Identity Theft: What to Do if Someone Used Your Online Account (Philippines)

This is a practical legal guide for individuals in the Philippines. It’s general information, not legal advice. If money is at stake or you face urgent risk, speak with counsel or go to the police/NBI immediately.

Snapshot: What counts as “identity theft” under PH law

Identity theft happens when someone acquires or uses your identifying information or credentials without authority to impersonate you or access your accounts.

Key Philippine laws you can rely on:

Cybercrime Prevention Act of 2012 (RA 10175)
- Computer-related identity theft—acquiring, using, misusing, transferring, possessing, altering, or deleting identifying data that belongs to someone else, without right.
- Related cybercrimes: illegal access (hacking/unauthorized access), computer-related fraud/forgery, cyber libel (if your identity is used to post defamatory content), and data interference.
- Penalties one degree higher for crimes committed “through ICT” (e.g., estafa done online can be punished more severely).
Data Privacy Act of 2012 (RA 10173)
- Protects personal data. Gives you rights to be informed, to access, rectify, erase/block, and to complain and seek damages for unlawful processing or negligent security.
- Organizations suffering a qualifying personal data breach must notify the National Privacy Commission (NPC) and affected individuals within 72 hours of knowledge or reasonable belief of the breach, where there is risk of serious harm.
Access Devices Regulation Act of 1998 (RA 8484)
- Covers unauthorized use of access devices (credit/debit cards, account numbers, OTPs used as access devices).
Revised Penal Code
- Estafa (swindling) and falsification can apply where property is obtained or documents are forged using your identity.
Financial Products and Services Consumer Protection Act of 2022 (RA 11765)
- Sets complaint-handling duties for banks/e-wallets and empowers regulators to protect consumers (possible restitution/compensation in proper cases).
E-Commerce Act of 2000 (RA 8792)
- Penalizes hacking/unauthorized access and recognizes electronic documents and signatures.
Rules on Electronic Evidence (A.M. No. 01-7-01-SC) & Rules on Cybercrime Warrants (A.M. No. 17-11-03-SC)
- Establish how electronic evidence is authenticated and how authorities obtain cyber warrants to preserve, disclose, intercept, search, and examine computer data.

Act fast: the first 24 hours

Contain the account
- Change the password immediately (use a long, unique passphrase).
- Sign out of all sessions/devices from account security settings.
- Turn on 2-factor authentication (2FA)—prefer an authenticator app or hardware key over SMS when possible.
- Review security logs: unfamiliar devices, IPs, recovery email/number, forwarding rules, app passwords, third-party connections—remove anything suspicious.
Freeze downstream risk
- If money could move (banks, e-wallets, shopping, ride-hailing, delivery apps), lock the account, freeze cards, and dispute unauthorized transactions right away.
- Call your telco to check for SIM-swap or call/SMS forwarding; request a block if needed and reset voicemail PIN.
- If your email was compromised, treat it as the “master key.” Secure it first, then reset all other accounts from a clean device.
Preserve evidence (before changes wipe logs)
- Take screenshots of suspicious activity, messages, and confirmations. Save original files and headers/URLs.
- Write a timeline with exact dates/times, amounts, usernames, device names, and any reference numbers.
- Keep bank/e-wallet SMS and email alerts intact; don’t delete chats or posts made by the impostor.
Tell the platform/provider
- Use the provider’s account recovery and impersonation/compromise forms.
- Ask for temporary suspension or “hold” to stop further use while you prove identity.
If money moved: notify your bank/e-wallet immediately
- Report as unauthorized/fraud. Request a freeze, chargeback/reversal, and a formal case number. Follow their documentary checklist (ID, dispute form, police/NBI report when available).
- Escalate promptly if you face delays or denial—see “Regulator escalation” below.

Where to report (and why)

Platform or Merchant (social media, marketplaces, email, cloud, ride-hailing, delivery)
- File a compromise/impersonation report. Ask for log retention/preservation.
Banks & E-Wallets (BSP-regulated)
- Use hotlines/in-app help to dispute transactions; ask for written acknowledgment and case ID.
- If unresolved, escalate to the bank’s Customer Protection unit; then to Bangko Sentral ng Pilipinas (BSP) under RA 11765.
Telcos (NTC oversight)
- Report SIM swap/fraud, request number block/change, and disable forwarding. Ask for logs to be preserved.
National Privacy Commission (NPC)
- If an organization’s security failure exposed your data, or they ignore your privacy rights, file a complaint. Organizations must notify within 72 hours for qualifying breaches.
Law enforcement
- PNP Anti-Cybercrime Group (ACG) or NBI Cybercrime Division (CCD) for criminal complaints under RA 10175/RA 8484/RPC.
- Bring: valid IDs, your timeline, screenshots, bank statements/receipts, platform case IDs, and any correspondence.
- Ask investigators about a Preservation Order / coordination with service providers under RA 10175 and the Rules on Cybercrime Warrants.
Other regulators (depending on the account)
- DTI for e-commerce consumer disputes; SEC/IC for investment/insurance platforms; NTC for telco issues.

Evidence that actually helps

Security logs: login IPs/locations/devices, times, password resets, recovery changes, app passwords, API tokens.
Transaction records: timestamps, amounts, reference numbers, recipient accounts/handles, device IDs.
Communications: phishing emails/SMS (with full headers), chat screenshots, call logs, OTP requests.
Account metadata: profile changes, new posts/listings, ad spends, order history, delivery addresses.
Chain of custody: export data where possible; keep originals; avoid editing screenshots; keep a contemporaneous notes file.

Tip: Ask the provider (through their legal/compliance channel) to preserve logs citing your police/NBI case number. RA 10175 requires service providers to retain/preserve certain traffic/subscriber data for a limited time upon request—early preservation is crucial.

Building your legal options

A. Criminal routes

RA 10175 offenses likely in play:
- Computer-related identity theft
- Illegal access
- Computer-related fraud/forgery
- Data interference
RA 8484 if credit/debit card or similar access device was used.
Estafa (Art. 315 RPC) if the impostor obtained money/property.
Falsification if your identity was used to forge documents or e-signatures.
Venue/jurisdiction: Where any element occurred, or where the computer system/data was accessed. Specialized cybercrime courts handle warrants and cases.
What you file: A criminal complaint-affidavit with attached evidence. Law enforcement and prosecutors then seek cyber warrants (to disclose/preserve/search/intercept data) and identify the offender.

B. Civil and regulatory routes

Damages under the Civil Code and RA 10173 (Data Privacy Act) for wrongful processing or negligent security.
Injunctions/TROs in appropriate cases (e.g., to stop ongoing misuse of your account, brand, or likeness).
DTI mediation/adjudication for online purchase disputes (refunds/chargebacks).
Financial consumer redress under RA 11765 (banks/e-wallets must have fair, timely complaint resolution; regulators can require corrective relief).

If the compromised account was…

A bank or e-wallet

Report via hotline/app; freeze access and cards.
File a formal dispute (get a copy with a case number).
Ask for transaction logs and merchant descriptors; identify any mule accounts.
If you suspect account takeover (ATO), say so explicitly.
If denied due to alleged “negligence” (e.g., OTP sharing), still appeal—context matters (social engineering, SIM-swap, spoofing). RA 11765 requires fair handling.
Escalate to BSP if unresolved.

A telco or email account

Check for SIM-swap and forwarding rules; reset voicemail and call diversions.
Secure email first (it resets everything else). Replace recovery email/number with ones not exposed.
Rotate passwords on all linked services.

A marketplace, delivery, or ride-hailing account

Cancel orders; request merchant refunds and account lock.
If your profile is used to sell items, insist on takedown and preservation of chat/order logs and payout details.

Social media

Use impersonation/compromise reporting flows; ask for account recovery and takedown of fake profiles.
If your name/image is used for scams, log victim reports and issue a public notice once you regain control.

Working with the National Privacy Commission (NPC)

Use NPC when an organization’s security lapse or unlawful processing led to your exposure, or when the organization won’t honor your privacy rights (access, correction, erasure/blocking).
Companies must notify NPC and affected users within 72 hours for breaches posing real risk of serious harm.
You can file a complaint asking for compliance orders and damages (where appropriate). Keep all correspondence and response timelines.

Practical timelines (aims, not strict deadlines)

Immediately: contain account; notify providers; preserve evidence.
Within 24–48 hours: file disputes with banks/e-wallets and key platforms; lodge reports with PNP-ACG/NBI-CCD; ask providers to preserve logs.
Soon after: if a company caused or mishandled a leak, raise with their DPO; then NPC if needed. For unresolved bank/e-wallet issues, escalate to BSP.

Proving your case (evidence & procedure basics)

Electronic evidence is admissible if authenticated (testimony about how it was generated/kept; system integrity; hashes/metadata where possible). Printed copies of electronic records may be accepted if properly identified; better if accompanied by certifications or custodian affidavits.
Cyber warrants (WDCD, WICD, WSSECD) are obtained by law enforcement/prosecutors to compel disclosure, interception, or forensic search of data. Your detailed timeline helps them draft precise applications.
Maintain a clean chain of custody for devices and storage media sent for examination.

Money recovery: expectations management

Banks/e-wallets investigate whether the transaction was authorized (by you or an impostor). If your device/email was taken over or you were social-engineered, emphasize:
- Timing and sequence of logins and resets
- Device changes and IP discrepancies
- SIM-swap or call forwarding events
- Speed/burst patterns typical of fraud
Even if you interacted with a phisher, regulators expect providers to have reasonable fraud controls. Keep pushing for a reasoned decision, not blanket blame.

Preventive hardening (after recovery)

Use a password manager + unique 16–24-character passwords.
Prefer authenticator apps or hardware security keys (FIDO2) over SMS OTP.
Keep a separate “recovery” email/number not publicly used.
Turn on login alerts, withdrawal limits, and transaction notifications.
Review connected apps, API tokens, and mail filters/forwarding quarterly.
Update devices; enable screen locks, full-disk encryption, and automatic updates.
Treat unsolicited links/calls as hostile; verify via official channels only.

Templates you can copy-paste

1) Evidence Preservation Request (to a platform/bank/telco)

Subject: Urgent Request to Preserve Logs – [Your Name / Account No.] Dear [Provider] Legal/Compliance Team, I am the lawful owner of account [identifier/username/email/number]. On [date/time, PH time], my account was compromised and used without authority. I have reported this to [PNP-ACG/NBI-CCD] under Case/Blotter No. [xxx]. Pursuant to applicable law on preservation of computer data and to aid law enforcement, please preserve and retain all relevant traffic data, subscriber information, access logs, device fingerprints, IP addresses, message/transaction logs, and change history relating to my account and the unauthorized sessions from [date range]. Kindly confirm receipt, identify your point of contact, and advise how law enforcement can serve a warrant/subpoena. Sincerely, [Name, contact number, ID copy if required]

2) Bank/E-Wallet Unauthorized Transaction Dispute

Subject: Dispute of Unauthorized Transactions – Case Request Dear [Bank/E-wallet], I dispute the following unauthorized transactions on account [last 4 digits] occurring on [dates/times] totaling ₱[amount]. I did not authorize these and my credentials were compromised. Please freeze the account/cards as needed, reverse/charge back the transactions where possible, and provide a written acknowledgment with case ID. I attach screenshots, SMS/email alerts, and my timeline. Kindly preserve all login/access logs, device IDs, IPs, OTP delivery records, and call/SMS forwarding logs for the investigation. Sincerely, [Name, contact details]

3) NPC Complaint (privacy rights/breach handling)

Subject: Complaint for Violation of Data Privacy Rights – [Your Name] I assert that [Company] failed to protect my personal data and/or to comply with breach notification and data subject rights. On [date], my account/data was misused. Despite my requests on [dates], the company failed to [notify/provide access/rectify/erase/block]. I request enforcement action and appropriate relief. Attachments: identity documents, correspondence, screenshots, incident timeline.

Frequently asked questions (PH-specific)

Do I need a police or NBI report for my bank dispute? Often yes—banks/e-wallets typically ask for a police blotter or NBI report. File one quickly; it also helps trigger log preservation with third parties.

What if the impostor used my identity to borrow money or open accounts? Dispute with the lender in writing, attach your police/NBI report, and demand closure. Ask the lender for the application IP/device, selfie/KYC images, and timestamps. You can raise with BSP/SEC depending on the entity. You may also dispute entries with the Credit Information Corporation (CIC) via its accredited bureaus.

They say I shared my OTP—does that kill my case? Not automatically. Context matters (spoofed lines, SIM swap, malware, social engineering). Providers still have duties to detect and stop fraud. Put everything in your narrative and escalate if needed.

Can I sue for damages? Yes—under the Civil Code and RA 10173 if unlawful processing or negligent security caused harm. Consider costs/benefits and evidence strength. For smaller sums, small claims procedures may be an option (check the current threshold and rules).

A fake profile is scamming people using my name. Report via the platform’s impersonation tools; ask contacts to report too. Consider a public advisory post once your account is secure. Preserve chats and payout details for law enforcement.

One-page checklist

Secure the email that controls everything else.
Change passwords, kill sessions, enable 2FA (non-SMS if possible).
Freeze financial accounts/cards; dispute unauthorized transactions.
Preserve evidence (screenshots, logs, messages, headers).
Report to platform; get case IDs.
PNP-ACG/NBI-CCD report; request log preservation.
If a company leaked/mishandled your data: raise with DPO, then NPC.
Escalate unresolved financial disputes to BSP (and other regulators as applicable).
Keep a living timeline and copies of all letters and reference numbers.

If you want, tell me:

which account was used,
what transactions/changes you see (with timestamps),
and which providers are involved,

…and I’ll draft tailored letters and a clean incident timeline you can hand to your bank, the platform, and PNP-ACG/NBI.