Quick answer

If someone is using your name, photo, business identity, or personal details through a fake social media account:

Preserve the account and its content before reporting it. Save the profile URL, username, screenshots, messages, posts, dates, payment details, and reporting confirmations.
Secure your genuine accounts. Change compromised passwords, sign out unknown devices, enable two-factor authentication, and protect the connected email address and mobile number.
Report the account directly to the platform for impersonation, fraud, harassment, or other applicable violations.
File a formal complaint with the PNP or NBI if your identity was used without authority, the account deceived others, money or information was taken, or the account posted threats, defamatory statements, or intimate material.
Call the government’s Hotline 1326 for cybercrime or scam assistance and referral.
Notify banks, e-wallets, government agencies, employers, or customers immediately if their accounts, records, or transactions may be affected.

A platform report can lead to removal or suspension, but it is not a criminal complaint. Conversely, reporting to law enforcement does not guarantee immediate removal of the account. These routes should usually be pursued at the same time.

Call 911 or the nearest police station immediately if there is a credible threat to life or safety, ongoing extortion, stalking, child exploitation, or imminent financial loss.

Is a fake account automatically identity theft?

Not necessarily. A parody, fan, commentary, or anonymous account may violate a platform’s rules—or may be permitted by them—without necessarily satisfying the elements of a Philippine crime.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, computer-related identity theft is the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another person or organization.

A fake account is more likely to raise identity-theft concerns when it deliberately uses another person’s name, photograph, contact information, documents, account details, or other identifying information to make people believe that the account is genuinely operated or authorized by that person.

For computer-related identity theft, RA 10175 provides a penalty of prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the imposable penalty is one degree lower. The actual charge and penalty remain for prosecutors and courts to determine from the evidence.

The Supreme Court upheld the constitutionality of the computer-related identity-theft provision in Disini Jr. v. Secretary of Justice.

Preserve the evidence before the account disappears

Fake accounts can be renamed, restricted, deleted, or replaced. Preserve what you can before blocking or reporting the account.

Keep the following:

The complete profile URL—not only the displayed name
The exact username, handle, profile name, and visible account ID
Full-page screenshots and a screen recording showing how you reached the profile
The profile photo, cover image, biography, contact details, and linked websites
Individual URLs for posts, photos, videos, comments, stories, or advertisements
Complete conversations, including earlier and later messages for context
Dates, times, and the time zone shown on your device
Names and contact information of people contacted or deceived by the account
Statements from witnesses who personally saw the account or received messages
Emails and text alerts involving logins, password resets, or account changes
Bank, e-wallet, delivery, or payment records if money was requested or transferred
Copies of platform reports, acknowledgment emails, and reference numbers
Proof of your genuine identity and authentic account, where relevant

Preserve original files and conversations whenever possible. Keep an unedited copy before making redacted versions. Avoid cropping out usernames, dates, surrounding messages, or browser addresses. Record when and how each item was captured.

Do not hack the account, guess passwords, install spyware, secretly access another person’s device, or impersonate the offender to obtain evidence. Evidence obtained unlawfully may be challenged and may expose you to a separate complaint.

If the material involves a child or apparent child sexual-abuse content, do not download, forward, repost, or circulate it. Preserve the URL, account details, dates, and a description of what appeared, then report it urgently to law enforcement. The applicable protections include the Anti-Online Sexual Abuse or Exploitation of Children and Anti-Child Sexual Abuse or Exploitation Materials Act, RA 11930.

Secure your real identity and accounts

If the fake account may have resulted from a compromised account, email address, SIM, or device:

Change the password of the connected email account first.
Change the social media password using the official app or website.
Sign out unknown devices and remove unfamiliar recovery addresses or mobile numbers.
Enable two-factor authentication, preferably through an authenticator app or another secure method offered by the service.
Revoke access granted to unfamiliar apps and browser extensions.
Review sent messages, advertisements, payment methods, and account-management roles.
Contact your mobile provider if your SIM unexpectedly lost service or you suspect an unauthorized SIM replacement.
Warn contacts through a verified channel that the fake account is not yours.
If an identification document was exposed, notify the issuing agency and ask what protective or replacement steps are available.

Do not post full identification documents publicly to prove that you are the real person. When a legitimate platform requires identification, upload it only through its official help form.

Report the account to the platform

Report both the profile and any specific harmful posts, messages, advertisements, or transactions. Different platform policies may cover impersonation, scams, privacy violations, harassment, non-consensual intimate images, or intellectual-property infringement.

Official reporting channels include:

Platform	Official reporting channel
Facebook	Report a profile or Page pretending to be someone or use the impostor-account form
Instagram or Threads	Report an impersonation account
TikTok	Report an impersonation account
X	Report impersonation

When completing the report:

Choose impersonation if the account is pretending to be you, your business, or someone you represent.
Identify your authentic profile, if you have one.
Explain briefly what information was copied and how people were being misled.
Report scam messages, threats, private-information disclosures, or sexual content separately when the platform offers those categories.
Retain every report number and acknowledgment.
Ask recipients of fraudulent messages to preserve their own conversations before reporting or blocking the account.

Do not organize false or automated mass reports. Several genuine reports from people who personally received fraudulent messages may help establish the scope of the conduct, but report volume is not a substitute for accurate evidence.

File a criminal complaint with the PNP or NBI

RA 10175 assigns cybercrime law enforcement to the Philippine National Police and National Bureau of Investigation. You may approach:

The PNP Anti-Cybercrime Group, a Regional Anti-Cybercrime Unit, or the nearest police station for referral
The NBI Cybercrime Division or an NBI Regional Cybercrime Center
Hotline 1326, the government’s round-the-clock cybercrime and anti-scam reporting and referral channel

The NBI’s current Citizen’s Charter procedure for computer-crime victims provides for a complaint sheet, preliminary interview, sworn statements or prepared affidavits, collection of supporting documents, and examination of a relevant device when necessary. It lists no intake fee.

Hotline 1326 accepts reports involving impersonation, phishing, scams, and other cybercrimes. DICT also lists 1326@dict.gov.ph as a feedback or complaint channel on its official contact page. A hotline report may result in assistance or referral, but comply promptly if the receiving agency asks you to appear, execute a sworn statement, or provide additional evidence.

What to include in your complaint

Prepare a clear chronological account covering:

Who is being impersonated
When and how the fake account was discovered
What name, images, documents, or details were used
What the account posted, promised, requested, or represented
Who received or relied on its messages
Any financial, reputational, emotional, privacy, or security harm
Platform reports already made and their results
The identity of any suspected operator and the factual basis for the suspicion
Witnesses and supporting documents
The relief or investigation you are requesting

If the operator is unknown, say so. Do not name a person as the offender based only on suspicion. Provide specific leads—such as knowledge revealed in messages, recurring payment accounts, phone numbers, writing patterns, or witnesses—while distinguishing facts from your conclusions.

Ask the investigator whether an immediate preservation request to the platform or service provider is appropriate. Under Section 13 of RA 10175, traffic data and subscriber information are subject to a minimum six-month preservation period from the transaction, while content data may be preserved for six months after a law-enforcement preservation order, with a one-time six-month extension. These are provider-preservation rules, not permission for a victim to wait six months before reporting.

Law enforcement may need court-issued cybercrime warrants to obtain subscriber information or other protected data. A private individual generally cannot compel a platform to reveal the operator merely by sending a demand.

A screenshot proves the account existed—but may not prove who operated it

A profile bearing a person’s name or photograph does not, by itself, establish who created, controlled, or authored its content.

In XXX v. People, G.R. No. 274842, the Supreme Court identified guideposts that may establish ownership, access, or authorship, including:

An admission of ownership, access, or authorship
A witness seeing the person use the account or compose the communication
Information in a post or message known only to the person or a limited group
Language or writing style consistent with the alleged author
Provider, telecommunications, or forensic records linking the account to a person or device
Conduct consistent with earlier posts or messages
Other circumstances showing ownership, access, or authorship

This is why full conversations, witnesses, unusual details, payment records, and technical evidence may matter as much as the profile screenshot.

Report financial misuse immediately

If the fake account obtained passwords, OTPs, card details, e-wallet credentials, or money:

Call the bank or e-wallet using the number in its official app, website, or the back of the card.
Request that access be secured and the transaction formally recorded as disputed.
Preserve transaction IDs, recipient accounts, mobile numbers, timestamps, and support tickets.
File with the PNP, NBI, or Hotline 1326.
If the institution does not resolve the complaint, escalate it through the BSP Consumer Assistance Mechanism.

BSP rules direct account owners to report disputed transactions immediately. The Anti-Financial Account Scamming Act, RA 12010, covers specified social-engineering schemes, money-muling activities, and the use of another person’s identity or documents to open financial accounts. Whether it applies depends on how the information and financial accounts were used.

Reporting quickly may allow an institution to trace or temporarily hold disputed funds when the legal and regulatory conditions are met. It does not guarantee reimbursement or recovery.

When to consider a National Privacy Commission complaint

Consider the National Privacy Commission when the conduct involves unlawful collection, use, disclosure, or other processing of your personal data—not merely because an account is false.

Under the NPC’s 2021 Rules of Procedure, as amended, a complainant generally must first notify the personal information controller, processor, or concerned entity in writing and allow it to act. If it does not take timely and appropriate action, or gives no response within 15 calendar days from receipt, an NPC complaint may proceed. The NPC may waive this requirement for properly established good cause or a serious violation involving significant risk of harm.

Keep proof of your platform or privacy complaint and the response, if any. A formal NPC complaint must be written, signed, verified, supported by evidence, and accompanied by a certification against forum shopping. Filing fees ordinarily apply, subject to the exemptions or waiver allowed by the rules. The NPC’s formal-complaint page provides the current form and submission instructions.

An NPC proceeding addresses data-privacy rights and compliance. It is not a substitute for an urgent police report or criminal investigation.

Other laws may apply

The correct charge depends on the account’s actual conduct, not simply its being “fake.” Possible laws include:

Cyberlibel, if the original author publishes a defamatory imputation meeting the elements of libel
The Safe Spaces Act, RA 11313, when online impersonation or posts form part of gender-based online sexual harassment
The Anti-Photo and Video Voyeurism Act, RA 9995, for conduct involving covered intimate recordings
RA 11930 when a child or child sexual-abuse or exploitation material is involved
Laws covering threats, extortion, fraud, violence against women and children, access-device fraud, or unauthorized access, depending on the facts

Do not assume that every insulting or false statement is automatically cyberlibel. Publication, the nature of the imputation, identity, authorship, applicable defenses, and other elements must be established.

Cyberlibel is especially time-sensitive. In its 2026 resolution in Causing v. People, G.R. No. 258524, the Supreme Court affirmed that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. Seek legal advice promptly if defamatory posts are involved.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and content
Keeping only cropped screenshots with no username, date, or context
Deleting the original conversation or factory-resetting a relevant device
Assuming the person pictured or named owns the account
Publicly accusing a suspected person without sufficient evidence
Reposting harmful or intimate material to “warn everyone”
Paying the impersonator, blackmailer, investigator, or supposed “account recovery expert”
Giving an OTP, password, recovery code, or full ID to an unofficial reporting page
Relying only on a barangay blotter or platform report when a formal criminal complaint is needed
Waiting for the operator’s identity before making a report
Expecting police to hack the account or compel immediate disclosure without lawful process

When legal help is urgent

Consult a Philippine lawyer promptly when:

The account is publishing defamatory accusations and the one-year cyberlibel period may be running
You need an urgent court order or coordinated preservation of evidence
Several victims, jurisdictions, platforms, or financial institutions are involved
The account uses business trademarks, confidential records, or employee or customer data
The suspect is a spouse, former partner, coworker, employer, public official, or person with access to sensitive records
You are being threatened with criminal exposure or a counter-complaint
Intimate images, child-related content, stalking, extortion, or credible threats are involved
A substantial amount of money or a financial account is at risk

A lawyer is not required merely to make an initial platform, PNP, NBI, CICC, bank, or e-wallet report. Legal assistance can nevertheless help organize evidence, identify the proper causes of action, and avoid missed deadlines.

FAQ

Can I report an account if I do not know who created it?

Yes. Preserve the URL and all available leads, then identify the respondent as unknown in substance. Law enforcement can evaluate whether preservation requests, warrants, provider records, or forensic examination are warranted.

Are screenshots enough?

They can establish what appeared on a screen, but they may not prove authenticity, completeness, publication, damage, or the operator’s identity. Retain the original device, full conversation, URLs, witnesses, and related records.

Will the police immediately remove the fake account?

Not necessarily. Platforms make policy-based removal decisions, while compulsory access to protected account data normally requires lawful investigative and judicial procedures. Report to the platform and law enforcement in parallel.

Can someone report on behalf of the victim?

Platforms may allow an authorized representative or bystander report. A criminal complaint is usually strongest when the victim and direct witnesses personally give sworn statements. For an NPC case, a representative generally needs a special power of attorney; parents or guardians of minors must provide the proof required by the NPC rules.

Should I confront the fake account?

Usually not. Confrontation may lead to deletion, retaliation, further deception, or loss of evidence. Preserve the material, secure your accounts, and obtain guidance from the platform or investigator.

What if the account keeps returning under new names?

Document each new URL as a separate entry, note similarities and differences, and refer to earlier platform and law-enforcement report numbers. Do not assume that all accounts have the same operator unless evidence supports that conclusion.

This article provides general Philippine legal information, not legal advice for a particular case. The proper remedy, offense, deadline, and forum depend on the evidence and surrounding facts. Laws, agency procedures, and official reporting channels were checked against available primary and official sources as of 4 August 2026.