Quick answer

If someone steals your online identity or creates an account pretending to be you:

Preserve the evidence before the account or posts disappear.
Report the profile and each harmful post or message to the platform.
Secure your email, social media, mobile number, bank, and e-wallet accounts.
Report suspected criminal impersonation, fraud, account takeover, threats, or extortion to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
If personal information was unlawfully used, send the responsible person or platform a written privacy complaint, then consider a formal complaint with the National Privacy Commission.
If money or financial credentials are involved, contact the bank or e-wallet immediately—before waiting for a police investigation.

A platform report can remove an account, but it does not automatically start a criminal case. Conversely, a police blotter or hotline report does not guarantee immediate takedown. Use both routes when appropriate.

When a fake account may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

A fake social media account may fall within this offense when, for example, it deliberately uses your name, photographs, business identity, contact information, or credentials for an illegitimate purpose such as:

Deceiving people into believing they are communicating with you
Soliciting money, loans, investments, personal data, passwords, or one-time PINs
Damaging your reputation through statements falsely attributed to you
Taking over your genuine account or posing as your business
Harassing, threatening, blackmailing, or sexually exploiting you or another person

However, not every duplicate name, parody, fan account, anonymous account, or use of publicly available information is automatically criminal identity theft. In Disini v. Secretary of Justice, the Supreme Court explained that identity information must be taken or used for an illegitimate purpose and that merely acquiring and disseminating information the user made public is not, by itself, identity theft. The account’s presentation, intent, conduct, and surrounding evidence matter.

Platform rules may still prohibit misleading impersonation even when the available facts are insufficient to establish a crime.

For computer-related identity theft that has caused damage, the Cybercrime Prevention Act prescribes

Quick answer

If someone is using your name, photos, documents, or account to impersonate you, preserve the evidence first, report the profile through the social-media platform, secure your real accounts, and report suspected crime to the PNP or NBI. If money or a financial account is involved, contact the bank or e-wallet immediately. If your personal data was unlawfully processed, you may also pursue a complaint before the National Privacy Commission (NPC).

A fake account is not automatically a crime simply because it uses a similar name or republishes public information. Under the Cybercrime Prevention Act of 2012, computer-related identity theft involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right. The Supreme Court has explained that the information must be taken or used for an illegitimate purpose; merely acquiring and sharing information that the person made public is not, by itself, identity theft. Whether a particular account crosses the line depends on its content, purpose, representations, and conduct. Disini v. Secretary of Justice

Platform removal and criminal liability are separate questions. A platform may remove deceptive impersonation even when the available evidence is not yet sufficient for a criminal case.

What to do immediately

1. Preserve the account before reporting or blocking it

Fake profiles can disappear or change quickly. Before taking action, save:

The complete profile URL, username, display name, profile photo, biography, and visible account-identification details.
Screenshots and, if practical, a screen recording showing how you reached the profile from the platform.
Each offending post, story, advertisement, comment, message, or marketplace listing, including its URL and visible date and time.
Messages sent to your relatives, customers, employer, or contacts.
Payment instructions, QR codes, bank or e-wallet details, receipts, reference numbers, and delivery information.
Emails connected with the incident, including the complete message and available header information.
Notices about password changes, unfamiliar logins, recovery requests, or new devices.
Names and contact details of witnesses or recipients who can describe what they received.
Proof of harm, such as rejected transactions, customer complaints, lost sales, account charges, threats, or demands for money.

Keep the original files. Do not crop, annotate, edit, or repeatedly resave your only copy. Record the date, time, and time zone when you captured the evidence. Save a backup in a secure location.

Screenshots are useful, but they are stronger when supported by URLs, original messages, account records, witnesses, and the device on which the content was received.

2. Secure your genuine accounts

If your real account or email may have been compromised:

Change the password using a trusted device.
Sign out unknown devices and active sessions.
Turn on multi-factor authentication.
Check whether the recovery email, mobile number, or linked accounts were changed.
Secure the email account connected to your social-media and financial accounts.
Remove unfamiliar applications and revoke suspicious third-party access.
Contact your mobile provider if your SIM suddenly stopped working or you suspect an unauthorized SIM replacement.
Do not factory-reset or discard a relevant device before preserving evidence or speaking with an investigator.

If an attacker still has access to money or sensitive information, securing the account takes priority over collecting perfect screenshots.

3. Report the profile and each harmful item to the platform

Use the platform’s impersonation route, not only its general spam option. Report individual scam posts, messages, threats, or intimate images separately when the platform provides different categories.

Official reporting pages include:

Platform	Official reporting route
Facebook	Report a profile or Page pretending to be someone
Instagram or Threads	Report an impersonation account
TikTok	Report an impersonation account
X	Report impersonation

Keep the report confirmation, case number, emails, and the date of every follow-up. If the form requires identification, submit it only through the platform’s verified help page and provide only what its instructions require. Never post an unredacted government ID publicly.

A concise report should identify:

Your genuine account.
The impersonating account.
The information or images copied.
The false representation being made.
Any fraud, threats, solicitations, or messages sent to others.
The action requested, such as removal of the account and preservation of relevant records.

4. Warn people without amplifying the harm

A brief notice from your genuine account can say that the identified account is unauthorized and that people should not send money, disclose passwords or one-time PINs, or transact with it.

Avoid publishing unverified accusations about who operates the account. Do not repost intimate images, private documents, or long collections of defamatory material. Send important evidence privately to investigators.

Where to report suspected identity theft

Philippine National Police

You may report the incident to the nearest police station or seek assistance from the PNP Anti-Cybercrime Group. Explain that the matter involves online impersonation or possible computer-related identity theft and ask that your evidence and chronology be referred to the appropriate cybercrime investigator.

A police blotter creates an official incident record, but it is not necessarily the same as a completed criminal complaint. Ask what additional sworn statement, affidavit, or evidence is required and obtain the report or reference number.

National Bureau of Investigation

The NBI Cybercrime Division accepts requests for investigation from the general public. Its official procedure includes a preliminary interview, a sworn complaint sheet or affidavit, collection of supporting documents, witness statements, and—when relevant—examination of a device. The listed service has no investigation-assistance fee. See the NBI procedure for victims of computer crimes and the NBI office directory.

The NBI directory lists the Cybercrime Division at ccd@nbi.gov.ph. An email or online submission may begin the contact process, but investigators may still require a personal appearance and sworn documents.

CICC cybercrime reporting

The Cybercrime Investigation and Coordinating Center provides an inter-agency reporting and referral channel through Hotline 1326 and its official reporting page. A CICC report can help route or coordinate the matter, but follow any instruction to execute a sworn complaint before the PNP, NBI, or prosecution office.

What to bring

Prepare:

At least one valid ID.
A one- or two-page chronological account of what happened.
The first date you discovered the account.
The fake account’s URLs and usernames.
Copies of screenshots, recordings, messages, and report confirmations.
Your genuine profile URL and proof that the copied identity belongs to you.
Names and contact details of witnesses or people solicited by the impersonator.
Proof of financial or reputational harm.
The relevant phone or computer, if an investigator asks to examine it.

Number your attachments and refer to them in your chronology. State only facts you personally know. If the operator is unknown, identify the respondent as unknown and provide the account details; do not guess.

Why prompt reporting matters

Under Section 13 of the Cybercrime Prevention Act, service providers must preserve traffic data and subscriber information for at least six months from the relevant transaction. Content data can be preserved for six months after an authorized law-enforcement preservation order, with a possible one-time extension.

That does not mean every post or account will remain publicly available for six months. Platform retention practices and deletion events vary. Report promptly so investigators can consider lawful preservation measures before relevant records disappear. Private users cannot compel a platform to disclose confidential subscriber information; law enforcement generally must use the procedures and warrants required by law.

The Act does not establish one universal victim-reporting deadline for every fake-account incident. Criminal prescription depends on the particular offense and facts, so delay is risky even when evidence remains online.

If money, a bank account, or an e-wallet is involved

Contact the financial institution through its official hotline or in-app support immediately. Ask it to:

Lock or secure the compromised account.
Record the transaction as disputed.
Trace the recipient account.
Preserve transaction and access records.
Begin coordinated verification under applicable rules.
Give you a complaint or reference number.

Under the Anti-Financial Account Scamming Act and BSP Circular No. 1215, covered financial institutions may temporarily hold disputed electronic-transfer funds for up to 30 calendar days, unless a competent court extends the period. A hold or report does not guarantee recovery, especially if the funds have already left the covered financial system.

Complain first through the bank’s or e-wallet’s consumer-assistance channel. If its response is unresolved or inadequate, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form.

Never give an OTP, PIN, password, or remote access to someone claiming that these are needed to reverse the transaction.

When to complain to the National Privacy Commission

An NPC complaint may be appropriate when a person, company, or platform unlawfully collected, used, disclosed, retained, or refused to remove your personal information. The Data Privacy Act of 2012 gives data subjects rights that may include correction and, upon the conditions stated in the law, blocking, removal, or destruction of personal information that is false, unlawfully obtained, or used for unauthorized purposes.

An NPC complaint is not automatically proper for every offensive or anonymous account. It must involve personal-data processing or a violation of a data-subject right.

Before filing, the current 2021 NPC Rules of Procedure generally require proof that:

You informed the personal information controller, processor, or concerned entity in writing about the privacy violation; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive this exhaustion requirement in specified circumstances, including properly established good cause or a serious privacy violation. Do not assume an exception applies without supporting facts.

The current rules do not carry forward the six-month filing period found in the NPC’s repealed 2016 procedure. Nevertheless, file promptly and obtain advice if prescription or another deadline may be an issue.

The NPC’s formal complaint instructions require the prescribed written form to be completed and notarized. It may be submitted in person, by courier, or as a scanned copy through complaints@privacy.gov.ph. The current basic filing fee is ₱500, with additional fees for certain damage claims under NPC Circular No. 2023-01.

A platform complaint, an NPC case, and a criminal complaint serve different purposes. Depending on the evidence, more than one route may be appropriate.

What laws may apply

The exact charge must be based on the evidence. Possible laws include:

Computer-related identity theft: intentional use or misuse, without right, of identifying information belonging to another for an illegitimate purpose.
Illegal access: unauthorized access to another person’s account or computer system.
Computer-related fraud or forgery: manipulation or use of computer data as part of a fraudulent or dishonest design.
Cyberlibel: defamatory online publication that satisfies the legal elements of libel.
Financial-account scamming: social-engineering schemes, money-mule activity, or use of another person’s identity or identification documents in financial accounts.
Gender-based online sexual harassment: certain online impersonation, threats, cyberstalking, non-consensual sharing, or reputation-harming conduct covered by the Safe Spaces Act.
Photo or video voyeurism: prohibited recording, copying, or distribution of covered sexual images under Republic Act No. 9995.
Child online sexual abuse or exploitation: conduct involving a child covered by Republic Act No. 11930.

Computer-related identity theft that has caused damage is punishable under Section 8 of Republic Act No. 10175 by prisión mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet occurred, the law provides for a penalty one degree lower. An accusation alone does not establish liability; guilt and the applicable penalty are determined through the criminal process.

Common mistakes to avoid

Reporting the profile before saving its URL and content.
Saving only cropped screenshots that omit the username, time, or surrounding context.
Publicly posting an unredacted ID to prove your identity.
Paying an impersonator or sextortionist in exchange for promised deletion.
Giving an OTP or password to someone claiming to be an investigator or platform employee.
Hacking, logging into, or trying to trace the fake account yourself.
Threatening the suspected operator or arranging an entrapment without law-enforcement guidance.
Naming a suspected person publicly without reliable evidence.
Assuming a platform report automatically starts a criminal case.
Waiting for the account to cause financial loss before reporting it.
Deleting messages, resetting the device, or closing compromised accounts before preserving necessary records.
Filing an NPC complaint without first making and documenting the required written privacy request, unless a recognized exception can be established.

When help is urgent

Call 911 or go to the nearest police station immediately if the account is connected to a credible threat, stalking, planned physical contact, kidnapping, extortion, or immediate danger.

Contact the bank or e-wallet immediately if money is moving or an account has been taken over. Do not wait for the platform to remove the profile first.

If a child is being impersonated, groomed, sexualized, threatened, or used in sexual material, report immediately to law enforcement and the Makabata Helpline 1383, which handles child-rights concerns and referrals. See the DSWD guidance on Helpline 1383.

Seek a Philippine lawyer promptly when:

The impersonation involves substantial financial or business loss.
Intimate images, blackmail, or repeated threats are involved.
The suspected operator is known and you are considering criminal or civil proceedings.
A platform refuses removal despite clear proof.
Evidence or account records may soon be deleted.
You need a preservation request, injunction, damages claim, or formal complaint-affidavit.
The suspected operator or platform is outside the Philippines.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Provide the account URL, username, messages, payment details, and other identifiers. Law enforcement can evaluate whether lawful preservation and disclosure procedures are available. Do not accuse a particular person merely because you suspect them.

Do I need a lawyer to make the initial report?

Generally, no. You may make an initial report personally to the PNP, NBI, CICC, platform, or your financial institution. A lawyer can be important when preparing a formal complaint-affidavit, identifying the correct offenses or respondents, or seeking urgent court relief.

Is a screenshot enough?

It may support a report, but it is not always sufficient by itself. Preserve the URL, original messages, full context, dates, witness information, report confirmations, and relevant devices.

Can the platform tell me who owns the fake account?

Platforms ordinarily do not disclose private subscriber information directly to another user. Investigators may seek records using the warrants and disclosure procedures required by Philippine law.

Should I ask all my friends to mass-report the account?

People who genuinely received deceptive messages may submit accurate reports and preserve what they received. Avoid coordinated false or exaggerated reports. A detailed report from the person impersonated, supported by evidence, is more useful than unsupported volume.

What if the person operating the account is abroad?

A Philippine investigation may still be possible. Republic Act No. 10175 recognizes jurisdiction in several situations, including when an element occurred in the Philippines, a relevant computer system was partly situated here, or the offense caused damage to a person who was in the Philippines at the time. Actual identification and enforcement may require international cooperation and will depend on the facts.

Does deleting the fake profile end the case?

Not necessarily. Removal limits continuing harm, but it does not erase conduct that already occurred. Preserve the evidence, platform correspondence, and proof of damage even after the account disappears.

This article provides general legal information, not advice for a specific case and not a prediction of any agency or court outcome. Procedures and conclusions may change depending on the evidence, platform, location, parties, and documents involved. Primary legal and official procedural sources were last checked on 2 August 2026.