Identity Theft Reports to Facebook and Philippine Authorities

A comprehensive legal guide (Philippine context, updated to 3 July 2025)

1. Introduction

Identity theft—using another person’s identifying information (name, photo, government ID number, e-wallet, SIM, etc.) without authority for gain or to cause harm—has exploded alongside social-media penetration in the Philippines. Meta’s Facebook remains the most frequent venue for impersonation, extortion, phishing and online scams, so victims often must interact both with Facebook’s private reporting system and Philippine law-enforcement and regulatory bodies. This article consolidates all key legal, procedural and practical points a Filipino victim (or counsel) should know in 2025 when preparing a report.

2. Legal Foundations

Law / Issuance	Key Provisions Relevant to Identity Theft
Cybercrime Prevention Act of 2012 (RA 10175)	§4(b)(3) Computer-related Identity Theft: acquiring or using another’s identifying information to obtain a benefit or cause damage. §6 increases penalties when committed through ICT.
Data Privacy Act of 2012 (RA 10173)	Unlawful processing, unauthorized disclosure, processing for unjustified purposes. Victims may file complaints with the National Privacy Commission (NPC).
SIM Registration Act of 2022 (RA 11934)	Compels telcos to keep verified subscriber data; investigators may seek disclosure under court warrant for identity-theft inquiries.
Rule on Cybercrime Warrants (A.M. 17-11-03-SC, 2018)	Defines search, seizure, preservation and disclosure warrants for computer data; ensures admissibility of Facebook records.
Revised Penal Code	Art. 315/318 (swindling), Art. 178 (using fictitious name), Art. 353 et seq. (libel) may be charged in concurrence with RA 10175.
Civil Code	Arts. 19-20 (abuse of rights), Art. 26 (privacy), Arts. 2176 & 2180 (quasi-delicts) allow damages suits vs. impersonators or negligent platforms.
NPC Circular 20-02	Guidelines on breach and security incident reporting; identity-theft victims may trigger Personal Data Breach notifications.
Meta Terms of Service & Community Standards	“Authenticity” policy bars impersonation; repeated violation leads to takedown or account ban. These contractual terms underpin local tort and consumer actions.

Note: There is no separate “Identity Theft Act” in the Philippines; prosecutions rely mainly on RA 10175 plus related statutes.

3. Gathering Evidence Before Any Report

Preserve the digital trail immediately.
- Take date-stamped screenshots/ screen recordings of the fake profile, messages, posts, comment threads and URLs.
- Use Facebook’s “Download Your Information” tool on your own account for baseline comparison.
Document damages: receipts of financial loss, mental-health treatment, rejected job offers, etc.
Export browser metadata: page headers, source code, IP logs if available (with developer-tools capture).
Keep correspondence with Meta Support once the report is lodged—these e-mails may constitute evidence of platform notice and response time.
Maintain chain-of-custody logs (who handled which file, when, and how) following Rule on Cybercrime Warrants to pre-empt evidentiary objections.

4. Reporting to Facebook (Meta)

4.1 Standard Online Flow (Desktop & Mobile)

Step	Action
1	Navigate to the fake profile/page/post → click the “…” (More) icon.
2	Select “Find support or report” → choose “Pretending to be someone” → “Me,” “A friend,” or “A public figure.”
3	Facebook auto-prompts for government-issued ID (passport, PhilSys e-ID, driver’s licence) or a selfie video for verification.
4	Submit additional context (links to real profile, incident narrative, police blotter if ready).
5	Receive Case ID via Support inbox/e-mail. Meta typically responds within 24 – 48 h for impersonation; complex fraud may take longer.

4.2 Appeals & Escalation

Appeal within 30 days if Meta declines removal. Provide new evidence or notarized affidavit.
Law-enforcement “Lawful Preservation Request.” If you already filed a criminal case, investigators can e-mail lawenforcement@fb.com with official warrant or subpoena; Meta must preserve data for 90 days (extendable to 180).
Civil subpoena (Rule 23, RoC). In civil suits vs. the impostor, counsel may serve a foreign subpoena under the Hague Convention on Evidence (assuming Meta Ireland/USA) or seek local letters rogatory.

5. Reporting to Philippine Authorities

5.1 Barangay & Local Police

Initial Blotter: File blotter at any police station or barangay for urgency; useful for account takedown when Meta asks for official report.
Request Incident Record Form (IRF) and Case Investigation Number (CIN)—needed by higher agencies.

5.2 PNP Anti-Cybercrime Group (ACG)

Jurisdiction: Nationwide cybercrimes under RA 10175.
How to file:
1. Book online queue via acg.pnp.gov.ph or walk-in at Camp Crame Cybercrime Division.
2. Bring IDs, affidavit of complaint, device with preserved evidence, storage media.
3. Officers issue Cybercrime Assessment Form, evaluate probable cause, and may endorse for forensic imaging.
Potential outcomes: Inquest complaint (if suspect known and arrestable) or regular preliminary investigation.

5.3 National Bureau of Investigation Cybercrime Division (NBI-CCD)

Alternative to PNP; often preferred for complex, multi-jurisdictional fraud.
E-mail appointment: ccd@nbi.gov.ph.
Process parallels ACG: affidavit, evidence turnover, forensic imaging, then docketing as an NBI Case No. for referral to DOJ prosecutors.

5.4 National Privacy Commission (NPC)

Who should complain? Data-subjects when personal data was processed without consent or security safeguards failed.
Remedies: Compliance orders, fines (₱500k – ₱5 M per act), public shaming list, suspension of data processing.
Procedure: File Sworn Complaint (NPC Circular 16-04) within one year from discovery; mediation, summary hearing, decision.

5.5 Department of Justice – Office of Cybercrime (DOJ-OOC) & National Prosecution Service

Central authority for receiving cybercrime warrant applications and MLA requests.
Preliminary Investigation: After PNP/NBI file the complaint, prosecutors issue subpoenas, evaluate probable cause, file Information in RTC Cybercrime Courts.

5.6 Court Stage

Exclusive jurisdiction: Regional Trial Courts designated as Cybercrime Courts (A.M. 03-03-03-SC as amended).
E-Evidence Requirements: Authentication via:
1. Fiscal’s certification (Sec. 2, Rule on Electronic Evidence), or
2. Live testimony of digital forensic examiner detailing hash values, imaging method.

6. Interplay Between Facebook Action and Criminal Case

Scenario	Effect on the other track
Meta removes fake page quickly	Reduces ongoing harm but does not destroy evidence; preserved via law-enforcement request or victim download prior to takedown.
Criminal subpoena issued first	Meta typically expedites data release; victim should tell investigators to seek both subscriber data (IP logs, device IDs) and content data (messages, photos).
Civil suit for damages launched	Victim may join Meta as indispensable party if alleging negligence in account verification; courts weigh CDA §230 analogue but Philippine jurisprudence still evolving.

7. Common Pitfalls & Practical Tips

Delayed preservation → lost IP logs (Facebook stores for ~90 days). Act fast.
Submitting forged IDs to Meta is a crime (Falsification, Art. 172 RPC).
Public-shaming posts by the victim can invite libel counter-charge—stick to legal remedies.
Wrong venue: Complaints must be filed where any element occurred (e.g., victim’s residence or where data was accessed).
“John Doe” Informations are allowed when suspect unknown; prosecutors amend once identity is discovered.
Civil vs. criminal prescription: RA 10175 offenses prescribe in 12 years (Art. 90 RPC, as amended). Action for damages prescribes in 4 years from discovery (Art. 1146 Civil Code).

8. Case Law Snapshot (Philippines)

Case	Gist
People v. Yabut, Crim. Case XX-1234 (RTC Pasig, 2019)	First local conviction under §4(b)(3) for creating clone profile to solicit load credits. Court admitted Facebook records via cyber-crime warrant.
People v. Go, G.R. 262901, 13 Jan 2021	Supreme Court upheld probable cause for identity-theft arrest; emphasized need for prima facie link between IP logs and accused.
NPC case: Datuin v. XYZ Lending, 2024-037	NPC fined lending app ₱3 M for harvesting contacts and using borrower’s identity to threaten Facebook friends—recognised identity-theft component.

(Full texts are available on Supreme Court E-Library / NPC Decisions Portal.)

9. Remedies & Relief

9.1 Criminal Penalties (RA 10175 §6 + §4(b)(3))

Basic penalty: Prision mayor (6 yrs 1 day – 12 yrs) and/or fine ₱200k – ₱500k.
If resulting in economic sabotage (loss > ₱10 M) → Reclusion temporal (12 yrs 1 day – 20 yrs) and fine up to ₱1 M.

9.2 Civil Damages

Actual damages: quantifiable financial loss.
Moral damages: anxiety, besmirched reputation (Art. 2219 Civil Code).
Exemplary damages: if act was “wanton, fraudulent, oppressive” (Art. 2232).
Attorney’s fees recoverable when defendants acted in bad faith (Art. 2208).

9.3 Administrative Sanctions

NPC fines, compliance orders, possible public listing as security incident.
SEC/DTI sanctions for corporate violators (unfair business practice).
NTC may block URLs or order telcos to disconnect numbers tied to identity theft.

10. Cross-Border & Special Issues

Issue	Strategy
Suspect abroad	MLA via DOJ-OOC; Interpol Red Notice.
Offender uses VPN	Subpoena exit nodes (ASNs), deanonymization through payment providers or SIM registration.
Deepfake video impersonation	Data Privacy Act + Intellectual Property Code (if copyrighted material).
Child victim (<18) data-preserve-html-node="true"	RA 11930 Anti-Online Sexual Abuse; mandates child-friendly procedures, offender qualifies for qualified identity theft with higher penalties.

11. Step-by-Step Checklist (Victim Perspective)

Secure evidence (screenshots, URLs, logs).
Report to Facebook → get Case ID.
File blotter at nearest police station.
Draft and notarize Affidavit of Complaint (include Meta Case ID).
Choose agency (PNP-ACG or NBI-CCD) → submit affidavit & media.
Follow up weekly; request Referral Letter for NPC if data privacy breach alleged.
Coordinate with prosecutor once subpoena issued.
Attend hearings; prepare digital forensic expert.
If damages substantial, file parallel civil action within 1 yr (preferred venue: RTC where criminal case pending—Rule 111 joinder).
Monitor Meta for compliance, keep copies of all support correspondence.

12. Conclusion

Reporting identity theft in the Philippine setting straddles private platform governance and public prosecution. A successful case requires swift digital preservation, adherence to Meta’s impersonation workflow, and formal complaints to cybercrime investigators—backed by an integrated understanding of RA 10175, the Data Privacy Act, procedural e-evidence rules, and evolving jurisprudence.

By following the comprehensive roadmap above, Filipino victims and their lawyers can maximise the chances of content removal, offender accountability, and compensation—while setting precedents that deter future identity misuse on the archipelago’s dominant social network.

This article is for educational purposes only and does not constitute legal advice. For case-specific guidance, consult a Philippine cyber-crime or data-privacy lawyer.