Quick answer

A fake Facebook account that uses your name or photos to solicit “loan fees,” collect money, or deceive borrowers may amount to computer-related identity theft under the Cybercrime Prevention Act. Depending on what the operator did, computer-related forgery or fraud, estafa, access-device fraud, Data Privacy Act violations, or other offenses may also apply.

You are generally not liable for a loan you did not apply for, authorize, receive, or consent to. A lender, collector, or victim may nevertheless mistake you for the scammer, so act quickly: preserve the account and transaction evidence, report the profile to Facebook, warn affected contacts, notify any named lender or payment provider in writing, and file a cybercrime report.

If money was transferred, contact the receiving bank or e-wallet and the CICC’s cybercrime hotline immediately. Fast reporting may help preserve records or stop further movement of funds, although recovery is not guaranteed.

What to do immediately

1. Preserve the evidence before reporting the account

Facebook may remove the profile, change its URL, or make its content unavailable. Before requesting takedown, collect:

The full profile URL—not only the displayed name
Screenshots and screen recordings showing the profile, photos, About section, posts, comments, and loan offers
The date and time each item was viewed
Messenger conversations, including the account name and profile details
Phone numbers, email addresses, websites, QR codes, referral links, and loan-app names used
Bank or e-wallet account names, numbers, transaction references, receipts, and timestamps
Copies of fake IDs, loan forms, contracts, approvals, or advertisements
Messages from people who were approached or deceived
The URL of your genuine account and original copies or earlier posts of the misused photos
Facebook report confirmations and every complaint reference number

Save the original files. Do not crop away usernames, URLs, timestamps, or transaction details. Export chats where possible and keep at least two secure copies. Ask witnesses to preserve their own devices and original conversations.

Do not secretly enter the scammer’s account, obtain passwords, impersonate the operator, or install tracking software. Unauthorized access can create separate legal and evidentiary problems.

2. Report the impersonating profile to Facebook

Use the three-dot menu on the profile and choose the option for reporting a profile that is pretending to be someone. Facebook also provides an impersonation-reporting route for a person who cannot access an account. Follow the current instructions in the Facebook Help Center.

State clearly that:

The profile is not yours;
It uses your name, image, or identifying information without permission;
It is offering loans or soliciting advance payments;
People are being directed to specific accounts, numbers, or links; and
You are preserving the material for a Philippine law-enforcement complaint.

A platform report may secure a takedown, but it does not replace a police, NBI, lender, regulator, or privacy complaint.

3. Warn people without destroying evidence

Publish a short notice from your genuine account and send it directly to close contacts:

A fake account is using my name/photos for loan transactions. I do not own or operate that account and have not authorized its offers. Do not send money, IDs, OTPs, or personal information. Please preserve any messages and report the profile.

Avoid naming an unverified suspect or publishing private account information unnecessarily. A false accusation could expose you to a separate complaint. Block the fake profile only after preserving what you can lawfully see.

4. Secure your genuine accounts

Change your Facebook and primary email passwords, use unique passwords, enable two-factor authentication, review active sessions, remove unknown connected apps, and check whether your email address or phone number was changed.

Also review your bank, e-wallet, and mobile accounts. Never give an OTP, PIN, recovery code, or remote access to someone claiming to “investigate” the scam. If your real account was accessed, tell investigators explicitly; illegal access is a separate cybercrime issue.

Report the cybercrime

The Cybercrime Prevention Act assigns cybercrime enforcement to the PNP and NBI. You may approach the nearest PNP anti-cybercrime unit or the NBI Cybercrime Division. The NBI’s current service procedure contemplates presentation of supporting documents, execution of a sworn statement, and examination of relevant devices when necessary. See the NBI’s investigative-assistance procedure, online complaint page, and Cybercrime Division contact listing.

You may also report through the Cybercrime Investigation and Coordinating Center:

Hotline: 1326
Email: report@cicc.gov.ph
Online reporting page: cicc.gov.ph/report

Channels can change or undergo maintenance, so confirm them on the agency’s official page when filing.

Bring or prepare:

A chronological account of what happened
Government-issued identification
Printed and electronic copies of the evidence
Your genuine profile URL and the fake profile URL
Names and contact details of willing witnesses
Transaction records from anyone who sent money
Details of every lender, bank, e-wallet, SIM, website, or app involved
Copies of prior reports and their reference numbers

Ask that your report specifically identify the need to preserve relevant platform, subscriber, traffic, payment, and communication records. Under Section 13 of the Cybercrime Prevention Act, law enforcement may require preservation of content data for six months, with a one-time extension of another six months. Disclosure of protected computer data generally requires the proper court warrant. Prompt reporting matters because platforms and financial providers do not keep every record indefinitely. The statutory rules appear in Republic Act No. 10175.

If someone already sent money

The person who transferred the funds should immediately:

Contact the sending bank or e-wallet through its official fraud channel.
Provide the amount, time, recipient account, transaction reference, and scam evidence.
Request investigation, preservation of records, and any available hold, recall, or account-restriction process.
Report to the CICC, PNP, or NBI.
Keep the original device, messages, receipts, and complaint numbers.

Do not pay anyone who promises guaranteed recovery or asks for a “release,” “verification,” or “processing” fee.

If the institution is supervised by the Bangko Sentral ng Pilipinas, complain to the institution first. If the response is unresolved, the complaint may be escalated through the BSP Online Buddy or the alternatives on the BSP Consumer Assistance page. The BSP mechanism addresses complaints involving BSP-supervised institutions; it is not a substitute for a criminal report.

If a lender or collector contacts you

Respond in writing. Do not admit the debt, promise payment, or sign a restructuring agreement merely to stop the calls.

State that:

You did not apply for or authorize the loan;
You did not receive or benefit from the proceeds;
Your identity appears to have been used fraudulently;
You dispute the account and demand suspension of collection against you;
You request copies of the application, contract, identification, selfie or liveness record, device and IP information, disbursement record, and destination account, subject to lawful disclosure; and
You request preservation of all relevant records and correction of any report made under your name.

Ask for the lender’s full corporate name, SEC registration details, certificate of authority to operate as a lending or financing company, office address, privacy officer, and complaint reference number. Verify the entity through official SEC services rather than through links supplied by the collector. Complaints or reports to the SEC may be lodged through its iMessage portal.

A genuine loan agreement requires consent. Under Articles 1311 and 1318 of the Civil Code, contracts generally bind their parties, and no contract exists without the contracting parties’ consent, a certain object, and a cause. A document created by an impostor does not become your voluntary loan merely because it contains your name or photograph. See the Civil Code of the Philippines.

That does not mean an allegation will disappear automatically. The lender may need evidence to separate your identity from the applicant, and forged signatures, compromised accounts, authorized representatives, shared proceeds, or later ratification can materially affect the analysis. Seek a lawyer before signing an admission, compromise, or waiver.

Check whether the fake loan reached your credit record

Obtain your CIC credit report and examine it for unfamiliar accounts or incorrect personal data. If an unauthorized loan appears, notify the reporting institution in writing and file a free dispute through the Credit Information Corporation’s Online Dispute Resolution System.

CIC explains that a consumer must first obtain a credit report before disputing erroneous, misleading, incomplete, or outdated data. CIC then coordinates with the entity that submitted the information; it cannot simply rewrite the lender’s submission on its own. Attach the cybercrime report, identity-theft affidavit, correspondence with the lender, and any evidence showing that the proceeds went elsewhere.

Continue checking later. A fraudulent account may be reported only after the first billing or collection cycle.

When the Data Privacy Act may help

Your photograph, name, contact information, and other information capable of identifying you are personal information. Collecting, copying, publishing, altering, or using them for an unauthorized fraudulent purpose may engage the Data Privacy Act, depending on who processed the information, the circumstances, and the Act’s exclusions.

The Act requires lawful and fair processing for a legitimate purpose and recognizes rights including access, correction, blocking or removal in proper cases, complaint, and damages. It also penalizes specified conduct such as unauthorized processing or processing for unauthorized purposes. Liability is not automatic merely because a photo appeared online; the precise data, actor, purpose, legal basis, and applicable exemptions must be established. See Republic Act No. 10173.

Before filing a formal NPC complaint, ordinarily notify the personal information controller, processor, or concerned entity in writing and allow it to act. Under the current NPC Rules, the exhaustion requirement is generally met if it fails to take timely and appropriate action or does not respond within 15 calendar days. The NPC may waive that requirement for good cause or in specified serious cases, including grave and irreparable harm.

A formal complaint generally must be written, signed, verified, supported by evidence, accompanied by the relevant correspondence and a certification against forum shopping, and subject to the applicable fee unless exempted or waived. Consult the NPC complaint mechanics and the 2021 NPC Rules of Procedure, as amended before filing. An incomplete complaint can be dismissed.

An NPC case is most useful when the respondent is a lender, platform, company, or identifiable person whose data practices or response can be examined. A criminal report remains important when the scammer is unknown.

What offenses may be investigated

The final charge depends on the evidence and is determined by investigators and prosecutors—not by the label placed on a complaint.

Computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another person or entity. Using another person’s identity to operate a fraudulent Facebook account can fall within this provision if its elements are proved.

For offenses under Section 4(b), Section 8 provides prisión mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. Where identity theft has not yet caused damage, the statute prescribes a penalty one degree lower.

Computer-related forgery or fraud

Fabricated electronic loan forms, approvals, IDs, signatures, or account data intended to be treated as authentic may support an investigation for computer-related forgery. Computer-related fraud has narrower statutory elements, including unauthorized input, alteration, or deletion of computer data or interference with a computer system, damage, and fraudulent intent. A deceptive Facebook post alone should not automatically be called computer-related fraud without checking those elements.

Estafa and related offenses

Obtaining money through a fictitious name, false pretenses, or fraudulent representations may constitute estafa under Article 315 of the Revised Penal Code if all required elements are present. Forged documents, unlawfully obtained payment credentials, fraudulent financial accounts, or deceptive phone or text source information may bring other laws into play, including the Access Devices Regulation Act or SIM Registration Act.

The same facts should not be assumed to establish every possible offense. Prosecutors must evaluate the particular acts, participation of each person, evidence of intent, damage, and rules against improper multiple punishment. In Disini v. Secretary of Justice, the Supreme Court upheld the Cybercrime Prevention Act’s computer-related identity-theft provision while ruling on several other challenged provisions. Read the Supreme Court decision.

Common mistakes to avoid

Reporting the profile before saving its URL and contents
Keeping only cropped screenshots with no timestamps or account identifiers
Deleting conversations or resetting the phone used to receive them
Paying the fake lender, collector, or “recovery agent”
Sending additional IDs or selfies to prove innocence through an unverified channel
Publicly accusing a suspected person without reliable evidence
Assuming a barangay blotter alone will trigger platform or subscriber-data preservation
Treating a Facebook takedown as the end of the matter
Ignoring collection notices or a credit-report entry
Signing an acknowledgment, settlement, or waiver without understanding it
Filing an NPC complaint without first documenting the required written notice—or explaining why the requirement should be waived
Expecting investigators to obtain private platform records without the required legal process

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a subpoena, prosecutor’s notice, summons, demand letter, or court papers;
A lender reports the loan under your name or threatens suit;
Your bank or e-wallet has been frozen or linked to the proceeds;
Your genuine Facebook, email, SIM, or financial account was compromised;
The scam uses a forged government ID, signature, video, or voice recording;
Multiple victims have paid substantial amounts;
The operator threatens, extorts, or publishes sensitive or intimate material;
A child’s identity or image is involved;
You know the suspected operator personally and confrontation may create danger;
You are asked to execute an affidavit whose contents you cannot verify; or
Evidence may soon disappear.

For immediate threats to life or physical safety, contact emergency services or the nearest police station rather than waiting for an online response.

FAQ

Am I responsible for repaying the fake loan?

Ordinarily, no—if you neither consented to the loan nor authorized the applicant and did not receive or adopt its benefits. Dispute it immediately and preserve proof. The conclusion can change if documents show authorization, participation, receipt of proceeds, or later ratification.

Is using my Facebook photo automatically a crime?

Not in every context. Lawful sharing, journalism, art, or other legally justified uses may be treated differently. Using your identifying information without right to impersonate you and facilitate a loan scam is far more likely to satisfy identity-theft or related legal elements.

Should I make a notarized affidavit of denial?

It can be useful for lenders, investigators, the CIC, or the NPC, particularly when it gives a precise chronology and identifies attached evidence. Notarization does not prove every statement by itself. Include only facts you personally know and do not use a generic form containing assumptions.

Can Facebook give me the scammer’s IP address or identity?

Usually not through an ordinary user request. Protected subscriber, traffic, or content data generally requires formal law-enforcement and court processes. Give investigators exact URLs, timestamps, and identifiers so they can seek preservation and lawful disclosure.

Should I deal directly with people who paid the scammer?

You may clarify that the account is fake and ask them to preserve evidence, but do not promise reimbursement for money you did not receive or instruct them to alter their statements. Encourage each sender to report the transaction to the financial provider and law enforcement.

Can I file both a cybercrime report and an NPC complaint?

Potentially, yes. They serve different functions: law enforcement investigates criminal conduct, while the NPC addresses violations involving personal-data processing and may order appropriate privacy remedies. Disclose related proceedings where required, including in the NPC certification against forum shopping.

What if the fake account has already disappeared?

Report anyway. Provide saved screenshots, the profile URL or username, dates, messages, witness details, and payment records. A prompt official complaint may allow investigators to pursue preserved records, but retrieval is not assured.

Official references

This article provides general Philippine legal information, not individualized legal advice and not a prediction of any complaint’s outcome. Procedures and online channels can change. Sources and official filing information were checked on September 3, 2026.