Quick answer

If someone is using your name, photos, personal details, or hacked account to pretend to be you, document everything first, report the profile and individual posts to the social-media platform, secure your accounts, and warn people who may be targeted. If the account is being used for scams, threats, harassment, extortion, reputational harm, or financial transactions, promptly file a complaint with the Philippine National Police or National Bureau of Investigation.

Under the Cybercrime Prevention Act of 2012, computer-related identity theft covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person or organization. A fake profile is not automatically criminal identity theft in every case. The account’s content, purpose, use of identifying information, and resulting or intended harm all matter.

Reporting a profile to the platform may remove it, but it does not begin a criminal investigation. Filing with the police or NBI does not guarantee immediate platform removal. When appropriate, do both.

What counts as identity theft or online impersonation?

Identifying information can include a person’s name, photograph, address, contact number, birth details, occupation, account credentials, identification documents, or similar information.

The Supreme Court explained in Disini v. Secretary of Justice that computer-related identity theft concerns the use of another person’s identifying information without right for an illegitimate purpose. Information that a person made public is not “stolen” merely because someone views or lawfully reports it. Context and purpose remain important.

Warning signs include an account that:

Uses your name and photographs while claiming to be you;
Messages relatives, friends, customers, or coworkers in your name;
Solicits money, investments, loans, donations, or personal information;
Uses copies of your government ID, signature, phone number, or financial details;
Publishes fabricated statements or transactions attributed to you;
Redirects people to fraudulent payment accounts or websites;
Threatens, blackmails, or sexually exploits you;
Takes control of your real account and changes its password or recovery details; or
Pretends to represent your business or organization without authority.

A parody, commentary, fan, or role-playing account may raise a different issue if it clearly does not claim to be the real person. Do not assume that every use of a name or photograph establishes a crime. Investigators and prosecutors must evaluate the evidence and the elements of the applicable offense.

Act immediately if there is danger or ongoing fraud

Do not wait for a platform response when:

Someone is threatening physical harm, kidnapping, sexual violence, or self-harm;
A child is being targeted or sexual images of a child are involved;
Intimate images are being distributed or used for extortion;
The impersonator is actively collecting money or account credentials;
Your bank, e-wallet, credit card, SIM, email, or government account has been compromised;
Your identification documents are being used for loans, registrations, or transactions; or
Evidence is rapidly disappearing.

Contact emergency services or the nearest police station when there is immediate danger. For unauthorized financial activity, notify the bank, e-wallet, card issuer, or other financial institution through its official fraud channel at once. Ask it to secure the account, record the dispute, preserve transaction records, and provide a reference number. Do not rely solely on a social-media report.

Preserve evidence before blocking or reporting

A fake account may disappear after it is reported or confronted. Capture the evidence before the platform removes it, provided doing so does not put anyone in danger.

Preserve:

The complete profile URL, username, user ID if visible, and profile name;
Screenshots and, where useful, screen recordings showing the full page;
The date and time each item was viewed;
URLs of individual posts, stories, videos, advertisements, and messages;
The account’s profile photo, biography, follower information, creation details, and contact details;
Full message threads—not only selected statements;
Emails or text messages containing security alerts or password changes;
Payment instructions, account names, account numbers, QR codes, receipts, and transaction references;
Names and contact information of people approached by the impersonator;
Copies of platform reports, confirmation emails, ticket numbers, and responses;
Proof that the real identity or account belongs to you; and
A chronological account of what happened and what action you took.

Keep original files. Avoid cropping, annotating, renaming, or repeatedly re-saving the only copy. Back them up securely. If a witness received messages, ask the witness to preserve the original conversation and prepare a factual account of what they personally saw or received.

Do not access the fake account unlawfully, attempt to hack it, install tracking software, or impersonate another person to obtain evidence. Subscriber information and nonpublic platform records generally require proper legal process.

Report the fake account to the platform

Use the platform’s impersonation category rather than only reporting the account as spam. Also report fraudulent posts, advertisements, messages, or payment solicitations individually when the platform allows it.

Official reporting pages include:

Follow the platform’s current instructions. It may ask for an identification document or proof that you represent the person, business, or organization being impersonated. Submit identification only through the platform’s genuine help page or in-app process.

Save the report confirmation. If the platform rejects the report, use any available review or appeal process and explain precisely how the account is misleading people. Include the fake account’s URL and the URL of your authentic account, if any.

Do not organize mass reporting using inaccurate reasons. Multiple truthful reports from people who actually received fraudulent communications can be helpful, but false or misleading reports may undermine the complaint.

Secure your real accounts

If your actual account or email may have been accessed:

Use a trusted device to change the password of the associated email account first.
Change the social-media password and any reused passwords.
Turn on multi-factor authentication, preferably through an authenticator app or another secure method offered by the service.
Sign out unknown devices and revoke unfamiliar sessions or connected applications.
Check recovery email addresses, phone numbers, forwarding rules, and security settings.
Save security-alert emails and login records before deleting anything.
Contact your mobile provider if your SIM suddenly stopped working or you suspect an unauthorized replacement.
Review bank, e-wallet, shopping, government, and cloud-storage accounts linked to the compromised email or phone number.

Use only contact details published on the institution’s official website or app. An impersonator may send fake “support” links after learning that you are trying to recover the account.

Warn people without destroying evidence

Tell likely targets that the fake account is unauthorized and that they should not send money, disclose codes, or follow its links. Use a verified channel that the recipient already knows.

A short notice may say:

An account using my name or photo is impersonating me. I am not requesting money, passwords, OTPs, investments, or transfers through that account. Please preserve any messages you received and report the account through the platform.

Avoid publicly accusing a named suspect unless you have reliable evidence and legal advice. A mistaken accusation can create additional legal problems. Do not repost sensitive documents or harmful content merely to prove that it exists.

File a criminal complaint

The NBI and PNP are the law-enforcement authorities specifically identified by Republic Act No. 10175 for cybercrime investigations.

You may:

Approach the nearest police station and request referral to the appropriate PNP anti-cybercrime unit;
File through the NBI online complaint page or personally approach the NBI;
Seek assistance from the NBI Cybercrime Division; or
Report a cybercrime incident to the DOJ Office of Cybercrime, which coordinates and acts on cybercrime complaints and referrals.

An online report or initial email may not, by itself, complete every requirement for a sworn criminal complaint. Follow the investigating office’s instructions concerning personal appearance, identification, affidavits, original devices, and supporting records.

Bring or prepare:

A government-issued ID;
Your affidavit or a clear chronological statement;
Printed and electronic copies of the preserved evidence;
The fake account’s exact URL and username;
Details of your authentic account;
Witness names and affidavits, if available;
Platform report numbers and correspondence;
Financial records and fraud-report reference numbers, if money was involved;
Proof of ownership or authorized representation for a business account; and
Any known facts about the possible offender, clearly separated from assumptions.

Ask for the complaint’s docket, reference, or investigation number and the assigned unit’s contact details. Tell the investigator if content is disappearing or a platform may hold identifying records. Under Section 13 of Republic Act No. 10175, traffic data and subscriber information relating to communication services must generally be preserved by service providers for at least six months from the transaction. Content data may be preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. This is a reason to report promptly; it does not give a private complainant authority to compel preservation or disclosure.

Private subscriber, traffic, or content data is not ordinarily obtained merely by asking the platform. Court warrants and the procedures governing cybercrime evidence may be necessary.

What offenses may apply?

The precise charge depends on what the account did and what the evidence can prove.

Computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the intentional, unauthorized handling or use of another person’s identifying information. If damage has not yet occurred, the Act provides for a penalty one degree lower than the otherwise applicable penalty.

For offenses under Section 4(b), Section 8 generally provides imprisonment of prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. Only a court may determine guilt and impose a penalty.

Other possible offenses

Depending on the conduct, investigators may also consider offenses involving fraud or estafa, threats, coercion, extortion, unauthorized access, access-device fraud, unlawful processing or disclosure of personal data, or online libel. These are not automatic consequences of opening a fake account. Each offense has separate elements and defenses.

The Data Privacy Act of 2012 may apply when personal information is processed, accessed, or disclosed without a lawful basis. Its application can depend on who processed the data, the purpose, the circumstances, and statutory exclusions.

Consider a National Privacy Commission complaint

An NPC complaint is appropriate when the facts involve a privacy violation, personal-data breach, or unlawful processing of your personal data. It is not a substitute for an urgent police report where fraud, threats, or another crime is ongoing.

Under the NPC’s current complaint mechanics, a complainant generally must first notify the respondent or concerned entity in writing and give it an opportunity to act. The complaint should show that the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving the written notice. Proof of notice and receipt should be attached. The NPC rules allow exceptions in appropriate circumstances, but a complainant should not assume an exception applies.

A formal NPC filing generally requires:

A completed and notarized complaint-assisted form or another verified written complaint;
Supporting documents and witness affidavits;
The required details about the parties, facts, relief requested, and related proceedings; and
A certification against forum shopping.

The NPC states that filing may be made personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. Check the NPC filing page and current form immediately before submission. A procedurally defective or inadequately supported complaint may be dismissed outright.

If the actual impersonator is unknown or cannot be traced, explain the steps taken to identify the account and consider first seeking law-enforcement assistance. The platform may be able to act on an impersonation report even when the operator’s identity is unknown.

If the victim is a child or cannot file personally

A parent, guardian, or duly authorized representative may need to act. Do not circulate a child’s images or private communications while seeking help. Preserve them securely and report urgently when sexual exploitation, grooming, threats, or extortion is involved.

For an NPC complaint, representatives ordinarily need proper authority. The NPC’s rules recognize filings by authorized representatives and contain specific provisions for minors and persons alleged to be incompetent. Verify the current documentary requirements before filing.

Common mistakes to avoid

Reporting the account before saving its URL, messages, and payment details;
Keeping only cropped screenshots without dates, context, or source links;
Deleting a compromised account or device before preserving relevant records;
Confronting the suspected offender and causing evidence to disappear;
Paying an extortion demand or “recovery agent” without consulting authorities;
Sending an ID or OTP through links supplied by the fake account;
Assuming a platform report is already a police complaint;
Naming a suspected offender publicly without adequate proof;
Editing or fabricating screenshots;
Waiting for a financial institution to investigate before reporting continuing fraud;
Filing an NPC complaint without the required prior written notice, proof of receipt, verification, supporting evidence, or certification against forum shopping; and
Expecting investigators to retrieve data that a service provider no longer retains.

When to consult a lawyer

Prompt legal advice is especially important when:

Significant money, business transactions, or multiple victims are involved;
You know or strongly suspect the offender and need to avoid a wrongful accusation;
The fake account published defamatory, sexual, confidential, or professionally damaging material;
A demand letter, preservation strategy, takedown request, or application for court relief may be needed;
The incident involves an employee, former partner, customer database, regulated professional, or corporate account;
You received a subpoena, counter-complaint, or notice from a prosecutor or the NPC;
You are considering damages or another civil remedy; or
A filing deadline may be approaching.

The Public Attorney’s Office may be able to assist qualified indigent persons, subject to its requirements and the nature of the case.

Frequently asked questions

Can I report a fake Facebook account if I do not have Facebook?

Yes. Facebook’s official help process states that an impersonating profile or Page may be reported even if the person being impersonated does not have a Facebook account.

Should I block the fake account?

Preserve the evidence first. You may then block it for safety, but blocking can limit what you can see. Ask a trusted witness to preserve any communications sent directly to that witness.

Do I need to know who created the account?

No, not to submit a platform report or make an initial report to law enforcement. Provide every available identifier. Formal proceedings may become difficult if the responsible person cannot be identified or traced, which is why early preservation and investigation matter.

Is using my photo automatically identity theft?

Not necessarily. The law considers the unauthorized use of identifying information together with intent and purpose. The same conduct may also raise privacy, intellectual-property, harassment, fraud, or other issues depending on the facts.

Can I demand the account holder’s name from the platform?

Usually not through an ordinary private request. Nonpublic subscriber or traffic information may require law-enforcement action and an appropriate court warrant.

Should I report to both the NBI and PNP?

You may approach either. Avoid creating confusing duplicate complaints without disclosure. If you contact more than one office, tell each office about the other report and provide the existing reference number.

What if the platform already removed the account?

Still preserve the removal notice, earlier screenshots, URLs, messages, and witness records. Removal does not erase any fraud, threats, or other harm that already occurred.

What if no money was lost?

You may still report the incident. Republic Act No. 10175 expressly addresses cases in which damage has not yet been caused, although the applicable penalty is lower. Investigators must still determine whether the legal elements are present.

Is the NPC’s 15-day period a deadline for reporting to the police?

No. It concerns the usual exhaustion requirement before an NPC privacy complaint. It is not a waiting period for reporting fraud, threats, identity theft, or other crimes to law enforcement. Urgent incidents should be reported immediately.

Official legal and reporting resources

This article provides general legal information, not legal advice or a prediction of how authorities or courts will decide a particular case. Procedures and platform reporting systems can change. The governing sources and official guidance cited here were checked as of September 2, 2026.