Quick answer

Report the seller immediately to the marketplace or social-media platform and ask it to preserve the account and transaction records, disable the fraudulent listing, and stop further use of the stolen identity. Save the report or ticket number.

If your own name, photograph, ID, address, signature, business documents, or account details are being used, send the seller or platform a written demand to stop the misuse and preserve proof that it was delivered. You may then report the matter to:

The Philippine National Police Anti-Cybercrime Group or the National Bureau of Investigation Cybercrime Division for possible computer-related identity theft, fraud, forgery, or related offenses;
The National Privacy Commission for unlawful processing or misuse of personal data;
The Department of Trade and Industry if an online consumer transaction or deceptive selling practice is involved; and
The bank or e-wallet provider immediately if money or a financial account is at risk.

These remedies serve different purposes. A platform report may remove the account; a DTI complaint may address a consumer dispute; an NPC complaint concerns personal-data rights; and a criminal complaint asks law enforcement to investigate an offense. Filing with one does not necessarily replace the others.

What counts as use of a stolen identity?

Warning signs include an online seller using, without authority:

Another person’s name, photograph, address, mobile number, email address, signature, or government-issued ID;
A legitimate business’s name, registration certificate, logo, receipts, tax documents, or representative’s identity;
A bank or e-wallet account presented as belonging to the supposed seller;
Fake verification documents assembled from another person’s personal data; or
A real person’s profile to convince buyers that the shop is legitimate.

A copied name or photograph is not automatically a crime in every situation. Context, authorization, purpose, and evidence matter. A parody account, an authorized reseller, or a business page managed by an authorized employee may raise different issues. Avoid publicly accusing a named person unless the evidence reliably connects that person—not merely the name or payment account—to the fraudulent activity.

Why this may be a criminal and privacy matter

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person. If no damage has yet occurred, the law provides for a lower penalty, but the conduct may still be punishable.

Depending on what happened, investigators may also consider computer-related fraud or forgery, estafa, falsification, access-device offenses, or offenses involving financial accounts. The proper charge depends on the method used, the offender’s intent, the resulting loss, and the available evidence. A complainant does not need to settle the final legal classification before asking law enforcement to investigate.

The Data Privacy Act of 2012 may also apply when personal information is collected, copied, disclosed, or used without a lawful basis. Consent is not the only possible lawful basis for processing, so liability cannot be determined from lack of consent alone. However, using someone’s ID or personal details to impersonate that person and operate a deceptive shop is a strong reason to seek an NPC assessment.

Preserve evidence before the account disappears

Collect evidence before contacting the seller if doing so is safe. Platforms can suspend accounts quickly, and sellers can change usernames, delete chats, or replace listings.

Preserve:

Full-page screenshots and screen recordings showing the profile, username, account ID, URL, listings, reviews, and dates;
The exact link to the shop, profile, product listing, or advertisement;
Copies of the stolen photograph, ID, registration document, or other identifying material as displayed;
Chats, emails, text messages, call logs, voice messages, and order confirmations;
Payment instructions, QR codes, account names, account numbers, transaction references, receipts, and amounts;
Courier records, parcel labels, return addresses, tracking numbers, and delivery photographs;
Platform complaint confirmations and ticket numbers;
Written statements from buyers or other witnesses, preferably with original messages or transaction records;
Proof that the identity belongs to you or to the person or business you represent; and
Proof of actual consequences, such as complaints received, unauthorized transactions, demands for payment, reputational harm, or account restrictions.

Keep the original files. Do not rely only on cropped screenshots. Where possible, retain the device on which the messages were received and export the conversation without altering it. Make a backup, but do not edit metadata or annotate the only copy.

When submitting an ID to an agency or platform, use its official channel. Redact information that is not requested when appropriate, but keep an unredacted copy available for lawful verification.

Step 1: Secure the affected identity and accounts

If your identity is being used:

Change the passwords of affected email, marketplace, social-media, banking, and e-wallet accounts.
Turn on multifactor authentication and sign out unknown devices or sessions.
Tell your bank or e-wallet provider immediately about any disputed or suspicious transaction. The BSP advises consumers to report suspicious transactions promptly to the regulated institution.
Notify the issuer of a compromised ID or credential and ask what replacement, annotation, or protective measures are available.
Warn close contacts or customers through a verified channel, but disclose only what is necessary.
Monitor accounts and messages for password resets, new loans, SIM-related activity, or demands connected with the fake seller.

If money has already been transferred, contact the sending bank or e-wallet immediately. Ask it to record a fraud report, attempt appropriate recovery measures, preserve transaction and recipient-account information, and give you a reference number. Recovery is not guaranteed, and delay can make tracing or fund recovery harder.

If the institution does not resolve a complaint, the account holder may use the BSP Consumer Assistance Mechanism. BSP escalation generally follows an initial complaint to the bank, e-money issuer, or other BSP-supervised financial institution.

Step 2: Report the seller to the platform

Use the platform’s reporting function and select the most accurate category, such as impersonation, identity theft, fraudulent seller, fake documents, or scam.

Your report should identify:

The account and listing URLs;
The information or documents being used without authority;
How you know the identity is stolen;
Any connected orders, payments, or victims;
The immediate risk of further fraud; and
The action requested.

Ask the platform to:

Disable or restrict the seller and fraudulent listings;
Prevent further use of the copied identity documents;
Preserve account-registration, verification, login, listing, messaging, order, payment, and IP-related records for lawful investigation; and
Provide a report number or written confirmation.

Do not ask the platform to send you another person’s private account records. Under the Internet Transactions Act of 2023, a covered platform may be required to provide specified information when a competent authority issues a subpoena in an investigation based on a sworn complaint and the perpetrator cannot otherwise be identified.

For disputes arising from an internet transaction, Section 24 of the Act generally requires an aggrieved party to use the platform’s or e-retailer’s internal redress mechanism before filing a complaint with a court or appropriate government agency. That mechanism is deemed exhausted if the complaint remains unresolved seven calendar days after filing. Preserve proof of the filing date and result.

This seven-day process should not be treated as a reason to ignore immediate danger. Report ongoing account takeover, threatened violence, rapid financial loss, or continuing criminal activity promptly to the appropriate law-enforcement agency while also completing the platform process.

Step 3: Make a cybercrime report

You may seek investigative assistance from the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. The NBI also provides an online complaint page and publishes its process for investigative assistance to victims of computer crimes.

Bring or submit:

A chronological account of what happened;
Your government-issued ID and contact details;
URLs, usernames, account IDs, and screenshots;
Original or exported electronic messages;
Payment and delivery records;
Proof that the identity or documents are yours, or proof that you are authorized to act for the affected business or person;
Platform and financial-institution report numbers; and
Witness details and affidavits, if available.

Clearly distinguish facts you personally observed from information provided by other people. If you are a buyer rather than the person impersonated, say how you discovered the apparent identity theft and provide the transaction records that led to that conclusion.

An incident report or online submission may begin the process, but investigators may require a personal appearance, sworn statement, device examination, or additional documents. Ask which office will handle the case and keep the reference or docket number.

Step 4: File a privacy complaint when personal data was misused

The National Privacy Commission can receive complaints from people whose personal information has allegedly been misused or whose data-subject rights have been violated.

Before filing, the NPC’s exhaustion rule generally requires the complainant to notify the respondent in writing about the privacy violation and allow an opportunity to address it. The requirement is ordinarily satisfied when the respondent fails to take timely or appropriate action, or gives no response within 15 calendar days after receiving the written notice. Keep proof of receipt. Review the NPC’s current complaint mechanics for possible exceptions and current filing requirements.

Use the NPC’s current Complaint-Affidavit form. The NPC announced that a new template took effect on July 1, 2025. The complaint should be verified or notarized as required and supported by evidence; failure to attach evidence can result in outright dismissal. Check the NPC’s current formal complaint instructions before submitting because forms, fees, and authorized filing channels may change.

A privacy complaint should explain:

What personal data was used;
Who appears to have processed or disclosed it;
Why the processing was unauthorized or otherwise unlawful;
When and how you notified the respondent;
The response received, if any;
The harm or continuing risk; and
The specific relief requested, such as blocking, erasure, correction, compliance, or investigation.

Do not use the NPC’s data-breach notification system merely because you are an individual victim. That system is principally for personal information controllers and processors reporting qualifying breaches. An individual seeking a remedy generally uses the NPC complaint process.

Step 5: File a consumer complaint when a sale is involved

If you bought or attempted to buy goods or services from the seller, or if consumers are being deceived through an online transaction, report the matter through the DTI Consumer CARe system or the appropriate DTI office.

Include:

The seller’s displayed and claimed identity;
The platform and listing;
The order, invoice, receipt, and payment records;
The promised and actual goods or services;
Your communications with the seller;
Proof that you used the platform’s internal complaint process; and
The remedy you seek.

DTI consumer proceedings are not a substitute for a criminal investigation. DTI jurisdiction also depends on the product, service, respondent, and law involved. Complaints involving food, medicines, insurance, securities, telecommunications, or another specially regulated product may be referred to the agency with jurisdiction.

If you are only the person whose identity was stolen and were not part of a consumer transaction, a cybercrime or NPC complaint may be more directly relevant than a request for consumer redress. Nevertheless, DTI may still receive information about an online business’s apparent violations within its enforcement mandate.

If a business identity or registration was copied

For a copied sole-proprietorship business name, verify the genuine registration through DTI’s official systems and notify the DTI business-name helpdesk if the underlying registration record itself appears to have been altered or fraudulently obtained.

For a corporation, partnership, or one-person corporation, preserve the official Securities and Exchange Commission record and report suspected misuse through the SEC’s official channels. A A genuine registration does not prove that the social-media account or person using the business name is authorized.

If the seller displays an E-Commerce Philippine Trustmark, verify its QR code or security number against the official database. Suspected misuse may be reported through the contact details on the DTI Trustmark website.

What not to do

Do not send additional money to “verify,” “unlock,” or recover an account.
Do not negotiate through links or numbers supplied by the suspected seller; use verified platform, bank, and government channels.
Do not impersonate a buyer to obtain private information or attempt to hack the account.
Do not delete the original chat, reset the affected device, or discard the SIM or parcel before preserving evidence.
Do not publicly post an unredacted stolen ID, bank account number, home address, or other sensitive data.
Do not assume that the person named on a payment account is necessarily the organizer. Accounts can also be compromised, rented, or misused.
Do not pay a private “recovery agent” who promises guaranteed arrest, takedown, or fund recovery.
Do not submit inconsistent timelines to different agencies. Correct mistakes promptly and preserve the correction.

When help is urgent

Contact law enforcement and the relevant bank, e-wallet, or platform without delay when:

Unauthorized withdrawals, loans, account openings, or fund transfers are occurring;
The seller is actively collecting money from multiple victims;
A government ID, signature, selfie-with-ID, biometric information, or financial credential is exposed;
The affected person is being threatened, stalked, blackmailed, or placed in physical danger;
A child’s identity or images are involved;
The seller is destroying evidence or rapidly moving between accounts; or
You receive a subpoena, demand letter, collection notice, or notice of a case arising from transactions you did not make.

Consult a Philippine lawyer promptly if substantial losses, multiple victims, competing ownership claims, possible defamation exposure, or a formal criminal, civil, or administrative proceeding is involved. A lawyer can help prepare affidavits, identify the proper complainant and respondent, and coordinate requests for preservation or lawful disclosure of platform and financial records.

Frequently asked questions

Can I report the seller if I did not lose money?

Yes. Computer-related identity theft may be punishable even when no damage has yet occurred, although the applicable penalty may differ. The absence of financial loss does not eliminate the need to stop continuing impersonation or protect personal data.

Should I report to the platform before going to DTI?

For an internet-transaction dispute covered by the Internet Transactions Act, generally yes. Use the platform’s internal redress mechanism and retain proof. It is deemed exhausted if unresolved after seven calendar days. Urgent criminal or safety concerns should also be reported promptly to law enforcement.

Must I know the seller’s real name?

No. Provide every available account identifier and transaction record. A competent authority may use lawful processes to request identifying information from the platform or financial institution. Do not obtain private records through deception or unauthorized access.

Can I file with both the NPC and the police or NBI?

Yes, when the facts support both routes. The NPC addresses personal-data processing and privacy rights, while law enforcement investigates possible crimes. Each office will independently determine its jurisdiction and requirements.

Is a screenshot enough?

A screenshot is useful but may not be sufficient by itself. Preserve URLs, timestamps, original messages, electronic files, transaction records, device data, and proof connecting the stolen identity to the affected person. NPC complaints must include supporting evidence compliant with applicable rules.

Can I demand that the platform reveal the seller’s records to me?

You may request preservation and investigation, but the platform may be legally restricted from disclosing another user’s private data directly to you. Investigators, prosecutors, courts, or other competent authorities can pursue lawful disclosure processes.

Can I post the suspected seller’s name as a warning?

Exercise caution. Public warnings can expose innocent account holders or identity-theft victims and may create privacy or defamation issues. Share verified facts, redact sensitive information, and prioritize reports to the platform and authorities.

Will reporting guarantee removal, prosecution, or recovery of money?

No. Results depend on the evidence, jurisdiction, platform rules, traceability of the offender, and applicable law. Fast reporting and complete records improve the authorities’ ability to act but do not guarantee a particular outcome.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and legal conclusions may depend on the documents, platform, transaction, respondent, and surrounding facts. Official sources and filing information were checked as of September 4, 2026.