Quick answer

If someone is using your name, photos, business identity, contact details, or other identifying information in a fake social media account:

Preserve the account and its activity before it disappears.
Report the profile and each harmful post or message through the platform’s official impersonation tools.
Secure your email, social media, mobile number, and financial accounts.
Warn contacts through a verified channel if the impostor is soliciting money or information.
Report promptly to the PNP, NBI, or the government’s Cybercrime Investigation and Coordinating Center (CICC) if the account is being used to deceive, defraud, threaten, harass, damage reputation, or misuse personal data.
Consider a National Privacy Commission complaint when personal information has been unlawfully collected, disclosed, or otherwise processed.

A fake or anonymous account is not automatically a crime. The stronger cases involve unauthorized use of another person’s identifying information together with deception, damage, attempted damage, fraud, account takeover, threats, or another unlawful purpose.

If anyone is in immediate physical danger, call Unified 911. If money has just been transferred, contact the bank or e-wallet provider immediately—before completing the other steps.

Is it identity theft, impersonation, or a hacked account?

Situation	Best first response
A separate account copies your identity	Preserve it, report it as impersonation, warn contacts, and assess whether a law-enforcement report is needed.
Your real account was taken over	Use the platform’s hacked-account recovery process, secure the connected email and mobile number, and report unauthorized activity.
An account uses a fictional name but does not pretend to be a real person or organization	It may violate platform rules, but it is not necessarily identity theft under Philippine law.
A clearly labeled parody, commentary, or fan account	It is not automatically unlawful, although particular posts may still violate privacy, fraud, defamation, harassment, intellectual-property, or other laws.
An account copies a business, government office, hotel, school, or professional practice	Preserve proof of the legitimate entity and official channels, report the impersonation, and act urgently if customers are being asked to pay.

An impersonator does not need to copy every detail. A name, organization, contact information, government identifier, account credential, or combination of details may be enough to identify a person or entity. A copied photograph can strengthen evidence of impersonation, but the legal result still depends on how the account was presented and used.

What Philippine law may apply?

Computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

In Disini v. Secretary of Justice, the Supreme Court upheld this provision and explained that it addresses unauthorized acquisition or use of identifying information, implicitly to cause damage. The statute separately provides for a penalty one degree lower if no damage has yet been caused. Read the Supreme Court decision.

For the completed offense, the statutory penalty is prisión mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The actual charge and sentence depend on the proven acts, damage, participation, and other case-specific circumstances.

Creating a fake profile does not by itself prove every element. Investigators must still establish matters such as:

what identifying information belonged to the victim;
whether it was acquired or used without right;
who actually controlled or used the account;
the account’s purpose and conduct; and
whether damage occurred or was intended.

Other possible offenses

Depending on what the impostor did, authorities may also examine:

illegal access or account takeover;
computer-related forgery or fraud;
estafa or another fraud offense committed through information and communications technology;
cyberlibel, if legally defamatory material was authored and published online;
threats, coercion, stalking, or harassment;
unlawful disclosure or processing of personal information;
financial-account scamming or money-mule activity;
online sexual harassment, photo or video voyeurism, or violence against women and children; or
offenses involving child sexual abuse or exploitation material.

These are not automatic labels. Each offense has distinct elements and defenses. Describe the facts accurately in your report and let investigators determine the possible charges.

Data Privacy Act

Unauthorized collection, disclosure, or use of personal information may also raise issues under the Data Privacy Act of 2012. Not every appearance of personal information online violates the Act: consent, legitimate purpose, lawful authority, context, and applicable exceptions matter.

A National Privacy Commission proceeding is separate from a criminal investigation. Reporting an account to the platform or NPC does not automatically commence a criminal case.

Preserve evidence before reporting or blocking

Fake accounts can change names, delete posts, block victims, or disappear after being reported. Capture the evidence first unless viewing it would expose you to immediate danger or illegal material.

Preserve:

the complete profile URL, username, display name, and visible account or user ID;
screenshots of the profile, bio, photographs, follower count, and creation information, if shown;
screenshots and direct URLs of individual posts, stories, advertisements, comments, and listings;
messages showing the account claiming to be you or acting for your business;
requests for money, passwords, one-time PINs, IDs, intimate images, or personal information;
dates, times, and the time zone shown on your device;
a screen recording showing how you navigated from the platform to the profile and relevant content;
original emails, message exports, attachments, audio, and images where available;
transaction references, recipient account names and numbers, QR codes, receipts, and bank or e-wallet notices;
messages from people who were contacted or deceived;
your legitimate profile, official website, business registration, or other proof of the real identity;
platform report confirmations, ticket numbers, emails, and appeal results; and
a chronological incident log describing what happened and when.

Keep the original files unchanged. Make separate working copies if you need to highlight or annotate anything. Avoid relying only on cropped screenshots, forwarded images, or a collage that hides the source and context.

Screenshots are useful but do not necessarily prove who operated the account. Subscriber information, login records, traffic data, and other platform records generally require lawful investigative and court processes.

Under the Cybercrime Prevention Act, service providers must preserve subscriber information and traffic data for at least six months from the transaction. Content data is preserved for six months after a law-enforcement preservation order, with a possible one-time six-month extension. This is one reason to report promptly and ask the assigned investigator whether preservation action is appropriate. A private complainant cannot substitute a personal demand for the legal process required from law enforcement.

Do not download, save, or forward suspected child sexual abuse material merely to collect evidence. Record the account and content location without redistributing the material, then report it immediately to the platform and law enforcement.

Secure your accounts and identity

If there is any possibility that your real account, email, phone number, or device was compromised:

From a trusted device, change the password of the connected email account first.
Change affected social media, banking, e-wallet, shopping, and cloud-storage passwords.
Use a different, strong password for every important account.
Turn on multi-factor authentication, preferably through an authenticator app or security key when available.
Review active sessions and sign out devices you do not recognize.
Check whether recovery emails, phone numbers, app permissions, forwarding rules, or payment methods were changed.
Contact your telecommunications provider immediately if your SIM stopped working unexpectedly or you suspect a SIM swap.
Scan affected devices and remove unfamiliar applications or browser extensions.
Tell trusted contacts not to follow payment instructions or share information based only on a social media message.

If warning the public, keep the notice factual: identify your official account, state that the other profile is unauthorized, and tell people not to transact with it. Do not publicly accuse a suspected operator unless the identification is verified and publication is legally justified.

Report the account to the platform

Report both the profile and any separate posts, advertisements, messages, listings, or payment solicitations that violate platform rules. The person being impersonated—or an authorized representative—should submit the primary impersonation report when possible.

Platform	Official reporting route
Facebook	Use the Facebook impostor-account form or the profile’s Report profile option.
Instagram or Threads	Use Meta’s Instagram and Threads impersonation form or report from the profile.
TikTok	Follow TikTok’s impersonation-reporting instructions: open the profile, choose Report account, then Pretending to Be Someone.
X	Use the X impersonation report. X states that the person or an authorized representative may file, and an X account is not required to report impersonation.

For another platform, use only its official Help Center or in-app reporting function. If an identity document is requested, confirm that the page belongs to the platform’s genuine domain. Do not send your ID to the fake account, a supposed “support agent” in direct messages, or a paid fixer.

Save the confirmation before closing the report page. Platform removal is not guaranteed, and no universal takedown deadline applies. Appeal through the platform’s official process if the first report is rejected, adding clearer comparison evidence.

Report to Philippine authorities

CICC Hotline 1326 and eGovPH

The CICC’s 1326 hotline is a national reporting and referral channel for cybercrime and online scams. Reports may also be made through the eReport feature of the eGovPH app. DICT currently lists 1326@dict.gov.ph for complaints. See the DICT contact information.

Provide:

your name and reliable contact details;
the profile and content URLs;
a concise timeline;
the identifying information copied;
what the account said or did;
any money, accounts, documents, or people affected;
whether there are ongoing threats or solicitations; and
copies of preserved evidence.

CICC reporting can assist with coordination and referral. Ask whether a separate sworn complaint with the PNP, NBI, or prosecutor is required for your case.

NBI Cybercrime Division

The NBI accepts reports through its online complaint page and through the Cybercrime Division and relevant regional or district offices.

The NBI’s current Citizen’s Charter for computer-crime complaints describes an initial complaint sheet and interview, followed as appropriate by sworn statements, affidavits, supporting documents, and examination of a relevant device. It lists no fee for this investigative-assistance service.

Bring originals and organized copies of your evidence. Do not surrender your only copy of a device or document without an inventory or receipt.

PNP

You may report to the nearest police station or PNP anti-cybercrime unit. Ask that the incident be recorded and, when appropriate, referred to the PNP Anti-Cybercrime Group or the cybercrime unit with jurisdiction.

Get the complaint, blotter, or reference number; the assigned investigator’s name and contact details; and instructions for submitting a sworn statement and digital evidence.

You do not ordinarily need a barangay blotter before reporting impersonation to a platform, CICC, NBI, or the PNP. Particular investigators may nevertheless request additional local documentation based on the circumstances.

If you already reported elsewhere

Disclose earlier reports and provide their reference numbers. Do not hide parallel proceedings. This avoids duplication and is especially important if you later sign a certification against forum shopping in an administrative or court proceeding.

A platform report does not stop the legal prescription period for an offense. Prescription depends on the charge, penalty, and facts, so do not delay while waiting for a platform decision.

When to complain to the National Privacy Commission

Consider an NPC complaint if an individual, organization, or platform has unlawfully collected, used, disclosed, retained, or failed to protect your personal data.

Under the 2021 NPC Rules of Procedure, as amended, the usual process requires you to:

Inform in writing the personal information controller, processor, or concerned entity you intend to complain against.
Allow it to take timely and appropriate action.
Show that it failed to act appropriately or did not respond within 15 calendar days after receiving the written notice.

Preserve proof of delivery and the response. An in-app report may be useful evidence, but whether it satisfies exhaustion against a particular respondent depends on whom it notified and what the report said.

The NPC may waive prior exhaustion for properly proven good cause or a serious Data Privacy Act violation, including circumstances involving grave and irreparable harm, no plain and adequate remedy, or patently illegal action. If contacting the suspected operator would be unsafe, explain that clearly instead of confronting the person.

A formal complaint generally requires a notarized Complaints-Assisted Form or verified complaint, supporting evidence, witness affidavits where available, and a certification against forum shopping. Follow the NPC’s current complaint-filing page for personal, mail, courier, or authorized email submission.

As of the source-check date, the NPC’s listed base filing fee is ₱500, plus a legal-research fee equal to 1% of the filing fee but not less than ₱10. Additional fees apply to claims for damages and certain applications. Qualified indigent litigants are exempt if they meet the stated income and property tests and submit the required proof. Check the current NPC fee schedule before paying, and pay only through an officially instructed channel.

If money or a financial account is involved

Contact the sending bank, e-wallet, card issuer, or other financial institution immediately through its official fraud channel. Ask it to:

secure or restrict the affected account;
record the transaction as disputed;
investigate unauthorized access or enrollment;
coordinate with the receiving institution when applicable; and
give you a case or reference number.

Under the implementing rules of the Anti-Financial Account Scamming Act, qualifying disputed funds may be placed on an initial hold of no more than five calendar days. The institution may seek an extended hold of up to 25 additional calendar days under the applicable conditions. A hold is not an automatic refund and does not guarantee recovery. Read the BSP’s AFASA rules.

If the institution does not resolve the complaint, the BSP Consumer Assistance Mechanism is a second-level channel for BSP-supervised institutions. Complaints may be escalated through the BSP Online Buddy or other BSP channels. Include the complaint first sent to the institution, its response, your requested resolution, and supporting documents.

Also report to law enforcement. A bank dispute, BSP complaint, platform report, and criminal complaint serve different purposes.

If the impostor used a government ID, mobile number, loan account, or other service in your name, notify the issuing agency, telecommunications provider, lender, or service provider in writing. Ask for records of the disputed application and for protective restrictions permitted by its procedures.

Common mistakes to avoid

Reporting or blocking the account before preserving its URL and content.
Deleting messages, resetting a device, or closing an account before saving relevant records.
Posting the suspected offender’s personal information or making an unverified public accusation.
Threatening, bargaining with, paying, or trying to hack the impostor.
Sending an ID or one-time PIN to someone claiming in direct messages to be platform support.
Assuming a platform report automatically becomes a police complaint.
Assuming a screenshot conclusively identifies the account operator.
Editing the only copy of a screenshot, recording, receipt, or message export.
Waiting for more victims while the account continues soliciting money.
Filing an exaggerated or knowingly false sworn statement.
Paying a fixer who promises guaranteed takedown, arrest, or recovery of funds.

When help is urgent

Seek immediate assistance when:

there is a threat of violence, stalking, kidnapping, or self-harm;
a child is being impersonated, groomed, threatened, or sexually exploited;
intimate images are being distributed or used for extortion;
the account is collecting money from the public;
a bank, e-wallet, SIM, email account, or government identity has been compromised;
fake documents or accounts have been opened in your name;
the impostor is contacting your employer, clients, patients, students, or family;
evidence is rapidly disappearing;
the suspected operator is overseas or multiple platforms and victims are involved; or
you receive a subpoena, prosecutor’s notice, court paper, or demand concerning activity you did not perform.

A lawyer can help prepare affidavits, identify the appropriate respondent and venue, coordinate preservation requests, and evaluate criminal, administrative, and civil remedies. Initial reporting to a platform, CICC, PNP, or NBI generally does not require a private lawyer.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Report the account, preserve its links and conduct, and state honestly that the operator is unknown. Investigators may seek subscriber or traffic data through the required legal process. The visible profile name alone does not establish the operator’s identity.

Is one screenshot enough?

It may support an initial report, but preserve more context if safely possible: the URL, username, profile, posts, messages, timestamps, transaction records, and a screen recording. Account attribution may require platform records and other corroborating evidence.

Can someone report on my behalf?

Platforms often permit an authorized representative and may permit bystander reports. For an NPC complaint, an adult representative generally needs proper authority, such as a special power of attorney. The amended NPC rules contain separate requirements for minors, persons alleged to be incompetent, juridical representatives, and certain non-resident citizens.

What if the fake account has already been deleted?

Report it using the saved URL, username, screenshots, messages, and transaction records. Deletion does not necessarily mean that all provider records are immediately gone, but retention is not guaranteed. Ask the assigned investigator promptly about lawful preservation.

Should I message the impostor and demand deletion?

Usually not. Contact can trigger deletion of evidence, retaliation, or further deception. Use platform and official reporting channels. If prior written notice is relevant to an NPC complaint, direct it safely to the appropriate controller, processor, or concerned entity; seek advice about a waiver where contacting the suspected operator would create risk.

Will reporting guarantee takedown, arrest, or refund?

No. Platforms apply their own rules, investigators need admissible evidence identifying the responsible person, and financial recovery depends on timing, available funds, institutional procedures, and the facts. Prompt, complete, and accurate reporting improves the chance of effective action but cannot guarantee an outcome.

Can I claim damages?

Potential civil or administrative relief may be available under the Data Privacy Act, Civil Code, or another applicable law, but entitlement and amount depend on proof of the violation, causation, actual injury, and the correct defendant. Obtain case-specific legal advice before making a damages claim.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Procedures and legal conclusions may change or depend on the account, records, parties, jurisdiction, and resulting harm. Official sources and reporting channels were last checked on 4 August 2026.