Quick answer

Report the account to the social-media platform, preserve the evidence, secure your real accounts, and file a formal complaint with the Philippine National Police or National Bureau of Investigation if the account is impersonating you to deceive, defraud, threaten, harass, or damage you.

Philippine law does not require a minimum financial loss before computer-related identity theft may be reported. Under the Cybercrime Prevention Act of 2012, intentionally using another person’s identifying information without right may constitute computer-related identity theft. The penalty is reduced by one degree if no damage has yet occurred, but the absence of monetary loss does not make harmful impersonation harmless or automatically lawful.

A fake or duplicate account is not automatically a crime. The surrounding facts matter: whether the person used identifying information without authority, intended an illegitimate purpose, deceived others, caused or attempted harm, hacked an existing account, solicited money, made threats, or published defamatory or sexual material. The Supreme Court explained in Disini v. Secretary of Justice that identity-theft liability concerns illegitimate use of identifying information; merely acquiring or sharing information that a user made public is not, by itself, identity theft.

What to do immediately

Preserve the account before reporting or blocking it. Save the exact profile URL, username or handle, account name, profile photo, bio, posts, messages, comments, follower list, and any requests for money or information.
Record the date and time. Take full-screen screenshots showing the address bar or app interface. Make a screen recording that opens the profile, scrolls through relevant content, and shows the URLs or account details.
Report the profile and the harmful content separately. Platforms may remove an account without automatically reviewing every message, post, advertisement, or group it created.
Secure your real accounts. Start with your email account, then change unique passwords, enable multi-factor authentication, sign out unknown sessions, remove unfamiliar recovery details and connected applications, and save login-alert emails.
Warn likely targets through a different, verified channel. Tell family, friends, clients, or coworkers not to send money, disclose one-time passwords, click links, or transact with the fake account.
Contact your bank, e-wallet, card issuer, or telecommunications provider immediately if money, financial credentials, a SIM, or a mobile number may be compromised. Use only contact details from the institution’s official app, website, or the back of your card.
File promptly with law enforcement when the impersonation involves fraud, threats, harassment, account takeover, intimate content, repeated targeting, or significant reputational or business harm.

Do not negotiate with, threaten, pay, or attempt to hack the operator. These actions may increase the risk and complicate the investigation.

When the conduct may violate Philippine law

Computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or organization, without right.

A case is stronger when the fake account:

Uses your name, photographs, contact details, identity documents, business information, or other identifying data;
Pretends to speak or transact as you;
Solicits money, loans, investments, passwords, one-time PINs, or sensitive information;
Contacts your family, customers, employer, or business partners while claiming to be you;
Is used to damage your reputation, interfere with your work, or facilitate another offense; or
Continues after the operator has been clearly informed that the use is unauthorized.

The statutory penalty for offenses under Section 4(b), including computer-related identity theft, is prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The law provides a penalty one degree lower when no damage has yet been caused. Actual liability and the proper penalty depend on the charge proved and the court’s findings.

Illegal access or account takeover

If someone entered your real email or social-media account without authority, changed its password, or locked you out, the conduct may also involve illegal access under Section 4(a)(1) of Republic Act No. 10175. Use the platform’s compromised-account recovery process in addition to making an impersonation report.

Fraud or financial-account scams

When the fake account obtains money through false pretenses, the facts may support estafa or other fraud charges, potentially with the use of information and communications technology as a qualifying circumstance. Transactions involving bank or e-wallet accounts may also fall under the Anti-Financial Account Scamming Act.

Report a disputed transaction to the financial institution immediately and ask it to secure the affected account and evaluate whether funds can be temporarily held or traced. If the institution does not resolve the complaint through its own consumer-assistance channel, a complaint involving a BSP-supervised institution may be escalated through the BSP Consumer Assistance Mechanism.

Gender-based online sexual harassment

The Safe Spaces Act expressly includes certain online acts such as impersonating a victim’s identity or posting lies to harm the victim’s reputation when committed as gender-based online sexual harassment. It also covers specified sexual, misogynistic, homophobic, transphobic, intimidating, stalking, and privacy-invasive conduct.

Cyber libel

A fake account that publishes defamatory allegations may raise cyber-libel issues, but an offensive, false, or embarrassing post is not automatically libel. The prosecution must establish the legal elements of libel, including a defamatory imputation, publication, identification of the offended party, and malice as required by law.

Cyber libel has a particularly short deadline. The Supreme Court has affirmed that it prescribes in one year from discovery by the offended party, authorities, or their agents, subject to the rules governing interruption and proof of discovery. See Causing v. People, G.R. No. 258524, April 8, 2026. Obtain legal advice promptly if defamatory posts are involved.

Where and how to report

Report the account to the platform

Preserve the evidence first, then use the platform’s official impersonation process:

Choose the option stating that the profile is pretending to be you, someone you represent, or your organization. If permitted, report each scam post, threatening message, private-information disclosure, or fraudulent advertisement separately.

The platform may request proof of identity or authority. Upload documents only through its official form. Do not send an ID to the fake account or to anyone contacting you through an unofficial email or message. Save the report confirmation, case number, emails, and screenshots of every submission.

A platform report is a request for moderation or takedown. It is not a criminal complaint and does not replace reporting to law enforcement.

File with the PNP or NBI

Republic Act No. 10175 designates the PNP and NBI as the principal law-enforcement authorities for cybercrime cases. You may approach:

The PNP Anti-Cybercrime Group or the appropriate regional anti-cybercrime unit;
The nearest police station, which may record the incident and refer it to a cybercrime unit;
The NBI Cybercrime Division or an NBI regional cybercrime office; or
The official NBI Online Complaint page, followed by any appearance or sworn statement the investigator requires.

The NBI Citizens’ Charter for computer-crime complaints states that the service is available to the general public without an intake fee. The process may include a complaint sheet, preliminary interview, sworn statements, supporting documents, and examination of a relevant device.

For a useful complaint, bring or prepare:

A government-issued ID and contact details;
A clear chronological account of what happened;
Your real account’s URL and the fake account’s exact URL;
Usernames, display names, account numbers, phone numbers, email addresses, and payment details connected to the incident;
Screenshots, recordings, exported messages, emails, receipts, transaction references, and platform report confirmations;
Proof that the name, photographs, business, or other identity belongs to you or that you are authorized to represent the affected person or organization;
Names and contact details of witnesses or recipients of fraudulent messages;
A list of losses, affected accounts, threats, demands, and corrective expenses; and
Any available information identifying a possible operator, clearly separated from suspicion or hearsay.

State only facts you know and identify assumptions as such. Ask for an acknowledgment, docket or reference number, the investigator’s contact details, and instructions for submitting additional evidence.

A barangay blotter or ordinary incident entry may document that you reported an event, but it is not a substitute for a formal cybercrime complaint and investigation.

File a privacy complaint when personal data was misused

The Data Privacy Act of 2012 may apply when personal information was unlawfully collected, used, disclosed, or processed. Data subjects may seek relief from the National Privacy Commission, including in appropriate cases involving unauthorized processing or failure by an organization to protect personal information.

Ordinarily, before filing with the NPC, the complainant must notify the personal information controller, processor, or concerned entity in writing and allow it to address the problem. The requirement is satisfied when the entity does not take timely and appropriate action or does not respond within 15 calendar days after receiving the written notice. The NPC may waive this exhaustion requirement for good cause or serious violations, including circumstances involving grave and irreparable damage, no adequate remedy, or patently illegal action.

A formal NPC complaint generally requires a verified or notarized complaint, supporting documents, witness affidavits if any, correspondence with the respondent, and a certification against forum shopping. The regular complaint filing fee is currently ₱500, subject to the NPC’s exemptions or waiver rules for qualifying complainants. Follow the current NPC complaint-filing instructions and the 2021 NPC Rules of Procedure, as amended.

An NPC complaint is not a substitute for a police or NBI report. Where the operator is unknown, law enforcement may be better placed to seek identifying records through lawful process.

Evidence to preserve

Keep an unedited master copy of every item. Create separate working copies if you need to crop, highlight, or annotate something.

Preserve:

The complete profile and content URLs;
Usernames, former usernames, account IDs, phone numbers, email addresses, and QR codes;
Full-screen screenshots with visible dates, times, and surrounding context;
Screen recordings showing how the account and content were accessed;
Original photographs, videos, voice messages, and downloaded files;
Entire message threads rather than selected lines;
Original emails with their full headers;
Login alerts, password-change notices, recovery emails, and lists of active sessions;
Bank, e-wallet, remittance, delivery, or cryptocurrency transaction records;
Call logs, SMS messages, voicemail, and telecommunications notices;
Reports from people who received requests or representations in your name;
Platform report confirmations and takedown notices; and
A dated incident log recording each new account, post, contact, report, and response.

Do not factory-reset, sell, or discard a relevant device while an investigation is possible. Do not alter the original files or rename them in a way that destroys useful dates or context. Back them up securely.

Avoid redistributing intimate images or material involving children. Preserve only what investigators instruct you to retain, do not forward it to friends, and report it urgently through proper channels.

Why prompt reporting matters

Under Section 13 of Republic Act No. 10175, service providers must preserve traffic data and subscriber information for a minimum of six months from the transaction. Content data may be preserved for six months after a law-enforcement preservation order, with a possible one-time extension.

This does not mean every platform will retain every record for exactly six months, nor does it give a private complainant the power to demand subscriber data. Disclosure generally requires an officially docketed investigation and the legal process required by the Cybercrime Prevention Act and the applicable court rules. Report early so investigators can assess whether preservation measures are necessary before records disappear.

Do not assume that every possible charge has the same filing deadline. Cyber libel generally prescribes in one year from discovery, while identity theft, fraud, privacy offenses, threats, and civil claims may be governed by different periods and rules. Prescription can also depend on when the offense was discovered and whether qualifying proceedings interrupted the period.

Common mistakes to avoid

Reporting the profile before saving its URL and contents;
Saving only cropped screenshots with no username, date, or context;
Blocking the account before recording messages and transactions;
Deleting security alerts or wiping the affected device;
Sending identification documents to unofficial “support agents”;
Paying the impersonator to remove the account;
Publicly accusing an unverified suspect;
Posting the suspect’s personal information or encouraging online harassment;
Asking others to submit knowingly false or exaggerated reports;
Treating a platform report, barangay blotter, or bank complaint as a replacement for a formal criminal complaint;
Assuming police can obtain a foreign platform’s subscriber information immediately; or
Waiting for financial loss before reporting repeated deception, threats, or data misuse.

When help is urgent

Contact the police immediately—and call the national emergency number 911 where there is an immediate safety risk—if the account is making credible threats, stalking you, arranging an in-person meeting, impersonating you to locate a child or vulnerable person, or threatening violence.

Seek urgent assistance when:

Money is being transferred or an unauthorized transaction is still pending;
A bank, loan, e-wallet, SIM, or government-service account was opened or taken over in your name;
The perpetrator is demanding money, sexual activity, passwords, or additional images;
Intimate material is being posted or threatened;
A child is involved;
The account is contacting customers or conducting transactions as your business;
Evidence is rapidly disappearing; or
A cyber-libel, protection-order, injunction, or other time-sensitive remedy may be necessary.

If you need legal advice and cannot afford private counsel, the Public Attorney’s Office provides legal advice and qualifying assistance to indigent persons, subject to its eligibility and merit rules.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Report it to the platform and give the PNP or NBI every available identifier. Do not guess the operator’s identity. Investigators may seek subscriber, traffic, or other records through the applicable legal process, although identifying an operator is not guaranteed.

Is using my name and photograph enough to establish identity theft?

Not necessarily. Similar names, fan pages, commentary, parody, journalism, and use of information deliberately made public require careful factual and legal assessment. Deceptive presentation, unauthorized representations, solicitation, harassment, illegitimate purpose, and resulting or intended harm are important circumstances.

Do I need to lose money before filing a complaint?

No. Republic Act No. 10175 expressly contemplates computer-related identity theft where no damage has yet been caused, although it provides a lower penalty in that situation. Report promptly when impersonation is being used for an illegitimate purpose.

Should I contact the fake account and demand deletion?

Usually not. Contact can warn the operator, trigger deletion of evidence, or expose you to further manipulation. Preserve the evidence and use official reporting channels. If written notice is needed for an NPC complaint, direct it to the identifiable organization or concerned entity through a verifiable address, not through risky negotiation with an unknown impersonator.

Can I report both to the platform and law enforcement?

Yes. They serve different purposes. The platform can enforce its rules and remove content; law enforcement investigates possible crimes. A privacy complaint, bank complaint, workplace or school complaint, and civil remedy may also proceed where legally appropriate.

Will police automatically have access to the account owner’s name or IP address?

No. Private subscriber and content records are not ordinarily released simply because a victim asks. Investigators must follow the Cybercrime Prevention Act, the Rule on Cybercrime Warrants, and any applicable international process. Foreign platforms may have different retention systems and response requirements.

What if the fake account has already been removed?

You may still report the incident. Provide saved URLs, screenshots, messages, report confirmations, witnesses, and transaction records. Removal can stop further public harm, but it does not erase evidence already preserved or necessarily prevent investigation.

Is a notarized affidavit always required?

Not for an ordinary platform report. A formal NBI or police complaint commonly involves a sworn complaint or sworn statement, which the receiving office may help prepare. An NPC complaint must comply with its verified or notarized filing requirements.

Official sources

This article provides general legal information, not legal advice or a prediction of any case outcome. The applicable offense, remedy, evidence requirements, and deadline depend on the facts and documents. Laws, procedures, and official reporting channels were checked as of 3 August 2026.