Quick answer

If someone creates a fake social media account using your name, photographs, business identity, or other identifying information, report the account immediately to the platform—but preserve the evidence before it disappears. If the account is being used to deceive people, solicit money, damage your reputation, threaten you, or access other accounts, file a formal complaint with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

The conduct may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on what the offender did, other offenses—such as computer-related fraud, illegal access, online libel, threats, falsification, or violations of the Data Privacy Act—may also apply.

A fake account is not automatically criminal merely because it resembles another person’s profile. Criminal liability depends on evidence showing the intentional and unauthorized acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information. Context matters, including whether the account is clearly labeled as parody, was created with permission, or is actually intended to deceive or cause harm.

What counts as computer-related identity theft?

Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act, penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, when done without right.

“Identifying information” can include information used to identify an individual or organization, such as:

A person’s name, photograph, signature, address, contact details, or date of birth;
Government-issued identification details;
Account usernames, email addresses, passwords, or authentication information;
Business names, logos, official photographs, and authorized representatives’ identities;
Banking, payment, or account information; and
A combination of details that enables others to recognize or transact with the victim.

Common examples include:

Creating a Facebook, Instagram, TikTok, X, or messaging account that pretends to be the victim;
Copying the victim’s name and photographs to ask friends or clients for money;
Impersonating a lawyer, business, government official, seller, or employee;
Using a stolen account to contact the victim’s family or customers;
Opening online accounts using another person’s identification documents;
Changing a hacked account’s email address, password, or profile information; and
Using another person’s identity to obtain loans, receive payments, or commit scams.

The prosecution must still prove the elements of the particular offense beyond reasonable doubt. A reused name, similar username, fan page, criticism page, or clearly disclosed parody account does not necessarily establish identity theft by itself.

Possible penalties and related offenses

Computer-related identity theft under Section 4(b)(3), in relation to Section 8 of RA 10175, is punishable by prisión mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. If no damage has yet been caused, the law provides for a penalty one degree lower.

The precise charge depends on the evidence. An impersonator may also be investigated for:

Computer-related fraud, if unauthorized manipulation of computer data or interference with a computer system causes damage with fraudulent intent;
Illegal access, if the offender entered another person’s account or computer system without right;
Computer-related forgery, if inauthentic computer data was created or knowingly used for a fraudulent or dishonest design;
Estafa, if deceit caused another person to part with money or property;
Online libel, if the account published a defamatory allegation meeting the legal elements of libel;
Threats, coercion, or extortion, depending on the messages and demands made;
Falsification or use of falsified documents, if fabricated documents or identification records were used; or
Data Privacy Act violations, when personal information was unlawfully processed, disclosed, accessed, or used under circumstances covered by that law.

Not every fake account supports every offense. For example, merely insulting someone is not automatically identity theft, while copying a photograph is not automatically online libel. Investigators and prosecutors must match the proven acts to the elements of each offense.

What to do immediately

1. Preserve the account before reporting or confronting anyone

Fake accounts can be renamed, altered, blocked, or deleted within minutes. Before alerting the suspected operator, preserve:

The complete profile URL, not merely the displayed username;
Screenshots showing the profile name, username, photograph, biography, posts, and date and time;
Screen recordings showing how the profile was reached and what appears on it;
URLs of individual posts, videos, or listings;
Messages, comments, voice notes, emails, and call logs;
Payment requests, QR codes, bank or e-wallet details, receipts, and reference numbers;
Names and contact details of persons approached by the fake account;
Notifications showing password, email, or security-setting changes;
Login alerts, IP or device information made available by the platform;
Copies of the genuine account and proof that it belongs to you; and
Reports submitted to the platform and the resulting reference numbers or emails.

Capture the entire conversation where possible. Selective screenshots can omit context and may later be challenged. Keep the original files on the original device, make backup copies, and avoid editing, cropping, annotating, or repeatedly forwarding the only copy.

Electronic evidence generally must be shown to be authentic. The Rules on Electronic Evidence allow electronic documents to be proved through evidence showing their integrity and reliability. The person who personally saw, received, captured, or downloaded the material may later be asked to explain how it was obtained.

2. Report the account through the platform

Use the platform’s impersonation, identity theft, hacked-account, fraud, or privacy-reporting channel. Select the category that accurately describes the conduct.

Official reporting resources include:

Platforms may ask for a government-issued ID or proof that you represent the person or business being impersonated. Submit only through the platform’s official website or application. Do not send identification documents to an account claiming that it can “help” remove the fake profile.

A platform report may result in removal or restriction, but it is not a criminal complaint and does not necessarily identify or prosecute the operator.

3. Secure your real accounts

If there is any possibility that your genuine account was accessed:

Change the password using a trusted device;
Use a unique password not used for email, banking, or other services;
Log out unknown devices and terminate unfamiliar sessions;
Enable multi-factor authentication, preferably through an authenticator application or security key;
Review recovery email addresses and telephone numbers;
Remove unfamiliar applications and connected services;
Check whether messages, posts, advertisements, or payment methods were added;
Secure the email account connected to the social media profile; and
Ask your mobile provider for assistance if your SIM suddenly lost service or you suspect an unauthorized SIM replacement.

Do not click “recovery” links sent by strangers. Open the official application or type the platform’s address directly.

4. Warn likely targets without destroying evidence

Inform family members, employees, clients, customers, or followers that the account is unauthorized. State the exact username and explain that they should not send money, disclose one-time passwords, or click links.

Keep the warning factual. Avoid publicly naming a suspected operator unless you have reliable evidence and legal advice. A mistaken accusation can create a separate legal dispute.

5. Contact financial institutions immediately if money or account data is involved

If the fake account obtained or attempted to obtain money:

Notify the relevant bank, e-wallet provider, card issuer, or payment service immediately;
Request that the transaction or recipient account be flagged;
Ask for a reference number and written confirmation;
Change affected credentials and disable compromised cards or accounts;
Preserve transaction records, account numbers, QR codes, and recipient details; and
Tell each person who sent money to report the transaction through their own financial institution and execute a statement.

Recovery is not guaranteed. Speed matters because funds can be transferred through several accounts shortly after receipt.

Where to file a cybercrime complaint

PNP Anti-Cybercrime Group

RA 10175 expressly designates the PNP and NBI as cybercrime law-enforcement authorities. You may approach the PNP Anti-Cybercrime Group or an appropriate regional or local cybercrime unit.

Bring:

A valid government-issued ID;
A chronological written account of what happened;
Printed and electronic copies of screenshots and recordings;
The exact URLs and usernames involved;
Your genuine-account details and proof of identity or authority;
Witness contact information and, if available, sworn statements;
Transaction records and communications with banks or e-wallet providers;
Copies of platform reports and responses; and
The device on which the evidence was received or captured, if investigators request its examination.

Ask for the complaint, incident, or reference number and the investigator’s official contact details.

NBI Cybercrime Division

The general public may request investigative assistance from the NBI Cybercrime Division. The NBI’s published procedure provides for a complaint sheet, preliminary interview, sworn statements, supporting documents, and, when relevant, examination of the device connected with the complaint. The service itself is listed as having no fee.

Complaints may also be brought to an appropriate NBI regional or district office. Confirm current office arrangements through the official NBI website before travelling.

Office of the prosecutor

A criminal complaint may ultimately be submitted for preliminary investigation before the proper prosecution office. It ordinarily requires a complaint-affidavit, witness affidavits, and supporting evidence sufficient to establish probable cause.

Because cybercrime venue and jurisdiction may depend on where the acts, computer systems, offender, or resulting damage are connected, obtain advice before selecting a filing office—particularly where the operator is abroad, unknown, or located in another province.

Investigators may need judicial warrants to compel disclosure of subscriber information, traffic data, or content. A private complainant ordinarily cannot force a social media platform or telecommunications provider to disclose another user’s protected account information merely by sending a request.

Why prompt reporting matters

Under RA 10175, service providers are subject to statutory preservation rules for specified computer data. The law generally requires traffic data and subscriber information relating to communications to be preserved for at least six months from the transaction, while content data may be preserved for six months from receipt of a lawful preservation order. Law-enforcement authorities may order a one-time extension under the conditions stated in the law.

This does not mean all evidence will remain available for six months. Accounts, messages, logs, and provider practices differ, and some information may no longer exist by the time legal process is issued. Prompt reporting gives investigators a better opportunity to seek lawful preservation and disclosure.

Do not attempt to hack the fake account, track the offender through illegal access, install spyware, or trick a platform employee into releasing subscriber data. Evidence obtained unlawfully may create legal problems and compromise the investigation.

When a National Privacy Commission complaint may be appropriate

A fake account can involve a privacy violation, but the National Privacy Commission (NPC) is not a substitute for the PNP, NBI, or prosecutor in pursuing cybercrime.

An NPC complaint may be appropriate when a person, company, organization, or platform has allegedly processed, disclosed, or failed to protect personal data in violation of Republic Act No. 10173, the Data Privacy Act, its implementing rules, or NPC issuances.

Under the 2021 NPC Rules of Procedure, a complainant ordinarily must first:

Inform the personal information controller, processor, or concerned entity of the alleged violation in writing; and
Show that the entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive these requirements for good cause or in serious cases, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

The complaint must generally be written and verified and must include the material facts, supporting documents, witness affidavits if any, correspondence with the respondent, the relief requested, and a certification against forum shopping. The NPC’s official complaint-filing page provides the current form and submission instructions.

If the impersonator is unknown

You do not need to know the offender’s real name before making an initial report. Provide every available identifier, including:

Profile and post URLs;
Usernames and former usernames;
Email addresses and telephone numbers;
Bank, e-wallet, or recipient-account details;
Delivery addresses;
Dates and times of messages and transactions;
Names of witnesses or recipients;
Voice recordings or video appearances; and
Links between the fake account and other profiles.

Identifying an operator often requires information held by platforms, telecommunications companies, banks, or payment providers. Disclosure may require proper legal process and, depending on the type of data, a judicial warrant under the Rule on Cybercrime Warrants.

An account’s displayed name, profile photograph, or alleged location does not reliably establish who controlled it.

If the account is attacking your reputation

Preserve each specific post, comment, or message. For a possible online-libel complaint, the exact words, their meaning, publication to another person, the identity of the person referred to, and the surrounding circumstances are important.

Do not assume that every false, harsh, or embarrassing statement is criminal libel. Truth, privileged communication, fair comment, lack of identification, lack of publication, and other factual or legal issues may affect liability. The Supreme Court’s decision in Disini v. Secretary of Justice also limits cyber-libel liability under RA 10175 to the original author of the post, not persons who merely receive it or react to it.

Consult counsel promptly because limitation periods and venue questions can be disputed and fact-sensitive.

If intimate images or threats are involved

Seek immediate assistance if the fake account:

Threatens physical harm;
Demands money in exchange for not releasing images or information;
Shares or threatens to share intimate images;
Targets a child;
Publishes an address or encourages others to attack the victim;
Impersonates the victim to arrange meetings or sexual activity; or
Continues stalking or harassment across several accounts.

Do not pay an extortion demand without first obtaining advice. Payment may not prevent publication and can lead to further demands. Preserve the threat, account URL, payment instructions, and deadline, then contact law enforcement.

If there is an immediate danger to life or safety, contact emergency services or the nearest police station without waiting for a platform response.

Civil remedies may also be available

Depending on the facts, the victim may consider civil remedies under the Civil Code for an invasion of privacy, interference with personal dignity, abuse of rights, or damage caused by a wrongful act. Injunctive relief or damages may be possible in an appropriate case.

A civil case requires more than proof that a fake account existed. The claimant must establish the wrongful conduct, the defendant’s responsibility, the injury suffered, and the legal basis for the relief requested. Whether an urgent court application is practical will depend on whether the operator can be identified and served and whether the evidence supports immediate relief.

Common mistakes to avoid

Reporting before preserving evidence. Removal protects the public but may erase information the victim still needs.
Saving only the display name. Usernames can change; preserve the full profile and post URLs.
Assuming a screenshot identifies the operator. It proves displayed content, not necessarily who controlled the account.
Cropping or editing the only copy. Preserve the original file and its surrounding context.
Sending IDs to unofficial “support agents.” Use only official platform channels.
Paying someone who promises guaranteed account removal or identification. No private person can guarantee platform action or lawful disclosure.
Publicly accusing a suspect without adequate proof. Apparent clues can be fabricated or copied.
Hacking back. Unauthorized access may itself be criminal.
Treating an NPC complaint as a criminal case. Privacy enforcement and criminal investigation serve different purposes.
Waiting for monetary loss before reporting. RA 10175 expressly addresses situations where no damage has yet occurred, although the applicable penalty may differ.
Failing to secure the connected email account. An attacker can regain access if the email remains compromised.

When legal help is urgent

Consult a lawyer or approach law enforcement promptly when:

Money has already been transferred;
The account has access to confidential business, legal, medical, or government information;
The offender is threatening violence or demanding payment;
Intimate material or information about a child is involved;
The victim’s genuine account, email, SIM, or financial account was compromised;
Several victims have been deceived;
A platform has refused action despite complete proof;
You need subscriber information or urgent preservation of provider data;
You are considering a court injunction or damages claim; or
The suspected offender is abroad or the proper venue is unclear.

Frequently asked questions

Can I report a fake account even if nobody has lost money?

Yes. Computer-related identity theft does not require completed financial loss in every case. RA 10175 specifically provides a lower penalty where no damage has yet been caused. Investigators must still determine whether the offender intentionally used identifying information without right.

Is using my photograph enough to establish identity theft?

Not necessarily. The photograph may be identifying information, but criminal liability depends on the entire context—including intentional use, lack of authority, and the conduct attributed to the suspect. Copyright, privacy, harassment, or platform-policy issues may also arise separately.

Should I report to both the platform and law enforcement?

Yes, when the conduct appears criminal or poses continuing harm. The platform can restrict or remove the account, while the PNP or NBI can investigate. Keep evidence of both reports.

Can the police immediately obtain the account owner’s identity from Facebook or another platform?

Not necessarily. Subscriber, traffic, and content data are subject to legal protections. Investigators may need a preservation order, a cybercrime warrant, or international cooperation, depending on the data and provider.

Can I file if I do not know the offender?

Yes. Identify the respondent as unknown if necessary and provide all available digital and transactional identifiers. Law enforcement will determine whether further legal process can identify the operator.

Is a parody or fan account illegal?

Not automatically. Clear disclosure that an account is unofficial or satirical may negate deception, although its particular content may still violate another law or platform rule. An account deliberately presented as the real person is materially different.

Is a police blotter sufficient?

A blotter can document that an incident was reported, but it does not replace a formal cybercrime complaint, supporting affidavits, evidence preservation, investigation, or prosecution.

Should I delete messages or reset my device?

Secure your accounts, but do not erase potentially relevant evidence. Before resetting a device, preserve the messages, files, security alerts, and account records and ask the assigned investigator whether forensic examination may be needed.

This article provides general Philippine legal information, not legal advice for a particular case. The appropriate complaint, venue, evidence, and remedies depend on the actual account activity, persons involved, and available records. Laws, procedures, and official reporting information were checked as of August 25, 2026.