Quick answer

If someone is using your name, photos, business identity, or personal details in a fake social media account:

Preserve the evidence before the account disappears. Save the exact profile URL, username, screenshots, posts, messages, transaction records, and dates.
Report the account through the platform’s impersonation process.
Secure your real accounts, email, mobile number, and financial accounts.
Report suspected criminal identity theft to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. The CICC Cybercrime Complaint Center may also route an incident through hotline 1326 or its online reporting channel.
If money was transferred, contact the bank or e-wallet immediately. Do not wait for the platform or police report before notifying the financial institution.

A fake account is not automatically a crime. Philippine computer-related identity theft generally requires the intentional acquisition or use of another person’s identifying information, without right, for an illegitimate purpose. The account’s contents, conduct, purpose, and resulting harm will matter.

Reporting to a platform may lead to removal, while reporting to law enforcement may lead to identification and prosecution. One does not replace the other.

When a fake account may amount to identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, without right.

Identifying information may include a person’s name, address, contact number, date and place of birth, occupation, family details, photographs, account credentials, and similar information. In Disini v. Secretary of Justice, the Supreme Court upheld the identity-theft provision and explained that the theft of identifying information must be for an illegitimate purpose. Merely acquiring information that a user made public for a legitimate purpose is not, by itself, the identity theft the law seeks to punish. Read the Supreme Court decision.

Indicators of potentially criminal impersonation include an account that:

Pretends to be you or your business and communicates as though it were genuinely yours;
Solicits money, investments, donations, loans, romantic attention, passwords, one-time PINs, or identity documents in your name;
Uses your identity to open or access financial, shopping, telecommunications, or other accounts;
Sends threats, harasses people, or publishes damaging statements while posing as you;
Uses your identity to create false documents, contracts, listings, advertisements, or transaction records;
Publishes your private information or sexual material without authority; or
Creates confusion deliberately to damage your reputation, employment, relationships, or business.

By contrast, the use of the same name, a pseudonym, or a clearly disclosed parody or fan account is not automatically identity theft. The decisive questions include whether the account is deceptively presenting itself as you, whether your identifying information was used without right, and whether the purpose was illegitimate.

The base penalty for computer-related identity theft under Sections 4(b)(3) and 8 of Republic Act No. 10175 is prision mayor, which runs from six years and one day to twelve years, or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The law provides for a penalty one degree lower when no damage has yet been caused. The precise charge and penalty remain for prosecutors and courts to determine from the evidence.

Preserve evidence before reporting the account

Takedown is useful, but it can also make evidence harder to retrieve. Capture the account before blocking it or asking others to report it.

Preserve:

The complete profile URL—not only the displayed name;
The exact username or handle, including capitalization and punctuation;
Screenshots showing the whole screen, account name, profile photo, URL where visible, date, and time;
A screen recording that opens the profile and scrolls through its posts, photos, followers, and account information;
Every post, story, advertisement, comment, or message relevant to the impersonation;
Message headers, email addresses, mobile numbers, QR codes, payment links, bank or e-wallet account details, and transaction reference numbers;
The date and time when you and other witnesses first saw each item;
Messages from people who were deceived, together with their names and contact details;
Platform acknowledgments, case numbers, and responses;
Proof that the identity is yours, such as your genuine profile history or business registration, while keeping unnecessary ID details out of public copies; and
Evidence of harm, including unauthorized transactions, customer complaints, lost work, threats, medical or counseling records, or expenses reasonably connected with the incident.

Keep the original files and device. Make working copies instead of editing, annotating, or repeatedly resaving the originals. Philippine rules place the burden of authenticating a private electronic document on the party offering it, so screenshots are more useful when a witness can explain when and how they were captured and when their integrity can be shown. See the Supreme Court’s Rules on Electronic Evidence.

Do not hack the fake account, install tracking software, secretly intercept private communications, or impersonate the impersonator. Those acts may create separate legal problems and can compromise the investigation.

Report the account to the social media platform

Open the fake profile, select its report menu, and choose impersonation, pretending to be someone, or the closest available category. Report individual scam posts, advertisements, threats, or intimate images separately when the platform provides distinct reporting options.

Use the platform’s official form:

Platform	Official impersonation channel
Facebook	Report a profile or Page pretending to be you or use the impostor-account form
Instagram or Threads	Report an impersonation account
TikTok	Report an impersonation account
X	Report impersonation

For other services, use the Help or Safety Center linked from the platform’s own website or app. Avoid “account recovery agents” who ask for payment, passwords, OTPs, or copies of IDs through private messages.

When a platform asks for identification:

Upload it only through the platform’s official HTTPS form;
Cover information the form does not require, if the platform permits;
Do not post the ID publicly or send it to the fake account; and
Save the report confirmation and reference number.

A platform report does not guarantee immediate removal. It also does not ordinarily require the platform to disclose the operator’s identity directly to you.

Secure your real accounts

Even if the fake account is separate from your real one, assume the impersonator may have collected information for account takeover.

Immediately:

Change the password of the email account connected to your social media;
Use new, unique passwords for important accounts;
Enable multi-factor authentication, preferably through an authenticator app or another secure method available to you;
Review active sessions and sign out unfamiliar devices;
Remove unknown recovery addresses, phone numbers, apps, and browser extensions;
Check whether forwarding rules were added to your email;
Ask your mobile provider about unexplained loss of signal or suspected SIM replacement;
Review privacy, tagging, mention, and messaging settings; and
Warn close contacts through a channel they already recognize.

If your genuine account was taken over, use the platform’s hacked or compromised account recovery process. An account takeover is different from a separate duplicate profile and should be reported under the correct category.

File a cybercrime report in the Philippines

Republic Act No. 10175 designates the PNP and NBI as the principal law-enforcement authorities for cybercrime.

PNP Anti-Cybercrime Group

Report to the PNP Anti-Cybercrime Group or the appropriate regional cybercrime unit. If there is an immediate threat, go to the nearest police station or call 911.

National Bureau of Investigation

You may begin through the NBI’s official online complaint page or proceed to the NBI Cybercrime Division or a regional or district office. The NBI Citizens’ Charter states that complainants may be interviewed, asked to execute sworn statements, submit supporting documents, and present a relevant device for examination. See the NBI procedure for computer-crime victims.

CICC Cybercrime Complaint Center

For incident reporting and inter-agency routing, use the CICC online report page or hotline 1326. If either channel is unavailable, report directly to the PNP or NBI.

What to bring or submit

Prepare an organized evidence packet containing:

A short chronological account of what happened;
Your government-issued ID;
The fake account’s profile URL and handle;
Printed and electronic copies of screenshots and screen recordings;
Original message files or access to the device containing them;
Names and contact information of witnesses or persons deceived;
Transaction receipts and financial-institution reference numbers;
Copies of platform, bank, employer, school, or agency reports;
Proof that the real identity, business, photograph, or account belongs to you; and
A list of the specific harm, threats, or losses caused.

State facts you personally know and identify information that came from someone else. Do not name a suspected offender as a certainty unless you have reliable evidence. An initial online report may still require personal appearance, identity verification, a sworn complaint or affidavit, and device examination before a formal investigation proceeds.

You may report even when you do not know who operates the account. Investigators may seek preservation and disclosure of subscriber or traffic data through the legal processes under Republic Act No. 10175 and the Supreme Court’s cybercrime-warrant rules. A private complainant generally cannot compel a platform to reveal subscriber information without the appropriate law-enforcement and court process.

Ask investigators about prompt data preservation

Time matters even when the fake profile remains visible.

Under Section 13 of Republic Act No. 10175, service providers must preserve the integrity of traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, and law enforcement may order one additional six-month extension. Disclosure of protected computer data generally requires a court warrant.

The six-month period is an evidence-preservation rule, not a universal deadline for filing every possible criminal complaint. Nevertheless, report promptly and ask the assigned investigator whether a preservation order should be issued. Do not send the platform a document falsely presented as a law-enforcement or court order.

If money was sent or a financial account was compromised

Contact the sending bank, receiving bank if known, credit-card issuer, or e-wallet through its official fraud channel immediately. Give the transaction reference, amount, date, receiving account, and police or CICC reference number when available.

The Anti-Financial Account Scamming Act and BSP implementing rules require account owners to report disputed transactions immediately. Under the current rules:

A financial institution may initially hold identifiable disputed funds for up to five calendar days;
The hold may be extended by up to 25 additional calendar days when the requirements are met; and
The customer may be required to submit a sworn complaint, affidavit, police report, or other supporting document within the initial holding period.

A hold is not automatic, and it does not guarantee recovery. Funds may already have been withdrawn or moved outside the participating financial system. Submit truthful information: maliciously filing completely unwarranted or false information that causes funds to be held is itself punishable under the law.

If the institution does not resolve your complaint, use the Bangko Sentral ng Pilipinas’ Consumer Assistance Mechanism. The BSP complaint process generally expects proof that the concern was first raised with the financial institution.

If an identification document was stolen or copied, notify the issuing agency and ask about replacement, cancellation, or an account alert. There is no single Philippine procedure covering every type of ID.

When the National Privacy Commission may help

A complaint to the National Privacy Commission may be appropriate when personal information was unlawfully processed, disclosed, or misused by a company, employer, lender, seller, public office, platform, or another person or entity covered by the Data Privacy Act.

The NPC route is fact-dependent and is not a substitute for a police or NBI report. A purely personal or household activity may fall within a statutory exclusion, while the same conduct may remain punishable under other laws.

Under the NPC Rules of Procedure, as amended, the complainant ordinarily must first:

Inform the respondent or concerned entity in writing of the privacy violation;
Give it an opportunity to take appropriate action; and
Show that it failed to act appropriately or did not respond within 15 calendar days of receiving the notice.

The NPC may waive this exhaustion requirement for good cause or serious cases, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct.

Use the NPC’s current complaint instructions and form. A formal complaint generally must be verified, use the prescribed format, identify the respondent or provide available leads, describe the facts and requested relief, and include supporting documents, witness affidavits, correspondence, and a certification against forum shopping. Filing fees may apply unless an exemption or waiver is available. Check the NPC complaint mechanics before submission because forms, fees, addresses, and authorized electronic channels can change.

Other laws may apply

The proper charge depends on what the fake account actually did. Identity theft may overlap with, or be accompanied by, offenses involving fraud, forgery, illegal access, threats, coercion, libel, sexual harassment, intimate images, financial accounts, or child exploitation.

A particularly important exception is gender-based online sexual harassment. Section 12 of the Safe Spaces Act, Republic Act No. 11313, covers qualifying online conduct such as sexual or gender-based threats, cyberstalking, nonconsensual sharing, and impersonating a victim online or posting lies to harm the victim’s reputation. The PNP Anti-Cybercrime Group receives complaints under this provision. The statutory offense under Section 12 is imprescriptible, but victims should still report immediately to preserve evidence and obtain protection.

If a fake account publishes defamatory material, consult counsel promptly. In its April 8, 2026 ruling in Causin v. People, the Supreme Court held that cyber libel prescribes in one year. Liability is also not automatically imposed on everyone who merely receives or reacts to a post; Disini sustained the cyber-libel provision as to the original author. Read the 2026 Supreme Court decision.

Common mistakes to avoid

Reporting or blocking the profile before preserving its URL and contents;
Saving only a cropped screenshot with no handle, URL, date, or context;
Assuming that the use of your name or photo alone proves every element of identity theft;
Paying the impersonator to remove the account;
Negotiating with an extortionist without police guidance;
Publicly accusing a suspected person without reliable evidence;
Hacking, tracking, or creating another fake account to retaliate;
Forwarding private or intimate material more widely in an attempt to gather support;
Sending IDs, passwords, OTPs, or payment to unofficial “recovery agents”;
Filing a copyright report for a photograph you do not own—being pictured in a photo does not necessarily make you its copyright owner;
Assuming a platform report automatically creates a criminal case; or
Assuming a police report automatically compels the platform to remove the account.

When help is urgent

Seek immediate police assistance or call 911 when there is:

A credible threat of violence, kidnapping, suicide, or physical stalking;
Publication of your home address or real-time location with threats;
Sexual extortion or demands for money in exchange for not publishing intimate material;
Sexual material involving a child or an immediate risk to a minor;
Ongoing unauthorized bank, credit-card, or e-wallet transactions;
Use of your identity to open accounts, obtain loans, register SIMs, or transact with government agencies;
A rapidly spreading scam victimizing customers, relatives, or co-workers; or
A deadline-sensitive claim such as possible cyber libel.

Do not download, reproduce, or circulate suspected child sexual-abuse material. Preserve the URL and surrounding information without redistributing the content, and report it immediately.

A lawyer is especially useful when you need an urgent court order, the impersonator is known, several offenses or jurisdictions are involved, the account is operated from abroad, a business is suffering continuing losses, or law enforcement needs a properly supported request for platform data.

Frequently asked questions

Can I report a fake account if I do not know who created it?

Yes. Provide the profile URL, username, messages, payment details, and every available lead. The operator’s identity may be investigated through platform records and lawful disclosure procedures.

Will the platform tell me who owns the account?

Usually not through an ordinary user report. Subscriber and traffic information may be protected and generally requires proper law-enforcement and court processes.

Do I need a lawyer to make a report?

No lawyer is ordinarily required for an initial platform, PNP, NBI, CICC, bank, or e-wallet report. Legal help becomes valuable if a complaint-affidavit is contested, urgent court relief is needed, or several possible laws apply.

Can I file reports with both law enforcement and the NPC?

Yes, when the facts support both criminal and data-privacy concerns. The proceedings serve different purposes. Disclose related cases accurately, particularly in an NPC certification against forum shopping.

Will reporting automatically remove the fake account?

No. The platform evaluates the report under its policies. A law-enforcement complaint also does not by itself order removal. The Supreme Court declared unconstitutional the former authority in Section 19 of Republic Act No. 10175 for the DOJ to block suspected computer data without the required judicial safeguards.

What if the fake account is operated outside the Philippines?

Report it locally. Republic Act No. 10175 can apply where a relevant element occurred in the Philippines, a covered computer system is situated here, or damage was caused to a person in the Philippines. Identification and enforcement may take longer when foreign providers or operators are involved.

Can I report for a child, parent, employee, or business?

A parent or guardian may act for a minor, and an authorized representative may report for a person or organization where the platform or agency permits it. Bring proof of relationship or authority. Investigators may still require statements from the victim and witnesses with personal knowledge.

Official references

This article provides general legal information, not advice for a particular case. Outcomes depend on the account’s contents, purpose, evidence, parties, and applicable procedures. Official sources and reporting channels were checked as of August 24, 2026.