Quick answer

If someone creates a fake social media account using your identity, or takes over your real account and pretends to be you, save the evidence first, secure your accounts, report the account to the platform, and file a cybercrime complaint with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD) if the conduct is fraudulent, damaging, threatening, or otherwise unlawful.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person. The Supreme Court upheld this offense as constitutional in Disini v. Secretary of Justice. (Lawphil)

A fake account is not automatically a criminal case simply because it uses a false or pseudonymous name. The important questions include whether the account appropriates another person's identifying information without right, whether it is actually pretending to be that person or organization, what the operator intended to do, and what harm or other unlawful acts followed.

Do not wait for the fake account to disappear before preserving evidence. Usernames can change, posts and messages can be deleted, and entire accounts can be deactivated. The Supreme Court has expressly recognized how easily Facebook accounts, posts, and messages can disappear and how fake or dummy accounts may be used for identity theft and other crimes. (E-Library)

Fake account, cloned account, and hacked account are not exactly the same

It helps investigators if you identify what happened as accurately as possible.

A fake or cloned account is a separate account created by someone else using your name, photographs, business identity, contact details, or other identifying information. You may still have complete control of your real account.

A hacked or taken-over account is your genuine account that someone accessed without authority. The intruder may change the password, email address, phone number, profile information, or recovery settings and then use the genuine account to impersonate you.

That distinction matters legally. Taking over an existing account may involve illegal access under Section 4(a)(1) of RA 10175 in addition to possible identity theft. If the account is then manipulated to defraud people, other cybercrime or fraud offenses may also become relevant. (Lawphil)

The DOJ Office of Cybercrime specifically advises victims of hacked Facebook accounts to use Facebook's official account-recovery procedures and notes that unlawful access may subsequently be used to commit computer-related fraud and other offenses. (Cybercrime Division)

When a fake social media account may amount to identity theft

Section 4(b)(3) of RA 10175 covers identifying information belonging not only to individuals but also to juridical persons, such as corporations and other organizations. (Lawphil)

The law's Implementing Rules and Regulations define identifying information broadly. It includes information such as:

a person's name and date of birth;
driver's-license, passport, or tax-identification numbers;
unique biometric information;
electronic identification numbers, addresses, or routing codes; and
telecommunications identifying information or access-device information. (E-Library)

In Disini, the Supreme Court likewise observed that identifying information ordinarily includes matters such as a person's name, citizenship, residential address, contact number, place and date of birth, spouse, occupation, and similar identifying data. The Court sustained the constitutionality of the identity-theft provision. (E-Library)

Examples that may justify investigation include an account that:

presents itself as you while using your name and photographs;
messages your relatives, friends, customers, employees, or business contacts while pretending to be you;
asks people for money, loans, investments, load, cryptocurrency, or transfers while impersonating you;
poses as your company or authorized representative to obtain goods or money;
uses your identity to enter relationships or transactions;
publishes fabricated statements as though they came from you; or
uses information taken from a compromised account to impersonate you elsewhere.

The NBI has, for example, previously investigated cases involving offenders who manipulated other people's Facebook identities and profile information to pose as someone else. More recently, the NBI has continued investigating online schemes in which suspects allegedly impersonated legitimate persons or organizations to deceive victims. (National Bureau of Investigation)

However, similar names, fan pages, parody, satire, or pseudonymous accounts should not automatically be labeled criminal identity theft. Whether RA 10175 was violated depends on the actual use of identifying information, the absence of a right or authority to use it, intent, and the surrounding facts.

Does there have to be financial loss?

Not necessarily.

RA 10175 itself anticipates computer-related identity theft in which no damage has yet been caused. Section 4(b)(3) provides that in that situation the imposable penalty is one degree lower. This means you should not assume that you must first lose money before reporting suspected identity theft. (Lawphil)

For the ordinary penalty under Sections 4(a) and 4(b), Section 8 provides for prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. Prision mayor runs from six years and one day to twelve years under Article 27 of the Revised Penal Code. The applicable penalty in a particular case can change because of statutory provisos, other offenses charged, mitigating or aggravating circumstances, and sentencing rules, so it should not be calculated from the fake profile alone. (Lawphil)

Other offenses may be involved

Identity theft is frequently only one part of the incident.

Depending on what the impersonator actually did, investigators or prosecutors may consider offenses involving illegal access, computer-related forgery, computer-related fraud, estafa, threats, coercion, unlawful disclosure of intimate material, or other crimes.

Section 6 of RA 10175 is also important: when a felony under the Revised Penal Code or a special law is committed by, through, and with the use of information and communications technologies, RA 10175 generally provides for a penalty one degree higher than the underlying law. The precise charges must nevertheless be based on the facts and legally supportable elements, rather than simply attaching every possible cybercrime label to the same incident. (Lawphil)

Step 1: Preserve the fake account before trying to have it removed

Evidence preservation should come first whenever it can be done safely.

Capture:

the full profile or page name;
exact username or handle;
full profile URL;
account or profile ID, if visible;
profile and cover photographs;
biography, contact details, and other identifying information being copied;
posts, stories, reels, advertisements, listings, and comments;
direct messages or chat conversations;
dates and times;
telephone numbers and email addresses used by the impersonator;
links sent by the impersonator;
bank, e-wallet, cryptocurrency, or payment details;
names of people contacted by the fake account; and
any threats, demands, fraudulent offers, or representations made in your name.

Take screenshots, but do not rely only on cropped screenshots. Save the URLs and, where practical, make a screen recording showing the profile, username, content, and navigation to the account itself. Preserve the original electronic files and messages.

Ask recipients who were contacted by the impersonator to preserve their own copies of the conversation. Their messages may show representations that are not visible from your account.

Do not edit the original screenshots merely to make them look cleaner. Make a separate annotated copy if you need to highlight portions for explanation.

Step 2: Secure your real accounts immediately

If there is any possibility that your genuine account, email, or mobile number has been compromised:

Change your social-media password.
Change the password of the email account connected to it.
Log out unfamiliar devices and sessions.
Enable two-factor authentication.
Review recovery email addresses and mobile numbers.
Remove unauthorized connected applications.
Check whether the attacker changed your username, profile information, ad account, payment methods, business-manager access, or page administrators.
Protect the mobile number used for OTPs and contact your telecommunications provider if you suspect SIM compromise.

If your Facebook account itself was hacked, use Meta's official hacked-account recovery process, preferably from a device previously used to access the account. (Facebook)

Do not factory-reset a potentially relevant phone or computer merely because you want to secure it. If investigators may need the device, preserving its existing data can be important.

Step 3: Report the impersonating account to the platform

A platform report and a criminal complaint serve different purposes.

The platform report seeks account restriction, suspension, recovery, or removal under the platform's rules. The law-enforcement complaint seeks investigation and possible criminal prosecution.

You can pursue both at the same time.

On platforms that provide an impersonation category, report the profile specifically as pretending to be you, another person, or an organization, rather than merely reporting it as spam. TikTok, for example, expressly provides an impersonation-reporting procedure, including an online process for accounts outside the United States.

Keep the platform's report reference number, confirmation email, support ticket, or screenshot showing that the report was submitted.

If identification documents are requested by the platform, submit them only through the platform's genuine official process. Do not send IDs to the fake account or to people claiming in private messages that they can "recover" or "verify" your account.

Step 4: File a complaint with the PNP Anti-Cybercrime Group

RA 10175 expressly assigns cybercrime law enforcement to the PNP and NBI, which are required to maintain specialized cybercrime units. (Lawphil)

The PNP-ACG's official guidance states that cybercrime incidents may be received through walk-in reporting and electronic complaint channels and referred to the appropriate cybercrime investigator or nearest ACG office. (PNP ACG)

As currently published by the PNP-ACG, its Cyber Response Unit may be contacted through:

Email: complaint@acg.pnp.gov.ph
Mobile: 0968 878 3561
Hotline: 87230401, local 7490

The PNP-ACG also publishes contact details for Regional Anti-Cybercrime Units and local cyber-response teams around the country. (PNP ACG)

Bring or submit a clear chronology and the evidence you preserved. If your objective is criminal investigation—not merely deletion of the account—say so clearly. PNP guidelines distinguish incidents in which a complainant wishes only to have a fake or dummy account deactivated from cases where the complainant supplies the evidence necessary to pursue an investigation. (PNP ACG)

Step 5: You may instead report to the NBI Cybercrime Division

The NBI Cybercrime Division also receives complaints from members of the public.

The NBI's current Citizens' Charter states that a complainant may proceed to the Cybercrime Division to request investigation, undergo a preliminary interview, complete a sworn complaint sheet, provide sworn statements or prepared affidavits, submit supporting documents, and make a relevant device available for examination when necessary. The NBI lists no fee for this investigative-assistance service. (National Bureau of Investigation)

Current NBI contact information lists:

Cybercrime Division email: ccd@nbi.gov.ph
Trunkline: (02) 8523-8231 to 38, local 3455
Main office: NBI Building, Taft Avenue, Ermita, Manila

The NBI also maintains regional and district offices around the Philippines. (National Bureau of Investigation)

You ordinarily do not need to file identical complaints with every law-enforcement agency. Choose a competent investigating office and cooperate with the investigator assigned to the case. Additional referrals can be made when appropriate.

Step 6: If the impersonator is asking people for money, act on the financial side immediately

If the fake account is soliciting transfers or has already caused someone to send money:

immediately notify the bank, e-wallet, card issuer, or payment service involved;
provide the transaction reference numbers and receiving-account information;
ask about the provider's fraud-reporting and account-preservation procedures;
preserve receipts and confirmation messages; and
inform PNP-ACG or NBI that the impersonation involves an active financial scam.

The Cybercrime Investigation and Coordinating Center (CICC) currently promotes 1326 as its reporting hotline for online scams and also publishes report@cicc.gov.ph as a reporting email. (CICC)

The faster a financial institution and investigators receive usable transaction details, the better the opportunity to trace the movement of funds. Recovery, however, is never guaranteed.

Step 7: Consider the National Privacy Commission when the problem involves unlawful personal-data processing

Identity misuse can sometimes raise issues under the Data Privacy Act of 2012 (RA 10173), particularly where personal information was obtained or processed without an applicable lawful basis.

The DPA penalizes, among other things, unauthorized processing of personal information and sensitive personal information. Whether those provisions apply to a particular fake-account case depends on the person or organization involved, the nature and purpose of the processing, the statutory scope and exceptions, and the available evidence. (Lawphil)

An NPC complaint is particularly worth considering where the problem involves a company, organization, website, employer, service provider, database operator, or other identifiable entity that controls or processes your personal data.

Under the NPC's current Rules of Procedure, the general rule on exhaustion of remedies requires a complainant first to inform the personal information controller, processor, or concerned entity in writing of the alleged privacy violation or breach. If the entity does not take timely or appropriate action, or gives no response within 15 calendar days from receipt, the requirement may be satisfied. The NPC may waive the exhaustion requirement in circumstances allowed by its rules. (National Privacy Commission)

A formal NPC complaint generally requires a notarized complaint form or verified complaint together with supporting evidence and witness affidavits. The NPC warns that insufficient complaints may be dismissed. (National Privacy Commission)

For a completely anonymous impersonator whose identity cannot yet be traced, PNP-ACG or NBI investigation will often be the more practical first step.

What evidence should you bring to PNP or NBI?

Prepare one organized folder, preferably with both electronic and printed copies where practical.

Include:

a government-issued ID identifying you;
a short chronological statement explaining when you discovered the account;
URL and username of your authentic account;
URL and username of the fake account;
screenshots and screen recordings;
downloaded or exported messages, where available;
proof showing that the photographs, identity, business, or account being copied are yours;
messages from friends, customers, or relatives who were contacted;
payment receipts or account numbers if money was requested or transferred;
emails, SMS messages, telephone numbers, and links connected with the incident;
security alerts showing unauthorized logins if your real account was hacked;
platform-report confirmations;
names and contact information of witnesses; and
a list of the specific harm already caused, such as financial loss, reputational damage, threats, lost customers, account lockout, or fraudulent transactions.

The investigator may require a sworn statement or complaint affidavit. Tell the truth precisely. Distinguish what you personally know from what someone else told you.

What if you do not know who created the fake account?

You may still report it.

Victims often know only the username, URL, phone number, email address, payment account, or other digital identifiers at the beginning of an investigation.

RA 10175 provides procedures through which law-enforcement authorities may seek preservation and, with the required judicial process, disclosure or examination of computer data. For example, Section 14 contemplates court-authorized disclosure of subscriber, traffic, or relevant data in connection with a valid complaint that has been officially docketed and assigned for investigation. (Lawphil)

This is one reason a formal cybercrime complaint can matter. An ordinary private user generally cannot compel a social-media company or telecommunications provider to identify another account holder merely by demanding the information.

Where providers or evidence are overseas, investigation can also require international cooperation. RA 10175 expressly provides for international cooperation concerning cybercrime investigations and electronic evidence, while the DOJ Office of Cybercrime serves as the central authority for relevant international cybercrime matters. (Lawphil)

Why reporting promptly matters

Digital evidence is unusually easy to alter or lose.

Under Section 13 of RA 10175, traffic data and subscriber information relating to communication services are subject to a statutory minimum preservation period of six months from the transaction. Content data may be preserved for six months from receipt of a law-enforcement preservation order, with a one-time extension for another six months under the conditions stated in the law. Data used as evidence in a case is subject to further preservation as provided by the statute. (Lawphil)

These provisions do not mean that every social-media company will necessarily retain every item you need for exactly the same period, or that evidence can always be recovered after deletion. They are a reason to involve investigators promptly when service-provider records may be necessary.

Do not delay merely because the fake account has not yet succeeded in stealing money.

Warn people who may be targeted

Once your evidence has been preserved, warn people who are realistically at risk of being deceived.

A short notice is usually enough:

identify your genuine account;
state that another account is impersonating you;
tell contacts not to send money, OTPs, passwords, IDs, or confidential information through the fake account;
ask anyone already contacted to preserve the entire conversation; and
give them a safe way to verify communications with you.

Avoid publishing unsupported accusations identifying a particular individual as the offender unless you have an adequate factual basis. The identity behind an account is something investigators may still need to establish.

Common mistakes to avoid

Reporting the profile before saving the evidence

If the platform removes the account immediately, useful posts, messages, URLs, and identifiers may become harder to document. Preserve what you can first.

Keeping only one screenshot

One image showing a profile name may prove very little. Preserve the URL, username, messages, context, dates, payment information, and other identifying details.

Deleting conversations or resetting devices

Those items may contain useful evidence. Secure the account without unnecessarily destroying the records investigators may need.

Publicly confronting the suspected offender

A confrontation can cause the person to delete accounts, messages, or devices. If law enforcement is already involved, follow the investigator's instructions rather than improvising an entrapment or confrontation.

Paying the impersonator to stop

Payment does not ensure that copied information, photographs, or credentials will be destroyed. If there is extortion or a demand for money, preserve the demand and seek law-enforcement assistance.

Assuming a platform report is already a criminal complaint

It is not. Reporting an account to Facebook, Instagram, TikTok, X, or another service is a private platform process. A criminal investigation ordinarily requires reporting to an appropriate law-enforcement authority.

Assuming a police or barangay blotter alone finishes the case

Documenting the incident may be useful, but if you want the perpetrator investigated for a cybercrime, make sure the matter reaches an office capable of conducting the necessary cybercrime investigation and evidence-preservation process.

Filing every possible offense without matching the facts

A fake profile may involve identity theft, hacking, fraud, threats, privacy violations, or other offenses—but not every law applies to every incident. Give investigators the complete facts and evidence instead of trying to force the incident into a particular criminal label.

When legal help is urgent

Seek prompt professional or law-enforcement assistance when:

the impersonator has access to your genuine email or social-media account;
banking, e-wallet, credit-card, cryptocurrency, or business accounts are compromised;
people are already transferring money to the impersonator;
the offender is threatening violence, extortion, or disclosure of intimate material;
a child's identity or safety is involved;
confidential corporate or customer data is being used;
fraudulent contracts, loans, purchases, or accounts are being created in your name;
the account is destroying a business's reputation or deceiving customers;
investigators may need information from a foreign platform before it disappears; or
you know the suspected offender and there is a risk that evidence will be destroyed once the person learns about the complaint.

Frequently asked questions

Is creating a fake Facebook account automatically illegal?

No. A false or pseudonymous account is not automatically computer-related identity theft. Criminal liability depends on whether the statutory elements of an offense are present. An account intentionally using another person's identifying information without right and pretending to be that person is much more serious than an account merely using an invented pseudonym.

Can I report identity theft even if nobody has lost money yet?

Yes. Section 4(b)(3) of RA 10175 expressly contemplates cases where no damage has yet been caused, although the law provides for a lower penalty in that situation. (Lawphil)

Can a company be the victim of computer-related identity theft?

Yes. Section 4(b)(3) expressly refers to identifying information belonging to another natural or juridical person. (Lawphil)

Can I report an unknown person?

Yes. Provide every digital identifier you have. Investigation may be necessary to determine who controlled the account.

Are screenshots enough?

Screenshots are useful, but they are stronger when accompanied by URLs, usernames, complete conversations, transaction records, original files, witness statements, security alerts, and other corroborating information.

Should I report to Facebook or TikTok first, or to the police first?

You may do both. If evidence could disappear when the account is removed, preserve it before requesting takedown. If there is an active scam, threat, extortion attempt, hacking incident, or continuing financial loss, do not postpone law-enforcement reporting while waiting for the platform.

Can PNP or NBI force the social-media company to identify the account owner?

Investigators can pursue lawful processes for computer data, including cybercrime warrants and international cooperation where required. Disclosure is not automatic, and the result depends on jurisdiction, available records, legal process, and the provider involved. RA 10175 requires judicial authorization for protected data covered by its warrant provisions. (Lawphil)

Can the DOJ simply order Facebook to block the fake account?

Do not rely on that assumption. Although Section 19 of the original Cybercrime Prevention Act authorized DOJ blocking orders, the Supreme Court declared that provision unconstitutional in Disini v. Secretary of Justice. Platform reporting, investigation, and applicable judicial or lawful processes must therefore be distinguished from the invalidated administrative blocking power. (Lawphil)

What if the impersonator is outside the Philippines?

Philippine jurisdiction may still exist in circumstances specified by Section 21 of RA 10175—for example, where an element of the offense occurs in the Philippines or the cybercrime causes damage to a natural or juridical person who was in the Philippines when the offense was committed. Cross-border evidence may nevertheless require international cooperation. (Lawphil)

Official sources and reporting pages

This article provides general Philippine legal information and is not a substitute for legal advice on a particular incident. The proper complaint, offenses, evidence, jurisdiction, and remedies depend on the actual account, communications, losses, parties involved, and available digital records. Laws, procedures, government contact details, and official guidance were checked against primary and official sources as of August 25, 2026.