Quick answer

Preserve the evidence first, then report the account through the platform’s impersonation channel. If the account is being used to deceive people, obtain money or personal data, threaten or harass someone, damage your accounts, or impersonate you for another unlawful purpose, promptly file a report with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

A fake, anonymous, parody, fan, or duplicate account is not automatically the crime of identity theft. Under the Cybercrime Prevention Act of 2012, computer-related identity theft involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person or organization. The Supreme Court has clarified that the identity information must be taken for an illegitimate purpose; merely obtaining and disseminating information that the user made public is not, by itself, identity theft. Whether a particular account is criminal therefore depends on its purpose, conduct, and evidence—not simply on its use of a similar name or photograph. See Disini v. Secretary of Justice.

Do not wait for the platform to remove the account before approaching law enforcement when money, threats, private information, account takeover, or continuing harm is involved. Platform removal and a criminal investigation are separate processes.

What to do immediately

1. Preserve the account before reporting or blocking it

Fake accounts can be renamed, made private, or deleted quickly. Before taking steps that may alert the operator, save:

The complete profile URL, username, display name, platform, and any visible account or user ID.
Full-screen screenshots showing the browser address bar or the account’s profile details.
A screen recording that opens the profile, scrolls through relevant posts, and shows the URL, username, date, and time.
Copies of posts, stories, advertisements, comments, direct messages, voice messages, images, and videos.
The exact dates and times when the account contacted you or other people.
Names and contact details of people who received messages or were asked for money.
Transaction receipts, reference numbers, QR codes, bank or e-wallet details, delivery records, and phone numbers.
Security alerts, password-reset emails, login notices, and records of unknown devices or sessions.
Confirmation emails, ticket numbers, and screenshots from every report submitted to the platform.

Keep the original files. Do not crop, annotate, enhance, rename, or repeatedly resave your only copy. Place copies in a separate secure folder or storage device and prepare a simple chronological account of what happened.

Screenshots are useful, but a screenshot alone may not prove who controlled the account. The Supreme Court has identified several ways ownership or authorship may be established, including admissions, witnesses who saw the person access the account, information known only to the suspected operator, distinctive language, consistent prior conduct, provider records, and device-forensic results. See the Court’s guide on proving control of a social-media account.

2. Secure your real accounts

If there is any possibility that your real account, email, phone, or device was compromised:

Change the password of your primary email account first, followed by social-media, banking, e-wallet, shopping, and cloud-storage accounts.
Use unique passwords and enable multifactor authentication.
Review active sessions and sign out unknown devices.
Remove unfamiliar recovery addresses, phone numbers, connected apps, forwarding rules, and browser extensions.
Ask your telecommunications provider to secure or replace a compromised SIM and investigate any unexpected loss of signal.
Use the platform’s account-recovery process if your genuine account was taken over. Reporting an impersonator will not necessarily restore a hacked account.

Do not give anyone a one-time password, recovery code, PIN, screen-sharing access, or payment supposedly required to “verify” or recover the account.

3. Contain financial harm

If the impersonator requested or received money, opened an account in your name, or accessed a bank, card, loan, or e-wallet account:

Contact the institution through the telephone number or channel published in its official app, card, statement, or website.
Ask it to block the affected instrument or account, investigate the transaction, and record an identity-theft or fraud dispute.
Request a case or reference number and confirm the report in writing.
Identify every unauthorized transaction precisely. Do not describe a payment as unauthorized if you personally approved it; explain truthfully if approval was obtained through deception.
Preserve the recipient account, account name, QR code, transaction reference, amount, and exact time.
Check your other accounts and obtain your credit information if you suspect that loans or credit facilities were opened in your name.

Fraud involving financial accounts may engage the Anti-Financial Account Scamming Act, as well as estafa, access-device, cybercrime, or other laws. The applicable offense will depend on what the impersonator actually did.

Report the account to the platform

Use the platform’s specific impersonation category rather than a general spam report whenever possible:

Report both the profile and the individual posts, advertisements, or messages that show fraud, threats, harassment, or misuse of information. Explain briefly:

Who is being impersonated.
Which genuine account belongs to that person.
What identifying information was copied.
How the fake account is misleading people.
Whether it requested money, credentials, intimate material, or personal information.
Whether there is an immediate safety risk.

A platform may ask for identification. Upload it only through the platform’s genuine app, website, or help form. Never send an ID to the fake account or to an unverified “support agent.” Keep the report confirmation and follow-up messages.

Removal is not a finding of criminal guilt, while refusal to remove an account does not prove that no law was violated.

File a cybercrime report

PNP Anti-Cybercrime Group

You may report to the nearest PNP Anti-Cybercrime Group regional unit or police station. The PNP and NBI are the law-enforcement authorities specifically tasked under Republic Act No. 10175 with cybercrime investigation.

Bring or prepare:

A government-issued ID and proof that the genuine identity, business, or account belongs to you.
Your chronology of events.
The fake account’s URLs, usernames, and saved evidence.
Copies of messages and witness details.
Financial records and institution case numbers, if applicable.
Platform report confirmations.
The device on which relevant messages or account activity were received, if investigators need to examine it.

Ask for the complaint or blotter reference number and the investigator’s official contact details. A barangay blotter or ordinary incident report may document what happened, but it does not replace a cybercrime investigation, complaint-affidavit, or prosecutor’s proceedings.

NBI Cybercrime Division

The NBI accepts requests for investigation of computer crimes through its Cybercrime Division and regional cybercrime centers. Its published procedure includes a complaint sheet, preliminary interview, sworn statements or affidavits, supporting documents, and, when relevant, examination of a device. Consult the NBI’s computer-crime assistance procedure and office locator before visiting. The NBI’s current divisions directory lists ccd@nbi.gov.ph for the Cybercrime Division, but verify the address on the official NBI directory before transmitting sensitive documents.

CICC reporting assistance

For cybercrime reporting assistance or referral, the Cybercrime Investigation and Coordinating Center may be reached through hotline 1326. The DICT also lists 1326@dict.gov.ph for complaints on its official contact page.

A CICC or platform report may help route the incident, but follow investigators’ instructions if you want a formal criminal investigation and prosecution.

Ask promptly about preservation of provider data

Ordinary users generally cannot compel a platform to reveal an account holder’s name, IP address, login history, or subscriber information. Disclosure requires the platform’s lawful process and, where applicable, a cybercrime warrant or another valid legal order.

Under Section 13 of Republic Act No. 10175, service providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data must be preserved for six months after receipt of a law-enforcement preservation order, with one permitted extension under the conditions in the law. Foreign platforms may also have their own retention policies and cross-border procedures.

For that reason, report promptly and give investigators the exact URLs, usernames, dates, and times. Ask whether a preservation request or appropriate cybercrime warrant should be pursued. The procedures for disclosure, interception, search, seizure, and examination of computer data are governed by the Supreme Court’s Rule on Cybercrime Warrants.

Do not attempt to obtain the operator’s identity through hacking, spyware, deceptive login links, unlawful recording, or public offers to expose personal information.

When to file a privacy complaint

The unauthorized collection, disclosure, or other processing of personal data may also fall under the Data Privacy Act of 2012. This route may be relevant when the fake account uses private identification documents, contact lists, medical or financial information, confidential communications, or other personal data without a lawful basis.

A National Privacy Commission complaint is not automatically appropriate for every fake profile, and it is not a substitute for an urgent police report. The application of the Data Privacy Act depends on who processed the information, how it was obtained and used, and whether an exclusion or lawful basis applies.

Under the NPC’s amended Rules of Procedure, a complainant normally must first:

Inform the personal information controller, processor, platform, or other concerned entity of the alleged privacy violation in writing.
Give it an opportunity to act.
Show that it failed to take timely or appropriate action, or that it did not respond within 15 calendar days after receiving the written notice.

The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct.

A formal complaint must generally be written, signed, verified, and notarized, with the material facts and supporting evidence attached. If the respondent’s identity is unknown, state the circumstances that may help identify the respondent. Follow the NPC’s current formal complaint instructions.

What the law may cover

Depending on the evidence, conduct connected with a fake account may involve one or more laws:

Computer-related identity theft: Intentional, unauthorized use or misuse of another person’s or organization’s identifying information for an illegitimate purpose.
Estafa or financial-account scamming: Using impersonation to obtain money, property, account access, or financial information.
Illegal access: Entering or taking over an account or computer system without right.
Cyber libel: Publishing a defamatory imputation online, subject to all required elements and defenses.
Threats, coercion, or harassment: Depending on the words, conduct, relationship, and surrounding facts.
Gender-based online sexual harassment: Conduct covered by the Safe Spaces Act.
Non-consensual intimate images: Conduct covered by the Anti-Photo and Video Voyeurism Act.
Violence against women and their children: Psychological violence, harassment, or threats by a spouse, former spouse, dating partner, former dating partner, or a person with whom the victim has a common child may raise issues under Republic Act No. 9262, including possible protection orders.
Offenses involving children or sexual-exploitation material: These require immediate reporting and may fall under specialized child-protection laws.

For computer-related identity theft that has caused damage, Republic Act No. 10175 provides imprisonment of prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the statute provides for a penalty one degree lower. The court determines liability and the proper penalty after considering the specific charge, evidence, participation, and applicable rules.

Situations requiring urgent help

Seek immediate police assistance instead of waiting for platform review when:

There is a credible threat of physical violence, stalking, abduction, or disclosure of a home or workplace address.
The impersonator is arranging meetings, deliveries, loans, contracts, or sexual encounters in your name.
Money is actively being transferred or more victims are being contacted.
A child is being impersonated, groomed, threatened, or sexually exploited.
Intimate images are being distributed or used for sextortion.
The offender appears to control your email, SIM, banking, or government-service accounts.
The conduct involves a current or former intimate partner and you fear further abuse.

For an immediate danger, call 911 or go to the nearest police station. If intimate or child sexual material is involved, do not forward it to friends or post it publicly. Preserve the URL and report it directly to the platform and authorities.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and evidence.
Keeping only cropped screenshots without dates, context, or the account address.
Deleting messages, security alerts, or transaction records after taking one screenshot.
Publicly accusing a suspected person without reliable proof.
Threatening, baiting, paying, or arranging to meet the account operator.
Asking friends to mass-message or harass the suspected operator.
Sending IDs, passwords, or one-time codes to unofficial “recovery” services.
Assuming a platform takedown automatically starts a criminal case.
Assuming a police or barangay blotter alone completes the legal complaint.
Paying a “hacker” to identify the account operator.
Waiting until the account disappears before approaching investigators.
Exaggerating facts or labeling a voluntary payment “unauthorized.” Give investigators and financial institutions a complete, accurate account.

Frequently asked questions

Can I report an account if I do not have an account on that platform?

Often, yes. Some platforms provide web-based impersonation forms for people who are not logged in. Requirements differ, so use the platform’s official help page.

What if the fake account uses my photographs but a different name?

You may still report it if the overall presentation is misleading or your images are being used for fraud, harassment, or another violation. Whether it constitutes criminal identity theft depends on the purpose, authorization, and surrounding conduct.

Is using my public profile photo automatically identity theft?

No. The Supreme Court has said that acquiring and disseminating information made public by the user is not, by itself, theft of identity information. Using that photograph as part of a deceptive account for an illegitimate purpose may present a different case.

Can the police obtain the account’s IP address?

Investigators may seek subscriber, traffic, content, or device data through the lawful processes available under Republic Act No. 10175 and the Rule on Cybercrime Warrants. A complainant ordinarily cannot demand this information directly from a platform.

What if the account has already been deleted?

Report it using the saved URL, username, screenshots, messages, dates, witness information, and platform ticket. Deletion does not necessarily erase all provider records, but availability depends on retention practices and how quickly lawful preservation steps are taken.

Should I warn my contacts?

Yes, if doing so will limit harm. Use your verified or known communication channels. State which account is genuine, identify the impersonating account accurately, and tell contacts not to send money, credentials, or personal data. Avoid publishing unverified accusations about who operates it.

Can someone report for a child or another victim?

A parent or guardian may assist a minor. Platform procedures vary. For an NPC complaint, the amended rules require proof of the representative’s authority or relationship; a parent may generally submit the child’s birth certificate, while other representatives may need a special power of attorney or court documentation.

Do I need a lawyer?

A lawyer is not required simply to report an account or approach the police or NBI. Legal help is advisable when there are substantial financial losses, multiple victims, intimate images, threats, an identifiable suspect, cross-border issues, possible protection orders, or uncertainty about the correct criminal or civil remedy.

Official references

General-information notice

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy, office, offense, deadline, and evidence requirements depend on the actual account, messages, documents, relationship of the parties, location, and resulting harm. Official sources and procedures were checked as of 23 July 2026.