Quick answer

If someone creates a fake social-media account using your name, photographs, contact details, business identity, or other identifying information, preserve the evidence before reporting or blocking the account, report the impersonating account through the platform, secure your legitimate accounts, and—where the impersonation involves unauthorized use of your identifying information, fraud, threats, reputational harm, hacking, or other unlawful conduct—report the incident to Philippine cybercrime authorities.

The principal criminal law is the Cybercrime Prevention Act of 2012 (Republic Act No. 10175). Section 4(b)(3) defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information, without right. The Supreme Court has upheld this provision and explained that identifying information commonly includes a person's name, citizenship, address, contact number, date and place of birth, spouse's name, occupation, and similar data. (E-Library)

A fake profile is therefore not automatically a criminal case merely because it resembles another person's account. The surrounding facts matter. An impersonator who deliberately uses your identity to deceive your relatives, solicit money, damage your reputation, obtain information, or make other people believe that the account is genuinely yours presents a much stronger case for criminal investigation than an unrelated account that merely has a similar name.

Do not wait for the fake account to disappear before preserving evidence. Under Republic Act No. 10175, service providers are required to preserve subscriber information and traffic data for at least six months from the relevant transaction, while content data is subject to preservation after an appropriate law-enforcement order. Early reporting can therefore matter when investigators later need account-registration, access, traffic, or other computer data. (E-Library)

What Philippine law considers computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, when done without right. The law also expressly provides for a lower penalty when no damage has yet been caused. (Lawphil)

In Disini v. Secretary of Justice, the Supreme Court rejected constitutional challenges to this provision. It explained that ordinary identifying information may include a person's name, residence address, contact number, date and place of birth, occupation, and similar information, and characterized the prohibited conduct as acquiring or using another person's identifying information without right in the context of identity theft. (E-Library)

This can cover conduct such as creating an account that uses your photograph and personal details and then pretending to be you, particularly where the account communicates with others as though it were genuinely yours. Whether criminal liability ultimately exists, however, depends on the evidence of intentional use, lack of authority, the information actually used, and the surrounding purpose and consequences.

The law should not be stretched to every mistaken identity, duplicate name, parody, fan account, criticism page, or other account simply because it mentions or depicts another person. Other constitutional and statutory considerations may apply. The safest legal analysis is therefore based on what the account actually used and did, not merely on the existence of a second account bearing a similar name.

Preserve the evidence before you report the account

Before blocking the impersonator or asking friends to mass-report the profile, document what presently exists. Platform enforcement can remove a profile, posts, messages, or other visible information, making later evidence collection more difficult.

Preserve, as applicable:

Screenshots showing the entire profile, including the profile photograph, cover photograph, username, display name, biography, follower or friend information, and other identifying details.
The account's exact profile URL or account link. Do not rely only on the displayed username because usernames can be changed.
Screenshots and links to posts, stories, comments, advertisements, marketplace listings, or other content published by the account.
Messages sent by the fake account to you, relatives, clients, customers, coworkers, or other persons.
Evidence showing that the account represented itself as you—for example, statements about your family, employment, profession, business, or personal circumstances.
Evidence of actual harm, including money transfers, lost transactions, complaints from clients, defamatory messages, threats, or witnesses who were deceived.
Transaction references, bank or e-wallet records, telephone numbers, email addresses, QR codes, payment instructions, and other identifiers used by the impersonator.
The date and approximate time when each item was discovered. Where possible, retain the original electronic files rather than only printed copies.

Do not edit screenshots in a way that obscures their source. Cropped copies may be useful for explanation, but keeping the original full-screen capture can help establish context.

If another person received the fraudulent messages, ask that person to preserve the messages on the original device as well. A screenshot forwarded repeatedly through messaging applications is generally less useful than evidence retained by the person who actually received the communication.

Secure your real accounts immediately

If the fake profile appeared after your genuine account was hacked, treat account recovery and identity theft as related but distinct problems.

Change the password of the affected social-media account and the email account connected to it. Review active sessions, revoke unfamiliar devices or applications, enable two-factor authentication, and change reused passwords on other services. Meta's official guidance directs users whose Facebook accounts have been hacked to its account-recovery process and recommends security measures such as two-factor authentication. (Facebook)

Do not negotiate with an unknown hacker by sending passwords, one-time PINs, recovery codes, identification documents, or payment unless you have obtained specific professional advice about the situation.

If the impersonator has only created a separate fake profile and has not entered your real account, changing your password is still sensible if there is any possibility that your credentials were compromised.

Report the fake account to the social-media platform

Platform reporting is usually the fastest method of seeking removal, but it is not a substitute for a criminal complaint when the conduct may constitute a crime.

Use the platform's impersonation or fake-account reporting procedure rather than reporting the account under an unrelated category. Preserve the account URL and screenshots first.

Facebook and Messenger expressly provide reporting mechanisms for accounts pretending to be another person. TikTok likewise allows reports for impersonation and provides a specific impersonation-reporting procedure, including an online form for accounts outside the United States. (Facebook)

Platforms may request identification or other proof that you are the person being impersonated. Follow the platform's official process and avoid sending identification documents to an account that contacts you privately claiming to be "support."

If the platform removes the account, retain the confirmation or case/reference number. Removal can stop continuing harm, but it does not automatically identify the person who operated the account or terminate any criminal investigation.

Where to report identity theft in the Philippines

For a potentially criminal incident, one practical reporting route is the Philippine National Police Anti-Cybercrime Group (PNP-ACG). Its current official contact directory lists the Cyber Response Unit and regional, provincial, and district cybercrime offices. The Cyber Response Unit currently lists complaint@acg.pnp.gov.ph as its complaint email. (PNP ACG)

The Department of Justice Office of Cybercrime (DOJ-OOC) also has statutory functions relating to cybercrime complaints, investigation assistance, preservation and production of computer data, evidence gathering, and coordination. Its current official contact page lists cybercrime@doj.gov.ph and its office in Ermita, Manila. (Cybercrime Division)

The DOJ Office of Cybercrime has also expressly identified both the NBI Cybercrime Division and the PNP Anti-Cybercrime Group as places where members of the public may report or file complaints concerning cybercrime incidents. (Cybercrime Division)

You generally do not need to make identical complaints to every agency merely for the sake of filing multiple reports. What matters is getting the incident properly documented and investigated, particularly when the person behind the account is unknown and law-enforcement assistance may be necessary to obtain service-provider information.

Where the suspected offender is already known and the evidence is sufficiently developed, a criminal complaint may ultimately proceed through the appropriate prosecutor's office. Under Rule 112 of the Rules of Criminal Procedure, a complaint for preliminary investigation must be supported by the complainant's and witnesses' affidavits and other supporting documents establishing probable cause. (E-Library)

What to tell cybercrime investigators

Give investigators a chronological account rather than simply saying that someone "stole my identity."

Explain when you discovered the account, what identifying information it used, why you know the account is not yours, what the operator represented to other people, whether money or information was obtained, whether your genuine account was hacked, and what harm occurred.

Bring or make available the profile URL, screenshots, communications, transaction records, names of witnesses, and any platform-report reference numbers.

If the operator is unknown, say so. Do not publicly accuse a particular individual merely because you suspect that person. Subscriber records, access information, devices, account-registration information, financial trails, and other evidence may be necessary before attribution can responsibly be made.

The Rule on Cybercrime Warrants provides procedures through which law-enforcement authorities may seek judicial authority for disclosure, interception, search, seizure, or examination of computer data when the legal requirements are satisfied. (E-Library)

If the impersonator obtained money or accessed a bank or e-wallet account

Treat the incident as urgent.

Immediately report the unauthorized transaction to the bank, e-money issuer, or other financial institution involved. The Bangko Sentral ng Pilipinas specifically advises financial consumers to report suspicious transactions immediately to their bank or e-money issuer. If the institution's response is unsatisfactory, BSP's Consumer Assistance mechanism is a second-level recourse, and the BSP advises consumers to obtain the financial institution's complaint reference number first. (Bureau of the Treasury)

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), separately addresses prohibited conduct involving financial accounts and social-engineering schemes. BSP Circular No. 1215, Series of 2025, now provides procedures for temporary holding and coordinated verification of disputed funds. Among other things, the rules contemplate an initial holding of disputed funds for up to five calendar days in specified circumstances, with procedures for an extended holding, subject to the statutory maximum. (Bureau of the Treasury)

Speed matters because funds may be transferred through several accounts before a complaint reaches the receiving institution.

When the Data Privacy Act may also apply

Misuse of someone's photograph, contact information, identification documents, financial information, or other personal data can also raise issues under the Data Privacy Act of 2012 (Republic Act No. 10173). The Act regulates processing of personal information and penalizes various forms of unauthorized processing and misuse. (E-Library)

However, a Data Privacy Act complaint should not automatically be added to every fake-account case. The statute's definition of a personal information controller excludes an individual processing personal information in connection with that individual's personal, family, or household affairs. The NPC has explained that whether particular conduct falls within that exclusion depends on the circumstances and that processing extending beyond a genuinely personal or household context may fall within the Act. (National Privacy Commission)

For a formal NPC complaint, the Commission currently requires a completed and notarized Complaints-Assisted Form or verified complaint, together with supporting evidence and applicable witness affidavits. The NPC's current website identifies complaints@privacy.gov.ph for complaints and provides the current complaint template. (National Privacy Commission)

As a general rule, the NPC requires exhaustion of remedies: the complainant must first notify the respondent in writing of the claimed privacy violation and allow appropriate action. If there is no timely or appropriate action, or no response within 15 calendar days from receipt, the requirement is ordinarily satisfied. The NPC may waive this requirement for good cause or serious violations, including situations involving grave and irreparable harm, lack of a plain, speedy or adequate remedy, or conduct that is patently illegal. (National Privacy Commission)

An NPC proceeding is separate from a cybercrime investigation. Depending on the circumstances, one, both, or neither route may be appropriate.

Other offenses may arise from the same fake account

The legal characterization depends on what the impersonator actually did.

If someone unlawfully entered your real social-media, email, or other computer account, illegal access under Republic Act No. 10175 may be relevant. If computer data or systems were manipulated as part of a fraudulent scheme, computer-related fraud or forgery may need to be considered. If the fake account published defamatory material, cyber libel may become relevant subject to its separate elements and defenses. Republic Act No. 10175 also provides that crimes under the Revised Penal Code and special laws committed by, through, or with information and communications technology may fall under Section 6 of the Cybercrime Prevention Act. (Lawphil)

Do not assume that every offensive post gives rise to every possible cybercrime charge. Investigators and prosecutors must evaluate each offense independently based on its statutory elements and the evidence.

What is the penalty for computer-related identity theft?

Computer-related identity theft under Section 4(b)(3) falls within the computer-related offenses penalized by Section 8 of Republic Act No. 10175. The prescribed penalty is prision mayor, or a fine of at least ₱200,000 up to a maximum amount commensurate to the damage incurred, or both. If no damage has yet been caused, the statute provides that the penalty is one degree lower. (Lawphil)

Under Article 27 of the Revised Penal Code, prision mayor ordinarily ranges from six years and one day to twelve years. The precise sentence in an actual conviction can depend on the applicable rules on penalties and the circumstances of the case; the statutory range should therefore not be treated as an automatic sentence for every accused person. (Lawphil)

Common mistakes that can weaken a complaint

A frequent mistake is reporting the fake account immediately but failing to save its URL, messages, profile information, and other evidence first.

Another is relying only on screenshots supplied by other people without asking the actual recipients to retain the original messages on their devices.

Do not alter, fabricate, or embellish evidence. Do not create a conversation with the fake account merely to manufacture stronger-looking proof.

Avoid publicly naming a suspected offender unless there is a reliable basis to do so. A mistaken public accusation can create a separate legal problem.

Do not send money merely to discover the impersonator's identity. If investigators believe a controlled transaction or other investigative technique is appropriate, let law-enforcement officers manage it.

Finally, do not assume that having the fake profile removed ends the matter. If money was taken, threats were made, confidential information was exposed, accounts were hacked, or other people remain at risk, preserve the takedown confirmation and continue with the appropriate complaint.

When legal or law-enforcement help is urgent

Seek immediate assistance when the impersonator is actively soliciting money in your name, has obtained access to your bank or e-wallet accounts, is threatening violence, is publishing intimate or highly sensitive information, is targeting children, is using stolen identification documents, or appears to have compromised your email or other accounts.

Immediate reporting is also advisable where the account is contacting clients, employers, government agencies, banks, or other persons in a way that may create financial, professional, or legal consequences.

The possibility that platform or service-provider records may change or cease to be readily available is another reason not to delay unnecessarily. Republic Act No. 10175 establishes preservation mechanisms precisely because computer evidence can be transient. (E-Library)

Frequently asked questions

Is creating a fake Facebook account automatically identity theft?

No. The legal question is not merely whether an account is "fake." Computer-related identity theft requires the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another, without right. The account's content, purpose, representations, and use of the victim's identity therefore matter. (E-Library)

Can I report an account even if I do not know who created it?

Yes. An unknown operator is one reason cybercrime investigation may be necessary. Preserve the account's exact URL, screenshots, messages, payment information, and any other identifiers rather than attempting to identify the person through speculation.

Should I report to Facebook or to the police first?

Preserve the evidence first. You can then use the platform's impersonation-reporting mechanism and report potentially criminal conduct to cybercrime authorities. Platform removal and criminal investigation serve different purposes.

Can the police obtain information identifying the person behind the account?

Potentially, but access to non-public computer data is governed by law and judicial procedures. Philippine cybercrime rules provide mechanisms for preservation and court-authorized disclosure, search, seizure, and examination of computer data where the legal requirements are met. (E-Library)

What if the fake account only copied my photo?

The answer depends on the surrounding circumstances. Copying a photograph may raise identity, privacy, intellectual-property, or platform-policy issues, but it should not automatically be labeled computer-related identity theft without examining how the photograph was obtained and used and whether the statutory elements are present.

What if the account is using my identity to borrow money from friends?

Preserve the messages, fake-account profile, payment instructions, transaction records, and statements of the persons contacted. Report the impersonating account to the platform and make a cybercrime report promptly. If money was transferred through a bank or e-wallet, the sender should also immediately notify the relevant financial institution.

Do I need a lawyer before reporting?

Not necessarily. Victims may approach cybercrime authorities directly. Legal assistance becomes particularly useful when substantial money is involved, several possible criminal offenses overlap, the offender's identity is disputed, sensitive personal information is involved, the case requires a formal prosecutor's complaint, or urgent court relief may be necessary.

Official sources

The full text of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, is available through the Supreme Court E-Library and Lawphil. Supreme Court E-Library — Republic Act No. 10175 Lawphil — Republic Act No. 10175

The Supreme Court's decision in Disini v. Secretary of Justice discusses the constitutionality and meaning of the computer-related identity-theft provision. Supreme Court E-Library — Disini v. Secretary of Justice

Current PNP cybercrime contact information is available from the PNP Anti-Cybercrime Group. PNP Anti-Cybercrime Group — Contact Us

Information and contact details for the Department of Justice Office of Cybercrime are available on its official website. DOJ Office of Cybercrime

For privacy complaints, use the National Privacy Commission's current complaint procedures and forms. National Privacy Commission — File a Complaint

For financial scams involving BSP-supervised banks, e-wallets, or other institutions, consult the Bangko Sentral ng Pilipinas Consumer Corner. Bangko Sentral ng Pilipinas — Consumer Corner

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice based on the specific account, messages, documents, financial transactions, identities of the parties, and other evidence involved. Criminal liability, data-privacy liability, and the appropriate filing route depend on the facts of each case. Laws, rules, agency procedures, and official reporting information were checked against primary and official sources as of August 25, 2026.