block affected cards, dispute unauthorized transactions, and preserve relevant records.
Change compromised credentials and remove unfamiliar devices.
Record the complaint reference number and every response.
If the institution does not resolve the complaint, escalate it through the BSP Consumer Assistance Mechanism. BSP is a second-level recourse, so the complaint must ordinarily be raised with the supervised institution first.

Reporting to a bank or platform does not replace a criminal complaint.

Preserve evidence before blocking or reporting

Collect evidence while the account and content remain accessible. Save:

The complete profile URL—not only the display name;
The exact username or handle, including spelling, symbols, and numbers;
Full-page screenshots showing the profile, address bar, date, and time;
A screen recording showing how you opened the profile and copied its URL;
Profile photos, cover photos, biography, account ID if visible, and linked accounts;
Every relevant post, story, reel, advertisement, comment, and caption;
Complete conversations, including dates, timestamps, voice messages, attachments, and payment instructions;
Email notifications and original emails with headers intact;
Telephone numbers, email addresses, websites, QR codes, bank or e-wallet details, and transaction reference numbers used by the account;
Proof that the identity belongs to you, such as your genuine account, earlier posts, business registration, or ownership of the copied photographs;
Messages from people who were contacted or deceived;
Platform report acknowledgments and case numbers; and
A written timeline stating when you discovered the account, what it did, who saw it, and what harm followed.

Keep untouched originals. Make working copies for annotation, but do not crop, edit, rename, or add markings to the only copy. Preserve the original device and do not delete the conversation after taking screenshots. A screenshot is useful, but the original message, URL, device, metadata, witnesses, and provider records may be needed to authenticate it.

If a friend discovered the account, ask that person to preserve what they personally saw and prepare their own account of the incident. Do not coach witnesses or ask anyone to submit a false report.

Secure your genuine accounts

A cloned profile and a compromised account require different responses. If your genuine account may have been accessed:

Secure the email account connected to it first.
Change passwords using a trusted device.
Sign out unknown sessions and revoke unfamiliar third-party applications.
Turn on multi-factor authentication.
Replace compromised recovery codes and verify the recovery email and mobile number.
Check for unauthorized posts, advertisements, messages, forwarding rules, or changes to account settings.
Use the platform’s hacked-account recovery process.

Do not pay a “hacker,” fixer, or stranger who promises to identify or remove the account. Do not try to access the suspected offender’s device or account yourself.

Report the account to the platform

Report both the profile and any harmful individual posts, messages, advertisements, or images. Select “impersonation” or “pretending to be someone” where available. State who is being impersonated, provide the genuine profile, and attach only the identification the official form requests.

Official reporting pages include:

Use only the platform’s official website or application when uploading identification. Never send an ID, selfie, password, one-time PIN, or recovery code to the fake account or to someone claiming to be “support” through direct messages.

Before submitting, save the evidence. Afterward, retain the report number, confirmation email, submitted text, and attachments. Removal is not guaranteed, and platform removal does not necessarily preserve the information needed to identify the operator.

File a report with law enforcement

You may approach:

The nearest PNP station or a PNP Anti-Cybercrime Group office; or
The NBI Cybercrime Division or an NBI Regional Cybercrime Center.

The NBI Citizen’s Charter states that computer-crime investigative assistance is available to the general public without a service fee. Its process includes a complaint sheet, preliminary interview, sworn statements from the complainant and witnesses, collection of supporting documents, and possible examination of a relevant device.

Bring or prepare:

A chronological account of the incident;
The fake account’s URLs and handles;
Printed and electronic copies of the preserved evidence;
Your genuine profile and proof connecting the copied identity to you;
Names and contact details of witnesses;
Financial records, if applicable;
Copies of platform, bank, or e-wallet reports; and
The device containing the original messages, if an investigator asks to examine it.

Ask for the complaint, reference, or docket number and the investigator’s official contact details. Disclose any related complaint already filed with another office so agencies can coordinate and avoid inconsistent statements.

If the account is still active, expressly tell the investigator that provider data may disappear and ask whether a preservation request should be issued. Under the Cybercrime Prevention Act, traffic data and subscriber information held by a service provider must be preserved for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, subject to a one-time six-month extension.

A private person cannot compel a platform to reveal an account operator. Law enforcement generally needs a court-issued cybercrime warrant to obtain protected subscriber, traffic, or other computer data. Even then, attribution is not automatic: registration details may be false, accounts may be shared, and technical records may be incomplete.

Depending on the investigation, you may be directed to file a complaint-affidavit with the proper city or provincial prosecutor. The DOJ’s preliminary-investigation filing guidance calls for an investigation data form, a complaint-affidavit or sworn statement, witness affidavits, and supporting evidence. Venue and the correct prosecution office depend on where relevant elements, computer systems, or damage occurred, so follow the investigator’s or prosecutor’s case-specific direction.

Consider a National Privacy Commission complaint

An NPC complaint may be appropriate when the incident involves unlawful collection, use, disclosure, alteration, or other processing of personal data. It is an administrative privacy remedy and is not a substitute for asking the police or NBI to investigate a crime.

Ordinarily, before filing with the NPC, the complainant must:

Inform the personal information controller, processor, or concerned entity of the violation in writing;
Give it an opportunity to act; and
Show that it failed to take timely or appropriate action or did not respond within 15 calendar days after receiving the written notice.

Keep proof of delivery and the response. If the complaint is against a platform, its report acknowledgment may be relevant proof, although whether it satisfies the requirement depends on the respondent and the contents of the report.

The NPC may waive prior exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable damage, the absence of a plain and adequate remedy, or patently illegal action. If contacting the impersonator would be dangerous or impossible, explain and document that circumstance instead of silently omitting the requirement.

Use the NPC’s Complaints-Assisted Form and filing instructions. A formal complaint should be notarized or otherwise properly verified, identify the parties—or state facts that may lead to an unknown respondent’s identity—narrate the material facts, specify the relief requested, attach evidence and correspondence, and include the required certification against forum shopping. It may be filed personally, by registered mail or courier, or through the email channel authorized by the NPC. Current NPC guidance lists complaints@privacy.gov.ph.

Filing fees may apply, subject to exemptions or waiver under the 2021 NPC Rules of Procedure, as amended.

Filing periods make delay risky

There is no single deadline for every fake-account case. The period depends on the offense, penalty, date of discovery, interruption of prescription, and other facts.

One particularly short period concerns cyberlibel. In its April 8, 2026 resolution in Causing v. People, the Supreme Court maintained that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents. Read the Supreme Court resolution.

Other cybercrime and data-privacy offenses may have different periods. Do not use a possible longer period as a reason to wait: provider records may become unavailable much sooner. Seek legal advice promptly if defamatory posts are involved or the incident happened months ago.

Common mistakes to avoid

Blocking the account before saving its URL and content;
Keeping only cropped screenshots with no handle, timestamp, or context;
Assuming that a platform report automatically starts a police investigation;
Assuming that account removal preserves subscriber data;
Delaying because the offender’s real name is unknown;
Confronting, threatening, or publicly accusing a suspected person without reliable proof;
Asking friends to mass-report using false reasons;
Reposting harmful content so widely that the damage increases;
Sending identification or recovery codes through unofficial support accounts;
Paying someone who claims to have insider access to a platform, bank, PNP, or NBI;
Filing an NPC complaint without the required written notice, evidence, verification, or certification against forum shopping; and
Giving inconsistent timelines to the platform, bank, police, NBI, NPC, and prosecutor.

When legal help is urgent

Consult a lawyer immediately when:

The account has caused financial loss or opened credit, loans, or accounts in your name;
A cyberlibel filing period may be running;
The impersonator is blackmailing or threatening you;
Intimate images, medical records, government IDs, or other sensitive data were published;
A minor is involved;
The platform operator or suspected offender is overseas;
You need an urgent court order or coordinated provider-data preservation;
You are a public figure, professional, or business facing continuing reputational or customer harm; or
You are unsure which person, company, or platform should be named as respondent.

Those who qualify may ask the Public Attorney’s Office for assistance. Private counsel may also coordinate the criminal, privacy, financial, and possible civil remedies so that filings do not contradict one another.

Frequently asked questions

Can I report a fake account if I do not know who created it?

Yes. Preserve all available identifiers and state in the complaint that the operator is unknown. Investigators may seek provider records through lawful process. Identification is possible in some cases but cannot be guaranteed.

Is using my photograph enough to establish identity theft?

Not automatically. The complete context matters: what information was used, whether the use was intentional and without right, whether the account pretended to be you, and what it did. A clearly labeled fan or parody account is different from an account designed to make others believe it is genuinely yours.

Should I go to the PNP or the NBI?

Either may receive and investigate cybercrime complaints. Go to the office you can reach promptly and follow any referral. Tell each office about prior reports and keep all reference numbers.

Is a barangay blotter enough?

A blotter may document that an incident was reported locally, but it does not replace a platform report, cybercrime investigation, or complaint before the prosecutor or NPC. A barangay also cannot compel a foreign social media platform to disclose protected account data.

Are screenshots enough to file a complaint?

They may be enough to begin an assessment, but they are stronger when supported by URLs, original messages, the source device, transaction records, witnesses, report confirmations, and provider data. Preserve more than screenshots whenever possible.

Can the case proceed if the account has already been deleted?

Possibly. Your preserved evidence, witness accounts, device data, and provider records may still be useful. Prompt reporting improves the chance that provider data can be preserved before its retention period expires.

What if the fake account is operated from another country?

Philippine jurisdiction may still exist when an element occurred in the Philippines, a relevant computer system was situated here, or damage was caused to a person who was in the Philippines. Obtaining foreign platform or subscriber records may require international cooperation and usually takes longer.

Can I demand compensation?

Possible civil or administrative remedies depend on proof of injury, causation, the responsible parties, and the law invoked. An NPC decision may include appropriate data-protection relief, while a separate civil action may be available in some cases. Obtain case-specific advice before claiming a fixed amount.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rules and filing channels can change, and the appropriate remedy depends on the evidence and documents. Sources were checked as of August 4, 2026.