A threatening message from a fake Facebook, Instagram, TikTok, X, Telegram, or messaging account can feel impossible to act on because you do not know the person’s real name. In the Philippines, however, you do not need to identify the account owner before reporting the incident. The important first steps are to protect yourself, preserve the digital evidence, and file a properly documented complaint quickly enough for investigators to seek subscriber, traffic, and platform records.

A fake profile is not automatically illegal. What matters is what the person did with it: threatened violence, demanded money, impersonated someone, published defamatory accusations, repeatedly stalked or messaged you, exposed private information, or distributed intimate images. Different Philippine laws may apply to the same incident.

When an Online Threat Requires Immediate Action

Treat the situation as an emergency when the sender:

Names a specific place, date, weapon, vehicle, workplace, school, or family member.
Says they are nearby or demonstrates knowledge of your current location.
Sends photos of your house, office, children, daily route, or personal belongings.
Has previously assaulted, stalked, or confronted you offline.
Demands money, sexual content, silence, or another action in exchange for not harming you.
Threatens suicide while also threatening to harm you or another person.
Appears to have accessed your accounts, private photos, contacts, or location data.

For an immediate danger, call the Philippines’ Unified 911 Emergency Hotline, proceed to the nearest police station, and move to a secure location. Do not wait for a cybercrime investigator to determine who owns the profile before seeking physical protection. The nationwide 911 system connects callers to police, fire, medical, and other emergency responders. (dilg.gov.ph)

Tell responding officers exactly why the threat appears credible. “I received a threatening message” is less useful than: “The account threatened to shoot me tonight, named my condominium, and sent a current photo of the building entrance.”

Is Creating a Fake Profile a Crime in the Philippines?

Creating an anonymous or fictional account is not, by itself, automatically a criminal offense. People may use pseudonyms for privacy, commentary, or personal expression.

The account may become part of a criminal case when it is used to commit another unlawful act.

Conduct involving the fake profile	Possible Philippine law
Threatening to kill, injure, abduct, burn property, or commit another crime	Grave threats under Article 282 of the Revised Penal Code, potentially in relation to Section 6 of RA 10175
Demanding money or imposing a condition while making a threat	Grave threats, robbery or extortion-related offenses depending on the facts
Using another real person’s name, photo, or identifying information without right	Computer-related identity theft under Section 4(b)(3) of RA 10175
Posting defamatory accusations publicly	Cyber libel under Article 353 and Article 355 of the Revised Penal Code in relation to Section 4(c)(4) of RA 10175
Gender-based intimidation, sexual remarks, cyberstalking, impersonation, or repeated unwanted messaging	Gender-based online sexual harassment under Section 12 of RA 11313
Threatening to release or actually sharing intimate images	RA 9995, RA 11313, and possibly other criminal laws
Harassment by a husband, former husband, boyfriend, former boyfriend, or dating partner against a woman or her child	RA 9262, including possible protection orders
Hacking an account or accessing private data without permission	Illegal access and related offenses under RA 10175
Using a child’s sexual images or coercing a child to produce sexual content	RA 11930 and other child-protection laws

The Cybercrime Prevention Act of 2012, or RA 10175, also provides that crimes under the Revised Penal Code and special laws committed through information and communications technology are covered by the Act, with the applicable penalty generally increased by one degree. (LawPhil)

Philippine Laws That Commonly Apply to Fake-Profile Harassment

Grave threats under the Revised Penal Code

Article 282 of the Revised Penal Code punishes a person who threatens another, or the victim’s family, with a wrong amounting to a crime against the person, honor, or property.

Examples include:

“I will kill you.”
“I will burn your store.”
“Your child will not make it home.”
“Pay me ₱50,000 or I will have you assaulted.”
“Withdraw your complaint or I will shoot your husband.”

A threat can be criminal even if the threatened act is never carried out. Investigators and prosecutors examine the words used, whether a condition or demand was imposed, the surrounding circumstances, the relationship between the parties, and whether the statement was a genuine threat rather than obvious exaggeration or an emotional outburst. The Supreme Court has identified the essential elements of grave threats as a threat to inflict a wrong, the wrong amounting to a crime, and, in the applicable form of the offense, the presence or absence of a condition. (LawPhil)

Because the threat was transmitted through a computer system or digital platform, Section 6 of RA 10175 may affect the charge and penalty.

Computer-related identity theft

Section 4(b)(3) of RA 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or organization without right.

This may apply when the fake profile uses:

Your real name and photograph.
A copy of your government ID.
Your employer’s logo and identity.
Another person’s email address, telephone number, or personal details.
Your identity to contact relatives, clients, co-workers, or romantic partners.

A profile using a completely invented name and stock photograph may not constitute identity theft by itself. A profile pretending to be a specific real person is much more likely to raise an identity-theft issue. The official Implementing Rules and Regulations of RA 10175 contain the statutory definition used by investigators. (Cybercrime Division)

Gender-based online sexual harassment under the Safe Spaces Act

The Safe Spaces Act, RA 11313, applies to more than requests for sex. Section 12 includes the use of technology to terrorize or intimidate a victim through physical, psychological, or emotional threats, unwanted sexual or sexist comments, misogynistic, homophobic or transphobic remarks, cyberstalking, incessant messaging, nonconsensual sharing of sexual media, impersonation, and posting lies intended to damage the victim’s reputation.

The conduct must fall within the law’s concept of gender-based online sexual harassment. An ordinary commercial dispute or non-gender-based insult does not automatically become a Safe Spaces Act case merely because it occurred online.

The PNP Anti-Cybercrime Group is specifically designated to receive complaints involving gender-based online sexual harassment, with the CICC coordinating appropriate measures. Section 14 provides imprisonment, a fine of ₱100,000 to ₱500,000, or both, upon conviction. (LawPhil)

Cyber libel

A fake account may commit cyber libel when it publicly posts a malicious accusation that identifies or clearly refers to a person and imputes a crime, vice, defect, or dishonorable conduct.

A private message sent only to the victim ordinarily presents a publication problem for libel because libel generally requires communication to at least one person other than the person defamed. The same private message may still support charges for threats, coercion, harassment, or another offense.

The Supreme Court explained in Disini v. Secretary of Justice that cyber libel is essentially traditional libel committed through a computer system. In its 2026 decision in Causing v. People, the Court reiterated that RA 10175 did not create a completely new libel offense but recognized a computer system as a means of publication. (LawPhil)

Intimate images and sexual blackmail

RA 9995, the Anti-Photo and Video Voyeurism Act of 2009, prohibits specified acts involving the recording, copying, selling, distributing, publishing, or broadcasting of sexual images or recordings without the required consent.

Consent to take an intimate image does not necessarily mean consent to distribute it. Section 4 applies its distribution prohibitions even when the person originally consented to the recording. (LawPhil)

A message such as “Send money or I will upload your intimate video” may involve several offenses at once, including threats, coercion, gender-based online sexual harassment, identity-related offenses, and violations of RA 9995.

Harassment by an intimate partner

When the victim is a woman and the suspected perpetrator is her husband, former husband, boyfriend, former boyfriend, dating partner, or former dating partner, online threats may fall under the Anti-Violence Against Women and Their Children Act, RA 9262.

Possible remedies include:

A Barangay Protection Order, which is generally effective for 15 days and addresses specified acts or threats of physical harm.
A Temporary Protection Order from the court.
A Permanent Protection Order after hearing.

A barangay blotter alone is not the same as a protection order. The order must be formally applied for and issued under RA 9262. (LawPhil)

Civil damages and injunctions

Even where the conduct does not result in a criminal conviction, Articles 19, 20, 21, and 26 of the Civil Code may support a civil action where a person abuses a right, acts contrary to law, morality, good customs, or public policy, or unjustifiably interferes with another person’s privacy, dignity, or peace of mind.

A civil case may seek damages and, in an appropriate situation, injunctive relief. The practical obstacle is that the defendant must first be identified and brought within the court’s jurisdiction.

How to Preserve Evidence from a Fake Account

Digital evidence can disappear within minutes. The sender may delete the account, unsend the messages, change the username, or block you.

Under the Supreme Court’s Rules on Electronic Evidence, the party presenting an electronic document must establish its authenticity. A screenshot is useful, but its weight becomes stronger when you can explain when, where, and how it was obtained and show that it accurately reflects the original data. (LawPhil)

Save these items before blocking the account

Full screenshots of every threat. Include the account name, profile picture, date, time, and surrounding conversation.
The exact profile URL. A display name can be changed. Copy the direct profile link, post link, message-thread link, channel link, or account ID where available.
A continuous screen recording. Start from the platform’s home screen, open the profile, show the URL or username, then open the messages or posts. This helps demonstrate context.
Original files. Download sent photos, voice recordings, videos, documents, and email attachments. Keep them in their original format.
Notification emails and text messages. Platforms sometimes email a copy or preview of a message even after the sender deletes it.
Platform report confirmations. Save the report number, automated response, case ID, or acknowledgment email.
Witness information. Record the names and contact details of people who saw the post or received messages from the fake account.
A chronological incident log. Include dates, approximate times, account names, links, exact words used, and what happened afterward.
Evidence showing why the threat is credible. This may include prior police reports, previous violence, photos of the sender near your home, earlier messages from a known suspect, or proof that the account knew nonpublic information.

Keep an untouched copy of each file. Do not crop, annotate, enhance, rename, or convert the only original. Create separate working copies for highlighting or printing.

Where the messages are in Filipino, Cebuano, Ilocano, or another language, preserve the original wording. An English translation can be attached later, but the original message remains important.

How to Report Online Threats in the Philippines

1. Address physical safety first

Call 911 or go to the nearest police station when the threat is immediate. Ask officers to record the incident and explain that the threat came through a fake online account.

Bring your phone, charger, identification, and any available screenshots. Do not surrender an unlocked device without obtaining a proper acknowledgment or inventory when it is formally taken for examination.

2. Secure your accounts without destroying evidence

After saving the evidence:

Change your email and social-media passwords.
Enable multi-factor authentication.
Review active sessions and log out unfamiliar devices.
Remove public location information.
Hide your friends list where the platform allows it.
Tell family members not to accept new requests from duplicate accounts.
Check whether your recovery email or mobile number was changed.
Preserve login-alert emails showing suspicious access.

Avoid deleting the entire conversation unless required for immediate safety. Deletion can remove information useful to investigators.

3. Report the profile to the platform

Use the platform’s reporting options for:

Threats or violence.
Harassment or bullying.
Impersonation.
Nonconsensual intimate images.
Privacy violations.
Hate speech or sexual harassment.
Compromised accounts.

Platform reporting can lead to quicker removal, but it is not a substitute for a police or NBI complaint. A suspended account may still require subscriber and traffic data to identify the user.

4. File with the PNP Anti-Cybercrime Group

The PNP Anti-Cybercrime Group, including its regional and local cybercrime units, investigates cybercrime complaints. For an online threat with a possible immediate physical component, you may also begin at the nearest police station and request coordination or endorsement to the appropriate cybercrime unit.

Bring:

A valid government-issued ID.
Printed and digital copies of the evidence.
The original device where the messages were received.
The profile and post URLs.
A timeline of events.
Names and contact information of witnesses.
Earlier barangay or police reports, if any.
Proof of prior dealings with the suspected person.
A draft complaint-affidavit, when available.

The officers may conduct an initial interview, ask you to execute a sworn statement, examine the device, and determine which offenses and investigative steps are appropriate.

5. File with the NBI Cybercrime Division

The NBI Cybercrime Division also handles computer-crime complaints. The NBI’s current directory identifies the Cybercrime Division and lists its official email as ccd@nbi.gov.ph. Its main office is at Filinvest Cyberzone, Diosdado Macapagal Boulevard, Pasay City, while regional and district offices may accept or route complaints. (National Bureau of Investigation)

The NBI Citizen’s Charter describes the intake process as including:

Initial interview and investigation.
Completion of a sworn complaint sheet.
Execution or submission of sworn statements and supporting documents.
Examination of a relevant device.
Assignment and approval of investigative authority.

The charter lists no agency fee for this intake and estimates about an hour for the initial processing steps. This does not mean the investigation will be completed in one hour. Tracing an account, obtaining warrants, coordinating with platforms, and preparing a criminal complaint can take much longer. (National Bureau of Investigation)

6. Use CICC Hotline 1326 for reporting and referral

The Cybercrime Investigation and Coordinating Center promotes Hotline 1326 for reporting online harm and cybercrime incidents. The CICC coordinates with law-enforcement and other government agencies but does not replace the investigating authority that must gather evidence and build the criminal case. (Facebook)

For a threat to life, use 911 first. Hotline 1326 is more appropriate for cybercrime reporting, coordination, and referral.

7. Execute a detailed complaint-affidavit

A complaint-affidavit is a sworn written account of what happened. It should state:

Your complete identity and contact information.
The date, time, platform, and account involved.
The exact threatening statements.
Whether the statements were public or private.
What the sender demanded.
Why you believe the sender may carry out the threat.
Whether you suspect a particular person and why.
The steps you took to preserve and report the evidence.
The harm caused, including relocation, missed work, medical treatment, security expenses, or fear for family members.
A numbered list of attachments.

Avoid guessing. Distinguish clearly between what you personally saw, what another person told you, and what you infer from the circumstances.

Investigators may administer the oath as part of the complaint process. When using a privately prepared affidavit, notarization fees vary by notary and location.

8. File or endorse the case for preliminary investigation

After case build-up, the complaint and evidence may be filed with the Office of the City or Provincial Prosecutor for preliminary investigation. This is the stage where a prosecutor evaluates whether the evidence satisfies the governing standard for filing a criminal case in court.

The Department of Justice lists common filing requirements that include:

The Investigation Data Form.
The complaint-affidavit or sworn statement.
Affidavits of witnesses.
Supporting documents and evidence.
The required number of copies. (Department of Justice)

The respondent is ordinarily given an opportunity to submit a counter-affidavit. The prosecutor may request clarification, additional evidence, or further case build-up before resolving the complaint.

Why Prompt Reporting Matters

The victim normally cannot require Meta, Google, TikTok, Telegram, an internet service provider, or a telecommunications company to disclose the user’s IP logs, subscriber records, or private account information.

Law-enforcement authorities may seek appropriate cybercrime warrants or disclosure orders. Under RA 10175:

Traffic data and subscriber information must generally be preserved by service providers for a minimum of six months from the transaction.
Content data is preserved for six months from receipt of a proper preservation order.
Law enforcement may order a one-time extension for another six months.
Disclosure of subscriber, traffic, or relevant data generally requires a court warrant and a valid complaint officially docketed for investigation. (LawPhil)

These rules do not guarantee that every platform has the information investigators need. A suspect may use public Wi-Fi, a virtual private network, a stolen device, false registration details, or an account created abroad. Prompt reporting still gives investigators a better chance to preserve records before routine deletion.

Where to Report and What Each Office Does

Office or channel	Best used for	Important limitation
Unified 911	Immediate threat to life, safety, or property	Emergency response does not replace full cybercrime case build-up
Nearest PNP station	Immediate protection, police recording, local response	The station may refer technical tracing to PNP ACG
PNP Anti-Cybercrime Group	Account tracing, cybercrime investigation, digital evidence	Identification usually requires formal investigation and court processes
NBI Cybercrime Division	Cybercrime complaints, complex or cross-regional investigation	Intake is faster than the full investigation
CICC Hotline 1326	Cybercrime reporting, coordination, and referral	CICC is not always the office that will prosecute or investigate the entire case
City or Provincial Prosecutor	Preliminary investigation and determination of charges	A weak or incomplete evidence package may be returned or dismissed
Barangay	Immediate community coordination, blotter, certain protection orders	Barangay officials cannot compel a foreign platform to identify an account
National Privacy Commission	Specific violations involving unlawful personal-data processing	It is not the general complaint desk for every insult, threat, or fake profile

Expected Fees and Timelines

Stage	Typical cost	Practical timeline
Calling 911 or making an initial police report	No government fee	Immediate to same day
NBI cybercrime intake	No agency fee under the published Citizen’s Charter	Initial intake may take about an hour if documents are complete
Printing, storage devices, transport, certified copies	Varies	Same day to several days
Private notarization of an affidavit	Varies	Usually same day
Platform review of an impersonation or threat report	Usually free	Hours to several weeks
Account tracing and preservation requests	No direct government fee to complainant in ordinary reporting	Weeks to months, depending on warrants and provider response
Prosecutor’s preliminary investigation	Government charges, if any, depend on the office and filing	Commonly several months, depending on service of subpoenas, submissions, and backlog
Court proceedings after filing	Varies	Often months to years

There is no guaranteed investigation period. Delays commonly arise from incomplete URLs, deleted accounts, missing original devices, difficulty serving the respondent, foreign-platform processing, requests for additional evidence, and court-warrant requirements.

Special Situations

The victim is outside the Philippines

A Filipino or foreign victim abroad may preserve the evidence, report the incident to authorities in the country where they are located, and communicate with Philippine law-enforcement offices where there is a Philippine connection.

RA 10175 gives Philippine courts jurisdiction in several situations, including where an element occurred in the Philippines, a relevant computer system was wholly or partly situated in the country, a Filipino national committed the violation, or the offense caused damage to a person who was in the Philippines at the time. (Supreme Court E-Library)

International cases can take longer because Philippine investigators may need assistance from foreign platforms, overseas law-enforcement agencies, or mutual legal-assistance channels coordinated through the DOJ Office of Cybercrime.

A sworn affidavit is executed abroad

An affidavit intended for formal use in the Philippines may be:

Signed before a Philippine Embassy or Consulate authorized to perform notarial services; or
Notarized locally and apostilled by the competent authority when executed in an Apostille Convention country.

For countries where the Apostille Convention does not apply, consular legalization or authentication procedures may still be required. The applicable Philippine embassy or consulate should be checked because procedures and fees differ by country. (Philippine Embassy in New Delhi)

The suspect is an ex-partner

Preserve evidence of the relationship, prior abuse, prior threats, shared residence, children, and previous protection orders. A VAWC complaint and protection-order application may be pursued together with the cybercrime investigation where the legal elements are present.

The victim is a minor

A parent, guardian, school official, or trusted adult should preserve the evidence without repeatedly forwarding sexual material. Sexual images of a child must not be recopied, posted publicly, or circulated to “expose” the offender.

Report promptly to the PNP, NBI, or an appropriate women-and-children protection unit. Cases involving online sexual abuse or exploitation of children are governed by particularly strict laws, including RA 11930.

The harassment happened at work or school

Where the harasser is a co-worker, supervisor, teacher, trainer, or student, the victim may make an internal complaint under the institution’s Safe Spaces Act policies while also filing with law enforcement.

An internal administrative case and a criminal complaint serve different purposes. Resignation, graduation, transfer, or deletion of the offending account does not necessarily end criminal liability.

Common Mistakes That Weaken an Online-Threat Complaint

Blocking the account before saving the profile link

Blocking may hide the profile or conversation. Preserve first unless continued access creates an immediate safety risk.

Submitting only cropped screenshots

A cropped image may omit the username, date, platform, conversation context, or URL. Keep full screenshots and original files.

Publicly accusing a suspected person without proof

A victim may strongly suspect an ex-partner, neighbor, or co-worker. Publicly naming that person without sufficient evidence can create a separate defamation dispute and may alert the offender to destroy evidence.

Give suspicions and supporting facts privately to investigators.

Replying with threats

Threatening the sender back may create additional evidence against the victim, confuse the factual record, or escalate the danger.

Paying without coordinating with authorities

Where money is demanded, immediately preserve the payment instructions, account number, wallet address, QR code, mobile number, and transaction details. An uncontrolled payment may not stop the threats and can encourage additional demands.

Assuming the platform’s account deletion ends the case

Deletion may remove the immediate content but does not necessarily erase all provider records. Keep the platform’s confirmation and continue the formal complaint.

Waiting for perfect evidence

A victim does not need an IP address, real name, or technical forensic report before making the initial complaint. Investigators need the available evidence soon enough to pursue preservation and disclosure procedures.

Frequently Asked Questions

Can I report a fake account even if I do not know who created it?

Yes. Complaints may initially identify the respondent as an unknown person associated with a specific account, username, URL, telephone number, email address, or platform ID. Account identification is part of the investigation.

Are screenshots enough to file a complaint?

Screenshots are enough to begin reporting, but they should be supported where possible by the original device, full conversation, URLs, screen recordings, downloaded files, witnesses, and an affidavit explaining how the evidence was obtained.

Can the police immediately ask Facebook who owns the account?

Not usually through an informal request. Subscriber, traffic, and content information may require a valid docketed investigation, preservation procedures, and an appropriate court warrant or disclosure order.

Is saying “I will kill you” online automatically grave threats?

It can support a grave-threats charge, but prosecutors assess the exact wording and context. A specific, deliberate threat is treated differently from obvious joking, quoting, conditional political speech, or an impulsive statement that the surrounding evidence shows was not seriously maintained.

What if the sender only threatened me through a private message?

A private message can still support charges for grave threats, coercion, gender-based online sexual harassment, VAWC, or other offenses. Public posting is not required for every cyber-related crime.

Can a fake account using my photograph be charged with identity theft?

Potentially, particularly where the account uses your identifying information without right to impersonate you, cause harm, deceive others, or obtain a benefit. Investigators will examine exactly what information was used and for what purpose.

Should I go to the barangay first?

You may make a barangay blotter when local safety, neighborhood coordination, or a protection order is involved. For account tracing or preservation of platform data, report directly to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or another appropriate law-enforcement office.

Can a foreigner file a cyber-harassment complaint in the Philippines?

Yes. Philippine criminal protection is not limited to Filipino victims. Jurisdiction depends on the location of relevant acts, systems, damage, the offender, and other statutory connections to the Philippines.

What if the account was created outside the Philippines?

The case may still have Philippine jurisdiction where a statutory connection exists. Foreign accounts are often slower to investigate because disclosure may involve overseas providers and international cooperation.

How long does it take to identify a fake profile?

There is no fixed period. Straightforward cases involving a traceable mobile number or locally registered account may move faster. Cases involving deleted accounts, public Wi-Fi, VPNs, foreign providers, false registration, or multiple devices may take months and may not always result in a conclusive identification.

Key Takeaways

A fake profile is not automatically illegal, but threats, impersonation, stalking, defamation, hacking, and intimate-image abuse may be criminal.
Call 911 when the threat presents an immediate danger.
Save full screenshots, URLs, original files, screen recordings, platform reports, and a chronological incident log.
Do not wait to discover the offender’s real identity before reporting.
File with the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the nearest police station, depending on urgency and location.
Hotline 1326 may be used for cybercrime reporting and referral.
Prompt reporting matters because provider data may be deleted and formal preservation or disclosure procedures take time.
A platform report, barangay blotter, police report, prosecutor’s complaint, and court protection order are different remedies and may be pursued together when appropriate.