The creation of fake social media profiles—often referred to as "account cloning" or online impersonation—has become a pervasive threat in the Philippines. Perpetrators steal names, photographs, employment details, and biographical information to create a mirror profile. These fake accounts are frequently deployed to scam the victim's contacts, destroy reputations through defamatory posts, or engage in malicious harassment.

Under Philippine law, this is not merely a violation of social media platform policies; it is a serious criminal offense. This guide outlines the comprehensive legal framework, immediate technical remedies, and law enforcement procedures available to victims of online identity theft in the Philippines.

I. The Legal Framework: Applicable Philippine Laws

A victim of online impersonation can seek recourse under several distinct statutory frameworks, depending on how the fake account is utilized.

1. Cybercrime Prevention Act of 2012 (Republic Act No. 10175)

This is the primary legislation targeting digital impersonation. The specific offenses include:

Computer-related Identity Theft (Section 4(b)(3)): This criminalizes the intentional acquisition, use, misuse, transfer, possession, or alteration of identifying information belonging to another person without right, particularly when done to further fraudulent or illegal activity. Creating a profile using your exact name and photo to deceive others directly satisfies these elements.
Cyber Libel (Section 4(c)(4)): If the perpetrator uses the fake profile to post defamatory comments, false allegations, or malicious status updates meant to dishonor or discredit you, they can be prosecuted for Cyber Libel. The penalty for cyber libel is one degree higher than traditional libel under the Revised Penal Code.
Computer-related Fraud (Section 4(b)(2)): If the clone account is used to solicit money, sell fake items, or trick your friends into transferring funds (via GCash, Maya, or bank transfers), it constitutes computer-related fraud.

2. Data Privacy Act of 2012 (Republic Act No. 10173)

Your name, face, and personal details constitute "personal information" under Philippine law.

Unauthorized Processing (Section 25): Gathering your public photos and personal history to set up an unauthorized profile constitutes the unlawful processing of personal data. This carries severe penalties, especially if sensitive personal information is involved.

3. The Revised Penal Code (RPC) and Civil Code

Estafa / Swindling (Art. 315, RPC): When the fake account successfully defrauds third parties by pretending to be you, the actor is liable for Estafa in conjunction with cybercrime provisions.
Civil Action for Damages (Articles 19, 20, 21, 26, & 33, Civil Code): Aside from criminal charges, victims can file an independent civil action to claim moral damages (for mental anguish, sleepless nights, and social humiliation) and exemplary damages to set a public example.

Summary of Penalties

Offense	Governing Law	Potential Penalties
Computer-related Identity Theft	R.A. 10175, Sec. 4(b)(3)	Prisión mayor (6 years and 1 day to 12 years) and/or a fine of at least ₱200,000.
Cyber Libel	R.A. 10175, Sec. 4(c)(4)	Prisión corrections in its maximum period to prisión mayor in its minimum period (up to 8 years) and substantial moral damages.
Unauthorized Processing of Data	R.A. 10173, Sec. 25	Imprisonment ranging from 1 to 3 years and fines ranging from ₱500,000 to ₱2,000,000.

II. Step 1: Immediate Technical Action & Evidence Preservation

Before taking legal action, you must act swiftly to preserve digital evidence. If the perpetrator deletes the account or modifies the content, proving the crime in a Philippine court becomes exponentially harder.

1. Document Everything (Preservation of Evidence)

Capture the Unique Profile URL: Do not just take a screenshot of the display name. Copy the unique URL string from the browser address bar (e.g., facebook.com/profile.php?id=1000xxxxxx or facebook.com/fake.username). This unique User ID (UID) remains constant even if the perpetrator changes the profile name or photo later.
Take Full-Page Screenshots: Use a desktop browser to take full screenshots showing the fake profile page, the "About" section, the specific timestamps of posts, and any dynamic content like Stories or Reels. Ensure your system clock (date and time) is visible in the screenshots.
Document the Interactions: Screenshot direct messages (DMs) where the fake account interacts with your friends, especially if they are soliciting financial favors.

⚠️ Critical Warning

Do not engage or confront the perpetrator. Avoid sending threatening messages or notifying the fake account that you intend to sue. This often prompts them to immediately deactivate or purge the account, wiping out critical IP logs and digital footprints before law enforcement can issue a preservation order.

2. Issue a Public Advisory

Post a clear, public notice on your legitimate Facebook profile. State explicitly that a fake account is operating under your name and that you are not soliciting money, investments, or favors. This serves two purposes: it protects your network from fraud, and it establishes legally that you took immediate steps to mitigate any harm or misrepresentation.

3. Report the Account to Meta (The Platform Track)

To minimize ongoing reputational harm, utilize Facebook’s internal reporting mechanisms:

Navigate to the fake profile.
Click the three dots (...) below the cover photo.
Select Find Support or Report Profile.
Choose Pretending to be someone $\rightarrow$ Me.
Submit the report. You can also have trusted friends report the account for "Fake Account" or "Impersonation" to expedite Meta's automated review system.

III. Step 2: Engaging Philippine Law Enforcement

Because private citizens cannot legally compel Meta to hand over the registration details, IP logs, or phone numbers associated with a dummy account, you must enlist specialized law enforcement agencies.

1. Where to File the Complaint

You can report the cybercrime to any of the following entities:

Philippine National Police - Anti-Cybercrime Group (PNP-ACG): Located at Camp Crame, Quezon City, with regional offices nationwide. Reports can also be initiated through their official website or CyberTip portals.
National Bureau of Investigation - Cybercrime Division (NBI-CCD): Located at the NBI Building, Taft Avenue, Manila. The NBI excels at complex digital tracing and forensic investigations.
National Privacy Commission (NPC): If you prefer to focus strictly on data privacy violations and seek administrative enforcement against the unauthorized use of your personal data.

2. Requirements for Filing

When visiting the PNP-ACG or NBI-CCD, bring the following items:

Two valid government-issued photo IDs (to prove you are the real identity owner).
A printed copy and a digital copy (on a flash drive) of all preserved screenshots, URLs, and communication timelines.
A draft or willingness to execute a Complaint-Affidavit, a sworn statement detailing exactly how and when you discovered the fake account, the details used, and the damages you have suffered.

IV. Step 3: The Subpoena and Cybercrime Warrant Process

Once law enforcement accepts your complaint, they must unmask the anonymous user. Under the Rule on Cybercrime Warrants, specific judicial procedures must be followed:

[Victim Reports to PNP-ACG/NBI] 
       │
       ▼
[Law Enforcement Issues Data Preservation Order to Meta]
       │
       ▼
[Application for Court-Issued WDCD (Warrant to Disclose Computer Data)]
       │
       ▼
[Meta Discloses Login IP Logs & Linked Phone/Email]
       │
       ▼
[Second WDCD Served to Telco (Globe/PLDT/Converge)]
       │
       ▼
[Telco Identifies Physical Subscriber/User]

Preservation Request: Law enforcement sends an official request to Meta to preserve the account's backend data (traffic logs, IP addresses, registration details) for an initial period of 60 days, preventing it from being permanently erased.
Warrant to Disclose Computer Data (WDCD): Law enforcement, through a state prosecutor, applies for a WDCD before a designated Special Cybercrime Court (Regional Trial Court).
Tracing the IP Chain: Once the court issues the WDCD, Meta is legally obligated to release the subscriber information and IP login logs of the account. Law enforcement then cross-references these IP logs with local Internet Service Providers (ISPs) like PLDT, Globe, or Converge via a secondary warrant to identify the physical address and registered subscriber of the device used to manage the fake account.

V. Filing the Case and the Prosecution Stage

If the perpetrator's identity is initially unknown, the complaint is filed against a "John Doe" or "Jane Doe." Once the PNP or NBI successfully unmasks the individual through the cybercrime warrant process, the complaint is amended to reflect the real name of the accused.

1. Preliminary Investigation

The case undergoes a Preliminary Investigation before the Office of the City or Provincial Prosecutor. The prosecutor determines if there is probable cause to believe a crime was committed and that the respondent is guilty of it. Both sides submit their respective affidavits (Complaint-Affidavit vs. Counter-Affidavit).

2. Filing of Information in Court

If probable cause is established, the prosecutor files a formal "Information" (the criminal charge sheet) before the Regional Trial Court acting as a Special Cybercrime Court. The judge will then evaluate the case and issue a Warrant of Arrest against the perpetrator.

3. Prescriptive Periods (Deadlines to File)

Do not delay your legal actions. Under Philippine law, crimes have expiration dates:

Cyber Libel: The Supreme Court has clarified that the prescriptive period for cyber libel is one (1) year from the time of publication or discovery.
Computer-related Identity Theft: Because it carries a heavier penalty (prisión mayor), the prescriptive period is fifteen (15) years. However, filing immediately ensures digital logs are still available.

VI. Practical Checklist for Victims

Stop: Do not message the fake account or alert the scammer.
Analyze: Copy the complete profile URL string (facebook.com/...) from a web browser.
Preserve: Take high-resolution screenshots with timestamps and system dates visible.
Protect: Publish a disclaimer on your real account warning your friends.
Report Tech: Submit an impersonation report directly through Facebook's interface.
Report Law: Visit the nearest PNP-ACG or NBI-CCD office to submit your digital evidence and execute a Complaint-Affidavit.