Quick answer

If someone is using your name, photos, personal details, or organization’s identity online, take action on two tracks:

Preserve the evidence before the account disappears.
Report the profile and each harmful post or message to the platform.
Secure your real accounts, email, mobile number, and financial accounts.
File a cybercrime complaint with the PNP or NBI if the account is being used to deceive people, obtain money or information, threaten or harass anyone, damage your reputation, or access accounts without permission.
Use the National Privacy Commission or BSP complaint process when applicable—for example, if an organization mishandled your personal data or a bank or e-wallet transaction is involved.

A platform report may remove an account, but it is not a criminal complaint. A police or NBI report does not automatically remove the profile. In serious cases, do both promptly.

If there is an immediate threat to life or safety, call the Philippines’ free, nationwide Unified 911 emergency hotline.

Is every fake account identity theft?

No. A false name, parody account, fan account, or duplicate-looking profile is not automatically a crime. The account’s purpose, representations, use of another person’s information, and resulting or intended harm matter.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

In Disini v. Secretary of Justice, the Supreme Court explained that the prohibited conduct involves personal identifying data used for an illegitimate purpose. The Court also said that merely acquiring and disseminating information that the person made public is not, by itself, identity theft. The context and actual use of the information therefore remain important. Read the Supreme Court decision.

A fake account should be treated as potentially criminal when it does such things as:

Pretends to be you while asking relatives, customers, or followers for money;
Uses your identity to open an account, obtain credit, apply for a loan, or conduct a transaction;
Collects passwords, one-time passwords, identification documents, or financial information;
Sends threats, blackmail, defamatory accusations, or sexual content;
Uses your identity to enter contracts or issue fabricated documents;
Takes control of your real account through unauthorized access; or
Impersonates a business, government office, professional, or employee to deceive others.

Depending on the facts, other laws may also be relevant, including those covering illegal access, computer-related forgery or fraud, estafa, threats, cyber libel, financial-account scamming, violence against women and children, sexual harassment, photo or video voyeurism, or online sexual exploitation of children. Their legal elements are different, so an investigator or lawyer should assess the actual posts, communications, documents, and losses.

Preserve evidence before reporting or blocking

Capture the account while it remains accessible. Social-media content can be renamed, edited, restricted, or deleted quickly.

Preserve:

The complete profile or page URL—not just the displayed name;
The username, handle, profile name, account ID if visible, and profile photograph;
Screenshots of the full profile, About section, posts, comments, stories, advertisements, and messages;
Direct URLs for each relevant post, photo, video, or conversation;
A screen recording showing how you reached the profile or content;
Dates and times, including when you first discovered the account;
Original emails, including headers if available;
Exported chat histories or downloaded account data where the platform provides that option;
Phone numbers, email addresses, bank or e-wallet details, QR codes, payment links, and delivery information used by the impersonator;
Transaction receipts, reference numbers, statements, and notices of unauthorized activity;
Messages from people who were contacted or deceived;
Your reports to the platform and every acknowledgment, case number, or response; and
Evidence showing which account, page, telephone number, or business profile is genuinely yours.

Keep original files and the device on which you received the communications. Avoid cropping, annotating, filtering, renaming, or repeatedly converting the only copy. Make working copies instead. Record who captured each item and when.

This matters because electronic evidence must be shown to be authentic, reliable, and connected to the person or account involved. Screenshots are useful, but their evidentiary value can depend on how they were obtained and authenticated under the Rules on Electronic Evidence.

Do not try to enter the fake account, guess its password, install tracking software, or obtain private data unlawfully. Give investigators the account identifiers and let them use the lawful preservation, disclosure, and cybercrime-warrant processes.

Secure your identity and real accounts

After preserving the evidence:

Change the password of the email account connected to your social-media accounts.
Use a new, unique password for each important account.
Enable multi-factor authentication, preferably through an authenticator app or security key where available.
Review active sessions and sign out devices you do not recognize.
Check whether recovery email addresses, phone numbers, forwarding rules, or connected applications were changed.
Secure your mobile account with your telecommunications provider if your SIM stopped working unexpectedly or you suspect a SIM-related attack.
Review your social-media privacy settings and remove unnecessary public exposure of identification documents, birthdays, addresses, signatures, and contact details.
Warn affected contacts through a channel you control. Identify the exact fake username or URL and say that you are not requesting money, passwords, or one-time passwords.
If a work or business identity is involved, notify your employer, clients, compliance team, or information-security team immediately.

Never send a password, OTP, recovery code, selfie with an ID, or payment to someone claiming that they can “verify,” “unlock,” investigate, or recover your account. Submit identification only through a verified platform, financial institution, or government channel that genuinely requires it.

Report the account to the platform

Report both the account and the specific posts, advertisements, or messages that show impersonation, fraud, threats, or other violations. Reporting only one post may leave the profile active; reporting only the profile may omit the clearest evidence.

Official reporting routes include:

Facebook: Use the profile or Page menu and select the option to report impersonation. A person who cannot access Facebook may use Meta’s impostor-account form. See also Facebook’s impersonation guidance.
Instagram or Threads: Report the account in the app or use Meta’s impersonation form.
TikTok: Follow TikTok’s official impersonation-account reporting process.
X: Use the official impersonation reporting page. X states that an account is not required to report impersonation.
Other services: Open the platform’s own Help or Safety Center and search for “impersonation,” “fake account,” “fraud,” or “hacked account.” Confirm that the domain belongs to the platform before uploading identification.

Explain briefly and factually:

Who is being impersonated;
How you are connected to that person or organization;
Which name, photograph, logo, document, or contact detail was copied;
What the account is falsely claiming or doing;
Whether anyone was asked for money or personal information; and
Which profile is authentic, if one exists.

Save the submission confirmation. A platform may remove, restrict, relabel, or decline to act on an account under its own rules. That decision does not determine whether Philippine law was violated.

File a cybercrime complaint with the PNP or NBI

Republic Act No. 10175 designates both the Philippine National Police and the National Bureau of Investigation as cybercrime law-enforcement authorities. You may approach either agency; you do not need to identify the offender conclusively before asking for an investigation.

PNP Anti-Cybercrime Group

Contact the PNP Anti-Cybercrime Group, the nearest Regional Anti-Cybercrime Unit, or a police station that can record and refer the complaint. Because contact numbers and unit assignments can change, verify them through the official PNP-ACG website or its official public page, not through an account that sends you an unsolicited message.

NBI Cybercrime Division

The NBI provides an official online complaint page and accepts complaints through its Cybercrime Division and regional or district offices. Its Citizen’s Charter for victims of computer crimes lists no prerequisite document in its checklist. It provides for a complaint sheet, preliminary interview, sworn statements or affidavits, collection of supporting documents, and possible examination of a relevant device.

The NBI also states that walk-in complainants may submit sworn complaints at its offices and that its assistance to the public is free. Confirm current locations through the NBI’s official website before travelling.

What to include in your report

Prepare a clear chronological account covering:

When and how you discovered the account;
The exact profile URL, username, and platform;
What identifying information was copied or misused;
What the account represented to other people;
Every demand, threat, application, transaction, or false statement involved;
Who received the messages or relied on them;
Any money, property, access, opportunity, or reputation affected;
Steps you took to secure your accounts and report to the platform;
The evidence you preserved; and
All known details that may help identify the operator.

Bring or submit organized copies and retain your originals. If asked to surrender a device for examination, ask for documentation identifying the device and acknowledging its receipt. Keep the complaint, acknowledgment, investigator’s contact details, and official docket or reference number.

Report promptly. Under Republic Act No. 10175, service providers ordinarily preserve traffic data and subscriber information for at least six months from the transaction. Content data may be preserved for six months after a law-enforcement preservation order, which may be extended once for another six months. Disclosure of protected subscriber, traffic, or content data generally requires lawful process, including a court warrant where required. A personal request to a platform normally cannot substitute for that process.

Report financial loss or unauthorized transactions immediately

If the fake account obtained money, used your financial information, or caused an unauthorized bank or e-wallet transaction:

Contact the originating bank, card issuer, or e-wallet through its official fraud channel immediately.
Ask it to block compromised access, record the disputed transaction, preserve relevant records, and give you a reference number.
Change banking credentials from a secure device.
Notify the receiving institution if its verified reporting channel is available, but do not delay reporting to your own institution.
File the cybercrime complaint and provide the transaction references.
If the institution’s response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism.

BSP guidance treats the institution’s Financial Consumer Protection Assistance Mechanism as the first-level recourse. The BSP Online Buddy or BSP Consumer Assistance Mechanism is the second-level route after the complaint has first been raised with the BSP-supervised institution. The BSP specifically advises consumers to report identity theft and suspicious or unauthorized transactions immediately.

If you discover a loan, account, or contract opened in your name, dispute it in writing with the institution. Request the application and transaction records it relied upon, preserve all collection notices, and avoid acknowledging a debt as yours before the records are checked. A police report helps document that you contested the transaction, but it does not automatically cancel a debt or guarantee reimbursement.

When to complain to the National Privacy Commission

A complaint to the National Privacy Commission (NPC) may be appropriate when personal information was unlawfully processed, disclosed, or inadequately protected—for example, where an organization exposed identifying information later used for impersonation or processed your data for an unauthorized purpose.

An NPC complaint is different from a police report. The NPC addresses violations of the Data Privacy Act of 2012 and related issuances. It is not a general takedown service for every fake profile.

Under the NPC’s 2021 Rules of Procedure, as amended, a complainant ordinarily must first:

Inform the personal information controller, processor, or concerned entity of the violation in writing; and
Show that it did not take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive those requirements for good cause or a sufficiently serious violation, including situations involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action. This 15-day procedure applies to the NPC complaint; it does not require a victim to delay an urgent police, NBI, platform, or bank report.

A formal NPC complaint generally must be written, signed, verified, supported by evidence and relevant correspondence, and accompanied by a certification against forum shopping. Filing fees ordinarily apply unless an exemption or waiver is available. The NPC’s current page provides the complaint form and filing instructions, including authorized filing by personal submission, registered mail, courier, or email.

Possible penalties and outcomes

For computer-related identity theft, Section 8 of Republic Act No. 10175 provides prisión mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet occurred, the statute provides for a penalty one degree lower.

These are statutory ranges, not an automatic sentence. The charge, proof of each element, applicable defenses, participation of each accused, damage, and final penalty are matters for prosecutors and courts.

A report may lead to:

Platform removal or restriction;
Preservation of platform, telecommunications, or financial records;
Identification of an account operator through lawful process;
A criminal investigation and referral to a prosecutor;
An NPC privacy investigation or administrative remedy;
A financial-institution investigation; or
A civil claim or other remedy, depending on the evidence.

No agency report guarantees a takedown, arrest, conviction, reimbursement, or award of damages.

Common mistakes to avoid

Reporting before saving the URL and evidence. The account may vanish after receiving notice.
Keeping only cropped screenshots. Preserve the surrounding profile, date, username, and direct link.
Confronting the operator. This can cause evidence to be deleted or provoke further harm.
Sending more money to “trace” or “recover” earlier payments.
Giving an OTP or ID to an account claiming to be the platform, police, NBI, bank, or lawyer.
Deleting the original conversation after blocking the account.
Assuming a platform report is already a police complaint.
Posting the suspected operator’s personal information publicly. Misidentification, harassment, privacy violations, or defamatory accusations can create new legal problems.
Using another person’s account to investigate private content without permission.
Waiting for the offender’s real name before reporting. URLs, transaction records, usernames, device evidence, and witness accounts can provide investigative leads.
Paying someone who claims to guarantee account removal or criminal prosecution. Verify government contacts independently.

When legal help is urgent

Seek immediate police assistance or legal advice when:

The account makes a credible threat of violence, kidnapping, stalking, or physical harm;
A child is being contacted, groomed, sexually exploited, or portrayed in sexual material;
Intimate images are being distributed or used for blackmail;
A large or continuing financial loss is occurring;
Loans, companies, government records, or contracts were created in your name;
The impersonation involves an election, public office, regulated profession, or company with many affected customers;
You received a subpoena, prosecutor’s notice, demand letter, collection case, or court document arising from the stolen identity;
The operator appears to have access to your email, phone, cloud files, or financial accounts; or
You need an urgent preservation request, injunction, protective order, or coordinated cross-border action.

If the apparent operator is abroad, report anyway. Republic Act No. 10175 may still apply when a Filipino committed the offense, an element occurred in the Philippines, a relevant computer system was situated wholly or partly here, or the offense caused damage to a person who was in the Philippines. Cross-border evidence, however, may require additional legal cooperation and time.

Frequently asked questions

Can I report an account if nobody has lost money yet?

Yes. Financial loss is not required before you report impersonation to a platform or suspicious conduct to law enforcement. Republic Act No. 10175 expressly contemplates computer-related identity theft where no damage has yet occurred, although the applicable penalty is lower.

Do I need a lawyer to make the initial report?

No. Members of the public may file with the PNP or NBI directly. A lawyer becomes particularly useful when there are substantial losses, multiple possible offenses, cross-border evidence, formal legal notices, privacy proceedings, or a need for urgent court relief.

Is a screenshot enough?

It may support a report, but do not rely on a single screenshot. Preserve the URL, full account context, original message or file, timestamps, transaction records, witnesses, and the device where possible. Electronic evidence must still be authenticated and shown to be reliable.

Should I report the account first or secure my own account first?

Capture the essential evidence, then secure your email and real accounts without delay. If the real account has been taken over or money is moving, security and financial reporting may need to happen immediately alongside evidence preservation.

What if the account uses my photo but a different name?

Report it if the photograph is being used deceptively or harmfully. Whether it constitutes a crime depends on the account’s purpose, statements, use of identifying information, and surrounding conduct—not solely on the copied photograph.

What if the fake profile has already been deleted?

Report the incident if harm occurred or the conduct was serious. Submit saved URLs, screenshots, messages, platform notices, witness accounts, and transaction records. Investigators may consider whether recoverable provider records exist, but delay can make preservation more difficult.

Can relatives or friends report for me?

They may report a platform violation as witnesses or bystanders where the platform permits it. A formal complaint or sworn statement is usually strongest when made by the person affected, although authorized representatives and parents or guardians may act in situations recognized by the applicable rules.

Should I create a public post naming the suspected offender?

Usually, preserve and report first. If you must warn contacts, use a factual notice identifying the fake profile and stating that it is unauthorized. Avoid claiming that a named person committed a crime unless that identification is supported and you have considered the legal risks.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Procedures and outcomes depend on the evidence, platform, institution, and facts involved. Sources and official procedures were checked as of 28 July 2026.