Quick answer

You may file a cyber-libel complaint even when the defamatory post came from a fake or dummy social-media account. The difficult part is not merely proving that the post exists—it is proving who created or controlled the account and authored the post.

Act immediately:

Preserve the post, account, links, comments, dates, and surrounding context.
Record when and how you first discovered it.
Ask the NBI Cybercrime Division or PNP Anti-Cybercrime Group to investigate the account and promptly preserve provider data.
Prepare a sworn complaint-affidavit with supporting affidavits and electronic evidence.
File it with the proper Office of the City or Provincial Prosecutor before the one-year prescriptive period expires.

A report to Facebook, TikTok, X, Instagram, a police blotter, or an informal NBI inquiry is not a safe substitute for filing the criminal complaint with the proper prosecution office.

What must be proved

Section 4(c)(4) of the Cybercrime Prevention Act of 2012 covers libel committed through a computer system. It applies the definition of libel under Articles 353 and 355 of the Revised Penal Code to online publication.

The evidence must support all of these matters:

Defamatory imputation: The post attributes a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or expose a person or juridical entity to contempt.
Publication: At least one person other than the complainant and author saw or received the statement.
Identification of the person defamed: Readers could reasonably tell that the post referred to the complainant, even if the complainant was not expressly named.
Malice: The imputation was malicious under the applicable rules. Defamatory imputations are ordinarily presumed malicious, but privileged communications, fair reports, public-interest speech, and statements about public officials may require a different analysis.
Use of a computer system: The statement was published through social media, a website, messaging platform, or comparable information-and-communications technology.
Identity and authorship: The respondent owned, controlled, accessed, or used the account and authored the particular defamatory statement.

Rudeness, criticism, satire, name-calling, or an unpleasant opinion is not automatically cyber libel. The words must be evaluated in their full context, including the language used, intended audience, accompanying images, prior exchanges, and whether the statement asserted a fact or conveyed protected opinion.

The fake account is the central evidence problem

A profile name, photograph, or suspicion is not enough by itself to prove who operated a fake account. In XXX v. People, the Supreme Court identified several ways ownership, access, or authorship of a social-media account may be established:

an admission of ownership or authorship;
a witness who saw the person access the account or compose the post;
information in the post known only to the suspected author or a small group;
language or expressions consistent with the suspected author’s characteristics;
records from the platform, telecommunications company, or internet-service provider;
device-forensic results, geolocation data, or other technical attributes;
conduct consistent with the account’s earlier posts; and
other circumstances demonstrating ownership, access, or authorship.

The complete guide appears in the Supreme Court’s December 2025 account-identification ruling.

Investigators may seek a Warrant to Disclose Computer Data or another appropriate cybercrime warrant to obtain subscriber information, traffic data, or other computer data from a service provider. A private complainant generally cannot compel a platform to disclose these records without lawful government process.

Do not publicly accuse a suspected operator merely because the account uses familiar language or photographs. Give your evidence and suspicions to investigators and explain the basis for each one.

Preserve the evidence before the account disappears

Capture the evidence before reporting, blocking, or confronting the account. Preserve:

the complete profile and cover pages;
the exact username, handle, profile ID, and profile URL;
the direct URL of every post, comment, image, video, or story;
full-screen screenshots showing the browser address or application context;
a screen recording that starts from the account page and navigates to the post;
visible publication dates, timestamps, privacy settings, reactions, shares, and comments;
all captions, hashtags, tagged accounts, linked pages, and attached media;
the defamatory material in its original language and an accurate translation, if needed;
messages, emails, notifications, or links through which you learned about the post;
earlier and later posts that may help identify the account operator;
documents disproving factual accusations;
proof of resulting harm, such as lost clients, disciplinary inquiries, cancelled transactions, or messages from concerned relatives and colleagues; and
the original phone, computer, storage media, and unedited digital files.

Ask people who personally saw the post to prepare sworn statements describing what they saw, when and where they saw it, how they understood it, and how they knew the post referred to you.

Avoid cropped or annotated screenshots as your only copies. Do not alter filenames, edit images, delete messages, or forward the material so many times that its source becomes unclear. A notarized printout does not, by itself, prove that the account belonged to the respondent. Electronic evidence must still be authenticated and shown to be reliable.

Never hack the account, guess passwords, impersonate another person, secretly access a device, or pay someone to obtain private platform data unlawfully.

Record the discovery date carefully

Cyber libel prescribes one year from discovery of the offense by the offended party or the authorities. In April 2026, the Supreme Court en banc affirmed this rule in Causing v. People and rejected the earlier view that cyber libel generally prescribes in 12 or 15 years. The Court also ruled that merely placing a post online does not automatically mean the offended party immediately discovered it. See the Court’s official summary and ruling.

Record:

the exact date and approximate time you first saw or learned of the post;
who showed or sent it to you;
the message, email, or notification through which you discovered it;
whether the account or post was private, restricted, or inaccessible earlier; and
any immediate response showing when you acquired knowledge, such as a platform report or consultation.

Do not assume that a post remaining online, receiving new reactions, or being accessible later automatically restarts the one-year period. A separately authored republication may require its own analysis, but continued visibility alone should not be treated as a new deadline.

The safest course is to file the complaint with the proper prosecutor well before the anniversary of discovery. Do not rely on a demand letter, platform complaint, police blotter, or incomplete law-enforcement inquiry to interrupt prescription.

First practical route: ask for a cybercrime investigation

When the operator’s identity is unknown, go promptly to either:

the NBI Cybercrime Division or an appropriate NBI regional office; or
the PNP Anti-Cybercrime Group or its appropriate regional unit.

Under the Cybercrime Prevention Act, both the NBI and PNP have cybercrime-enforcement responsibilities. The NBI’s Citizen’s Charter for computer-crime victims provides for a complaint sheet, preliminary interview, sworn statements, submission of supporting documents, and examination of relevant devices. Confirm the current office location and intake procedure before travelling.

Bring:

a government-issued ID;
printed and digital copies of the evidence;
your original device, if requested for examination;
a short timeline;
names and contact details of witnesses;
the account and post URLs; and
any information linking a suspected person to the account.

Explicitly ask whether investigators can issue an immediate data-preservation request and pursue the appropriate cybercrime warrant. Service providers do not necessarily retain every account or connection record indefinitely.

If the account uses another person’s name, photograph, or identifying information, inform investigators. The conduct may also require assessment under the computer-related identity-theft provision of Republic Act No. 10175. A fictional username or anonymous account, by itself, does not automatically establish identity theft.

Prepare the complaint-affidavit

The complaint-affidavit should be factual, chronological, and specific. It should ordinarily contain:

Your full name, address, contact details, and relevant personal circumstances.
The respondent’s known information—or a clear statement that the operator’s true identity is still unknown—together with the exact account identifiers.
The words, photographs, video, or other content complained of.
The date, time, platform, URL, and manner of publication.
An explanation of why the content was defamatory.
An explanation of how readers knew it referred to you.
The names of people who saw or received it.
The date and circumstances of discovery.
Facts establishing the proper venue.
Evidence linking the respondent to the account and post.
Relevant background, including exchanges that explain the post’s meaning or motive.
The harm caused and supporting records.
A request for investigation and prosecution under Section 4(c)(4) of Republic Act No. 10175 in relation to Articles 353 and 355 of the Revised Penal Code.
A complete list of annexes.

Quote the exact statement rather than merely calling it “malicious” or “fake news.” Attach a translation when it is in Filipino, a regional language, slang, or coded language that the prosecutor may not understand.

The affidavit must be sworn before a prosecutor, another government officer authorized to administer oaths, or—when permitted—a notary public. Never include facts you cannot honestly affirm under oath.

Where to file

File with the Office of the City or Provincial Prosecutor corresponding to a legally supportable venue. Confirm venue before filing because venue in a criminal case is jurisdictional.

Under Section 2.1 of the Rule on Cybercrime Warrants, the eventual criminal action for an offense under Section 4 of Republic Act No. 10175 must be filed in the designated cybercrime court of the province or city:

where the offense or any element was committed;
where any part of the computer system used was situated; or
where damage to a natural or juridical person took place.

The first court in which the criminal action is validly filed acquires jurisdiction to the exclusion of the others. The Supreme Court discussed this rule in Tieng v. Palacio-Alaras.

Do not select a distant prosecution office merely because the post could be viewed there. State concrete venue facts, such as your actual residence at the relevant time, where the reputational injury occurred, or another place connected to an element of the offense. Public officers, companies, multiple complainants, overseas actors, and posts created through foreign systems can present additional venue questions requiring a lawyer’s review.

Filing requirements under the current DOJ rules

Cyber libel carries a prescribed imprisonment range extending beyond six years. It therefore undergoes regular preliminary investigation under the 2024 DOJ–National Prosecution Service Rules on Preliminary Investigations and Inquest Proceedings, issued through DOJ Department Circular No. 15. The Supreme Court upheld the validity of these DOJ rules in March 2026.

Prepare:

the original complaint-affidavit;
two duplicate copies for official files;
one additional copy for every respondent;
a completed NPS Investigation Data Form;
witness affidavits; and
documentary, electronic, and other supporting evidence.

The prosecution-office head initially checks the complaint’s form and evidentiary completeness. The office may require missing evidence before docketing. Current official filing information and forms are available on the DOJ’s preliminary-investigation filing page.

Verify the office’s current receiving hours, filing fees, payment method, e-filing availability, and local administrative requirements. If an office permits electronic filing, follow its official instructions and any requirement to submit hard copies. Retain the stamped receiving copy, docket number, official receipts, and proof of every submission.

What happens after filing

The investigating prosecutor may:

recommend outright dismissal if the complaint and evidence provide no ground to continue;
issue a subpoena requiring the respondent to submit a counter-affidavit and evidence;
conduct a preliminary-investigation or clarificatory hearing;
direct further case build-up or the production of additional evidence;
dismiss the complaint if the required evidentiary standard is not met; or
find prima facie evidence with reasonable certainty of conviction and file an Information in the proper Regional Trial Court.

The respondent must be given at least the period stated in the subpoena—generally not less than 10 days from receipt—to prepare a counter-affidavit. The DOJ rules generally call for resolution within 60 calendar days from receipt of the complete case record, with a possible 30-day extension for a complex case or capital offense. These are administrative disposition periods, not a guarantee that the entire criminal case will finish within that time.

An aggrieved party generally has 15 calendar days from receipt of the prosecutor’s resolution to move for reconsideration. A petition for review may also be available, subject to the governing DOJ rules and strict filing requirements.

A complaint does not cause an automatic arrest. If an Information is filed, the judge independently evaluates probable cause before issuing a warrant of arrest.

Possible penalties and civil relief

Cyber libel is subject to a penalty one degree higher than ordinary written libel. Under People v. Soliman, the available fine for online libel ranges from ₱40,000 to ₱1,500,000. The prescribed imprisonment spans prisión correccional in its maximum period to prisión mayor in its minimum period—approximately four years, two months and one day to eight years. Depending on the case, the court may impose imprisonment, a fine, or both; imprisonment is not automatic.

Civil liability arising from the offense is ordinarily deemed included in the criminal action unless it is waived, reserved, or previously filed. An independent civil action for defamation may also be possible, but it should be coordinated carefully with the criminal complaint.

Filing a complaint does not automatically remove the post. The automatic DOJ blocking or takedown power formerly found in Section 19 of Republic Act No. 10175 was declared unconstitutional in Disini v. Secretary of Justice. Platform reporting and any application for judicial relief are separate steps.

Important exceptions and defenses

A strong complaint must account for possible defenses:

Privileged communication: Article 354 protects certain private communications made in performing a legal, moral, or social duty, as well as fair and true good-faith reports of non-confidential official proceedings made without added comments.
Truth, good intention, and justifiable motive: Truth is not automatically a complete answer in every Philippine libel case. The applicable provisions and the nature of the imputation must be examined together.
Public officials and public figures: Criticism involving official conduct or matters of public concern may require proof of actual malice—knowledge of falsity or reckless disregard of whether the statement was false.
Fair comment or opinion: Protected opinion and fair comment must be distinguished from a false assertion of fact.
No identifiable complainant: A post is not actionable merely because the complainant feels targeted; the audience must reasonably be able to identify the person defamed.
No publication: A message communicated only to the person allegedly defamed ordinarily lacks publication to a third person.
No proven authorship: Even an obviously defamatory post cannot support a conviction against a particular person unless that person’s identity and authorship are proved beyond reasonable doubt.

Under Disini, the cyber-libel provision is valid against the original author but unconstitutional as applied to people who merely receive and react to the post. A person who adds a new defamatory caption, comment, or independently authored accusation may require separate evaluation.

Common mistakes to avoid

Waiting for the platform to identify the user before consulting investigators or filing.
Treating one year as running from account deletion rather than discovery.
Reporting the account before preserving its full contents.
Filing in any city where the post happened to be viewed.
Submitting only cropped screenshots without URLs or context.
Naming a suspected operator without evidence linking that person to the account.
Omitting the discovery date or facts supporting venue.
Failing to obtain affidavits from people who saw and understood the post.
Assuming a notary’s seal authenticates the social-media account.
Responding publicly with threats, doxxing, or defamatory accusations.
Assuming barangay conciliation is always required. Cyber libel exceeds the penalty thresholds for mandatory Katarungang Pambarangay proceedings, so barangay conciliation is generally not a prerequisite.
Assuming a platform takedown ends the criminal case—or that leaving the post online automatically creates a new offense every day.

When legal help is urgent

Seek immediate assistance when:

the one-year anniversary of discovery is approaching;
the account is being deleted, renamed, or repeatedly deactivated;
the operator is unknown and provider records must be preserved;
the post includes threats, stalking, extortion, doxxing, intimate images, child sexual-abuse material, or account hacking;
the complainant is a public official, public figure, business, or organization;
the suspected operator or relevant computer system is abroad;
several people authored, reposted, or edited the content;
you need damages, injunctive relief, or coordinated platform action; or
the prosecutor has issued an adverse resolution and the 15-day reconsideration period is running.

For qualified indigent applicants, the Public Attorney’s Office provides legal assistance subject to its merit and eligibility rules.

Frequently asked questions

Can I complain if I do not know the operator’s real name?

Yes. Give investigators the account handle, URLs, profile identifiers, technical clues, and all available attribution evidence. The true operator must ultimately be identified and linked to the post, so early law-enforcement assistance is especially important.

Are screenshots enough?

They may help prove what appeared online, but screenshots alone may not prove authenticity, publication, or authorship. Preserve the original device and files, obtain witness affidavits, and seek platform, telecommunications, ISP, or forensic evidence when available.

Does reporting the account to the platform stop the one-year period?

No. A platform report is useful for safety and content moderation, but it is not the same as filing a criminal complaint with the proper prosecutor.

Can I still file if the post has been online for more than a year?

Possibly, because the period generally runs from discovery, not automatically from upload. You must be able to state and support when the offended party or authorities discovered the offense. Obtain legal advice immediately rather than assuming the case remains timely.

Must I first send a demand to delete or apologize?

No general rule makes a demand letter a prerequisite to a cyber-libel complaint. A demand may also alert the operator to delete evidence. Preserve the evidence and consider the prescription period before making contact.

Is liking or sharing a defamatory post automatically cyber libel?

No. Disini protects people who merely receive and react to the original post. Liability may be different when a person writes a new defamatory statement, adds a defamatory caption, or otherwise becomes the author of separate content.

Does using my name or photograph make every fake account identity theft?

Not automatically. Computer-related identity theft has its own statutory elements. Report the impersonation and let investigators assess it alongside cyber libel and any other applicable offense.

Is barangay conciliation required?

Generally, no. The maximum imprisonment and fine for cyber libel exceed the statutory limits for compulsory barangay conciliation.

Official sources

This article provides general legal information, not legal advice or an assessment of any particular post, person, account, or set of documents. Cyber-libel liability, venue, prescription, and authorship depend on the evidence and surrounding facts. Official sources and procedures were checked as of July 23, 2026.