Executive summary

Identity theft on Facebook—someone posing as you or misusing your personal data to deceive others—can trigger criminal, administrative, and civil liability in the Philippines. The Cybercrime Prevention Act of 2012 (Republic Act No. 10175) squarely penalizes computer-related identity theft, while the Data Privacy Act of 2012 (Republic Act No. 10173) protects your personal information and provides a route to hold organizations (including platforms and local businesses) accountable for privacy violations. Victims can (1) report and pursue criminal charges through the PNP-Anti-Cybercrime Group (ACG) or NBI-Cybercrime Division, (2) file privacy complaints with the National Privacy Commission (NPC), (3) seek civil damages in court, and (4) request platform takedown and preservation of digital evidence.

What “identity theft” means in the Philippine context

Core conduct. Using, acquiring, misusing, transferring, or possessing another person’s identifying information (e.g., name, photos, government IDs, contact details, account credentials) without right and with intent to cause damage or gain, done through information and communications technology (ICT) (e.g., Facebook accounts, Messenger, Pages).
Common Facebook scenarios.
- Impersonation accounts (same name/profile photo; messaging friends to solicit money).
- Account takeovers (compromised login, changed recovery info).
- Deepfakes or edited photos used to deceive or extort.
- Business Page hijacking (co-admin removed; page used to run scams).
- Social-engineering using leaked data (e.g., breached email/phone) to reset your account.

Governing laws at a glance

Cybercrime Prevention Act (RA 10175). Criminalizes computer-related identity theft and other cyber offenses (e.g., computer-related fraud/forgery, illegal access, cyber libel). Provides rules on preservation, disclosure, and jurisdiction.
Data Privacy Act (RA 10173). Protects personal information (PI) and sensitive personal information (SPI). Imposes duties on personal information controllers/processors; establishes data subject rights; empowers the NPC to investigate, issue compliance orders, and recommend prosecution.
Revised Penal Code (RPC). Depending on facts, related offenses may apply (e.g., estafa, libel, unjust vexation, grave threats, falsification). Under RA 10175, penalties for some RPC crimes increase by one degree when committed through ICT.
Special laws (context-dependent). Anti-Photo and Video Voyeurism Act, Anti-Wiretapping Act, and laws on violence against women and children (if the conduct targets protected classes or involves intimate images).

Criminal remedies under RA 10175

1) Offense: Computer-Related Identity Theft

Elements (simplified):

Identifying information of another person;
Acquisition/possession/use/misuse/transfer of that information without right;
Intent to damage or to gain; and
Conduct facilitated through ICT (e.g., Facebook).

Penalty. Punishable by imprisonment and/or fine under RA 10175. (If the conduct also amounts to an RPC offense via ICT—e.g., estafa through impersonation—penalties may be elevated.)

2) Related cyber offenses that often accompany identity theft

Illegal access (breaking into the account).
Computer-related fraud/forgery (fake messages, manipulated screenshots).
Cyber libel (defamatory posts sent from the impersonation account).
Cybersex/online sexual exploitation (if images are used to extort).
Unlawful or prohibited acts involving devices (credential-stealing tools).

3) Jurisdiction and venue (practical guide)

Philippine courts can take jurisdiction if any element occurred here, the victim or offender is Filipino, or the act affects a Filipino.
Where to file: Typically with PNP-ACG or NBI-CCD in your locality; they coordinate with prosecutors for inquest or filing. For cyber libel and other RPC offenses via ICT, venue can depend on the complainant’s residence or where the post was accessed—consult counsel for venue strategy.

4) Evidence handling and preservation

Preservation letters. Request immediate preservation of traffic/content data from Facebook and relevant service providers. RA 10175 provides for minimum six-month preservation, extendable.
Chain of custody. Keep original files/devices intact; make forensic copies where possible; hash files (MD5/SHA-256) to prove integrity.
Screenshots + source. Capture the URL, date/time, and full screen; use “View Source” or developer tools to capture post IDs when possible.
Witness statements. Obtain affidavits from friends/contacts who received messages from the impersonation account or were defrauded.
Financial traces. Keep GCash/bank transfer records, remittance slips, e-wallet receipts used in the scam.

Administrative remedies under the Data Privacy Act (RA 10173)

1) When to use the DPA route

Your personal data was processed without your consent or other lawful basis, or beyond the declared purpose (e.g., a local e-commerce seller harvested your Facebook profile info and spammed/phished you; a breached local platform failed to secure your data that was later used for impersonation).

2) Your rights as a data subject

Right to be informed, object, access, rectification, erasure/blocking, data portability, and to file a complaint with the NPC.

3) Filing a complaint with the NPC

Parties: Name the personal information controller (PIC) (e.g., a local company, school, clinic, employer) and any processor involved.
Contents: Verified complaint, facts, nature of data, harm suffered, what you’ve asked the PIC to do (e.g., delete, secure, notify), and relief sought.
Process (typical flow): Docketing → mediation or conference → submissions/position papers → compliance orders (e.g., to cease processing, delete data, notify data subjects, improve security) → possible recommendation for criminal prosecution.
Relief available: Orders compelling action, administrative fines/sanctions (when applicable), and referrals for prosecution. For monetary damages, you generally file a separate civil action.

4) DPA offenses (high-level)

Unauthorized processing, access due to negligence, improper disposal, malicious or unauthorized disclosure, concealment of security breaches, etc. These carry fines and imprisonment depending on the offense, the nature of the data (PI vs SPI), and aggravating factors (e.g., vulnerable data subjects, financial harm).

Note on platforms like Facebook. The DPA can apply to organizations outside the Philippines if they maintain an office/agency here or use equipment in the country. In practice, the NPC has investigated global platforms in cooperation with foreign counterparts and local entities when Filipino users are affected.

Civil remedies and private enforcement

1) Civil action for damages

Against the impersonator: for fraud, defamation, invasion of privacy, or other torts under the Civil Code.
Against negligent entities: If a local entity’s poor security allowed your data to leak and be used for impersonation, pursue damages under the DPA and quasi-delict (Article 2176) where appropriate.
Interim relief: Seek injunctions or temporary restraining orders to stop ongoing misuse where facts justify.

2) Restitution to third parties

If friends were duped into sending money to the impersonator, coordinate a group complaint to streamline proof of a common scheme; they may file separate estafa complaints for their losses.

Working with Facebook (platform-level steps)

Report impersonation via Help Center → Impersonation (for individuals or Pages). Attach a government ID and sample links showing confusion/damage.
Use “Report profile” on the fake account: choose Pretending to be someone → Me. Ask friends to report the same profile (helps with platform detection).
If your account was hacked, use facebook.com/hacked, run security checkup, change passwords, revoke suspicious sessions, and enable 2-factor authentication (2FA).
For urgent harm (e.g., sextortion), use “Nudity/Intimate Image” tools and request rapid removal. Preserve evidence before it’s deleted.
Law enforcement or counsel can submit legal process through Facebook’s Law Enforcement Online Request System to preserve and, with proper court orders, disclose data relevant to the case.

Step-by-step playbook for victims

First 24–48 hours

Secure your accounts: New, strong password; 2FA; update recovery email/phone; check trusted devices.
Document everything: Screenshots with URL/timestamps; list friends contacted by the impersonator.
Report to Facebook and request takedown; ask friends to avoid engaging and to report.
Freeze the money trail: If funds moved, alert bank/e-wallet (e.g., GCash, Maya) to flag recipient accounts and file dispute.

Law-enforcement pathway

Go to PNP-ACG or NBI-CCD (nearest office).
Bring: government ID; screenshots (with URLs/time); list of witnesses; bank/e-wallet proofs; device if needed; draft affidavit-complaint.
Request officers to issue preservation letters to Facebook, telcos, and payment intermediaries.
Coordinate with prosecutor for inquest (if suspect is caught) or preliminary investigation (if at large).

NPC privacy pathway

Write the erring local PIC first (demand letter invoking DPA rights); give them a reasonable time to act.
If unresolved or egregious, file a verified complaint with the NPC including evidence and the PIC’s response (or lack thereof).

Civil action pathway

Consult counsel to assess damages, injunctive relief, and venue (often where you reside or where the wrongful act occurred/was accessed).

Evidence & documentation toolkit

Timeline table: account creation of fake profile, first contact with your friends, requests for money, takedown/report dates.
Forensic checklist:
- Export Facebook data (Settings → Download your information).
- Hash critical files; log collection steps.
- Keep original messages (avoid copy-pasting only).
Metadata to capture:
- Facebook profile ID/URL of fake account, message IDs, post IDs;
- Payment account numbers, reference numbers, IP logs if available;
- Device info (IMEI/serial) if a device is seized.

Special contexts

Minors as victims. Prioritize immediate takedown and contact school/guardians. Some acts (sextortion, grooming) invoke stricter penalties and mandatory reporting.
Gender-based abuse. If misuse involves intimate images or threats targeting women/children, consider the Anti-Photo and Video Voyeurism Act, Safe Spaces Act, and VAWC remedies in parallel.
Business Pages. If your business Page is hijacked, gather Business Manager logs, ad account records, and invoices; request platform admin restoration and report fraudulent ads.

Compliance and prevention (for individuals and organizations)

Individuals:
- 2FA, passkeys where available; unique passwords via a manager.
- Lock down Friends list visibility and public profile info; review tagging and impersonation reporting settings.
- Be skeptical of urgent money requests even from “you.” Establish code words with family.
Organizations (PICs/Processors):
- Maintain a privacy management program (DPIAs, privacy notices, consent records).
- Implement access controls, encryption, breach response plans, and vendor due diligence.
- Train staff against social engineering; test with phishing simulations.
- Keep a breach log and notify data subjects/NPC when thresholds are met.

Frequently asked questions

Is merely using my publicly available profile photo “identity theft”? Not necessarily. The act becomes criminal when your identifying information is used without right and with intent to damage or gain (e.g., scamming your contacts). Absent that intent, other remedies—like platform takedown or privacy complaints—may still apply.

What if the perpetrator is overseas? RA 10175 allows extraterritorial jurisdiction in defined scenarios (e.g., effect on a Filipino). Law enforcement may work through MLATs and provider cooperation. Preservation orders remain crucial.

Can I get damages from the platform? Generally difficult unless you show actionable local violations (e.g., non-compliance by a local PIC). Most relief is takedown/preservation plus criminal/civil actions against the impersonator and DPA remedies against local entities that mishandled your data.

How long do cases take? Timelines vary widely. You can often get quick platform action on clear impersonation while criminal/privacy cases proceed on their own tracks.

Practical templates (copy and adapt)

A. Preservation request (excerpt)

We represent [Name], victim of computer-related identity theft via Facebook profile [URL/Profile ID]. Pursuant to RA 10175, please preserve all traffic and content data, including registration info, login IPs, device identifiers, messages, and posts associated with: (1) Fake account: [URL/ID]; (2) Target’s real account: [URL/ID]; (3) Relevant time window: [dates]. We are coordinating with law enforcement and will follow with appropriate legal process for disclosure.

B. Affidavit-complaint (skeleton)

Affiant’s identity and residence.
Factual narrative (creation/use of fake profile; how contacts were deceived; losses).
Elements matched to RA 10175 identity theft (identifying info, without right, intent to gain/damage, via ICT).
Evidence list (screenshots with URLs/time, witnesses, bank/e-wallet proofs).
Relief prayed for (filing of charges; preservation; warrants/orders as needed).

Quick victim checklist

Change passwords; enable 2FA; review sessions/devices.
Screenshot fake profile/posts/messages with URLs/timestamps.
Report to Facebook (Impersonation) and request takedown.
Notify friends/contacts not to send money/codes.
File report with PNP-ACG/NBI-CCD; ask for preservation letters.
Consider NPC complaint if a local entity mishandled your data.
Consult counsel on civil damages and injunctions.

Final notes and cautions

Accuracy over speed. Preserve first, then pursue takedown—but if harm is imminent (e.g., extortion), prioritize immediate removal while documenting everything.
Venue and strategy matter. For mixed facts (identity theft + fraud + defamation), a multi-track approach (criminal + privacy + civil) is often best.
Legal assistance helps. A lawyer can craft affidavits aligned with the elements of the offenses, secure the right court orders, and coordinate with platforms and payment providers.

If you want, I can adapt the affidavit and preservation templates to your exact scenario and turn your screenshots/links into a ready-to-file packet.