A Philippine Legal Guide

I. Introduction

Telegram scams in the Philippines often combine two harms at once: fraud and identity misuse. A scammer may create a Telegram account using another person’s name, photos, business identity, or personal details, then use that false persona to solicit money, deceive victims, or damage reputations. In legal terms, this can trigger not only fraud-related liability but also cybercrime, privacy, falsification-related, and other criminal or civil consequences depending on the facts.

In the Philippine context, reporting this kind of misconduct effectively requires more than sending screenshots to a police page or using Telegram’s in-app report feature. A report that can lead to investigation or prosecution usually needs evidence preservation, a clear legal theory, an affidavit, and submission to the proper Philippine authority.

This article explains, in Philippine legal context, how to report Telegram scammers who use stolen identities, what laws may apply, what evidence to gather, where to file, what to ask authorities to do, and what practical limitations to expect.

II. What This Conduct Usually Means Under Philippine Law

A Telegram scam involving a stolen identity is not just “someone pretending to be someone else.” Under Philippine law, it may involve several distinct legal wrongs.

1. Computer-related identity theft

A central law is the Cybercrime Prevention Act of 2012, which punishes certain acts committed through information and communications technologies. When a person intentionally acquires, uses, misuses, transfers, possesses, alters, or deletes identifying information belonging to another without right, that may fall under computer-related identity theft.

This is often the clearest cybercrime angle when a Telegram account uses:

another person’s full name,
profile photo,
government ID image,
business name,
company logo,
contact details,
personal story,
or any other identifying information

without authority, especially to gain trust or facilitate a scam.

2. Estafa or fraud

If the impersonation is used to induce victims to part with money, property, goods, or valuable consideration, the conduct may amount to estafa under the Revised Penal Code, or its cyber-enabled equivalent depending on how the facts are framed by investigators and prosecutors.

Typical examples include:

pretending to be a friend, employee, seller, or broker;
using a stolen identity to collect reservation fees, investments, deposits, or “release fees”;
posing as a business representative to divert payments.

The stolen identity matters because it is often the deceit mechanism that makes the fraud succeed.

3. Other cybercrime-related offenses

Depending on the case, authorities may also consider:

computer-related fraud;
illegal access, if the scammer also hacked an account or device;
online libel, if the impersonation is used to publish false and defamatory claims;
cyber-enabled threats, coercion, or extortion, if money is demanded under threat of exposure, embarrassment, or release of private material.

4. Data privacy violations

If the scammer is using personal data obtained, processed, disclosed, or circulated without authority, the Data Privacy Act of 2012 may become relevant. This is especially true where the identity misuse involves:

leaked ID cards,
selfies,
contact lists,
addresses,
email addresses,
bank details,
employment information,
or other personal data.

The Data Privacy Act is particularly important when the stolen identity came from a company database, lending app, workplace records, or other personal data system.

5. Falsification, document misuse, or fake credentials

If the scammer uses forged IDs, fabricated authorization letters, fake business permits, altered screenshots of IDs, or counterfeit documentation to support the Telegram scam, additional offenses may arise. The exact charge depends on the document involved and how it was used.

III. Why Telegram Cases Need Special Handling

Telegram cases are legally reportable, but practically harder than ordinary in-person fraud complaints.

Three issues usually arise:

1. Telegram accounts may use aliases, handles, disposable numbers, or foreign infrastructure

A scammer may use:

a username instead of a real name,
cloud-based chats,
hidden phone numbers,
fake profile details,
foreign SIM cards or virtual numbers.

This means your local complaint should not merely identify the scammer by nickname. It should ask law enforcement to investigate technical identifiers, including usernames, phone numbers, linked wallets, GCash or bank destinations, recovery emails if discoverable, device artifacts, and related accounts.

2. Screenshots alone are often not enough

Screenshots are useful, but prosecutors and investigators usually prefer a fuller evidentiary package, such as:

screenshots with date and time visible,
exported chat records,
profile links or usernames,
payment receipts,
transaction reference numbers,
call logs,
links to fake profiles,
copies of fake IDs sent by the scammer,
statements from the real person whose identity was stolen.

3. A platform report is not the same as a criminal complaint

Reporting the Telegram account in-app may help suspend or review the account, but it does not itself start a Philippine criminal case. For local enforcement, you still need to bring the matter to the proper Philippine office.

IV. Who May Report

Any of the following may report:

the person who lost money;
the person whose identity was stolen;
a family member acting with supporting facts;
a business whose trade name, logo, or employee identity was misused;
a witness with direct knowledge;
an authorized corporate representative, for business-related impersonation.

Ideally, if there are both fraud victims and identity-theft victims, both should execute statements. That strengthens the case because it shows both deception and unauthorized use of identity.

V. When to Report Immediately

You should report at once if any of these are present:

money has already been sent;
the scam is still active and attracting more victims;
the scammer is using your name or face;
government ID images, banking details, or sensitive personal data were exposed;
threats, blackmail, or extortion are involved;
minors are involved;
the scammer appears to have hacked an account;
there is risk of rapid fund transfer or account deletion.

Speed matters because account trails, transaction trails, and device-related evidence may become harder to recover over time.

VI. Evidence to Preserve Before Reporting

The most important practical rule is this: preserve first, report second. Do not argue at length with the scammer. Do not edit files. Do not delete chats. Do not reset your phone if it may contain relevant evidence.

Prepare the following.

1. Telegram account identifiers

Capture all of the following if visible:

Telegram display name;
username;
phone number, if shown;
profile link;
profile photo;
bio/about text;
group or channel name;
invite links;
message timestamps.

If the scam happened in a group, preserve the group name, link, admins, pinned messages, and participant identifiers if visible.

2. Full conversation records

Take screenshots, but do not stop there. Also preserve the broader context:

how contact began;
what representations were made;
when the scammer claimed to be a certain person;
what money was requested;
what payment instructions were given;
what documents or photos were sent;
what threats or urgency tactics were used.

Where possible, export or back up the chat in a way that preserves date and sequence.

3. Proof of the stolen identity

If you are the person impersonated, gather:

your real social media or business profile;
documents showing the name, image, or logo is genuinely yours;
proof that you did not authorize the Telegram account;
any messages from confused third parties who believed the fake account was yours.

If you are not the person impersonated, try to identify and notify that person, because their affidavit can materially strengthen the complaint.

4. Financial evidence

If money changed hands, preserve:

GCash receipts;
Maya receipts;
bank transfer confirmations;
over-the-counter deposit slips;
screenshots of wallet names and numbers;
QR codes used;
transaction reference numbers;
exchange or crypto wallet addresses, if involved;
invoice or order screenshots;
delivery booking details, if used in the scam.

5. Device and account context

Keep:

your phone number used in the chat;
email confirmations;
call logs;
SMS OTPs, if relevant;
screenshots showing the date and time on your device;
screen recordings navigating the fake account.

Do not fabricate evidence or “clean up” screenshots. Authenticity matters.

6. Witness statements

If other people saw the fake account or were also targeted, ask them to prepare written statements with dates and details.

VII. Where to Report in the Philippines

In practice, several offices may receive a report, but they do not all do the same thing.

1. PNP Anti-Cybercrime Group or local police

A complaint may be brought to:

the PNP Anti-Cybercrime Group, including regional or local units where available; or
a regular local police station, especially if that is the most accessible first point of contact.

For cyber-enabled scams, specialized cybercrime units are generally better equipped. Still, if there is urgency, a local police blotter and referral can be a useful first step.

2. NBI Cybercrime-related offices or local NBI district office

The National Bureau of Investigation may receive complaints involving online fraud, identity misuse, account compromise, extortion, and related cyber offenses. If you have a nearby district office, it may serve as the local filing point or referral channel.

NBI complaints can be particularly useful when the case requires digital investigation, document verification, tracing, or coordination across locations.

3. Office of the City or Provincial Prosecutor

If you are ready to pursue a formal criminal complaint, the matter may be filed with the Office of the Prosecutor with a complaint-affidavit and supporting evidence. In some cases, law enforcement will conduct investigation first; in others, complainants directly initiate a prosecutorial complaint, especially where the facts and documentary evidence are already substantial.

4. National Privacy Commission

If the case involves misuse, leakage, unauthorized disclosure, or unlawful processing of personal data, a complaint or incident report to the National Privacy Commission may also be appropriate. This does not replace criminal reporting where fraud occurred, but it can address the personal-data dimension.

5. Financial institution or e-wallet provider

This is not a criminal authority, but it is often crucial. If money was sent through a bank, e-wallet, remittance service, or digital platform, report immediately to the relevant provider and request:

account flagging,
transaction review,
preservation of records,
temporary hold if still possible,
and a formal acknowledgment of your report.

This can support later law-enforcement requests.

VIII. The Best Reporting Sequence

For most Philippine Telegram scam cases involving stolen identities, the most effective sequence is:

preserve all evidence;
notify the bank or e-wallet provider immediately if funds were transferred;
report to PNP Anti-Cybercrime Group or NBI;
prepare a sworn complaint-affidavit;
file with the proper prosecutor if pursuing criminal charges;
separately report to Telegram and, where relevant, the National Privacy Commission.

That sequence helps prevent evidence loss while keeping prosecution options open.

IX. How to Write the Complaint Properly

A weak report says: “Someone scammed me on Telegram.”

A stronger report says:

who the scammer pretended to be;
what identity was stolen;
how the fake identity was used to gain trust;
what exact misrepresentations were made;
what amount was requested or obtained;
when and how payments were made;
what evidence proves the account was fake;
what harm resulted;
what law-enforcement action is requested.

Your complaint should be factual, chronological, and precise.

X. Contents of a Strong Complaint-Affidavit

A Philippine complaint-affidavit for this type of case should usually contain:

1. Identity of the complainant

State your full name, age, citizenship, address, and capacity in the case, such as:

victim who sent money,
person whose identity was stolen,
corporate representative,
or witness.

2. Statement of facts in chronological order

Set out:

when you first encountered the Telegram account;
what username or profile it used;
whose identity it stole;
how you confirmed the identity was stolen or unauthorized;
what the scammer asked for;
what you relied upon;
what transactions occurred;
what happened afterward.

3. Specific identifiers

Include every specific identifier available:

Telegram username;
number;
links;
QR codes;
bank account number;
e-wallet number;
recipient name appearing in the payment channel;
other related accounts.

4. Legal characterization

A complainant does not need to draft perfect charges, but it helps to state that the facts may constitute:

computer-related identity theft,
fraud or estafa,
computer-related fraud,
data privacy violations,
and other offenses as may be applicable.

5. Attached annexes

Label attachments clearly, for example:

Annex “A” – screenshot of fake Telegram profile
Annex “B” – chat screenshots
Annex “C” – proof of genuine identity
Annex “D” – bank transfer receipt
Annex “E” – affidavit of the real person impersonated
Annex “F” – spreadsheet of affected victims

6. Verification and oath

For formal proceedings, affidavits should be sworn before a notary public or authorized officer, depending on filing procedure.

XI. What the Real Identity Owner Should Say in Their Affidavit

If the case involves impersonating a real person, that person’s affidavit should state:

that the identity, image, name, or profile details are genuinely theirs;
that they did not create, authorize, or control the Telegram account;
that they did not authorize the scam transactions;
that the account is false, misleading, and harmful;
that the misuse caused reputational, financial, emotional, or professional injury;
and that they are willing to support investigation and prosecution.

This affidavit can be decisive. Without it, the case may look like ordinary fraud. With it, the identity-theft component becomes much clearer.

XII. What to Ask Authorities to Do

When reporting, do not merely hand over screenshots. Make specific requests.

You may ask the receiving authority to:

record and docket the complaint;
conduct cybercrime investigation;
issue preservation requests where legally available;
coordinate with e-wallets, banks, telecoms, or service providers;
identify the account holder or fund recipient;
trace related accounts and devices;
investigate whether other victims exist;
refer the matter for inquest or regular preliminary investigation where warranted.

In practical terms, the clearer your requests, the easier it is for the receiving officer to understand that this is a prosecutable cyber-enabled fraud case, not a mere platform dispute.

XIII. Reporting to Telegram

A Telegram report is still worth making, but it serves a different purpose.

It may help by:

flagging the account for impersonation or scam activity;
leading to account restrictions or platform review;
reducing further victimization.

But it does not substitute for Philippine criminal reporting. Treat it as supplementary, not primary.

When reporting to Telegram, include:

account username;
profile screenshots;
explanation that the identity is stolen;
proof of the real identity, if you are the affected person;
scam details and payment attempts;
urgency if active victims remain at risk.

XIV. Reporting to Banks, E-Wallets, and Payment Services

Many Telegram scams move quickly through financial rails. A prompt financial report can matter as much as the criminal complaint.

When contacting the provider, state:

that the transaction was induced by fraud through impersonation;
that the scammer used a stolen identity on Telegram;
that you request immediate account review, record preservation, and any available protective action;
and that a police or NBI complaint is being prepared or has been filed.

Attach:

transaction references,
screenshots,
account numbers,
recipient details,
and timeline.

Even if recovery is uncertain, record preservation can later support the criminal case.

XV. If the Scammer Used Your Photos, ID, or Personal Data

This raises both criminal and privacy issues.

You should do all of the following:

preserve evidence of the fake account;
preserve proof that the photos, ID, or details are genuinely yours;
report to law enforcement;
report to Telegram;
notify any affected bank, employer, school, or clients if impersonation may spread;
consider reporting the data misuse dimension to the National Privacy Commission, particularly if the information appears to have come from a data breach or unauthorized disclosure.

If the fake account used your government ID image, emphasize that the ID image itself is being misused and may enable broader fraud beyond Telegram.

XVI. If the Scammer Used a Business Identity

Where the scammer pretends to be a business, employee, seller, clinic, broker, or service provider, the business should act quickly through an authorized representative.

The complaint should include:

proof that the brand, logo, trade name, or employee name belongs to the business;
proof that the Telegram account is unauthorized;
statements from customers or targets;
evidence of payments diverted or attempted;
proof of resulting confusion or reputational damage.

A business-related impersonation case may involve not only fraud and cybercrime concerns but also commercial and reputational injury. Separate civil remedies may become relevant.

XVII. If the Scammer Is Abroad or Unknown

Many victims worry that nothing can be done if the scammer is anonymous or may be outside the Philippines. That is not a reason to avoid reporting.

A Philippine complaint still matters because:

victims may be in the Philippines;
the stolen identity victim may be in the Philippines;
the money destination may touch Philippine banks or e-wallets;
SIM, device, IP, wallet, or recipient trails may lead to local actors;
local accomplices or money mules may be identifiable;
authorities can at least build an investigative record.

Even when the mastermind is foreign, local collection channels, account holders, remittance recipients, or co-conspirators may still be reachable.

XVIII. Common Mistakes That Weaken Cases

Several mistakes repeatedly damage otherwise valid complaints.

1. Waiting too long

Delay increases the risk that:

chats vanish,
phones are replaced,
numbers are deactivated,
financial records become harder to freeze or trace.

2. Relying only on screenshots

Screenshots without context are often incomplete. Keep full sequences and technical identifiers where possible.

3. Not involving the real identity owner

If the scammer stole someone else’s identity, the real person’s affidavit can be crucial.

4. Filing an emotional but vague complaint

A complaint should be factual and chronological, not just descriptive of outrage.

5. Deleting conversations after reporting

Never delete the original chat unless advised by counsel after proper preservation.

6. Sending more money to “catch” the scammer

That can worsen the loss and complicate the facts.

XIX. Criminal, Civil, and Administrative Remedies May Overlap

A Telegram scam using stolen identities can produce multiple legal tracks.

1. Criminal

Possible criminal proceedings may involve cybercrime and fraud-related charges.

2. Civil

Victims may seek damages where the law and facts support it, especially if financial loss, reputational injury, or data misuse caused measurable harm.

3. Administrative or regulatory

If personal data was mishandled by an organization, privacy-related remedies may also be relevant.

These remedies can coexist. A platform takedown alone is not full relief.

XX. What Local Authorities Usually Need From You

In real-world Philippine practice, authorities usually need three things to move the case forward:

a coherent narrative,
identifiable evidence,
and a complainant willing to execute a sworn statement.

If you present only an unsorted folder of screenshots, the complaint may stall. If you present a properly organized affidavit with annexes and financial records, it is easier for authorities to process.

XXI. Practical Checklist for Filing

Use this checklist before going to the police, NBI, or prosecutor:

full name and contact details of complainant;
summary timeline of events;
Telegram display name, username, link, number, screenshots;
proof of stolen identity;
proof of non-authorization from the real identity owner;
payment records and reference numbers;
witness details;
list of annexes;
valid IDs of complainant;
drafted complaint-affidavit;
copies in digital and printed form, if possible.

XXII. Suggested Structure of the Actual Report

A workable report usually follows this order:

Background Explain how you encountered the Telegram account.
Identity theft aspect Explain whose identity was stolen and how you verified it.
Fraud aspect Explain the deception and resulting transfer of money or attempted transfer.
Evidence summary List chats, screenshots, receipts, witness statements, and real-identity proof.
Relief requested Ask for investigation, tracing, coordination with financial institutions, and filing of appropriate charges.

XXIII. On Immediate Safety and Containment

If the scammer still has your personal data, photos, or account-linked information, take defensive steps at once:

change passwords for related accounts;
enable two-factor authentication where available;
alert banks and e-wallets;
inform close contacts that the Telegram profile is fake;
issue a public clarification if your reputation or business identity is being used.

These steps are not a substitute for reporting, but they reduce ongoing harm.

XXIV. Important Limits and Expectations

Not every report leads quickly to arrest. Telegram-based cases can be technically and procedurally difficult. Still, a well-documented report can do several important things:

create an official record;
support platform action;
help trace money flows;
connect multiple victims;
support prosecutor review;
and preserve your rights.

The fact that the scam used a stolen identity is legally significant. It can elevate the case beyond a simple private dispute and place it squarely in cybercrime and fraud territory.

XXV. Bottom Line

In the Philippines, a Telegram scam using a stolen identity should be treated as a serious legal matter, not just an online nuisance. The strongest response is a coordinated one:

preserve evidence immediately,
document the fake identity use carefully,
secure the cooperation of the real identity owner where possible,
notify banks or e-wallets at once,
report to PNP Anti-Cybercrime Group or NBI,
and formalize the matter through a sworn complaint where prosecution is sought.

A successful report is built on clarity, speed, and evidence. The more clearly you show that the Telegram account used another person’s identity without right and used that false identity to deceive, obtain money, or cause harm, the stronger the case becomes under Philippine law.

This is general legal information for Philippine context based on my knowledge cutoff in August 2025, not case-specific legal advice. Exact charges, procedure, and office practice can vary by facts and locality.