If someone is harassing you online, pretending to be you, spreading lies, using your photos, threatening you, or creating fake accounts to damage your reputation, you are not powerless. In the Philippines, cyber harassment and fake online accounts may involve several laws at the same time: cybercrime, libel, identity theft, threats, privacy violations, sexual harassment, voyeurism, violence against women and children, or civil damages. The right first step depends on what the person is doing, what evidence you have, and how urgent the risk is.

What Counts as Cyber Harassment in the Philippines?

“Cyber harassment” is not always a single crime with one exact label. It is a practical term people use for harmful online behavior such as:

repeated insulting, shaming, or humiliating messages;
sending threats through Facebook, Messenger, Viber, Telegram, TikTok, Instagram, X, email, or SMS;
creating a fake profile using your name, photo, workplace, school, or personal details;
posting edited screenshots or false accusations about you;
spreading your private photos, address, phone number, or personal information;
threatening to release intimate photos or videos;
using dummy accounts to attack your business, family, or reputation;
impersonating you to scam others;
using anonymous accounts to stalk, intimidate, or sexually harass you.

The important point is this: not every rude post is automatically a crime, but many online acts become legally actionable when they involve defamation, threats, identity misuse, private sexual images, personal data, repeated harassment, or damage to reputation and safety.

Main Philippine Laws That May Apply

Cybercrime Prevention Act — RA 10175

The key law is the Cybercrime Prevention Act of 2012, Republic Act No. 10175.

It covers several cyber-related offenses, including:

Online act	Possible legal issue
Using your name, photo, or identifying details without authority	Computer-related identity theft
Posting defamatory accusations online	Cyber libel
Threatening you through chat, email, or social media	Threats under the Revised Penal Code, committed through ICT
Using fake accounts to deceive people	May involve identity theft, estafa, fraud, or cybercrime
Accessing or taking over your account	Illegal access or computer-related offenses
Using online means to commit an existing crime	Penalty may be one degree higher under RA 10175

A very important feature of RA 10175 is that it does not only punish “new” cybercrimes. It can also increase the penalty when an existing crime under the Revised Penal Code is committed through information and communications technology.

For example, if a person threatens you face-to-face, that may be punished under the Revised Penal Code. If the same threat is made through Messenger or email, cybercrime rules may also become relevant.

Cyber Libel

Cyber libel happens when a defamatory statement is published online. The legal basis is Article 353 and Article 355 of the Revised Penal Code, as applied online through Section 4(c)(4) of RA 10175.

In simple terms, cyber libel usually involves:

an allegation or statement;
that identifies a person, directly or indirectly;
that is defamatory, meaning it tends to dishonor or discredit the person;
that is published online; and
made with malice, either presumed by law or proven depending on the circumstances.

In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel but explained that online libel is essentially the traditional crime of libel committed through a computer system. You can read the decision in Disini v. Secretary of Justice, G.R. No. 203335.

The Supreme Court has also clarified in Causing v. People that cyber libel prescribes in one year from discovery. This means delay can be fatal. If the harmful post is defamatory, do not wait too long before consulting counsel or filing a complaint. The Supreme Court announcement is available here: SC Affirms Cyber Libel Prescribes One Year from Discovery.

Identity Theft and Fake Accounts

A fake account is not automatically criminal just because it is anonymous or uses a made-up name. But it can become legally serious when it uses another person’s identity.

Under RA 10175, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person without right.

This may apply when someone:

uses your real name and photo to pretend to be you;
creates a fake account with your photos and personal details;
messages your friends, clients, or relatives while pretending to be you;
uses your identity to scam people;
creates a fake dating, marketplace, or business account using your information;
edits your photos and presents them as real;
uses your company name or logo to deceive customers.

If the fake account also posts accusations against you, the case may involve both identity theft and cyber libel.

Revised Penal Code: Threats, Coercion, Unjust Vexation, and Libel

The Revised Penal Code, Act No. 3815, remains important even in online cases.

Depending on the facts, the following may apply:

Conduct	Possible offense
“I will kill you,” “I will hurt your family,” or similar serious threats	Grave threats
Threatening to expose private information unless you pay or comply	Grave threats, coercion, robbery/extortion, or other crimes depending on facts
Persistent online harassment causing distress but not clearly covered by another law	Unjust vexation may be considered
False damaging accusations posted online	Libel or cyber libel
Forcing someone to do something through intimidation	Coercion

Unjust vexation is often raised in harassment complaints, but it is not a magic catch-all. Prosecutors still look for clear acts showing annoyance, irritation, torment, distress, or disturbance without lawful justification.

Safe Spaces Act — RA 11313

The Safe Spaces Act, Republic Act No. 11313, also known as the “Bawal Bastos” law, covers gender-based sexual harassment, including online sexual harassment.

This may apply when someone online:

sends unwanted sexual comments or messages;
repeatedly sends sexual advances after being told to stop;
uploads or threatens to upload sexual content;
makes sexist, homophobic, transphobic, or gender-based attacks;
sends unwanted explicit photos;
uses online platforms to shame someone based on sex, gender identity, or sexual orientation.

The Safe Spaces Act is especially relevant when harassment has a sexual or gender-based nature, even if the victim and offender are not in a workplace, school, or romantic relationship.

Anti-Photo and Video Voyeurism Act — RA 9995

If the issue involves intimate photos or videos, the Anti-Photo and Video Voyeurism Act of 2009, Republic Act No. 9995, may apply.

This law can cover situations where someone:

records a person’s private parts or sexual activity without consent;
shares intimate photos or videos without written consent;
threatens to upload private sexual images;
spreads old intimate content even if the person originally agreed to be recorded.

A common misunderstanding is that “consent to record” means consent to share. That is wrong. A person may have agreed to a private recording but not to its distribution.

Data Privacy Act — RA 10173

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information.

It may be relevant when someone maliciously uses or exposes:

your address;
phone number;
private messages;
government ID;
school or employment details;
medical or financial information;
photos used to identify or embarrass you;
screenshots containing private information.

If your personal information has been misused, maliciously disclosed, or improperly processed, you may consider filing a complaint with the National Privacy Commission. The NPC’s official guide is here: National Privacy Commission — Filing a Complaint.

Violence Against Women and Children — RA 9262

If the harasser is a husband, former husband, boyfriend, ex-boyfriend, live-in partner, dating partner, or someone with whom the woman has or had a sexual or dating relationship, the Anti-Violence Against Women and Their Children Act, Republic Act No. 9262, may apply.

Online abuse may form part of psychological violence, especially when it involves:

threats;
humiliation;
stalking behavior;
control of accounts;
repeated messaging;
public shaming;
threats to release private photos;
harassment of the woman’s family, friends, or workplace.

A Barangay Protection Order, Temporary Protection Order, or Permanent Protection Order may be considered depending on the facts.

If the Victim Is a Child

If the victim is a minor, take the matter more urgently. The following laws may become relevant:

RA 11930, Anti-Online Sexual Abuse or Exploitation of Children and Anti-Child Sexual Abuse or Exploitation Materials Act
Special Protection of Children Against Abuse, Exploitation and Discrimination Act
Anti-Child Pornography Act
Safe Spaces Act
Cybercrime Prevention Act

If there are sexual images, grooming, extortion, or threats involving a minor, preserve evidence and report immediately to law enforcement.

What To Do First: Practical Step-by-Step Guide

1. Do Not Delete the Evidence

Many victims instinctively delete messages because they are embarrassed, scared, or angry. Do not delete anything until you have preserved it.

Save:

screenshots of posts, comments, messages, and profiles;
the full URL or link to the fake account or post;
profile ID, username, display name, and account handle;
dates and times;
screenshots showing the number of shares, reactions, comments, or views;
message headers, email addresses, or phone numbers;
names of witnesses who saw the post;
proof that the fake account used your photo, name, logo, or personal details.

For screenshots, capture the entire screen where possible, including the date, time, username, and URL. A cropped screenshot may still help, but a complete screenshot is better.

2. Create an Evidence Folder

Make a folder arranged by date. A simple structure works:

01 Fake Profile Screenshots
02 Messages and Threats
03 Defamatory Posts
04 Witnesses
05 Platform Reports
06 IDs and Personal Documents
07 Timeline

Prepare a short timeline:

Date	What happened	Evidence
January 3	Fake Facebook account created using my photo	Screenshot 1, URL
January 5	Account messaged my clients pretending to be me	Screenshots 2–5
January 8	Account posted accusation that I stole money	Screenshot 6, witnesses
January 10	I reported to Facebook	Report confirmation

This timeline helps police, NBI, prosecutors, lawyers, and even platform support teams understand the pattern quickly.

3. Secure Your Accounts

Before confronting the harasser, secure your digital life.

Do these immediately:

Change passwords for email and social media.
Turn on two-factor authentication.
Check account recovery email and phone number.
Log out of unknown devices.
Review connected apps.
Make your friend list private if needed.
Warn close contacts not to engage with the fake account.
Report hacked or impersonation accounts through the platform.

If the fake account is impersonating you, do not just post “please report this.” Also use the platform’s impersonation report tools because platforms often require a formal in-app report before they act.

4. Report the Content to the Platform

Report the fake account or abusive content directly to the platform. Use the most accurate category:

Situation	Platform report category to look for
Account uses your name and photo	Impersonation
Account posts your private info	Privacy violation / doxxing
Account posts intimate images	Non-consensual intimate content
Account threatens violence	Threats / violence
Account scams people using your name	Fraud / scam / impersonation
Account attacks you repeatedly	Harassment / bullying

Take screenshots before and after reporting. Save the report confirmation if the platform provides one.

5. Decide Where to File: PNP, NBI, Prosecutor, Barangay, or NPC

The right office depends on your case.

Situation	Where to go
Fake account, threats, cyber libel, hacking, online extortion	PNP Anti-Cybercrime Group or NBI Cybercrime Division
Formal criminal complaint for preliminary investigation	Office of the City or Provincial Prosecutor
Data privacy misuse or malicious disclosure of personal information	National Privacy Commission
VAWC situation involving partner or former partner	Barangay VAW Desk, PNP Women and Children Protection Desk, prosecutor, or court
Immediate danger	Nearest police station or emergency response
Purely civil reputation or damages issue	Regular courts through a civil action
Content takedown only	Platform reporting, sometimes with law enforcement support

For cybercrime investigation, the two usual agencies are the PNP Anti-Cybercrime Group and the NBI Cybercrime Division. The NBI’s official Citizen’s Charter page for cybercrime complaints is here: NBI Investigative Assistance for Victims of Computer Crimes.

6. Prepare a Complaint-Affidavit

For a formal criminal complaint, you will usually need a complaint-affidavit. This is a sworn written statement explaining what happened.

It should contain:

your full name, address, and contact details;
the identity of the person complained of, if known;
the fake account URL, username, phone number, or email address;
a clear timeline of events;
exact words used in defamatory posts or threats;
screenshots and links;
names of witnesses;
explanation of how you were harmed;
request for investigation or prosecution.

A complaint-affidavit is normally notarized. If you are abroad, Philippine authorities may require consular acknowledgment or an apostilled document, depending on how and where it will be used.

7. File With the Investigating Agency or Prosecutor

For many cybercrime cases, victims first go to the PNP Anti-Cybercrime Group or NBI Cybercrime Division because those agencies can assist with technical investigation.

In practice, expect the following:

You submit your evidence and complaint details.
The investigator interviews you.
You may be asked to execute or revise a sworn statement.
The agency evaluates whether the case needs digital forensic steps.
If the suspect is known, the case may proceed to the prosecutor.
If the suspect is unknown, investigators may need platform, telecom, IP, device, or subscriber information through lawful processes.
The prosecutor determines whether there is probable cause.

For cybercrime data, law enforcement cannot simply demand private platform data informally. The Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, provides procedures for warrants involving preservation, disclosure, interception, search, seizure, and examination of computer data.

Documents Usually Needed

Requirement	Notes
Valid government-issued ID	Passport, driver’s license, UMID, national ID, PRC ID, etc.
Complaint-affidavit	Usually notarized; must clearly narrate facts
Evidence screenshots	Include dates, usernames, URLs, and full context
Links or URLs	Essential for social media posts and fake profiles
Witness affidavits	Helpful if others saw the post or were messaged by the fake account
Proof of identity misuse	Photos, original account, IDs, business records, employment proof
Platform report confirmations	Shows you tried to stop the abuse
Medical or psychological records	If claiming trauma or emotional harm
Business records	If the harassment damaged your business or client relationships
Authority to represent	Needed if filing for a company, minor, or another person

For company or business impersonation, bring SEC registration, DTI registration, business permit, trademark documents if any, and proof that you are authorized to file.

Fees and Timelines

Item	Usual practical reality
Initial report to PNP or NBI	Usually no filing fee
Notarization	Often a few hundred pesos, depending on location
Printing and photocopying	Prepare multiple copies
Lawyer’s assistance	Optional at initial reporting, but helpful for affidavit and strategy
Platform takedown	Can be quick, slow, or denied depending on platform rules
Initial law enforcement evaluation	May take days to weeks
Technical investigation	Can take weeks or months
Prosecutor preliminary investigation	Often several months, depending on docket and complexity
Court case	Can take years if fully litigated

Cyber cases often move slowly because investigators may need data from platforms, telecoms, or devices. Foreign-based platforms may require strict legal process, and some data may no longer be available if the complaint is filed late.

This is why early preservation of evidence is critical.

Special Issues With Fake Online Accounts

The Account Is Anonymous

Many fake accounts hide behind made-up names. That does not automatically end the case.

Investigators may look at:

profile URLs and account IDs;
linked phone numbers or emails, if obtainable;
IP logs, if legally available;
device data;
payment or ad records;
common photos, language, contacts, or posting patterns;
witnesses who received messages;
admissions or threats from related accounts.

However, identifying an anonymous account can be difficult without cooperation from platforms or telecom providers.

The Harasser Is Abroad

If the harasser is outside the Philippines, the case becomes more complicated but not necessarily impossible.

Consider:

Is the victim in the Philippines?
Was the harm felt in the Philippines?
Was the post accessible in the Philippines?
Is the accused Filipino or foreigner?
Is the platform or evidence located abroad?
Is there a need for mutual legal assistance?

The DOJ Office of Cybercrime may become relevant for cybercrime coordination and international requests. The DOJ page for reporting cybercrime incidents is here: Department of Justice — Reporting of Cybercrime Incidents.

For foreigners dealing with Philippine proceedings, documents executed abroad may need notarization, consular acknowledgment, or apostille, depending on the country and intended use.

The Harasser Is a Former Partner

If the person is an ex-boyfriend, ex-girlfriend, spouse, or live-in partner, look beyond cybercrime. The facts may involve VAWC, grave threats, coercion, psychological abuse, sexual harassment, or voyeurism.

Common examples:

“If you leave me, I will post your private photos.”
“I will send your old videos to your family.”
“I will message your boss and ruin your reputation.”
“I will create dummy accounts until you talk to me.”
“I will accuse you publicly unless you come back.”

These are not just “relationship drama.” They may be legally serious.

The Fake Account Is Used Against a Business

If a fake page pretends to be your business, takes orders, scams customers, or posts false claims, gather:

DTI or SEC registration;
business permit;
official social media pages;
screenshots of fake page activity;
customer complaints;
proof of lost sales;
bank or e-wallet details used by the fake account;
trademark registration, if any.

Possible legal angles include cybercrime, fraud, unfair competition, trademark issues, civil damages, and platform takedown.

The Post Is “Just Opinion”

Opinions are generally treated differently from false factual accusations. “I had a bad experience with this seller” is different from “This seller stole my money” if the latter is false and defamatory.

In cyber libel cases, wording matters. Prosecutors and courts look at the exact language, context, whether the victim is identifiable, whether the statement is factual or opinion, and whether malice is present.

The Harasser Deletes the Post

A deleted post can still be used if you preserved evidence. But deletion makes investigation harder, especially if you did not save the URL, screenshots, timestamps, or witnesses.

If the post is still live, capture it immediately.

How to Preserve Digital Evidence Properly

Good evidence is not just a screenshot. Good evidence tells a clear story.

Use this checklist:

Screenshot the full post, message, or profile.
Capture the URL or profile link.
Record the date and time.
Save the device used.
Download message history if possible.
Keep original files, not just compressed copies.
Do not edit screenshots except to make separate redacted copies.
Save copies in cloud storage and an external drive.
Ask witnesses to screenshot what they saw.
Have witnesses execute affidavits if the case becomes formal.

For serious cases, especially involving hacked accounts, intimate images, or business damage, avoid “cleaning up” the device before investigators or a digital forensic examiner can advise you.

When to Go to the Barangay

Barangay conciliation may be relevant for some disputes between individuals in the same city or municipality, especially if the case is more of harassment, insult, or personal conflict.

But barangay proceedings are generally not the best route when:

the case involves serious cybercrime;
the offender is unknown;
the offender is in another city or abroad;
there is immediate danger;
the case involves violence against women or children;
the matter requires urgent evidence preservation;
the issue involves intimate images, extortion, or hacking.

For VAWC, barangays can be very important because they can issue a Barangay Protection Order in appropriate cases.

Civil Remedies: Damages, Injunctions, and Takedown-Related Relief

Criminal complaints are not the only option. Some victims may also consider civil remedies.

Under the Civil Code, a person who causes damage through fault, negligence, bad faith, abuse of rights, or acts contrary to morals may be liable for damages. Depending on the facts, Articles 19, 20, 21, 26, 32, 33, and 2219 of the Civil Code may become relevant.

Civil remedies may be considered when:

the victim suffered reputational damage;
a business lost customers;
private life was exposed;
emotional distress is documented;
false posts caused measurable harm;
the victim wants damages, not only prosecution.

In urgent cases, a lawyer may also evaluate whether injunctive relief is possible. Courts are careful with speech-related orders, so this depends heavily on the facts.

Common Mistakes Victims Make

Mistake 1: Posting an Angry Public Response Immediately

It is understandable to want to defend yourself, but an emotional public response can worsen the situation or expose you to counterclaims.

Before posting, ask:

Will this preserve evidence or destroy it?
Will it provoke more harassment?
Am I accidentally naming someone without enough proof?
Am I sharing private data?
Could my own post be considered defamatory?

Mistake 2: Reporting Without Evidence

Police, NBI, prosecutors, and platforms need specifics. “Someone is harassing me online” is not enough.

Bring screenshots, URLs, dates, usernames, and a timeline.

Mistake 3: Waiting Too Long

Cyber libel has a one-year prescriptive period from discovery. Platform data may also disappear or become harder to obtain over time.

Act early, especially if the content is defamatory, threatening, sexual, or identity-related.

Mistake 4: Assuming a Fake Account Is Easy to Trace

Some fake accounts are easy to identify because the user makes mistakes. Others are difficult because they use VPNs, burner emails, hacked accounts, or foreign platforms.

A strong complaint focuses on preserved evidence and lawful investigative steps, not guesses.

Mistake 5: Filing the Wrong Type of Complaint

A data privacy complaint, cyber libel complaint, VAWC complaint, and platform impersonation report are different tools. Sometimes you need more than one. Sometimes one is better than the others.

The facts determine the strategy.

Practical Complaint Strategy by Scenario

Scenario	Best first steps
Fake account using your photo and name	Screenshot profile, copy URL, report impersonation to platform, file with PNP ACG or NBI if harmful
Fake account posting accusations	Preserve posts, assess cyber libel, file promptly because of prescription concerns
Anonymous threats	Screenshot messages, save sender details, report to PNP/NBI, consider immediate police assistance if danger is real
Threat to release intimate photos	Preserve threats, do not pay, report urgently; consider RA 9995, Safe Spaces Act, VAWC if applicable
Doxxing or exposure of private data	Preserve content, report to platform, consider NPC complaint and cybercrime complaint
Ex-partner harassment	Consider VAWC, protection orders, cybercrime, Safe Spaces Act, or RA 9995 depending on facts
Business impersonation	Gather business documents, customer reports, fake page URLs, payment details, platform reports
Child victim	Preserve evidence and report immediately to law enforcement; do not circulate the material

Frequently Asked Questions

Can I file a case against a fake Facebook account in the Philippines?

Yes, if the fake account is used to impersonate you, harass you, defame you, threaten you, scam others, or misuse your personal information. A fake account by itself may violate platform rules, but legal action usually requires a harmful act such as identity theft, cyber libel, threats, fraud, privacy violation, or sexual harassment.

Where do I report cyber harassment in the Philippines?

You may report serious cyber harassment to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. If the issue involves personal data misuse, you may also consider the National Privacy Commission. If it involves a partner or former partner abusing a woman, the barangay VAW Desk, PNP Women and Children Protection Desk, prosecutor, or court may also be relevant.

Is cyberbullying a crime in the Philippines?

For adults, there is no single general “cyberbullying law” that covers every insulting or mean online act. However, cyberbullying behavior may fall under cyber libel, unjust vexation, threats, coercion, Safe Spaces Act violations, VAWC, data privacy violations, or other laws depending on what exactly happened. For minors and school settings, child protection and school policies may also apply.

Can someone go to jail for creating a fake account?

Possibly, if the fake account is used for a criminal act such as identity theft, fraud, threats, cyber libel, sexual harassment, or distribution of intimate images. Merely using a nickname or anonymous account is not automatically criminal. The key question is whether the account misused someone’s identity or caused legally recognized harm.

What evidence do I need for a cyber libel complaint?

You need the exact defamatory post or message, screenshots, URL, date of discovery, proof that the post identifies you, proof of publication, and evidence showing why the statement is false or damaging. Witness affidavits can help if other people saw and understood the post as referring to you.

What if the harasser deleted the post?

You may still proceed if you preserved screenshots, links, witnesses, or other proof. But deletion can make investigation harder. If the content is still online, preserve it immediately before reporting or confronting the person.

Can I sue someone for posting my private photos?

Yes, depending on the facts. If the photos are intimate or sexual, RA 9995 may apply. If the post is gender-based or sexual harassment, RA 11313 may apply. If personal data was misused, RA 10173 may apply. If the post damaged your reputation, civil damages or cyber libel may also be considered.

Can I file a complaint if I am outside the Philippines?

Yes, but practical requirements may be more complicated. Your affidavit may need notarization, consular acknowledgment, or apostille depending on where it is executed and how it will be used. If the harm occurred in the Philippines, the victim is in the Philippines, or the online content affected Philippine interests, local remedies may still be considered.

Should I message the fake account to ask who they are?

Usually, no. Engaging the fake account may provoke more abuse or alert the person to delete evidence. Preserve evidence first. If communication is necessary, keep it calm, short, and documented. For serious threats, extortion, or intimate image abuse, report rather than negotiate.

How long does a cybercrime complaint take?

Initial reporting may happen in a day, but investigation and prosecution can take weeks, months, or longer. Cases involving anonymous accounts, foreign platforms, deleted posts, or technical data usually take more time. Court cases can take years if they proceed to trial.

Key Takeaways

Cyber harassment and fake online accounts in the Philippines may involve RA 10175, the Revised Penal Code, RA 11313, RA 9995, RA 10173, RA 9262, or child protection laws.
Preserve evidence before deleting, blocking, or confronting the harasser.
Save screenshots, URLs, usernames, dates, messages, witness names, and platform report confirmations.
Report serious cybercrime issues to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
File data privacy complaints with the National Privacy Commission when personal information is misused or maliciously disclosed.
Cyber libel has a one-year prescriptive period from discovery, so delay can hurt your case.
Fake accounts are most legally serious when they impersonate, defame, threaten, scam, sexually harass, or expose private information.
If there is immediate danger, threats of violence, intimate image extortion, or a child victim, treat the matter as urgent and seek law enforcement help immediately.