How to Report Identity Theft and Fake Social Media Accounts

Quick answer

If someone is using your name, photo, personal details, or business identity in a fake social media account, preserve the evidence first, report the account through the platform’s impersonation channel, secure any affected accounts, and file a complaint promptly with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

Do not wait for the platform to remove the account before approaching law enforcement if it is being used for fraud, threats, harassment, sexual abuse, loan applications, or solicitation. A platform report can lead to takedown, but it is not a criminal complaint and may not identify the person behind the account.

A fake account is not automatically a crime in every situation. Criminal liability depends on what identifying information was intentionally acquired or used, whether the use was without right, and what the account was used to do. Parody, commentary, fan, or pseudonymous accounts that are clearly disclosed and do not unlawfully appropriate another person’s identity may be treated differently.

What Philippine law covers

Computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, prohibits the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

“Identifying information” can include a name, birth details, address, telephone number, government identification number, account identifier, biometric information, or other information that identifies a particular person when used alone or together with other data. A copied name and photograph may therefore be legally significant, especially when combined with contact details, messages, or representations that make people believe the account is genuinely yours.

The statutory penalty for offenses under Section 4(b) is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. For computer-related identity theft, the law states that the penalty is one degree lower if no damage has yet been caused. The applicable charge and penalty remain matters for the prosecutor and court based on the evidence.

In Disini v. Secretary of Justice, the Supreme Court upheld this provision and explained that it regulates specific acts involving another person’s identifying data. However, a complainant must still prove the facts required by the law; the mere existence of an unfamiliar or anonymous profile does not establish every element of identity theft.

Other offenses may apply

Depending on what the fake account does, authorities may also consider:

These laws have different elements. For example, a false or insulting post is not automatically cyberlibel, and every unauthorized display of a photograph is not automatically a Data Privacy Act offense. The account’s content, purpose, audience, source of the information, relationship of the parties, and resulting harm all matter.

What to do immediately

1. Protect safety and money first

Call 911 if there is an immediate threat of violence, stalking at your location, abduction, or another emergency.

If the account has obtained money, accessed a bank or e-wallet, or is actively asking your contacts for payments:

  • Call the bank, e-wallet, card issuer, or other financial institution using the number in its official app, website, or the back of your card.
  • Ask it to block or secure affected accounts and record the transactions as disputed or unauthorized.
  • Change the password of your primary email account first, followed by financial and social media accounts.
  • End unfamiliar sessions, remove unknown recovery details and connected applications, and enable multi-factor authentication.
  • Contact your telecommunications provider immediately if your SIM was lost, taken over, or suddenly stopped working.
  • Keep every case number, email, text alert, transaction reference, and written response.

The Bangko Sentral ng Pilipinas advises consumers to report fraudulent or unauthorized transactions immediately. If the institution does not satisfactorily address the complaint, it may be escalated through the BSP Consumer Assistance Mechanism.

2. Preserve evidence before blocking or reporting

Capture the account while it remains accessible. Save:

  • The complete profile URL, username, display name, and platform;
  • Screenshots and a screen recording showing how you navigated to the profile;
  • The profile picture, cover image, bio, “About” details, contact information, and account-creation details if visible;
  • Every relevant post, Story, Reel, video, comment, advertisement, or live-stream recording;
  • Complete message threads, including dates, times, sender details, attachments, payment instructions, and voice messages;
  • Links to individual posts and the names of people contacted or deceived;
  • Bank, e-wallet, delivery, loan, or transaction records connected to the account;
  • The original photos or documents that were copied;
  • Emails and notifications from the platform, including report acknowledgments;
  • Statements from people who received requests or believed they were communicating with you; and
  • A dated timeline explaining when you discovered the account and what happened afterward.

Keep an untouched copy. Do not crop, annotate, rename, or edit the only copy of a screenshot, recording, message export, or media file. Save duplicates in at least two secure locations. Retain the phone or computer on which you received the messages, and do not factory-reset it while an investigation is being considered.

A screenshot can document what appeared online, but it does not necessarily prove who owned or controlled the account. The Supreme Court’s guideposts on identifying the controller of a social media account recognize the importance of evidence linking the accused to the account, such as being seen using it, admissions, linked contact details, witness testimony, or technical and circumstantial evidence. Law enforcement may need subscriber records, traffic data, devices, or other evidence obtained through lawful process.

3. Report the account to the platform

Use the profile’s report menu and choose “Impersonation,” “Pretending to be someone,” or the closest available category. Report the individual posts or messages as well when they involve fraud, threats, private information, or sexual content.

Official reporting pages include:

Submit identification only through the platform’s verified application or help-center page. Check the domain carefully; scammers sometimes send a second fake “verification” link after being reported.

Record the date of submission and save the confirmation or ticket number. If the platform rejects the report, use its appeal process and explain specifically which name, photo, organization, or personal details were copied and how the account is misleading people.

Platform removal and criminal investigation are separate processes. An account can be removed without identifying its operator, and an account may remain online while authorities evaluate whether a crime occurred.

4. File with the PNP-ACG or NBI

You may report to either of the following:

For an in-person complaint, bring:

  • A government-issued ID;
  • A clear chronological account of the incident;
  • Printed copies of the profile, posts, messages, URLs, and platform reports;
  • Digital copies on a clean storage device, while retaining your originals;
  • Transaction records and proof of loss, if any;
  • Contact information and affidavits of witnesses, when available; and
  • Documents proving that the copied identity, account, business, or brand belongs to you or the represented entity.

The NBI Citizen’s Charter for victims of computer crimes provides for a complaint form, sworn statements or affidavits, supporting documents, and examination of a relevant device when needed. A company or organization should send a duly authorized representative with proof of authority and relevant registration records.

Tell the investigator whether:

  • The account is still active;
  • Money is still being collected;
  • A child, intimate image, or threat is involved;
  • You suspect a particular person and why;
  • The operator may be outside the Philippines; or
  • The account, posts, or messages are likely to be deleted.

Ask for the complaint or docket reference number, the assigned unit or investigator, and instructions for submitting additional evidence. If account records are important, ask whether immediate data preservation action is appropriate.

Under Section 13 of Republic Act No. 10175, service providers must preserve the integrity of traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with one authorized extension of another six months. Disclosure generally requires a court warrant. The Rule on Cybercrime Warrants governs preservation, disclosure, interception, search, seizure, and examination of computer data.

These rules make prompt reporting important. They do not guarantee that usable records exist, that a foreign platform can immediately produce them, or that an account can be traced.

Additional remedies for particular harm

Privacy complaint

Consider the National Privacy Commission when the facts involve unlawful collection, use, disclosure, or other processing of your personal data by a person, company, platform, lender, employer, or other responsible entity. An NPC complaint is not a substitute for a police report or emergency takedown request.

Under the NPC’s amended Rules of Procedure, a complainant generally must first inform the personal information controller, processor, or concerned entity in writing and allow it to act. A formal complaint ordinarily becomes appropriate if it fails to take timely or suitable action or does not respond within 15 calendar days after receiving the written notice. The NPC may waive this requirement for good cause or a serious violation or breach presenting significant risk of harm.

A formal complaint must use a notarized Complaints-Assisted Form or another verified complaint and include supporting evidence and witness affidavits. It may be filed personally, by registered mail, by courier, or by authorized electronic mail. A representative generally needs a special power of attorney. See the NPC’s current formal complaint instructions and amended 2021 Rules of Procedure.

Loans or credit obtained in your name

Contact the lender in writing and clearly dispute the account or application. Ask for the complaint reference number and copies of documents you are legally entitled to receive. Do not acknowledge the debt merely to stop collection calls.

You may obtain your credit report through the Credit Information Corporation’s official channels. If it contains a loan or account that is not yours, use the CIC’s online dispute process and attach supporting documents.

Gender-based harassment or sexual impersonation

The Safe Spaces Act expressly covers certain online conduct including cyberstalking, sexual or sexist messages, nonconsensual sharing of sexual media, impersonating a victim’s identity online, and posting lies to harm the victim’s reputation when the conduct constitutes gender-based online sexual harassment. The PNP-ACG is the agency specifically tasked to receive these complaints.

If intimate content is being used for blackmail, do not pay, send more images, or arrange an entrapment on your own. Preserve the demands and contact law enforcement immediately.

A child is involved

Report urgently if a fake account sexualizes a child, solicits sexual images, grooms a minor, or shares child sexual abuse or exploitation material. Call the national MAKABATA Helpline 1383, which provides child-protection assistance and referrals, or report directly to the PNP or NBI.

Do not download, forward, repost, or circulate suspected child sexual abuse material to “prove” that it exists. Preserve the account name, URL, dates, messages, and a description of what you observed, then let trained authorities secure the material lawfully.

What happens after reporting

The PNP or NBI may take your sworn statement, examine devices with your cooperation, interview witnesses, request preservation of data, and seek appropriate cybercrime warrants. If sufficient evidence is developed, the complaint may be referred to the proper prosecutor for preliminary investigation.

The prosecutor—not the social media platform or the investigating officer—determines whether the evidence establishes probable cause to bring a criminal charge. A court ultimately determines guilt and the appropriate penalty.

There is no single filing deadline for every incident involving a fake account. Prescription depends on the particular offense, its penalty, when it was committed or discovered, and whether prescription was legally interrupted. Platform-retention periods, financial dispute periods, and available electronic evidence may be much shorter than a criminal prescriptive period. Report promptly instead of relying on a possible long legal deadline.

Common mistakes to avoid

  • Reporting the profile before saving its URL, messages, posts, and identifying details;
  • Keeping only cropped screenshots that omit the username, date, time, or surrounding conversation;
  • Deleting messages, resetting the device, or closing an affected account before preserving evidence;
  • Treating a barangay or police blotter entry as a complete cybercrime complaint;
  • Assuming that many mass reports will identify the offender;
  • Sending identification to an unverified “support agent” or link;
  • Publicly accusing a suspected person without reliable evidence;
  • Hacking the fake account, guessing its password, installing tracking software, or impersonating the impersonator;
  • Paying blackmail or negotiating an entrapment without law-enforcement direction;
  • Posting private evidence publicly, especially IDs, addresses, intimate media, or information about a child;
  • Asking friends to continue engaging with the account after evidence has been secured; or
  • Waiting for financial loss before acting when the account is already contacting potential victims.

When legal help is urgent

Seek prompt assistance from law enforcement and, where possible, a lawyer if:

  • There is a credible threat, stalking, doxxing, or knowledge of your home, school, or workplace;
  • Money is being transferred or financial accounts are being opened or accessed;
  • The account is soliciting funds, investments, loans, goods, or sensitive information in your name;
  • A government ID, signature, tax number, passport, biometric, or financial credential was used;
  • The perpetrator is an intimate partner, former partner, co-worker, employer, or person with access to confidential records;
  • Sexual images, blackmail, gender-based harassment, or a child is involved;
  • The platform has preserved or removed the account and law enforcement needs to seek records quickly;
  • The suspected operator or platform is outside the Philippines; or
  • You need an affidavit, prosecutor filing, protection order, civil damages claim, NPC complaint, or urgent court relief.

Frequently asked questions

Is every fake social media account illegal?

No. Anonymous, fictional, parody, fan, and commentary accounts are not automatically criminal. Liability depends on whether the account unlawfully uses another person’s identifying information and whether its conduct satisfies the elements of identity theft or another offense. Failure to disclose that an account is a parody may also violate platform rules even when criminal liability is not established.

Can I report identity theft even if nobody has lost money?

Yes. Financial loss is not the only form of legally relevant harm, and Republic Act No. 10175 expressly provides a lower penalty where computer-related-related identity theft has not yet caused damage. Investigators must still determine whether another person’s identifying information was intentionally acquired or used without right.

Can the police trace a deleted or anonymous account?

Sometimes, but not always. Subscriber information, login records, linked contact details, devices, witnesses, admissions, transaction trails, and other evidence may establish who controlled it. Deletion, false registration information, foreign services, shared devices, VPNs, and delayed reporting can make identification harder.

Should I warn my contacts?

Yes, if doing so will prevent fraud. Use your genuine account or another trusted channel and state only verified facts: identify the fake username, tell people not to send money or information, and give the link they should report. Avoid publicly naming an unconfirmed suspect.

Do I need a lawyer to report to the PNP or NBI?

No. A victim may report directly. A lawyer can be valuable when preparing a detailed affidavit, responding to a prosecutor, seeking urgent protective relief, filing with the NPC, pursuing damages, or handling overlapping criminal and civil claims.

What if the victim is a company, organization, or brand?

Republic Act No. 10175 also refers to identifying information belonging to juridical persons. An authorized corporate representative may report the impersonation, bringing registration documents, proof of ownership or control of the legitimate account or brand, and written authority to act.

Will a platform takedown end the case?

Not necessarily. Takedown may stop immediate public harm, but copied accounts can reappear and removal does not establish who operated the account. Preserve the takedown notice, report number, and all evidence for the investigation.

Official sources and reporting links

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the account’s content, the evidence, the parties, and the resulting harm. Laws, procedures, contacts, and platform forms were checked against official sources as of 3 August 2026.

Disclaimer: This content is not legal advice and may involve AI assistance. Information may be inaccurate.

Privacy Policy

Terms of Use

Lawyer Login

 
 
Privacy Policy         Terms of Use         Lawyer Login