Identity Theft Using Facebook Photos for Scams in the Philippines

Discovering that someone has taken your Facebook photos and is using them to create fake profiles for scams can feel like a profound violation. Whether the impersonator is messaging your friends and family asking for urgent loans, posing as you in romance schemes, or building credibility for investment frauds, it misuses your likeness and can harm your reputation or relationships. In the Philippines, this is not just unethical — it is a specific cybercrime. This article explains what the law actually covers, your practical rights, and the exact steps you can take to report it, preserve strong evidence, and push for action through platforms and authorities.

What This Form of Identity Theft Involves

Scammers routinely scrape publicly visible Facebook photos, combine them with a person’s name or slight variations, and create convincing fake profiles. These accounts then contact the victim’s network with urgent requests for money, promote fake investments or loans, or engage in broader catfishing. The familiar face creates trust that pure text-based scams lack.

The core offense is not simply copying a photo. It becomes computer-related identity theft when someone intentionally acquires, uses, or misuses your identifying information (name, photo, and associated details that establish who you are) without your right or consent, especially when done to commit fraud or cause harm. Even if your photos were posted publicly, you did not consent to this deceptive, fraudulent use of your identity.

This misuse can also trigger related offenses if money changes hands or if it causes provable damage to you or others.

Legal Basis Under Philippine Law

Republic Act No. 10175 – Cybercrime Prevention Act of 2012

The primary law is RA 10175, specifically Section 4(b)(3) on computer-related identity theft. It penalizes:

“The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical, without right.”

Identifying information includes your name, photo, and other details that allow someone to pass themselves off as you. The law applies whether or not actual financial damage has occurred yet. If no damage has been caused, the penalty is one degree lower; otherwise, it carries the full weight.

Penalties under Section 8 include imprisonment of prision mayor (6 years and 1 day to 12 years) or a fine of at least ₱200,000 (up to an amount commensurate with the damage), or both. The Supreme Court upheld this provision as constitutional in Disini, Jr. v. Secretary of Justice, G.R. No. 203335 (February 18, 2014).

You can read the full text of the law on the official lawphil repository.

Overlap with Other Laws

When the fake profile is used to extract money or property through deceit, prosecutors commonly add estafa under Article 315 of the Revised Penal Code. If an organized group is involved and the amount is significant, it may qualify as syndicated estafa with heavier penalties.

The Data Privacy Act of 2012 (RA 10173) provides additional protection. Your photo and associated personal details qualify as personal information. Unauthorized processing or use for fraudulent purposes can violate this law, giving you a parallel avenue to complain before the National Privacy Commission.

Civil remedies also exist under the Civil Code (Articles 19, 20, and 21 on abuse of rights, and general provisions on damages for emotional distress and reputational harm). You can pursue these alongside or after the criminal case.

Immediate Practical Steps If Your Photos Are Being Misused

Act quickly but methodically. The strength of your evidence often determines how seriously authorities treat the case.

1. Preserve evidence before doing anything else.
   Take full-screen screenshots of the fake profile, every post, story, and visible message. Make sure the browser or app URL bar, date, and time stamp are clearly visible. Record a continuous screen video scrolling through the entire profile and relevant chats while showing your device’s clock. Export relevant Facebook data from your own account as backup. Create a simple timeline log noting when and how you discovered the account and any known impact on friends or family. Store originals in at least two safe locations and never edit or annotate the master copies.

2. Report the account directly to Facebook (Meta).
   On the fake profile, click the three dots → Report → choose “Pretending to be someone else,” “Scam or fraud,” or the impersonation option. Upload clear proof that you are the real person (government-issued ID that matches the individual in the photos). Note any reference or case number Meta provides. This route can lead to relatively fast account suspension under Meta’s community standards, though it works best when paired with an official police report.

3. Prepare a formal Complaint-Affidavit.
   Write (or have a lawyer help draft) a sworn statement in clear, chronological order. Include who you are, details of your legitimate Facebook presence, exactly how and when you discovered the fake account(s), how your photos and identity are being used, and the specific harm or risk this has caused you (reputational damage, emotional distress, strained relationships, or financial risk to people you know). Clearly state the laws violated and what you are asking authorities to do (investigate, prosecute, assist in takedown, preserve evidence, and identify the perpetrator). Have the affidavit notarized.

4. File your complaint with the proper cybercrime units.
   Submit the notarized affidavit plus all annexes (labeled evidence with an index) and copies of your valid government IDs.

   • PNP Anti-Cybercrime Group (ACG) is often the practical first stop for many victims. Email acg@pnp.gov.ph or call (02) 8414-1560 / 0998-598-8116. They maintain units in Camp Crame, Quezon City, and regional offices.
   • NBI Cybercrime Division (CCD) handles more complex cases requiring deeper forensics or when multiple jurisdictions or larger networks are involved. Contact them at ccd@nbi.gov.ph or through (02) 8523-8231.

   You may also start with a blotter at your local police station for an initial paper trail, then have it elevated. Many victims file with both PNP and NBI. Bring digital copies on a USB drive as well as printed sets.

5. Follow up and cooperate.
   Keep a record of every interaction with authorities and ask for a case or reference number. Investigators may issue preservation requests or subpoenas to Meta and telecommunications companies. Be prepared to give additional statements or clarify evidence if asked. The process involves coordination across platforms and can move in stages.

6. Consider additional parallel actions if warranted.
   File a separate complaint with the National Privacy Commission if you want to emphasize the data privacy violation. If significant financial or reputational harm occurred, consult a lawyer about filing a civil case for damages in the appropriate Regional Trial Court.

Common Challenges and Realistic Expectations

Digital evidence must be authentic and properly timestamped. Weak or edited screenshots are frequently challenged.

Tracing perpetrators is technically possible but often slow. Scammers use VPNs, fake SIM cards, mule accounts, and foreign servers. Many successful outcomes involve disabling the harmful account and gathering intelligence rather than immediate arrest and conviction.

Cybercrime dockets have backlogs. Initial intake can happen within days or weeks, but full investigation and any prosecution frequently take many months to over a year.

Do not publicly shame or reveal personal details of suspected scammers online. This can expose you to counter-complaints for cyber libel or data privacy violations. Leave identification and enforcement to the authorities.

If you are an overseas Filipino or foreigner, you can still pursue the case. Execute your affidavit before a Philippine embassy or consulate (or have it notarized abroad and apostilled if your country is part of the Apostille Convention) and consider authorizing a Philippine lawyer through a Special Power of Attorney. Jurisdiction generally exists when any element of the offense (such as harm felt by you or your contacts in the Philippines, or data processed here) occurred in the country.

Evidence and Documents Typically Required

Strong cases rest on clear, well-organized proof. Here is what authorities usually expect:

• Full-frame screenshots and screen recordings of the fake profile, posts, and any messages (with visible URLs, dates, and times).
• Your valid government-issued photo ID(s) proving you are the person depicted.
• Notarized Complaint-Affidavit with a detailed timeline and statement of harm.
• Index or table listing every piece of evidence with descriptions, sources, and dates.
• Any records of impact on friends, family, or your own finances (with their consent where appropriate).
• Backup of your own legitimate Facebook data and profile information.

There is generally no filing fee for the criminal complaint with PNP or NBI. Notarization costs are modest. Engaging a lawyer to prepare or review the affidavit is optional but strongly advisable for first-time filers or complex situations.

Frequently Asked Questions

Is using my public Facebook photo for a fake scam profile still considered identity theft?
Yes. Public availability does not equal consent for impersonation or fraudulent use. RA 10175 specifically penalizes the intentional misuse of identifying information belonging to another without right.

How quickly can Facebook remove a fake profile impersonating me?
It varies. Clear reports with proof of identity often result in action within days, but some cases take longer or require follow-up. Reporting to authorities strengthens your request because law enforcement can issue formal preservation and disclosure requests.

What if I have no idea who created the fake account? Can I still file a complaint?
Absolutely. Many victims never identify the individual behind the screen. Authorities can still disable the account, preserve evidence, and investigate linked criminal activity even without an immediate suspect name.

Can I file if I live abroad or am a foreigner whose photo was stolen?
Yes. Philippine cybercrime laws protect victims regardless of nationality when the offense has a connection to the Philippines. You can execute documents through a Philippine embassy or consulate and work with a local lawyer.

Will reporting this make my own personal information public or affect my Facebook account?
No. Your complaint and supporting documents are handled through official channels with appropriate confidentiality. Your own account remains unaffected unless you choose to make changes yourself.

What is the difference between reporting to Facebook and reporting to PNP or NBI?
Facebook applies its own community standards and can suspend accounts relatively quickly based on impersonation or fraud reports. PNP and NBI investigate the criminal violation, coordinate officially with the platform for data, and pursue prosecution. The strongest approach is usually to do both.

Can I recover money or claim damages if people were scammed using my identity?
If you or others suffered actual financial loss or provable harm, you can seek civil damages (actual, moral, and exemplary) in addition to the criminal case. Courts have awarded compensation for emotional distress and reputational harm in similar situations.

How serious are the penalties?
Under RA 10175 alone, penalties include up to 12 years of imprisonment and fines starting at ₱200,000. When combined with estafa, penalties can increase significantly depending on the amounts involved and whether the crime was syndicated.

What practical steps can I take to reduce the risk of this happening again?
Tighten your Facebook privacy settings so photos and posts are visible only to people you trust. Be selective about friend requests. Consider using reverse image search tools periodically to monitor unauthorized use of your photos. Watermarking personal images or posting lower-resolution versions publicly can also help deter casual scraping.

Key Takeaways

• Using your Facebook photos to impersonate you for scams constitutes computer-related identity theft under Section 4(b)(3) of RA 10175 and is punishable even if no money has changed hands yet.
• Preserve high-quality, timestamped evidence immediately — this is the single most important thing you control.
• Report to both Facebook (for fast platform action) and PNP ACG or NBI CCD (for formal criminal investigation and prosecution).
• You do not need to identify the perpetrator yourself; authorities have legal tools to request data from platforms and telcos.
• Realistic timelines involve weeks to months for meaningful progress; patience and organized follow-up are essential.
• Filipinos abroad and foreigners can pursue these cases with proper documentation through embassies or local counsel.
• Avoid public shaming or doxxing — it risks creating new legal problems for you.
• Taking these documented steps protects you, helps shut down harmful accounts, and contributes to broader enforcement against repeat offenders.

The Philippine legal system provides real remedies for this increasingly common problem. Starting with solid evidence and the correct reporting channels gives you the best chance of stopping the misuse and holding those responsible accountable.