Quick answer
If someone creates a fake Facebook, Instagram, TikTok, X, or other social-media account using your name, photos, business identity, contact details, or other identifying information, preserve the evidence first, report the account to the platform, secure any compromised accounts, and report serious impersonation to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division.
Philippine law expressly penalizes computer-related identity theft: the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person. If someone actually broke into your genuine social-media account, the separate offense of illegal access may also be relevant. Other offenses can arise when the impersonation is used to obtain money, make threats, publish defamatory material, falsify documents, or commit another crime. (Lawphil)
A fake account is not automatically proof that computer-related identity theft has been committed. Investigators and prosecutors must still establish the statutory elements, including the intentional use or other prohibited handling of another person's identifying information without right. In Disini v. Secretary of Justice, the Supreme Court upheld the identity-theft provision and recognized names, addresses, contact numbers, birth information, occupation, and similar data as examples of identifying information. (eLibrary)
What Philippine law covers
Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers computer-related identity theft involving identifying information of both individuals and juridical persons such as corporations. This makes the law potentially relevant not only to cloned personal profiles but also to accounts pretending to represent a company, organization, professional practice, or other legal entity. (Lawphil)
The same law separately penalizes illegal access to a computer system. This distinction matters. If an offender merely creates a new profile pretending to be you, the issue may involve identity theft. If the offender obtained your password and entered your real account without authority, illegal access may also be involved. If the offender then uses the account for another crime, additional criminal liability may arise depending on the actual conduct and evidence. Republic Act No. 10175 also provides that crimes under the Revised Penal Code and special laws committed through information and communications technology may fall under its relevant provisions. (Lawphil)
The Supreme Court sustained the constitutionality of computer-related identity theft in Disini. The Court explained that the law addresses the acquisition or use of another person's identifying data without right and rejected the argument that there is a constitutional right to acquire another person's personal data. (eLibrary)
What to do when you discover a fake or impersonating account
Preserve the evidence before trying to have the account removed. Capture the entire profile, not merely the profile picture. Save the exact username or handle, profile URL, displayed name, biography, photographs, posts, comments, messages, advertisements, payment instructions, phone numbers, email addresses, QR codes, bank or e-wallet information, and the date and time you saw them. Where possible, save the original electronic files and URLs instead of relying entirely on cropped screenshots. Philippine law recognizes electronic documents and data messages, but a party presenting electronic evidence may still need to establish its authenticity and reliability. (Lawphil)
Record how the account is impersonating you. Save a copy or screenshot of your genuine profile for comparison. If the impersonator copied your photograph, biography, business logo, professional credentials, posts, or contact details, document each duplication. If relatives, clients, customers, or friends received messages from the fake account, ask them to preserve those messages on their own devices as well.
If your genuine account was hacked, secure it immediately. Change the password, review active sessions and connected devices, remove unknown recovery addresses or phone numbers, enable multi-factor authentication, and secure the email account linked to the social-media account. Do not reuse the compromised password on another service.
Report the fake profile through the platform's official impersonation process. Choose an option such as “impersonation,” “pretending to be someone,” or the closest equivalent. Keep the platform's confirmation email, report number, acknowledgment, or screenshot. Platform takedown and criminal investigation are separate processes: removing the profile may limit further harm, while law enforcement may investigate who operated it. TikTok currently provides an impersonation-report process both through its reporting tools and online procedures, while X provides a dedicated impersonation-report mechanism.
Report potentially criminal impersonation to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Republic Act No. 10175 specifically designates the PNP and NBI as law-enforcement authorities responsible for cybercrime cases. Give investigators the fake account's exact URL and handle, your evidence, details of any financial loss or threats, and the identities of witnesses or recipients of fraudulent messages. (Lawphil)
Tell investigators if evidence may disappear quickly. Under the Cybercrime Prevention Act, service providers are subject to statutory computer-data preservation mechanisms. Traffic data and subscriber information are subject to specified preservation periods, while law-enforcement authorities can order preservation of content data and a one-time extension under the conditions stated in the law. Disclosure of subscriber information, traffic data, or relevant data requires the legal process prescribed by the statute, including a court warrant where required. (Lawphil)
If money, banking credentials, or an e-wallet was involved, contact the financial institution immediately. Tell it that the transaction or communication resulted from impersonation or identity theft, ask what protective measures are available, and preserve the institution's case or reference number. Do not wait for the social-media platform to finish reviewing the fake account before protecting financial accounts.
Consider a National Privacy Commission complaint when there is a genuine Data Privacy Act issue. A person's name, contact details, and other information capable of identifying that person can constitute personal information under Republic Act No. 10173. Whether a particular impersonation incident constitutes a DPA violation depends on who processed the information, why it was processed, applicable exclusions or lawful bases, and the evidence. An NPC proceeding is therefore an additional remedy in appropriate cases, not an automatic substitute for a criminal complaint. (Lawphil)
Where to report cyber identity theft in the Philippines
PNP Anti-Cybercrime Group
The Cybercrime Prevention Act expressly assigns cybercrime law-enforcement functions to the Philippine National Police and the National Bureau of Investigation. The PNP Anti-Cybercrime Group maintains a Cyber Response Unit and regional or local cybercrime offices. Its current official contact page lists the Cyber Response Unit at complaint@acg.pnp.gov.ph, telephone (02) 8723-0401 local 7490, and mobile 0968-878-3561, together with contacts for regional anti-cybercrime units and provincial teams. Because agency contact details can change, confirm them on the official PNP ACG page before filing. (PNP ACG)
You can bring the preserved profile information, screenshots, messages, identification, proof that the genuine identity or account belongs to you, records of financial loss if any, and witness information. Investigators may request additional material depending on the case.
NBI Cybercrime Division
The NBI's current Citizen's Charter states that members of the general public may proceed to its Cybercrime Division to file a complaint or request an investigation. The process includes an initial interview, completion of a sworn complaint sheet, execution or submission of sworn statements or affidavits, collection of supporting documents, and, where relevant, examination of a device connected with the investigation. The Citizen's Charter lists no fee for this investigative assistance. It also recognizes Cybercrime Regional Centers for appropriate cases. (National Bureau of Investigation)
Do not assume that you must already know the real name of the fake account's operator before seeking help. Give investigators every identifier you have. Identifying the person behind an account may require evidence held by a platform or telecommunications provider and legal processes available to law enforcement.
Cybercrime Investigation and Coordinating Center
The Cybercrime Investigation and Coordinating Center can also receive reports and provide cybercrime-related assistance and coordination. Its government materials currently identify 1326 as a reporting hotline and report@cicc.gov.ph as a reporting email, with additional mobile numbers published by the agency. CICC materials encourage victims of online scams to report promptly. (CICC)
CICC should not be confused with the statutory law-enforcement roles of the PNP and NBI. Republic Act No. 10175 gives CICC coordinating, monitoring, assistance, and cybercrime-prevention functions, while Section 10 specifically identifies the NBI and PNP as the law-enforcement authorities for the Act. (Lawphil)
Why preserving the account URL matters
A screenshot showing a person's photograph and display name can be useful, but an investigator may need much more. Usernames can change, profiles can disappear, posts can be deleted, and copied images can be reused across several accounts. Saving the direct profile URL, post URLs, timestamps, messages, and other identifiers gives investigators a clearer starting point.
Electronic evidence is not excluded merely because it exists in electronic form. Republic Act No. 8792 recognizes electronic documents and data messages and expressly addresses their evidentiary effect, authentication, integrity, and retention. For that reason, keeping complete, unaltered copies is generally preferable to repeatedly editing, annotating, or cropping the only copy of the material you possess. (Lawphil)
If possible, retain the device on which important messages were received. Do not factory-reset it, erase the conversation, uninstall relevant applications, or destroy files before discussing preservation with the investigator handling a serious case.
Can the authorities obtain the identity behind a fake account?
Potentially, but a victim normally cannot compel a social-media company to hand over private subscriber records personally.
Republic Act No. 10175 contains procedures governing preservation and disclosure of computer data. Subscriber information and traffic or other relevant data may be obtained through the legal mechanisms prescribed by the Act. Section 14 provides for disclosure pursuant to a court warrant and an official investigation; once the required order is received, the statute directs the person or service provider concerned to submit the covered information within seventy-two hours. That 72-hour period is not a deadline for the victim to file a complaint. It concerns compliance with a qualifying law-enforcement disclosure order. (Lawphil)
This is one reason prompt reporting can matter. Instead of attempting to trace an IP address yourself or paying an unknown “hacker” to identify the offender, provide law enforcement with the account identifiers and ask whether preservation or other lawful investigative measures are appropriate.
When a National Privacy Commission complaint may help
The Data Privacy Act defines personal information broadly enough to include recorded information from which an individual's identity is apparent or can reasonably and directly be ascertained, or which can identify the individual when combined with other information. Unauthorized use of someone's personal data in an impersonation scheme can therefore raise privacy issues in an appropriate case, although the facts and statutory scope still have to be examined. (Lawphil)
The NPC's present procedure generally requires a complainant first to inform the respondent or concerned entity in writing about the alleged privacy violation and give it an opportunity to act. If no timely or appropriate action is taken, or no response is received within fifteen calendar days, the exhaustion requirement may be satisfied. The NPC may waive this requirement for good cause or serious violations in circumstances recognized by its rules. (Privacy Commission)
The NPC's 2021 Rules of Procedure were amended in 2024. Its current complaint guidance requires a notarized complaint-assisted form or verified complaint with supporting evidence, and the NPC announced a new Complaint-Affidavit template effective July 1, 2025. A complaint can be dismissed where it is insufficient in form or evidence, outside the DPA's scope, or where parties cannot be identified or traced despite diligent efforts. (Privacy Commission)
If contacting the impersonator directly would be dangerous, could worsen harassment, or might cause important evidence to disappear, obtain legal advice before doing so merely for purposes of NPC exhaustion. The NPC rules expressly contemplate justified exceptions rather than requiring a victim to expose himself or herself to needless risk. (Privacy Commission)
Common mistakes that can weaken a complaint
Reporting the account before saving anything. A successful platform report can cause the profile or material to disappear. Preserve the relevant evidence first unless immediate removal is necessary to prevent serious ongoing harm.
Saving only a cropped screenshot. A photograph of a fake profile may prove that something appeared on a screen, but the profile URL, handle, dates, messages, account identifiers, and surrounding context can be equally important.
Deleting embarrassing or upsetting conversations. Threatening, fraudulent, or impersonating messages may become important evidence. Preserve them even if you do not want to keep looking at them.
Arguing extensively with the impersonator. Confrontation can warn the operator that a complaint is coming, cause evidence to be deleted, or create additional messages that complicate the factual record. Preserve the material and allow investigators to advise you, particularly where threats, extortion, or financial fraud are involved.
Assuming the platform report is already a criminal case. A social-media company's moderation process determines whether content violates the platform's own rules. A Philippine criminal investigation is a separate governmental process.
Paying someone online to “trace” or hack the account. Unauthorized access is itself regulated by the Cybercrime Prevention Act. Do not respond to one suspected cybercrime by commissioning another potentially unlawful intrusion. (Lawphil)
When help is urgent
Seek law-enforcement assistance promptly if the fake account is soliciting money from your relatives, customers, or clients; obtaining copies of IDs or financial information; threatening violence; extorting you; publishing private or intimate material; targeting a child; using your identity for contracts or financial transactions; or continuing to harm people despite platform reports.
If someone has already transferred money, notify the bank, e-wallet, card issuer, or other payment provider immediately as well. If an offender is making a demand and proposing an in-person meeting or payment, do not independently organize an entrapment operation. Contact the PNP or NBI and follow investigators' instructions.
There is no general rule that you should wait for the platform to decide your report before approaching law enforcement. Serious suspected criminal conduct can be reported while the platform complaint is still pending.
Frequently asked questions
Is creating a fake Facebook account automatically identity theft?
Not necessarily. The statutory offense requires intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another's identifying information without right. Whether a particular profile satisfies those elements depends on what information was used, how it was used, the circumstances, and the available evidence. (Lawphil)
What if the fake account has not successfully scammed anyone yet?
Lack of completed financial loss does not necessarily mean there can be no computer-related identity-theft case. Section 4(b)(3) itself addresses situations in which no damage has yet been caused and provides for a lower penalty in that circumstance. Whether a prosecutable offense exists still depends on proof of the statutory elements. (Lawphil)
What if someone hacked my real Facebook or Instagram account instead of creating a clone?
Unauthorized access to your genuine account may implicate the illegal-access provision of Republic Act No. 10175. Secure the account, preserve login alerts and security emails, record unauthorized changes and messages, and report the incident to the platform and, where warranted, cybercrime investigators. (Lawphil)
Can I report an account even if I do not know who created it?
Yes, you can bring the known facts and electronic identifiers to the PNP ACG or NBI Cybercrime Division. The identity of an anonymous account operator may itself be one of the matters requiring investigation. Private subscriber or platform information must be obtained through the appropriate lawful process rather than by the victim simply demanding access to it. (Lawphil)
Should I report to both the PNP and the NBI?
Republic Act No. 10175 recognizes both as cybercrime law-enforcement authorities. It is generally more important to make a complete, prompt report to an appropriate investigating unit than to duplicate the same complaint unnecessarily. If there is already an assigned investigator or formally docketed case, tell any other agency you approach about it. (Lawphil)
Is a screenshot enough?
It can be useful evidence, but do not assume it will always be sufficient by itself. Electronic evidence may require authentication, and the reliability, integrity, origin, storage, and surrounding circumstances can affect evidentiary weight. Preserve URLs, messages, dates, account identifiers, original files, and the device containing important communications whenever practicable. (Lawphil)
Can I ask Facebook, TikTok, or X to remove the account even while a criminal complaint is pending?
Yes. Platform moderation and Philippine criminal investigation perform different functions. Preserve the evidence first when practicable, then use the platform's official impersonation-reporting mechanism. TikTok and X, for example, maintain specific impersonation reporting processes.
Does the Data Privacy Act always apply to fake accounts?
No. Use of personal information can raise Data Privacy Act issues, but NPC jurisdiction and liability depend on the facts, the persons involved, the nature and purpose of the processing, statutory exclusions, and compliance with the DPA's substantive and procedural requirements. A fake-account complaint should therefore not be labeled automatically as a DPA violation without examining the evidence. (Lawphil)
Official sources and reporting resources
Cybercrime Prevention Act of 2012 — Republic Act No. 10175 (Lawphil)
Supreme Court decision in Disini v. Secretary of Justice
PNP Anti-Cybercrime Group — official contact directory
NBI — Investigative Assistance for Victims of Computer Crimes
Cybercrime Investigation and Coordinating Center
National Privacy Commission — File a Complaint
Data Privacy Act of 2012 — Republic Act No. 10173
Electronic Commerce Act — Republic Act No. 8792
TikTok — Report an impersonation account
X Help — Report impersonation accounts
General-information disclaimer
This article provides general Philippine legal information and is not a substitute for advice from a lawyer who has reviewed the actual account, messages, electronic evidence, financial records, and other circumstances of a particular case. Cybercrime, platform, privacy, and evidence issues are highly fact-dependent, and additional laws may apply when impersonation involves fraud, threats, intimate material, children, defamatory publications, falsified documents, or financial accounts.
Law and official-source check: August 25, 2026.