In the Philippines, online identity theft and the creation of fake accounts are not just violations of platform policies—they are serious criminal offenses. The proliferation of imposter profiles on social media platforms like Facebook, X (formerly Twitter), and Instagram has led to a robust legal framework designed to penalize perpetrators and protect victims.

If someone has created a fake account using your name, photos, or personal details, or if your existing online identity has been hacked and misused, several Philippine laws protect you:

Cybercrime Prevention Act of 2012 (Republic Act No. 10175): Section 4(b)(3) explicitly criminalizes Computer-related Identity Theft. This is defined as the intentional acquisition, use, misuse, transfer, possession, or deletion of identifying information belonging to another person, without right.
Revised Penal Code (RPC): Depending on how the fake account is used, the perpetrator can also be charged with Falsification of Documents (if digital signatures or official documents are forged), Online Libel (Section 4(c)(4) of RA 10175), or Swindling/Estafa (if the account is used to solicit money or run scams).
Data Privacy Act of 2012 (Republic Act No. 10173): If your personal data was leaked, breached, or processed without your consent to create the profile, violations regarding the unauthorized processing of personal information apply.

Step 1: Immediate Digital Triage (Preserving Evidence)

Before contacting law enforcement, you must secure the evidence. In digital forensics, data can be easily deleted or altered.

Do Not Block the Account Immediately: While your instinct may be to block the imposter, doing so might prevent you from gathering crucial evidence or monitoring their activity.
Take High-Quality Screenshots: Document everything. Capture the account's profile picture, cover photo, unique URL/web address, bio, and posts. If the account is messaging people, screenshot the conversations, including the dates and timestamps.
Locate the Unique Profile ID: On platforms like Facebook, usernames can be changed, but the numeric profile ID remains the same. Copy the exact hyperlink (URL) of the fake account's timeline.

Step 2: Reporting to the Platform

Most social media networks have mechanisms to take down imposter accounts. This is the fastest way to stop immediate reputational damage while the legal case is being prepared.

Facebook/Instagram: Click the three dots (...) on the fake profile, select "Find Support or Report," and choose "Pretending to be someone" (or "Pretending to be me").
X (Twitter): Visit their Help Center under "Report an account for impersonation" and upload a government-issued ID to prove your identity.
Mass Reporting: Enlist trusted friends to report the account as a fake profile to expedite the platform's automated review system.

Step 3: Filing an Official Law Enforcement Complaint

To hold the perpetrator criminally liable, you must report the incident to specialized cybercrime units in the Philippines. You can approach either of the following agencies:

1. PNP Cybercrime Group (PNP-ACG)

The Philippine National Police Cybercrime Group handles the investigation of computer-related identity theft.

Action: Visit the PNP-ACG headquarters at Camp Crame, Quezon City, or report via their regional offices (RACUs) or their official website/hotlines.
What to bring: Printouts of your gathered evidence, a valid government-issued ID, and a narration of facts.

2. NBI Cybercrime Division (NBI-CCD)

The National Bureau of Investigation is highly equipped to track digital footprints and identify anonymous perpetrators behind fake accounts.

Action: File a formal complaint at the NBI Main Office (Cybercrime Division) or the nearest NBI regional office.
Subpoena Powers: The NBI and PNP can request data from Internet Service Providers (ISPs) and tech conglomerates (like Meta) through legal channels to trace the IP address used to create the fake account.

Step 4: Escalating to the National Privacy Commission (NPC)

If the creation of the fake account stemmed from a data breach (e.g., a company leaked your IDs or personal data, which scammers then used to build the profile), you should file a complaint with the National Privacy Commission.

Note: The NPC focuses on data privacy violations. If a malicious entity is processing your personal information without authorization, the NPC can issue cease-and-desist orders and recommend prosecution under RA 10173.

The Legal Process: What Happens Next?

[Gather Evidence] ➔ [File Complaint with PNP-ACG / NBI] ➔ [Preliminary Investigation] ➔ [Court Trial]

Affidavit of Complaint: Law enforcement will assist you in executing a formal sworn statement (Affidavit of Complaint) detailing how you discovered the identity theft and the damage it has caused.
Preliminary Investigation: The law enforcement agency will forward the case to the Department of Justice (DOJ) or the local Prosecutor's Office. The prosecutor will determine if there is probable cause to indict the suspect.
Filing in Court: If probable cause is found, a criminal Information will be filed in the appropriate Regional Trial Court (RTC) designated as a Cybercrime Court.

Penalties and Imprisonment

Under Section 6 of the Cybercrime Prevention Act of 2012, all crimes defined in the Revised Penal Code, if committed by, through, and with the use of information and communications technologies (ICT), shall be penalized with a punishment one degree higher than that provided for by the RPC.

Offense (Cybercrime Act)	Republic Act No. 10175 Penalty
Computer-related Identity Theft	Prision mayor (6 years and 1 day to 12 years imprisonment) and/or a fine of at least ₱200,000.
Online Libel (via fake account)	Prision correccional in its maximum period to prision mayor in its minimum period (4 years and 2 months to 8 years) and/or fines.

Strategic Advice for Victims

Do Not Engage: Avoid publicly arguing with the fake account or alerting the creator that you are taking legal action. This prevents them from deleting the account and wiping the digital trail before law enforcement can secure a warrant.
Issue a Disclaimer: Post a brief, public announcement on your real account warning your network that an imposter is using your name/photos, and explicitly state that you are not responsible for any financial transactions or statements made by that account.
Preserve Digital Chain of Custody: If possible, save the source code or HTML of the fake profile webpage, or use archiving tools to preserve the URL exactly as it appears.