If someone has used your name, government ID details, photos, or financial information without your permission to create accounts, make transactions, or impersonate you online, you are likely a victim of identity theft—a specific cybercrime under Philippine law. This article explains exactly how the law defines and penalizes it, what practical steps you can take right now to protect yourself and report the incident, the realities of the process with Philippine authorities, and how to pursue both criminal and civil remedies.

What Constitutes Computer-Related Identity Theft

Under Republic Act No. 10175, the Cybercrime Prevention Act of 2012, computer-related identity theft is defined in Section 4(b)(3) as:

The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical, without right.

Identifying information includes a person’s name, date and place of birth, address, contact numbers, citizenship, marital status, occupation, government-issued ID numbers (such as PhilID, passport, driver’s license, SSS, TIN, or UMID), email addresses, usernames, passwords, bank or e-wallet account details, biometric data, photos used for verification, and similar personal data. The Supreme Court in Jose Disini Jr. v. Secretary of Justice (G.R. No. 203335, February 18, 2014) upheld this provision as constitutional and clarified that the law targets those who acquire or use such information without right, implicitly to cause damage or gain.

The offense covers the full lifecycle: stealing data through phishing, hacking, or data breaches; possessing or selling it; using it to impersonate someone on social media, dating apps, or loan platforms; altering records; or deleting evidence. It applies whether the victim is an individual or a company (juridical person). The law does not require that money was already lost—mere unauthorized acquisition or possession with the prohibited intent or effect can be punishable, though the penalty is reduced by one degree if no damage has occurred yet.

This cybercrime often overlaps with other offenses under the same law, such as illegal access, computer-related fraud, or computer-related forgery. In practice, prosecutors frequently file multiple charges together when evidence shows a chain of digital acts. Traditional crimes under the Revised Penal Code, such as estafa (swindling), may also apply when money or property is obtained through the stolen identity.

Penalties and Related Legal Protections

Any person convicted of computer-related identity theft faces imprisonment of prision mayor (6 years and 1 day to 12 years) or a fine of at least ₱200,000 up to an amount commensurate with the damage caused, or both. If no actual damage has occurred at the time of the act, the penalty is lowered by one degree. Aiding or abetting carries a lighter penalty of 6 months and 1 day to 6 years imprisonment or a fine of ₱100,000 to ₱500,000, or both.

Beyond criminal penalties, victims have civil remedies. You can claim actual damages (money lost or expenses incurred), moral damages for emotional distress and reputational harm, and exemplary damages to deter similar acts. These claims rest on provisions of the Civil Code, particularly Articles 19, 20, and 21 (abuse of rights and acts contrary to law, morals, good customs, or public policy) and Article 2176 (quasi-delict). You may pursue these in a separate civil case or as part of the criminal proceedings.

If the identity theft stemmed from a personal data breach by a company, app, or organization that failed to protect your information, you also have rights under Republic Act No. 10173, the Data Privacy Act of 2012. The National Privacy Commission (NPC) can investigate and sanction the responsible entity for inadequate security measures or failure to notify affected individuals.

Step-by-Step: What to Do Immediately If You Discover Identity Theft

Act quickly—delays can make recovery harder and allow perpetrators to cover their tracks.

Secure your existing accounts and limit further damage
Change passwords on all important accounts (email, social media, banking, e-wallets like GCash or Maya) using a strong, unique password for each. Enable two-factor authentication (preferably app-based or hardware key, not SMS). Review recent logins and devices, and log out everywhere. Contact your banks and e-wallet providers immediately to report unauthorized activity, request account freezes or blocks, and dispute transactions. Many have 24/7 hotlines and online dispute forms.
Preserve strong evidence
Take clear, full-screen screenshots or screen recordings of every fraudulent profile, message, transaction, or post. Include the full URL or profile link, visible timestamps or dates, and any usernames, phone numbers, or email addresses involved. Do not crop or edit images. Save original chat logs, emails, bank or e-wallet statements showing unauthorized charges, and any other records. Note the exact dates and times you discovered the activity. Keep your devices and original files intact—make backup copies. This “evidence trail” is what investigators and platforms rely on.
Report impersonation or fraud to the platforms involved
On Facebook, Instagram, or other social platforms, use the built-in report feature for impersonation or fake accounts and attach your evidence. Many require you to submit a government-issued ID to verify you are the real person. For dating apps or other sites, follow their impersonation or fraud reporting process. While platforms can remove fake accounts, only Philippine authorities can pursue criminal charges.
File an official complaint with law enforcement
The primary agencies for cybercrime complaints are the Philippine National Police Anti-Cybercrime Group (PNP-ACG) and the National Bureau of Investigation Cybercrime Division (NBI-CCD).
- PNP-ACG: Use their official website (acg.pnp.gov.ph) or e-complaint portal for online reporting. Call or text their 24/7 hotline at (02) 8723-0401 local 7491 or 0917-847-5757. You can also visit their headquarters at Camp Crame, Quezon City, or a regional cybercrime unit.
- NBI-CCD: File online through the NBI website (nbi.gov.ph) or visit their main office in Manila or a regional office for more complex or large-scale cases.
Prepare and notarize an Affidavit of Complaint (sworn statement) detailing who you are, what happened, when and how you discovered it, the evidence you have, and what harm you suffered. Many victims also prepare an Affidavit of Denial stating that you did not authorize the accounts or transactions. Bring two valid government-issued IDs, printed copies of your evidence, and the notarized affidavit. The agency will issue a case or blotter number—this document is usually required by banks, e-wallets, and platforms before they will reverse transactions or take further action on your behalf.
Report to the National Privacy Commission if a data breach is involved
If you believe your information was exposed because a company or app failed to secure it, download the NPC Complaint Affidavit form from privacy.gov.ph, notarize it, and submit it in person, by courier, or by email to complaints@privacy.gov.ph. The NPC can order the entity to investigate, notify other victims, improve security, or face penalties.
Follow up and consider civil action
Stay in touch with the investigating officer and provide any additional information promptly. For significant financial losses or ongoing reputational harm, consult a lawyer about filing a civil case for damages in the appropriate Metropolitan Trial Court or Regional Trial Court. You can do this independently or alongside the criminal case. Criminal cases are prosecuted by the government; civil claims seek compensation for you personally.

Common Scenarios, Challenges, and Realities Victims Face

Many ordinary Filipinos and foreigners encounter identity theft through phishing SMS or emails pretending to be from banks or government agencies, fake loan or shopping apps that request selfies and ID scans, compromised e-wallet accounts, or data sold on underground forums after a company breach. Impersonation on social media to scam friends and family is also common. OFWs and expats are frequent targets because their documents or accounts may be accessed while they are abroad.

Practical challenges include:

Digital evidence disappearing if accounts are deleted or perpetrators use VPNs, fake numbers, or multiple accounts.
Banks and platforms sometimes requiring an official police or NBI report before acting, which creates a short-term delay.
Investigations taking weeks to several months (or longer for complex transnational cases) because of case volume and the need for digital forensics.
Difficulty identifying anonymous perpetrators, though SIM registration requirements and improved tracing capabilities have helped in many cases.
For foreigners: You can file complaints online or through a Philippine-based representative using a Special Power of Attorney (notarized and, if executed abroad, apostilled). Philippine courts generally have jurisdiction when the crime affects a Philippine system, citizen, or resident, or when key acts occurred in the Philippines.

Common pitfalls that weaken cases are failing to capture full URLs and timestamps in screenshots, waiting too long to dispute transactions, or submitting unnotarized statements. Acting methodically from day one significantly improves outcomes.

Documents Typically Required and Where to Go

For PNP-ACG or NBI complaints:

Notarized Affidavit of Complaint (and Affidavit of Denial if impersonation occurred)
Two valid government-issued IDs
Printed or digital copies of all evidence (screenshots with URLs/timestamps, transaction records, chat logs)
Any existing police blotter or case numbers from other agencies

For NPC complaints (data privacy angle):

Notarized NPC Complaint Affidavit form
Supporting evidence of the breach or misuse
Proof of harm or risk

Notarization usually costs ₱200–₱500 depending on the notary and location. No filing fees apply for the initial criminal complaint with PNP or NBI.

How to Protect Yourself Going Forward

Use unique, strong passwords managed by a reputable password manager. Enable app-based two-factor authentication on every important account. Be extremely cautious with links and attachments—verify sender details directly through official channels. Limit sharing of government ID scans and selfies; use virtual or single-use card numbers for online purchases when possible. Regularly review account activity and bank/e-wallet statements. Keep physical IDs secure and avoid unnecessary photocopies. On social media, use strict privacy settings and be selective about what personal information you post. For businesses or apps you use, check their privacy policies and data security practices.

Frequently Asked Questions

What exactly is computer-related identity theft under Philippine law?
It is the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information (name, IDs, financial details, photos, etc.) without right, as defined in Section 4(b)(3) of RA 10175. It covers both digital theft and subsequent misuse, even if no money has been lost yet.

What are the penalties for identity theft in the Philippines?
Conviction carries prision mayor imprisonment (6 years and 1 day to 12 years) or a fine starting at ₱200,000 (up to the amount of damage), or both. The penalty drops by one degree if no damage occurred. Aiding or abetting carries lighter penalties.

How do I report identity theft or online impersonation?
Gather strong evidence first, then file online or in person with the PNP Anti-Cybercrime Group (acg.pnp.gov.ph or hotline (02) 8723-0401 local 7491 / 0917-847-5757) or NBI Cybercrime Division. Prepare a notarized affidavit detailing the facts and attach your evidence. Banks and platforms usually require the resulting case number to assist you.

Do I need a lawyer to file a complaint?
No. You can file the initial criminal complaint yourself with PNP-ACG or NBI. However, for complex cases, significant damages, or if you want to pursue a separate civil action for compensation, consulting a lawyer experienced in cybercrime or data privacy is highly advisable.

Can I recover money lost through identity theft?
Yes, in many cases. Report to your bank or e-wallet provider immediately and provide the police/NBI case number. They have internal dispute processes. Successful criminal or civil cases can also result in court-ordered restitution. Recovery chances are highest when you act within days of discovery.

What if someone created a fake social media profile using my photos and name to scam others?
Report the fake profile directly to the platform with evidence that you are the real person. Simultaneously file a complaint with PNP-ACG or NBI, including an Affidavit of Denial. The authorities can investigate the perpetrator even if the main harm is to third parties you know.

Is there a difference between reporting to PNP-ACG and NBI?
Both handle cybercrime. PNP-ACG is often the faster first stop for most individual victims and has regional units. NBI-CCD is frequently used for more complex, high-value, or organized cases. You can start with either; they sometimes coordinate.

Can a foreigner file a complaint for identity theft involving Philippine accounts or perpetrators?
Yes. You can file online through the official portals or authorize a Philippine representative or lawyer via a notarized Special Power of Attorney (apostilled if signed abroad). Philippine authorities have jurisdiction when the crime involves Philippine systems, citizens, or residents, or when substantial acts occurred in the country.

How long does a typical investigation take?
It varies widely. Initial response and account freezes can happen within days. Full investigation and identification of perpetrators may take weeks to several months, depending on complexity, digital evidence volume, and whether the suspect is in the Philippines. Court resolution, if charges are filed, often takes longer.

What should I do if my information was exposed in a company data breach?
Secure your accounts immediately. File a complaint with the National Privacy Commission (privacy.gov.ph) against the responsible organization using their notarized complaint form. You can also report the resulting identity theft to PNP-ACG or NBI if misuse has occurred.

Key Takeaways

Identity theft is a distinct, prosecutable cybercrime under Section 4(b)(3) of RA 10175, covering unauthorized acquisition or use of your personal identifying information.
The Supreme Court has upheld the law’s constitutionality, and penalties include up to 12 years imprisonment plus substantial fines.
Immediate action—securing accounts, preserving full evidence with timestamps and URLs, and obtaining a notarized affidavit—greatly improves your chances of stopping further damage and achieving accountability.
Report primarily to PNP-ACG or NBI for criminal investigation; add an NPC complaint if a company data breach enabled the theft.
You have both criminal remedies (through the State) and civil remedies (for your personal damages and losses) under the Civil Code.
Prevention through strong unique passwords, app-based 2FA, caution with personal data sharing, and regular account monitoring remains your strongest defense.
Official resources such as the full text of RA 10175 on lawphil.net, acg.pnp.gov.ph, nbi.gov.ph, and privacy.gov.ph provide the most current forms and contact details.

Acting promptly with clear documentation puts you in the strongest position to regain control and hold those responsible accountable under Philippine law.