Quick answer

A dummy account does not become lawful merely because its owner is anonymous. In the Philippines, the practical way to stop online harassment is to preserve the evidence before it disappears, report and block the account, secure your own accounts, and promptly file a documented complaint with the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or the proper prosecutor’s office. When necessary, investigators can seek court-authorized disclosure of subscriber, traffic, location, device, or other computer data that may help identify the person behind the account.

Creating a pseudonymous account is not automatically a crime. Liability depends on what the person does with it. Depending on the facts, repeated attacks may constitute cyber libel, threats, coercion, unjust vexation, computer-related identity theft, gender-based online sexual harassment, psychological violence under the VAWC law, unlawful sharing of intimate images, or another offense. The correct remedy depends on the exact words, conduct, relationship of the parties, evidence, and harm caused.

Do not delay. Evidence may be deleted, platform records may become unavailable, and some offenses have short filing periods. Most importantly, the Supreme Court has definitively ruled that cyber libel prescribes in one year from the date the defamatory material is actually discovered by the offended party, authorities, or their agents.

First, determine whether anyone is in immediate danger

Contact the police or call 911 immediately when the account:

Makes a credible threat to kill, injure, abduct, or sexually assault someone;
Publishes your home address, real-time location, children’s school, workplace schedule, or travel plans;
Appears to be following you offline;
Demands money, sex, passwords, or another benefit in exchange for silence;
Threatens to release intimate images;
Has taken over your email, banking, social-media, or messaging accounts; or
Targets a child or another vulnerable person.

Do not arrange a private meeting with the suspected harasser. Do not pay an extortion demand without first getting law-enforcement and legal advice. Move to a safe location, notify trusted people, and tell building, school, or workplace security when the threat involves a known place.

Preserve the evidence before reporting or blocking

A removed account can still be investigated, but the case becomes harder when the victim has kept only cropped screenshots or cannot show where the material came from.

Preserve each incident before blocking the account:

Capture the entire screen. Include the username, profile photo, account name, date, time, post or message, and surrounding context. Keep an unedited copy.
Save the exact URLs. Copy the profile link and the individual links to posts, comments, videos, stories, or other content. A username alone may be changed.
Record the account’s identifying details. Note its creation date when visible, bio, previous usernames, followers, friends, linked pages, contact details, and any account or user ID shown by the platform.
Make a screen recording. Start from the profile page, open the offensive content, and scroll through the conversation. This helps show that separate screenshots came from the same account.
Export or download account data when the platform permits it. Keep original message files, notification emails, login alerts, and platform acknowledgments.
Preserve the device. Do not factory-reset the phone, erase the conversation, or overwrite original files. Back up the evidence to another secure device or storage location.
Prepare a chronological incident log. For every occurrence, record when you first discovered it, what happened, who saw it, what report you made, and what harm followed.
Keep evidence of impact. Preserve medical or counseling records, leave records, school reports, client cancellations, lost-income documents, security expenses, and messages from people who received or believed the posts.
Identify witnesses. A person who personally saw the account, received the message, recognized facts known only to the suspected offender, or observed the effect on you may later provide an affidavit or testimony.

Electronic evidence must still be shown to be authentic, reliable, and connected to the accused. The Rules on Electronic Evidence place the burden of proving authenticity on the party offering a private electronic document.

Evidence that may identify the person behind a dummy account

You do not always need to know the account owner before filing a complaint. Identification can develop during the investigation.

In XXX v. People, G.R. No. 274842, October 22, 2025, the Supreme Court recognized that ownership, access, or authorship of a social-media account may be proved by direct or circumstantial evidence. Relevant evidence may include:

An admission that the person owned, accessed, or wrote through the account;
A witness who saw the person using the account or composing the message;
Information in the post known only to the offender or a small group;
Distinctive expressions, spelling, language, or writing patterns;
Conduct consistent with the account’s posts or private messages;
Records from a social-media company, internet provider, or telecommunications company;
Device-forensic results, location data, account history, or other technical attributes; and
Other facts which, taken together, reliably connect the person to the account.

The Court also acknowledged that dummy accounts are easy to create. A name or profile photograph, standing alone, should not automatically be treated as conclusive proof of who wrote the post. Technical records are useful, but the Court said they are not indispensable when other evidence sufficiently establishes authorship.

Report the content to the platform

After preserving the evidence, use the platform’s reporting tools. Select the most accurate ground, such as:

Harassment or bullying;
Credible threats;
Impersonation;
Sharing personal information;
Non-consensual intimate imagery;
Sexual exploitation;
Hate speech;
Account compromise; or
Fraud or extortion.

Keep screenshots and reference numbers for every report. When the account impersonates you, use the platform’s dedicated impersonation process and provide identity documents only through the platform’s official form.

Blocking or restricting the account can reduce direct contact. Adjust who may message, tag, mention, follow, comment on, or search for you. Review active login sessions, change reused passwords, enable two-factor authentication, and warn contacts not to respond to requests from the fake account.

A platform report may remove content, but it is not a substitute for a criminal complaint, does not necessarily identify the offender, and should not be assumed to stop a legal prescriptive period.

Ask law enforcement to preserve platform records quickly

Republic Act No. 10175 requires the preservation of traffic data and subscriber information for a minimum period of six months from the relevant transaction. Content data is preserved for six months from receipt of a lawful preservation order, and law enforcement may order an authorized extension. Disclosure and examination of protected computer data ordinarily require the appropriate legal process or cybercrime warrant.

Because records can be deleted under ordinary platform-retention practices, tell the investigator that the account is active and ask whether an immediate preservation request should be sent to the platform, internet provider, or telecommunications company.

A private complainant generally cannot compel a foreign social-media company to disclose another user’s IP address or subscriber records merely by sending a demand letter. Investigators may apply for a Warrant to Disclose Computer Data or another appropriate cybercrime warrant under A.M. No. 17-11-03-SC. International requests may also be necessary when records are stored abroad.

Where to file a complaint

NBI Cybercrime Division

The National Bureau of Investigation provides investigative assistance for victims of computer crimes. You may approach the NBI Cybercrime Division or an NBI regional or district office. The NBI also maintains an official online-complaint page and directory of offices.

Bring:

A government-issued ID;
Your incident timeline;
Printed and electronic copies of the evidence;
URLs and account details;
Your phone or device containing the original records;
Names and contact details of witnesses;
Copies of platform reports;
Information about any suspected person and the factual basis for the suspicion; and
Records showing threats, emotional harm, financial loss, or other damage.

PNP Anti-Cybercrime Group or local police

You may also report to the PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the nearest police station. For sexual harassment, domestic abuse, or offenses against children, ask for assistance from the Women and Children Protection Desk.

A police blotter documents that an incident was reported. By itself, however, a blotter entry is not the same as completing the sworn complaint, affidavits, evidence submission, and prosecutorial steps required for a criminal case.

Office of the city or provincial prosecutor

A criminal complaint may also be filed with the prosecutor’s office having proper jurisdiction. The usual submission includes a complaint-affidavit, witness affidavits, documentary or electronic evidence, and copies for the respondents. Venue and the need for preliminary investigation depend on the offense and where legally significant acts or harm occurred.

Because online conduct may involve several locations, allow the investigator or lawyer to assess the correct prosecutor’s office and court rather than filing identical complaints in multiple places without a legal basis.

DOJ Office of Cybercrime

The Department of Justice Office of Cybercrime handles cybercrime policy, coordination, international cooperation, and related assistance. Its official site publishes Republic Act No. 10175, its implementing rules, contact information, and other cybercrime resources. Under the law’s implementing rules, law-enforcement authorities must record sworn cybercrime complaints in their official docketing system for investigation.

Which Philippine laws may apply?

Cyber libel

Cyber libel generally involves a public and malicious imputation of a crime, vice, defect, act, omission, condition, or circumstance that tends to dishonor, discredit, or expose an identifiable person or entity to contempt, when published through a computer system.

Not every insult, criticism, negative opinion, or inaccurate statement is automatically libel. The exact words, context, factual basis, identification of the complainant, publication to another person, applicable privileges, and presence or absence of malice matter.

In Disini v. Secretary of Justice, the Supreme Court upheld the cyber-libel provision as applying to the original author of the online statement. The Court did not treat a person as criminally liable for cyber libel merely for receiving, reacting to, or commenting on material written by somebody else under the provisions challenged in that case. A person who creates a new defamatory post or adds a separate unlawful imputation presents a different factual question.

Deadline: Cyber libel prescribes in one year from actual discovery, not automatically from the upload date. Document the date you first discovered the post. Filing the proper complaint with the prosecutor or DOJ may interrupt prescription under current Supreme Court doctrine, but a platform report, private demand, or informal conversation should not be relied upon for that purpose.

Threats, coercion, and unjust vexation

Messages that threaten a crime, force a person to do something against their will, or intentionally cause serious annoyance or distress may fall under provisions of the Revised Penal Code, depending on their wording, conditions, seriousness, and surrounding acts.

Section 6 of the Cybercrime Prevention Act covers crimes under the Revised Penal Code and special laws when committed through information and communications technology and may increase the applicable penalty. The prosecutor must still establish every element of the underlying offense.

Computer-related identity theft

Using a dummy account is not, by itself, computer-related identity theft. The offense may become relevant when someone fraudulently acquires, uses, misuses, transfers, possesses, alters, or deletes another person’s identifying information without right.

An account that copies your name, photographs, employment details, contact information, or other identifiers to pretend to be you, deceive others, solicit money, or damage your reputation should be reported as possible impersonation and identity theft.

Gender-based online sexual harassment

The Safe Spaces Act, Republic Act No. 11313, covers gender-based online conduct such as unwanted sexual remarks, threats, cyberstalking, persistent messaging, unauthorized sharing of sexual content, impersonating identities, and posting lies to harm a victim’s reputation when the conduct falls within the law’s gender-based scope.

The law provides criminal penalties for gender-based online sexual harassment and allows victims to seek appropriate remedies and psychological counseling. The PNP Anti-Cybercrime Group is tasked with identifying perpetrators, while the DOJ Office of Cybercrime coordinates related legal processes.

Violence Against Women and Their Children

Republic Act No. 9262 may apply when the victim is a woman and the harasser is her husband, former husband, current or former dating or sexual partner, or a person with whom she has a common child. It also protects qualifying children.

Repeated public humiliation, threatening posts, stalking, or malicious online attacks may form part of psychological violence when the statutory relationship and required mental or emotional anguish are proved. Courts may issue temporary or permanent protection orders. A Barangay Protection Order has a more limited statutory scope and should not be assumed to cover every form of online psychological abuse.

Preserve counseling, medical, work-absence, and witness evidence showing the effect of the conduct. Emotional anguish must be proved; it should not be treated as automatically established by the existence of an offensive post.

Non-consensual intimate images

Republic Act No. 9995 prohibits specified acts involving the capture, copying, reproduction, sale, distribution, publication, or broadcast of sexual images or recordings without the required consent. Consent to the original recording does not automatically authorize later copying or publication.

Report actual or threatened distribution immediately. Do not forward the image to friends “for evidence.” Preserve it in the safest manner possible and give it only to your lawyer, investigator, or another authorized person.

When a child is depicted or sexually targeted, additional child-protection and online sexual-abuse laws may apply. Treat the matter as urgent.

Data-privacy violations and doxxing

Publishing another person’s address, phone number, government identifiers, medical information, financial information, or other personal data may raise issues under the Data Privacy Act, depending on who processed the information, why it was processed, and whether an exemption applies.

Not every personal dispute or doxxing incident automatically falls within the National Privacy Commission’s jurisdiction. The NPC route is most relevant when personal information has been unlawfully processed, maliciously disclosed, improperly disposed of, or handled in violation of a data subject’s rights. The NPC requires a verified or notarized complaint in the prescribed form with supporting evidence and permits the filing methods stated in its current rules and official guidance.

Cyberbullying involving a student

For an elementary or secondary-school learner, report the incident to the school’s designated child-protection or anti-bullying personnel in addition to preserving evidence and considering law-enforcement action. Republic Act No. 10627 requires schools to maintain policies for preventing and addressing bullying, including bullying through electronic means within the law’s coverage.

A school complaint does not prevent the family from reporting conduct that may also constitute a crime or child-abuse offense.

Practical ways to reduce continuing harm

While the investigation is pending:

Lock down who can view old posts, friends, contact details, and location information.
Remove public photographs showing your home, vehicle plate, school, workplace, or daily routine.
Disable location tagging and review app permissions.
Ask relatives not to tag your live location.
Tell your employer, school, clients, or family about an impersonation account before the harasser contacts them.
Publish a brief factual warning through your authentic account when necessary: identify the fake account and state that you are not connected with it. Avoid naming an unverified suspect.
Ask recipients to preserve any message received from the dummy account rather than deleting or forwarding it.
Keep communications with the platform, police, NBI, prosecutor, school, or employer in one organized folder.
Continue updating your incident log when new accounts appear.

Common mistakes that can weaken a case

Reporting before preserving

Mass reporting may cause the account to disappear before the victim has saved URLs, original messages, and contextual evidence.

Posting the suspected person’s name without reliable proof

A familiar writing style or personal detail may support an investigation but does not necessarily justify publicly accusing someone. A mistaken public accusation can create a separate legal dispute.

Editing or annotating the only copy

Highlighting, cropping, adding arrows, or combining screenshots may be useful for explanation, but retain the untouched originals and identify any edited copy as an aid.

Engaging in a prolonged public fight

Arguments generate more content, may reveal your strategy, and can expose you to counterclaims. Preserve necessary responses, then restrict contact.

Assuming deletion ends the case

A deleted account does not automatically prevent a complaint. Your copies, witnesses, linked accounts, platform records, provider data, and circumstantial evidence may remain relevant.

Waiting for the platform to finish its review

Platform processes and legal deadlines are separate. This is especially dangerous in a possible cyber-libel case because of the one-year period from discovery.

Treating a blotter entry as the completed case

Ask what additional affidavit, evidence, preservation request, prosecutor filing, or follow-up is required. Keep the docket or reference number and the investigator’s official contact details.

When a lawyer’s help is urgent

Seek prompt advice from a Philippine lawyer experienced in criminal, cybercrime, privacy, or family law when:

The account has made a credible threat;
The suspected person is a spouse, former partner, coworker, employer, teacher, or public official;
Intimate images, a child, or sexual exploitation are involved;
You are being extorted;
The account is contacting customers, employers, schools, or relatives;
You need a protection order;
The first discovery of a potentially libelous post occurred nearly one year ago;
The platform or suspected account owner is outside the Philippines;
Law enforcement says records must be obtained from a foreign provider; or
You are considering a civil action for damages or other court relief.

People who cannot afford private counsel may inquire with the Public Attorney’s Office, an Integrated Bar of the Philippines legal-aid office, a law-school legal-aid clinic, or another accredited legal-aid provider. Eligibility and availability vary.

Frequently asked questions

Can the police really identify a dummy account?

Sometimes. Investigators may combine witness testimony, account behavior, writing patterns, personal knowledge shown in messages, linked profiles, device evidence, and court-authorized records from platforms, telecommunications companies, or internet providers. Identification is possible but never guaranteed, particularly when records have been deleted or the offender used sophisticated concealment methods.

Are screenshots enough to file a complaint?

Screenshots can support a complaint, but they are stronger when accompanied by URLs, original files, screen recordings, witness testimony, account details, and the device on which the material was received. A criminal conviction also requires proof connecting the accused to the account and establishing every element beyond reasonable doubt.

Is using a fake name online illegal?

Not automatically. Anonymous or pseudonymous speech is not, by itself, the offense. The account’s conduct may become unlawful when it is used for threats, defamation, fraud, impersonation, sexual harassment, identity theft, stalking, extortion, or another prohibited act.

Can I file even if I do not know the harasser’s real name?

Yes. Bring all available account identifiers and explain that the offender is unknown. Law enforcement can evaluate whether preservation requests, cybercrime warrants, forensic examination, or other investigative measures are justified.

What if the dummy account has already been deleted?

You may still report it. Preserve everything you have, including notification emails, links, reports, screenshots, screen recordings, witness messages, and the dates on which the account was active. Tell investigators when it disappeared.

Should I send a cease-and-desist message?

A carefully drafted demand can sometimes help, especially when the person is known. It may also alert the offender to delete evidence or create more accounts. Preserve evidence first and obtain legal advice when threats, extortion, intimate images, or a short prescriptive period are involved.

Can I publicly expose the person I suspect?

That is risky unless the identification is supported by reliable evidence and the publication is legally justified. Give the information privately to investigators or counsel. Avoid turning an unverified suspicion into a new defamatory publication.

Can the barangay stop the harassment?

A barangay may assist with immediate community safety and qualifying VAWC protection measures. Ordinary cybercrime investigation, platform-data preservation, and court-authorized disclosure generally require law enforcement, prosecutors, and courts. Do not rely solely on informal mediation when there are threats, continuing danger, or disappearing electronic evidence.

What if the harasser is abroad?

Philippine law may still apply in circumstances covered by the Cybercrime Prevention Act, but identifying the offender and obtaining foreign-held records may require international cooperation. Report promptly to the NBI, PNP Anti-Cybercrime Group, or DOJ Office of Cybercrime.

Official sources and complaint pages

General-information disclaimer

This article provides general Philippine legal information, not legal advice for a particular case. Online-harassment cases are highly fact-sensitive, and the correct offense, venue, evidence, deadline, and remedy may depend on the actual posts, account records, relationship of the parties, and documents available. Laws, court rules, agency procedures, and filing channels may change.

Sources checked through July 23, 2026.