Discovering that someone has stolen your identity to create a fake social media profile — using your photos, name, personal details, or even voice messages to scam your family and friends, spread lies, or damage your reputation — is a deeply unsettling experience. In the Philippines, this is not merely an online annoyance. It constitutes computer-related identity theft under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, and you have practical legal avenues to stop the impersonation, hold the perpetrator accountable, and seek remedies for the harm caused.

This article explains the legal framework, walks you through the exact steps to document evidence and report the incident effectively, covers procedures with platforms and government agencies, addresses special situations for people abroad or foreigners, and answers the questions victims most often search for. The guidance draws from current procedures used by the Philippine National Police Anti-Cybercrime Group (PNP-ACG), the National Bureau of Investigation (NBI), and the National Privacy Commission (NPC).

Understanding Identity Theft and Online Impersonation Under Philippine Law

Philippine law treats online impersonation seriously when it involves the unauthorized use of another person’s identifying information through a computer system. The key provision is Section 4(b)(3) of RA 10175, which defines computer-related identity theft as:

The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical, without right.

“Identifying information” includes your name, photos, birthdate, address, phone number, email, government ID details, or any data that can link to your real identity. Creating a fake Facebook, Instagram, TikTok, or X profile that pretends to be you and then interacts with others (especially to ask for money, spread defamatory content, or harass) clearly falls under this definition.

The Supreme Court upheld the constitutionality of this provision in Disini, Jr. v. Secretary of Justice (G.R. No. 203335, February 18, 2014). Related offenses may also apply:

Computer-related fraud (Section 4(b)(2) of RA 10175) if the impersonation is used to obtain money or cause damage.
Estafa under Article 315 of the Revised Penal Code if deceit leads to financial loss.
Usurpation of authority (Article 177, Revised Penal Code) if the fake profile impersonates a government official or uses official-looking credentials.
Using a fictitious name (Article 178, Revised Penal Code) in some contexts.

If the impersonation stems from a data breach at a company, bank, or government agency that exposed your personal information, the Data Privacy Act of 2012 (RA 10173) also applies. Victims can file complaints with the National Privacy Commission for violations of data subject rights.

Penalties under RA 10175 for identity theft are significant: imprisonment of prision mayor (six years and one day to twelve years) or a fine of at least ₱200,000 (up to an amount commensurate with the damage caused), or both. If no damage has occurred yet, the penalty is one degree lower. Courts have imposed these penalties in cases involving fake profiles used for scams or harassment.

Immediate Actions: Documenting and Preserving Evidence

Strong evidence is the foundation of any successful report or case. Act quickly because platforms and perpetrators can delete content.

Take clear, timestamped screenshots or screen recordings of the fake profile, every post, comment, message, friend request, and any interaction. Include the full URL, username/handle, date and time visible on screen, and your own profile for comparison.
Capture proof of harm — messages from relatives or friends who were deceived, bank or e-wallet transaction records (GCash, Maya, bank transfers), screenshots of emotional distress messages, or lost opportunities (e.g., job-related defamation).
Preserve originals — do not edit or crop images in a way that removes metadata. Keep the files on your device and make backup copies on a USB drive or cloud storage you control. Note the exact dates and times of discovery.
Gather supporting documents — your valid government-issued ID (passport, driver’s license, UMID, or PhilID), old photos or posts proving you are the real person, and any prior police blotter if you already reported suspicious activity.
Avoid contacting the fake account directly unless advised by authorities, as it may alert the perpetrator or complicate the investigation.

These steps help establish the elements of the crime: intentional unauthorized use of your identifying information via a computer system, and any resulting damage or risk of damage.

Reporting the Fake Account to Social Media Platforms

Start here for fast removal of the impersonating content. Platforms have policies against impersonation and fake accounts.

For Facebook and Instagram (Meta platforms):

Go to the fake profile or post → click the three dots → Report → select “Pretending to be someone else” or “Fake account.”
Provide details and upload your government-issued ID photo that clearly matches your real profile picture. Meta often requires this proof of identity.
You can also use Meta’s dedicated impersonation reporting form in the Help Center.

For other platforms (TikTok, X/Twitter, YouTube, etc.):

Use the in-app or website “Report” feature and choose the impersonation or fake account category. Follow their specific verification process.

Platform reports are usually processed within days to a couple of weeks and can result in the account being disabled or content taken down. This step does not replace filing a criminal complaint — it only removes the immediate harm. Keep records of your platform report (screenshot the confirmation or ticket number).

Filing a Criminal Complaint with Philippine Authorities

For criminal investigation and prosecution, report to specialized cybercrime units. You can file even if the platform has already removed the account.

Primary options:

PNP Anti-Cybercrime Group (ACG) — Handles most identity theft and social media impersonation cases. Main office at Camp Crame, Quezon City, with regional units nationwide.
- Hotline: (02) 8723-0401 local 7491 or 7483
- Mobile/text options often listed on their official channels (check current numbers via acg.pnp.gov.ph)
- Email: acg@pnp.gov.ph
- Website/portal: acg.pnp.gov.ph (online complaint options or e-complaint forms available in some periods)
NBI Cybercrime Division (CCD) — Better suited for complex, syndicated, high-value, or cross-border cases.
- Hotline: (02) 8523-8231 to 38
- Email: cybercrime@nbi.gov.ph
- Main office in Manila or regional NBI offices

Typical filing process:

Prepare a detailed Affidavit-Complaint (notarized) narrating the facts chronologically: how you discovered the fake profile, what the impersonator did, evidence of harm, and what you want authorities to do.
Attach two valid government-issued IDs, printed and digital copies of all evidence (ideally on USB), and witness affidavits if friends or family were affected.
Submit in person (walk-in assistance is common), through the online portal if available, or via email/hotline for initial guidance. PNP-ACG and NBI personnel often help victims complete forms.
Authorities may conduct or request cyber-forensic examination, subpoena platform records (IP addresses, device data, etc.), and coordinate with telcos.

The case then goes through preliminary investigation at the Prosecutor’s Office. If probable cause is found, an Information is filed in court (usually a designated cybercrime court in the Regional Trial Court).

There is generally no filing fee for the criminal complaint itself, though notarization costs ₱100–₱500 depending on the notary. Regional PNP-ACG units allow many victims to file closer to home without traveling to Manila.

If It Involves a Data Breach: Reporting to the National Privacy Commission

If you suspect or know that a company, bank, government agency, or app leaked your personal data (which was then used for the impersonation), file a complaint with the National Privacy Commission.

Download the Complaint-Assisted Form or prepare a notarized Complaint-Affidavit from privacy.gov.ph.
Submit in person, by courier, registered mail, or email (complaints@privacy.gov.ph) together with evidence.
The NPC can investigate the personal information controller, order corrective measures, impose fines, and help you exercise your data subject rights (access, correction, erasure, etc.).

This complements, rather than replaces, the criminal complaint with PNP or NBI.

Pursuing Civil Remedies and Damages

You can file a separate civil action for damages even while the criminal case is ongoing (or after). Under the Civil Code:

Articles 19, 20, and 21 cover abuse of rights and acts contrary to morals, good customs, or public policy.
Article 2176 covers quasi-delict (negligence causing damage).
You may claim actual damages (financial losses), moral damages (for anxiety, humiliation, sleepless nights), and exemplary damages (to deter similar acts).

Small claims procedure is available for lower amounts and is faster and simpler. A lawyer is helpful for larger or complex claims, but not strictly required for filing the criminal complaint.

Special Considerations for Filipinos Abroad and Foreign Nationals

Overseas Filipinos (OFWs) and dual citizens:

Execute your Affidavit-Complaint before a Philippine Embassy or Consulate (or a local notary public then have it apostilled if your country is part of the Hague Apostille Convention).
Send the notarized/apostilled documents via courier or authorize a representative in the Philippines through a Special Power of Attorney.
The same reporting channels (PNP-ACG, NBI, NPC) apply. Many embassies assist with initial guidance or notarization.

Foreign nationals (victims or respondents):

The same substantive laws apply if the impersonation occurred on Philippine platforms or affected persons in the Philippines.
Bring your passport as primary ID. If you have an ACR I-Card or other Philippine-issued document, include it.
International coordination is possible through the DOJ Office of Cybercrime when the perpetrator is abroad (via mutual legal assistance treaties or other channels). Evidence from foreign platforms or banks may require apostille or other authentication.

Act promptly — digital evidence can disappear, and prescription periods apply (generally following the Revised Penal Code rules for the corresponding penalties).

Common Challenges and Practical Tips

Victims often face these realities:

Perpetrators use VPNs, fake SIM cards, or overseas servers, making immediate identification difficult. Authorities can still obtain subscriber information through proper legal process.
Fake accounts sometimes get deleted by the platform before you report to police. Screenshots taken earlier become crucial.
Emotional and reputational harm is real; many victims experience anxiety or strained relationships. Documenting this (messages from affected friends, therapy notes if any) strengthens both criminal and civil aspects.
Provincial victims may need to coordinate with regional PNP-ACG units rather than traveling to Manila.
Not every case results in immediate arrest, but successful investigations have led to prosecutions and account takedowns.

Tips that help in practice:

Be as detailed and organized as possible in your affidavit.
Follow up politely with the investigating officer (keep records of communications).
Consider consulting a lawyer experienced in cybercrime for guidance on strategy, especially if significant financial loss or ongoing harassment is involved.
Secure your own accounts: enable two-factor authentication, review privacy settings, and monitor for other fake profiles.

Frequently Asked Questions

What evidence is most important when reporting identity theft on social media?
Clear, timestamped screenshots or screen recordings showing the fake profile, your real profile for comparison, the impersonator’s posts or messages, URLs, and any proof of harm (financial loss, messages to your contacts, or reputational damage). Original files with metadata preserved are ideal.

Is it still a crime if the impersonator has not yet asked for money or caused financial loss?
Yes. Under RA 10175 Section 4(b)(3), the intentional unauthorized acquisition or use of your identifying information is already punishable, even if no damage has occurred yet (though the penalty is lower in that case). Many victims report cases where the fake profile was used only to damage reputation or harass.

How long does it usually take to remove a fake social media account?
Platform reports (especially Meta) often result in action within a few days to two weeks if you provide proper identity verification. Criminal investigation and full prosecution take longer — weeks to months for investigation and forensics, plus time for preliminary investigation and court proceedings.

Can I file a complaint if I am an OFW or living abroad?
Yes. You can have your affidavit notarized at a Philippine Embassy or Consulate (or apostilled after local notarization in many countries) and submit it through a representative or by courier. The PNP-ACG and NBI accept such complaints.

Do I need to hire a lawyer to report identity theft?
No for the initial criminal complaint with PNP-ACG or NBI — you can file it yourself with their assistance. A lawyer becomes very helpful for complex cases, civil damages claims, or when you need strategic advice on evidence or follow-up.

What is the difference between reporting to PNP-ACG and NBI?
PNP-ACG handles the majority of social media impersonation and identity theft cases and has wider regional presence. NBI is often involved in more complex, syndicated, high-value, or transnational cases. You can start with either; they sometimes coordinate.

Can the perpetrator be prosecuted if they are located outside the Philippines?
Yes, in many cases. Philippine courts have jurisdiction over cybercrimes committed against persons in the Philippines or using Philippine platforms. The DOJ Office of Cybercrime can seek international assistance through mutual legal assistance or other channels to identify and pursue the offender.

What if the fake account has already been deleted by the platform?
You can still file a criminal complaint. Your earlier screenshots and other evidence remain valid. Authorities may still request platform records or other digital traces that exist even after deletion.

How do I also protect my data privacy rights if a company leak enabled the impersonation?
File a separate complaint with the National Privacy Commission using their Complaint-Assisted Form (available on privacy.gov.ph). This addresses the data controller’s failure to protect your information and can result in orders for the company to improve security or compensate affected individuals.

Key Takeaways

Identity theft and online impersonation on social media are criminalized primarily under Section 4(b)(3) of RA 10175 (Cybercrime Prevention Act of 2012), with penalties up to 12 years imprisonment and substantial fines.
Act immediately: preserve timestamped screenshots and evidence of harm before anything is deleted.
Report first to the social media platform for quick takedown, then file a criminal complaint with PNP-ACG (most common route) or NBI.
If a data breach is involved, also file with the National Privacy Commission.
Filipinos abroad can file through embassies or apostilled documents; foreign nationals follow the same substantive rules.
Strong documentation and prompt action significantly improve outcomes in both criminal prosecution and any civil claim for damages.
Regional PNP units and online/hotline options make reporting accessible even outside Metro Manila.

You have clear rights and workable procedures under Philippine law. Many victims successfully stop the impersonation and obtain accountability by following these systematic steps. Start with evidence preservation and platform reporting today, then proceed to the appropriate law enforcement unit.