I. Introduction

A hacked Facebook account can cause immediate and serious harm. The hacker may post scams, defamatory statements, private photos, fake investment promotions, malicious accusations, sexual content, political propaganda, fake job offers, loan advertisements, phishing links, threats, or messages asking friends and relatives for money. In the Philippines, where Facebook is widely used for personal identity, business, community announcements, school groups, barangay pages, online selling, and family communication, unauthorized posts can quickly damage reputation, relationships, employment, finances, and legal standing.

A Facebook account hack is not merely a social media inconvenience. It may involve identity theft, unauthorized access, computer-related fraud, cyber libel, phishing, estafa, data privacy violations, harassment, extortion, malicious mischief, and other civil or criminal consequences. The victim may also face complaints from people who believed the unauthorized posts or sent money to the hacker.

The controlling principle is clear: a person should not be held responsible for posts, messages, transactions, or representations made through a Facebook account after it was hacked and used without their knowledge, consent, authority, or control, but the victim must act promptly to secure the account, preserve evidence, notify affected persons, and report the incident.

II. What Counts as a Hacked Facebook Account?

A Facebook account may be considered hacked, compromised, or taken over when someone other than the lawful user gains access or control without authority. This may happen through:

Stolen password;
Phishing link;
Fake login page;
Malware or spyware;
SIM swap or loss of phone number used for recovery;
Compromised email account;
Weak or reused password;
Shared device or public computer;
Unauthorized access by a former partner, family member, employee, or friend;
Fake customer support page;
Malicious browser extension;
Social engineering;
Compromised business page admin account;
Session hijacking or stolen cookies;
Account recovery abuse.

A hacked account is not limited to total loss of access. Even if the user can still log in, unauthorized posts, messages, page actions, payment activity, or changed settings may show that another person accessed the account.

III. Forms of Unauthorized Facebook Activity

Unauthorized activity may include:

Posting scam advertisements;
Sending private messages asking for money;
Posting defamatory statements;
Posting private or intimate images;
Posting fake sale listings;
Sharing phishing links;
Joining groups;
Commenting on posts;
Changing the profile picture or name;
Adding unknown friends;
Removing friends or blocking people;
Creating or controlling pages;
Running paid advertisements;
Linking unknown Instagram, WhatsApp, or business accounts;
Changing email, password, or recovery number;
Deleting messages or posts;
Accessing private conversations;
Downloading personal data;
Posting political or religious content;
Using the account to harass, threaten, or impersonate others.

Each type of activity has different legal and practical consequences.

IV. Common Hacking Scenarios in the Philippines

1. “Send GCash” or Emergency Money Scam

The hacker messages friends or relatives claiming an emergency and asking for money through GCash, Maya, bank transfer, remittance, or another account. This may constitute fraud or estafa by the hacker.

2. Fake Investment or Crypto Post

The hacker posts fake investment returns, crypto schemes, trading platforms, online casino links, or “double your money” offers using the victim’s identity.

3. Fake Online Selling Post

The hacker posts gadgets, tickets, vehicles, appliances, phones, or rental units for sale, collects deposits, then disappears. The victim may be blamed by buyers unless the hack is documented.

4. Cyber Libel or Defamatory Post

The hacker posts accusations against another person. The victim may be accused of cyber libel if they cannot promptly show unauthorized access.

5. Private Photo or Intimate Image Leak

The hacker posts private images or threatens to release intimate content. This may involve cybercrime, violence against women and children laws in proper cases, anti-photo/video voyeurism concerns, extortion, and privacy violations.

6. Political, Religious, or Hate Content

The hacker uses the account to post inflammatory content, which may damage the victim’s reputation or employment.

7. Business Page Takeover

A hacker gains admin access to a business page, posts scams, changes page roles, runs ads, or damages customer trust.

8. Unauthorized Marketplace Listings

The hacker posts items for sale on Facebook Marketplace or groups, collects payment, and uses the victim’s account to look trustworthy.

9. Account Used for Phishing

The hacker sends links to friends, causing more accounts to be compromised.

V. Legal Issues Under Philippine Law

A hacked Facebook account may involve several legal areas.

1. Unauthorized Access

Unauthorized access to a Facebook account may fall under cybercrime-related rules because the account is accessed through a computer system or online platform without authority.

2. Identity Theft

Using another person’s account, name, photo, and identity to post, message, solicit money, or deceive others may constitute identity theft or related cybercrime.

3. Computer-Related Fraud

If the hacker uses the account to obtain money, property, services, or personal information, the conduct may amount to computer-related fraud.

4. Estafa or Swindling

If friends, relatives, customers, or buyers send money because they believed the hacker’s representations, the hacker may be liable for fraud or estafa, depending on the facts.

5. Cyber Libel

If the hacked account posts defamatory statements, the person whose account was used may be accused. However, liability should depend on authorship, control, intent, and proof. The victim must preserve evidence showing unauthorized access.

6. Data Privacy Violations

If the hacker accesses, downloads, uses, or discloses private messages, photos, contacts, documents, or personal information, data privacy issues may arise.

7. Harassment, Threats, or Extortion

If the hacker uses the account to threaten, blackmail, extort, shame, or harass others, additional criminal and civil liability may be involved.

8. Unauthorized Use of Images

If the hacker posts photos, private images, IDs, or documents, rights to privacy, dignity, and data protection may be implicated.

9. Business and Consumer Fraud

If a hacked business page is used to deceive customers, consumer protection, civil liability, and platform reporting issues may arise.

VI. Is the Account Owner Automatically Liable for Unauthorized Posts?

No. The owner of the Facebook account is not automatically liable for unauthorized posts made by a hacker. Liability depends on whether the owner actually authored, authorized, participated in, tolerated, or later ratified the post or transaction.

However, the practical problem is proof. To outsiders, the post appears to come from the victim’s account. The victim must therefore act quickly to establish that the account was hacked and that the posts were unauthorized.

Important factors include:

When the account was compromised;
When the unauthorized posts or messages appeared;
Whether the victim still had access;
Whether the victim immediately deleted or disowned the posts;
Whether the victim warned contacts;
Whether the victim reported to Facebook;
Whether the victim filed a police or cybercrime report;
Whether login alerts show unknown devices or locations;
Whether password, email, or recovery number was changed;
Whether the victim benefited from the unauthorized activity.

Prompt action helps distinguish the victim from the wrongdoer.

VII. Immediate Steps After Discovering Unauthorized Posts

The victim should act in a calm, evidence-based way.

1. Preserve Evidence Before Deleting

Before deleting unauthorized posts or messages, take screenshots or screen recordings showing:

The post or message;
Date and time;
URL or profile link;
Comments or reactions;
Recipient names if messages were sent;
Payment instructions posted by the hacker;
Unknown devices or login alerts;
Changed email, phone, or password notices.

If possible, use another device to photograph the screen. Do not rely only on memory.

2. Secure the Account

If still able to log in:

Change the password immediately;
Log out of all devices;
Remove unknown emails and phone numbers;
Check recovery settings;
Enable two-factor authentication;
Remove suspicious apps and websites;
Check account center links;
Review page roles and business settings;
Check ad accounts and payment methods;
Review recent activity.

3. Recover the Account

If locked out, use Facebook’s account recovery process. The victim may need to prove identity, use trusted devices, or recover access through email or phone.

4. Warn Contacts

Post or send a warning through alternative channels:

“My Facebook account was hacked. Please ignore posts, messages, links, payment requests, or offers sent from my account during [date/time]. Do not send money or click links. I am working to recover and secure the account.”

5. Report to Facebook

Report the account as hacked and report specific unauthorized posts, messages, ads, or pages.

6. Notify Banks and E-Wallets

If the hacker posted payment details, solicited money, or accessed linked accounts, notify banks, GCash, Maya, cards, ad accounts, and payment platforms immediately.

7. File a Report if Harm Occurred

If money was lost, threats were made, defamatory posts appeared, private images were posted, or the account was used for scams, file a report with appropriate authorities.

VIII. Evidence Checklist

The victim should preserve:

Screenshots of unauthorized posts;
Screenshots of unauthorized messages;
Login alerts;
Unknown device or location information;
Password change notifications;
Email change notifications;
Recovery phone change notifications;
Account recovery emails;
Facebook report reference numbers;
URLs of posts and profile;
Names of persons who received messages;
Payment details used by the hacker;
Receipts from victims who sent money;
Bank or e-wallet account numbers posted;
Marketplace listings;
Ad account charges;
Business page changes;
Messages from friends warning of the hack;
Police blotter or cybercrime report;
Affidavit of incident.

Evidence should be saved in multiple places: phone, cloud, USB drive, and printed copy if needed.

IX. Affidavit of Hacking Incident

An affidavit may help document the victim’s position. It may state:

Identity of the account owner;
Facebook profile URL or username;
Date and time the account was discovered hacked;
Description of unauthorized access;
Unauthorized posts or messages made;
Statement that the victim did not create, authorize, approve, or benefit from the posts;
Steps taken to recover the account;
Steps taken to warn contacts;
Reports filed with Facebook, banks, platforms, or authorities;
Screenshots and supporting documents attached;
Request for investigation or acknowledgment.

An affidavit is especially useful if the hacked account was used for fraud, cyber libel, threats, or unauthorized sale posts.

X. Sample Public Advisory Post

If the victim regains access or can post through another account, a public advisory may read:

Public Advisory

My Facebook account was hacked or accessed without authority on or around [date/time]. Any posts, messages, links, offers, payment requests, defamatory statements, or transactions made from my account during that period were unauthorized and should be disregarded.

Please do not send money, click links, or share personal information in response to messages from my account during the affected period. If you received any suspicious message or sent money, please preserve screenshots and contact me through [safe contact method].

I am taking steps to secure the account and report the incident.

XI. Sample Notice to Persons Who Received Scam Messages

Subject: Notice of Hacked Facebook Account

Hello. My Facebook account was hacked on or around [date/time]. If you received a message asking for money, offering items for sale, sending links, or requesting personal information, please disregard it. I did not send or authorize those messages.

Please do not send money or click any links. If you already sent money, please preserve screenshots, receipts, payment details, and the conversation. The incident is being documented and reported.

Thank you.

XII. Sample Report Narrative

A report narrative may state:

“On [date/time], I discovered that my Facebook account [profile name/link] had been accessed without my authority. Unauthorized posts and messages were made from the account, including [describe posts/messages]. I did not create, authorize, approve, or benefit from these posts or messages. I immediately took steps to recover the account, change passwords, warn contacts, and preserve screenshots. I request assistance in documenting and investigating the unauthorized access and related acts.”

XIII. Unauthorized Posts and Cyber Libel Risk

If the hacker posted defamatory statements against another person, the account owner should act quickly. The victim should:

Preserve the defamatory post as evidence of unauthorized activity;
Delete or hide it once evidence is preserved;
Publicly disown it if appropriate;
Privately notify the person targeted, if safe;
Explain that the account was hacked;
File an affidavit or report;
Preserve login alerts and recovery evidence.

The victim should avoid repeating the defamatory statement unnecessarily. Reposting or resharing the content may worsen harm.

XIV. Unauthorized Posts Asking for Money

If the hacker asked friends or relatives for money, the victim should collect:

Screenshots of messages;
Names of recipients;
Payment method used;
Account or wallet receiving funds;
Amount sent;
Time of transfer;
Receipt or reference number;
Any subsequent communication.

The victim should advise affected persons to report the transaction to their bank or e-wallet provider immediately. Fast reporting may help freeze funds, although recovery is not guaranteed.

XV. Unauthorized Marketplace or Business Posts

If the hacked account was used to sell fake items, the victim should:

Preserve screenshots of listings;
Remove the listing after evidence is saved;
Warn potential buyers;
Report the listing to Facebook;
Identify any payment accounts used by the hacker;
Notify banks or e-wallets if payment details are known;
File a report if buyers lost money;
Keep proof that the victim did not receive funds.

If the account is used for business, the owner should also notify customers, suppliers, admins, and moderators.

XVI. Business Page or Ad Account Takeover

If a business page is hacked, additional steps are needed:

Review page roles and remove unknown admins;
Check Meta Business settings;
Review linked Instagram and WhatsApp accounts;
Check ad account spending;
Remove unauthorized payment methods;
Disable active fraudulent ads;
Preserve invoices and ad activity logs;
Notify customers;
Change passwords of all admins;
Require two-factor authentication for admins;
Report unauthorized ad charges;
Review connected apps and pixels.

A hacked business page may create consumer complaints and reputational harm, so public notice may be necessary.

XVII. If the Hacker Changed the Email or Password

If the hacker changed the login email or password, the victim should:

Use account recovery tools immediately;
Check email inbox for Facebook security messages;
Use “This wasn’t me” links if available;
Secure the email account first;
Check if the recovery phone number was changed;
Use a trusted device previously used to log in;
Prepare identity verification documents if required;
Warn contacts through another channel.

If the email account is also hacked, recover the email first because Facebook recovery often depends on email access.

XVIII. If the Hacker Used the Account for Loans or E-Wallets

If the hacker used the Facebook account to apply for loans, contact references, or link e-wallets, the victim should dispute the transactions in writing. The victim should state that the account was hacked and that any loan, application, authorization, or message made during the compromised period was unauthorized.

Online lending and e-wallet providers should be asked to preserve records and investigate.

XIX. If Private Messages Were Accessed

A hacker may read years of private conversations, photos, documents, personal issues, business communications, intimate content, addresses, IDs, and financial details. The victim should assume that sensitive information may have been exposed.

Practical steps include:

Warn persons whose private information may be affected;
Change passwords for accounts mentioned in chats;
Watch for blackmail attempts;
Secure cloud storage and email accounts;
Review shared documents or IDs;
Report threats or extortion immediately.

XX. If Intimate Photos or Videos Were Posted or Threatened

If intimate images were posted, threatened, or used for blackmail, the victim should preserve evidence and seek urgent help. The victim should avoid negotiating endlessly with the extortionist, avoid sending more images, and avoid paying without legal advice, because payment often leads to more demands.

The victim may report the content to Facebook for removal and file complaints under applicable criminal, cybercrime, privacy, and special laws depending on the facts.

XXI. If the Hacker Is Someone Known to the Victim

Unauthorized access may be done by a former partner, spouse, family member, employee, friend, coworker, or business partner. The fact that the person knows the victim or once had access does not automatically authorize continued use.

Examples include:

Former partner using saved password;
Employee retaining page admin access after termination;
Family member logging in through shared device;
Friend using a borrowed phone;
Business partner posting without authority;
Ex-admin taking over a page.

The victim should revoke access, document the unauthorized acts, and consider civil, criminal, or administrative remedies depending on harm.

XXII. Employer and Workplace Consequences

Unauthorized Facebook posts may affect employment if they appear to violate company rules, insult clients, disclose confidential information, or damage reputation. An employee whose account was hacked should notify the employer promptly if workplace-related harm is possible.

The employee should submit proof of hacking, such as login alerts, screenshots, reports, and affidavit. Employers should investigate fairly before imposing discipline. An employee should not be terminated or penalized solely based on hacked posts without considering evidence of unauthorized access.

XXIII. School and Student Consequences

Students may face disciplinary complaints if a hacked account posts bullying, threats, cheating materials, obscene content, or defamatory statements. The student or parent should promptly notify the school, preserve evidence, and submit a written explanation that the account was compromised.

Schools should distinguish between actual misconduct and unauthorized account use.

XXIV. Barangay, Community, and Family Impact

In many Philippine communities, Facebook posts quickly become barangay or family disputes. A hacked post may lead to confrontation, blotter entries, or mediation. The victim should bring evidence to barangay proceedings and avoid heated verbal arguments.

Barangay settlement may help resolve misunderstandings, but serious cybercrime, fraud, extortion, or intimate image abuse should be reported through proper channels.

XXV. Civil Liability and Damages

A hacker may be civilly liable for damage caused by unauthorized access and posts. Recoverable damages may include:

Financial loss;
Reputational harm;
Business loss;
Emotional distress in proper cases;
Cost of account recovery;
Cost of legal assistance;
Loss caused by fraudulent posts;
Damage to customers or third parties;
Attorney’s fees where justified.

The account owner may also need to defend against claims by third parties who believed the posts. The best defense is prompt proof that the account was hacked and that the owner did not benefit.

XXVI. Criminal Liability of the Hacker

Depending on the acts committed, the hacker may face liability for:

Unauthorized access;
Identity theft;
Computer-related fraud;
Estafa;
Cyber libel;
Threats;
Extortion;
Unlawful disclosure of private data;
Harassment;
Use of falsified identity;
Illegal access to payment systems;
Other offenses depending on the facts.

If the hacker used the account to commit another crime, liability may be aggravated by the use of technology.

XXVII. Responsibility of the Account Owner to Mitigate Harm

Although the victim is not responsible for the hacker’s acts merely because the account was used, the victim should mitigate harm after discovering the hack.

Reasonable steps include:

Recovering the account;
Deleting unauthorized posts after preserving evidence;
Warning contacts;
Reporting the account compromise;
Securing linked email and phone number;
Cooperating with affected persons;
Reporting payment fraud quickly;
Avoiding further spread of harmful content.

Failure to act after discovery may create practical problems, especially if more people are harmed.

XXVIII. Platform Reporting and Limitations

Facebook provides account recovery and reporting tools, but platform processes may be slow or limited. The victim should not rely solely on platform reporting if legal harm has occurred.

Platform reports are still useful because they create records. Save confirmation emails, reference numbers, and screenshots of submitted reports.

XXIX. Preventive Security Measures

To prevent hacking:

Use a strong unique password;
Enable two-factor authentication;
Secure the email account linked to Facebook;
Secure the mobile number used for recovery;
Do not click suspicious links;
Avoid logging in through public computers;
Review logged-in devices regularly;
Remove unknown apps and websites;
Do not share passwords with partners, friends, or staff;
Use password managers if appropriate;
Update devices and browsers;
Avoid fake verification pages;
Verify messages asking to vote, claim prizes, or recover accounts;
Set trusted contacts or recovery options where available;
Require 2FA for business page admins.

The linked email account is often the weakest point. Securing Facebook without securing email is incomplete.

XXX. Special Risk: Phishing Through Friends

Many hacks begin with a message from a friend whose account was already compromised. The message may say:

“Please vote for me”;
“Is this you in the video?”;
“I need help recovering my account”;
“You won a prize”;
“Check this link”;
“Send me the code you received”;
“Your page will be deleted unless you verify.”

A person should never send login codes, OTPs, or recovery codes to anyone, even a friend.

XXXI. Special Risk: Fake Facebook Support

Scammers often pretend to be Facebook support, Meta Business, copyright enforcement, or page verification. They may claim that the account or page will be disabled unless the user logs in through a link.

Official platform notices should be checked inside the platform or through verified channels, not through suspicious links.

XXXII. Special Risk: SIM Swap and Recovery Number Theft

If the hacker controls the phone number linked to Facebook, they may receive recovery codes. The victim should contact the telco if the SIM is lost, stolen, replaced without authority, or no longer receiving signal. Banks and e-wallets should also be alerted.

A Facebook hack may be part of a larger identity theft incident.

XXXIII. Special Risk: Email Account Compromise

If the hacker controls the email linked to Facebook, they can reset passwords and hide security notices. The victim should:

Change email password;
Log out all sessions;
Check forwarding rules;
Check recovery email and phone;
Review connected apps;
Enable two-factor authentication;
Search for deleted security emails;
Secure cloud files and documents.

XXXIV. Demand Letter to a Known Hacker

If the hacker is known, a demand letter may state:

Subject: Demand to Cease Unauthorized Access and Use of Facebook Account

Dear [Name]:

It has come to my attention that my Facebook account, page, or related online profile was accessed or used without my authority on or around [date]. Unauthorized posts, messages, or actions were made from the account.

You are hereby demanded to immediately cease any access, use, control, posting, messaging, publication, deletion, alteration, or interference involving my account, page, personal data, private messages, photos, contacts, or related online assets. You are further demanded to preserve all records, devices, messages, and information relating to the unauthorized access.

This letter is sent without prejudice to all civil, criminal, administrative, and other remedies available under law.

Sincerely, [Name]

XXXV. Notice to Employer or School

If employment or school consequences are possible:

Subject: Notice of Hacked Facebook Account

Dear [HR/School Official]:

I respectfully inform you that my Facebook account was hacked or accessed without authority on or around [date/time]. Unauthorized posts or messages may have appeared during that period.

I did not create, authorize, or approve those posts or messages. I am taking steps to recover and secure the account, preserve evidence, and report the incident.

Attached are screenshots and available proof of unauthorized access for your reference.

Sincerely, [Name]

XXXVI. Practical Legal Assessment

To assess the case, ask:

When was the account first compromised?
Does the owner still have access?
What unauthorized posts or messages were made?
Were defamatory statements posted?
Was money solicited or received?
Were private photos or documents exposed?
Were business pages, ads, or payment methods affected?
Were friends, customers, or relatives harmed?
Was the linked email or phone also compromised?
Did the victim report to Facebook?
Did the victim warn contacts?
Is there proof of unknown login location or device?
Is the hacker known?
Has any complaint been filed against the account owner?
What damages occurred?

The answers determine whether the matter is mainly account recovery, identity theft, cybercrime, fraud, cyber libel defense, data privacy incident, or civil damages claim.

XXXVII. Common Mistakes by Victims

Victims often weaken their position by:

Deleting posts before taking screenshots;
Waiting too long to warn contacts;
Not securing the linked email;
Ignoring unknown login alerts;
Failing to report payment scams quickly;
Using the same password again;
Not logging out unknown devices;
Not checking page admin roles;
Arguing publicly instead of documenting facts;
Failing to execute an affidavit when serious harm occurs.

The safest approach is to preserve, secure, warn, report, and document.

XXXVIII. Common Mistakes by Friends or Third Parties

People who receive suspicious messages from a hacked account should:

Verify through another channel before sending money;
Avoid clicking links;
Never share OTPs;
Preserve screenshots;
Report the account as hacked;
Notify the real person through phone or another verified contact;
Report payment fraud quickly if money was sent.

Trusting a message simply because it came from a familiar profile is risky.

XXXIX. Conclusion

A hacked Facebook account with unauthorized posts can create serious legal and personal consequences in the Philippines. It can lead to scams, cyber libel accusations, identity theft, financial fraud, workplace discipline, business loss, privacy violations, and emotional distress. The account owner is not automatically liable for what a hacker posted, but must act quickly to show that the posts were unauthorized.

The most important steps are immediate evidence preservation, account recovery, password and email security, warning contacts, reporting to Facebook, notifying banks or e-wallets if money is involved, and filing a report or affidavit when the hack causes legal harm. If defamatory posts, threats, intimate images, scam messages, business page abuse, or financial loss are involved, legal assistance should be considered.

The controlling rule is clear: unauthorized posts made through a hacked Facebook account should be treated as acts of the hacker, not the victim, but the victim must create a clear record of non-consent, loss of control, prompt action, and mitigation.