Quick answer

If someone is using your name, photos, personal details, or hacked account to impersonate you, preserve the evidence first, report the account through the platform’s official impersonation channel, secure your email and financial accounts, and file a report with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD).

Do not wait for the platform to remove the account before contacting law enforcement when money, threats, extortion, hacked accounts, private images, or continuing harm are involved. Platforms can disable accounts, but identifying and prosecuting the operator generally requires lawful investigation and, where required, a court warrant.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012, computer-related identity theft covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person or organization. A fake account may fall within this provision, but the account’s contents, purpose, use of your information, and surrounding facts will determine whether a crime occurred.

Act immediately if money or safety is at risk

Take urgent action if the fake or compromised account is:

Asking your contacts for money, investments, donations, OTPs, passwords, or identity documents
Accessing your bank, e-wallet, email, shopping, government, or work accounts
Threatening, stalking, blackmailing, or extorting you
Publishing private, intimate, or altered sexual images
Targeting a child or vulnerable person
Making transactions or signing documents in your name
Causing an immediate risk of physical harm

For immediate danger, call the nationwide Unified 911 emergency hotline. For a disputed bank or e-wallet transaction, contact the institution through its official hotline or in-app support immediately—before posting publicly or waiting for a police report.

First, preserve the evidence

Capture evidence before blocking the account or requesting its removal. Once an account is deleted, renamed, or restricted, important details may become harder to retrieve.

Preserve:

The complete profile URL, username, display name, and visible account ID
Screenshots of the profile, bio, photos, posts, comments, stories, and messages
A screen recording showing how you reached the profile from the platform
The date and time when each item was viewed or received
Messages sent to you, your relatives, customers, coworkers, or friends
Phone numbers, email addresses, payment instructions, QR codes, and links used
Bank or e-wallet account names, account numbers, transaction references, receipts, and timestamps
Notices from the platform and confirmation numbers for reports
Proof that the real identity or account belongs to you
Names and contact details of witnesses or people approached by the impostor
A short chronological account of what happened and when you discovered it

Keep the original files on the device where possible. Save backup copies without editing, annotating, compressing, or repeatedly forwarding them. Cropped screenshots are useful for quick reference, but also preserve uncropped versions showing the account, URL, date, and surrounding context.

Electronic evidence must still be shown to be authentic and reliable. The Rules on Electronic Evidence recognize electronic documents and accurate printouts, but the person offering them may have to establish their integrity and authenticity.

Secure your real accounts

If there is any possibility that your account was hacked rather than merely copied:

Change the password of the email account connected to your social-media profiles.
Change passwords for affected social-media, banking, e-wallet, shopping, cloud-storage, and government accounts.
Use unique passwords and enable multi-factor authentication.
Review active sessions and sign out unfamiliar devices.
Remove unknown recovery emails, phone numbers, applications, and browser extensions.
Check whether forwarding rules were added to your email.
Ask your mobile provider for assistance if your SIM suddenly lost service or you suspect an unauthorized SIM replacement.
Review financial statements and transaction histories.
Warn close contacts through a trusted channel, but do not publish sensitive evidence or government-ID numbers.

Use a clean, trusted device if you suspect that your phone or computer contains malware.

Report the account to the platform

Report both the profile and any harmful posts, messages, advertisements, or payment solicitations. A report against the profile alone may not fully document separate violations.

Official reporting channels include:

Follow the platform’s instructions carefully. If identity verification is requested, submit documents only through the genuine platform form or application—not through links or email addresses supplied by the fake account. Record the report number and keep copies of all correspondence.

Ask people who actually received fraudulent messages to preserve and report those messages from their own accounts. Their firsthand evidence can show how the impostor used the account and what representations were made.

A platform report is important, but it is not the same as a criminal complaint. Account removal also does not automatically reveal who created or operated it.

Where to report in the Philippines

The Cybercrime Prevention Act assigns cybercrime enforcement to the PNP and NBI. You may approach either agency.

Where to report	Best used for	What to expect
PNP Anti-Cybercrime Group eComplaint or a PNP anti-cybercrime unit	Impersonation, hacking, online fraud, threats, extortion, and related cybercrime	Initial evaluation followed, where appropriate, by a formal sworn complaint and investigation
NBI Online Complaint or the NBI Cybercrime Division	Identity theft, hacked accounts, fraud, and cases requiring digital investigation	Interview, complaint sheet, sworn statements, supporting documents, and possible examination of relevant devices
CICC/DICT through hotline 1326 or 1326@dict.gov.ph	Initial assistance, scam reporting, and referral when you are unsure which agency should handle the incident	Coordination or referral; a formal complaint with the PNP, NBI, or another proper agency may still be required
National Privacy Commission	Unlawful collection, disclosure, or use of personal data and violations of data-subject rights	A separate administrative privacy proceeding subject to NPC procedural requirements
Your bank or e-wallet, then the BSP Consumer Assistance Mechanism	Unauthorized or disputed financial transactions involving a BSP-supervised institution	The institution handles the first-level complaint; unresolved complaints may be escalated to the BSP

The NBI’s current citizen’s charter states that a complainant may be interviewed, execute sworn statements, submit supporting documents, and present a relevant device for examination. The NBI lists ccd@nbi.gov.ph as the Cybercrime Division’s official email address, but an email or online tip may not replace the sworn complaint and personal participation needed for a formal investigation.

When filing, bring a valid ID, your timeline, printed and electronic copies of the evidence, platform-report confirmations, transaction records, and the device containing the original messages if requested. Ask for a complaint, reference, or docket number.

What to include in your report

A clear report should answer:

Who is being impersonated?
What identifying information was copied or used?
What is the exact URL and username?
When was the account discovered?
What did the operator say or do?
Who received the messages?
Was money requested, transferred, or lost?
Were any accounts accessed without permission?
What harm has occurred or is still likely?
What reports have already been made to the platform, bank, employer, or government agency?
What information might help identify the operator?

If the operator is unknown, say so. Do not guess. Provide the circumstances and technical leads that may help investigators identify the person.

Ask the investigator whether an immediate preservation request should be sent to the platform or service provider. Under Section 13 of the Cybercrime Prevention Act, traffic data and subscriber information are generally preserved for at least six months from the transaction, while content data may be preserved for six months after a law-enforcement preservation order, subject to the law’s extension rules. Victims should therefore report promptly even when the account has already been removed.

Disclosure of subscriber information or other protected computer data is not automatic. Section 14 requires law enforcement to secure a court warrant before ordering disclosure in connection with a valid, officially docketed investigation.

If money was transferred

Contact the sending bank or e-wallet immediately using its official fraud channel. Provide the transaction reference, amount, time, recipient account, and supporting messages. Ask the institution to:

Mark the transaction as disputed
Secure your account and block unauthorized access
Coordinate with the receiving institution
Trace and, when legally available, temporarily hold the disputed funds
Give you a complaint or case reference number

The Anti-Financial Account Scamming Act and BSP Circular No. 1215 establish procedures for temporary holding and coordinated verification of disputed funds. A temporary hold can last no more than 30 calendar days under the BSP rules, including initial and extended periods. This is not a guarantee that money will be recovered; speed, available balances, transaction paths, and the evidence will matter.

If the institution does not resolve the complaint, escalate it through the BSP Online Buddy or the BSP Consumer Assistance Mechanism. BSP generally requires proof that you first used the institution’s own consumer-assistance process.

When a National Privacy Commission complaint may help

Identity misuse may also involve the Data Privacy Act of 2012, particularly when personal information was unlawfully collected, disclosed, or used. However, not every fake account automatically establishes a Data Privacy Act violation; the type of information, person or entity responsible, purpose, consent, lawful basis, and statutory exceptions must be examined.

Before filing a formal NPC complaint, the 2021 NPC Rules of Procedure, as amended generally require the complainant to:

Inform the personal information controller, processor, or concerned entity of the violation in writing.
Allow it to take appropriate action.
Show that it failed to act appropriately or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive these requirements for properly established good cause or a serious violation involving significant risk of harm. A formal complaint must generally be written, signed, verified, supported by evidence, accompanied by the required certification against forum shopping, and filed using an authorized mode. Follow the NPC’s current complaint instructions and form, including any applicable filing fee.

An NPC proceeding is separate from a PNP or NBI criminal investigation. One does not necessarily replace the other.

Is every fake account a crime?

No. The legal issue is not simply whether an account is “fake.”

An account is more likely to raise criminal concerns when it uses another person’s identifying information without right for an illegitimate purpose—such as deception, fraud, harassment, accessing accounts, obtaining money, damaging reputation, or causing others to act on false information.

A person using a pseudonym, sharing the same name, operating a clearly disclosed fan or parody account, or reposting information that the subject made public is not automatically committing computer-related identity theft. In Disini v. Secretary of Justice, the Supreme Court explained that Section 4(b)(3) targets the illegitimate acquisition or use of another’s identifying data and that obtaining and disseminating information made public by the user is not, by itself, identity theft.

The complete conduct still matters. A supposedly humorous or unofficial account may become legally problematic if it deceives people, solicits funds, publishes unlawful threats or defamatory material, or misuses private information.

Possible penalties

Computer-related identity theft is punishable under Section 8 of the Cybercrime Prevention Act by prisión mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, Section 4(b)(3) provides for a penalty one degree lower. Only a court can determine guilt, the applicable penalty, and whether other offenses were also committed.

Depending on the proven acts, a case may involve other laws or offenses, such as illegal access, computer-related forgery or fraud, estafa, threats, extortion, cyberlibel, or unlawful processing or disclosure of personal information. These should not be assumed merely from the existence of a fake account.

Deadlines: do not rely on the outer prescriptive period

The Cybercrime Prevention Act does not create a special short deadline for reporting identity theft. Under Act No. 3326, special-law offenses punishable by imprisonment of six years or more generally prescribe after 12 years. The starting point and interruption of prescription depend on when the offense was committed or discovered and when proceedings were instituted.

That calculation can change with the specific offense, applicable penalty, continuing conduct, identity of the offender, and procedural history. Obtain case-specific legal advice if significant time has passed.

More importantly, platform records can disappear much sooner. The six-month statutory preservation periods for certain computer data are a practical reason to report without delay.

Common mistakes to avoid

Waiting for the platform’s decision before preserving evidence or reporting serious harm
Keeping only cropped, edited, or forwarded screenshots
Deleting conversations, resetting the phone, or discarding the SIM used
Clicking links or sending IDs, OTPs, passwords, or money to the impostor
Publicly accusing a suspected person without reliable evidence
Threatening, hacking, or trying to entrap the operator yourself
Publishing the impostor’s bank details together with your own private information
Assuming that mass reporting will identify the account operator
Treating a platform takedown as a substitute for a police or NBI complaint
Filing inconsistent versions of events with different agencies
Failing to keep reference numbers and copies of submissions

When legal help is urgent

Consult a

Quick answer

If someone is using your name, photos, personal information, or hacked account to deceive others, preserve the evidence first, report the account through the platform’s impersonation channel, secure your email and financial accounts, and promptly file a report with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or National Bureau of Investigation Cybercrime Division (NBI-CCD).

Report any unauthorized bank or e-wallet transaction to the financial institution immediately. If personal data was unlawfully processed or the platform or another organization failed to address a privacy violation, a separate complaint may be filed with the National Privacy Commission (NPC).

A platform report can remove an account, but it does not replace a criminal complaint. Likewise, an account’s removal does not necessarily identify its operator or recover stolen money.

Is a fake account automatically illegal?

Not every account using a similar name is automatically a crime. The legal issue depends on what information was used, whether the use was authorized, and what the account was intended to accomplish.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person. If no damage has yet occurred, the law provides for a penalty one degree lower.

In Disini v. Secretary of Justice, the Supreme Court explained that the prohibited conduct concerns another person’s identifying data and must involve an illegitimate purpose. Merely acquiring or sharing information that the person made public is not, by itself, identity theft. The surrounding conduct therefore matters: pretending to be the victim, soliciting money, gaining account access, deceiving contacts, or using personal data to damage the victim can materially change the legal assessment. Read the Supreme Court decision.

Depending on the facts, the same conduct may also involve illegal access, computer-related forgery or fraud, estafa, threats, cyber libel, unlawful processing of personal information, or another offense. These are not automatic consequences of every fake profile; investigators and prosecutors must evaluate the evidence and the elements of each offense.

Clearly disclosed parody, commentary, fan accounts, pseudonyms, and accounts belonging to people who genuinely share the same name are different from deceptive impersonation. A copied photograph or name alone should not be treated as conclusive proof of a crime without examining the account’s presentation and conduct.

What to do immediately

1. Preserve evidence before reporting or blocking

The account may disappear once it is reported or confronted. Before taking action, save:

The complete profile URL, username, display name, and any visible account or user ID.
Screenshots of the profile, biography, photos, posts, comments, followers, and messages.
Screenshots showing the browser address bar or app profile details, not only cropped content.
A screen recording showing how you reached the profile and the content displayed.
Dates and times when the account was discovered and when each message or transaction occurred.
Copies of emails, SMS messages, chat exports, voice messages, and call logs.
Names and contact details of people approached or deceived by the account.
Payment instructions, account names, mobile numbers, QR codes, receipts, transaction references, and bank or e-wallet statements.
Platform-report confirmations, ticket numbers, and replies.
Proof that the genuine identity or original account belongs to you, such as older profile records or account notifications.

Keep the original files. Do not rely only on edited, annotated, or compressed screenshots. Store a backup and record who collected each item and when. The Rules on Electronic Evidence require electronic evidence to be authenticated and shown to be reliable; a screenshot is useful, but its source, integrity, and context may still need to be proved.

Do not hack the account, install tracking software, trick the operator into downloading malware, or publicly expose an unverified suspect.

2. Secure the accounts that could be affected

If any account may have been compromised:

Change the password of your primary email first, using a trusted device.
Change passwords for social media, banking, e-wallet, shopping, cloud-storage, and government-service accounts.
Sign out unknown devices and revoke unfamiliar sessions or connected applications.
Turn on multi-factor authentication, preferably through an authenticator app or other method supported by the service.
Check whether recovery emails, phone numbers, forwarding rules, or security questions were changed.
Ask your mobile provider for help if your SIM stopped working unexpectedly or a SIM-swap is suspected.
Notify the issuing agency if a government ID or identification number was exposed or fraudulently used.

Never send an OTP, password, recovery code, or full image of an identification card to the impostor.

3. Warn likely targets without oversharing

Tell family members, coworkers, clients, and other likely contacts that the account is unauthorized. Provide the exact fake username or URL and instruct them not to send money or personal information.

A short public warning may help, but do not publish private identification numbers, unredacted bank records, sensitive messages, or unsupported accusations against a suspected person.

Report the account to the platform

Use the platform’s impersonation process and separately report scam messages, threatening posts, or other violating content. Reporting only an individual post may leave the account active.

Official reporting pages include:

Provide identification only through the platform’s genuine website or application. Check the domain carefully. Do not send an ID through a direct message to someone claiming that they can remove the account.

Ask affected contacts to submit truthful reports based on what they personally observed. Avoid automated or knowingly false mass reports.

Save the report reference and all platform replies. Takedown timing varies, and submitting a report does not guarantee removal. If the platform denies the report, use its appeal or follow-up process and attach clearer evidence of impersonation.

File a cybercrime report

The Cybercrime Prevention Act assigns cybercrime law enforcement to the NBI and PNP. You may approach either agency.

PNP Anti-Cybercrime Group

Use the PNP-ACG e-Complaint channel or contact the nearest PNP Anti-Cybercrime Group office or regional unit. An online submission may be an initial report; investigators may still require a personal appearance, sworn statement, identification, and examination of relevant devices.

National Bureau of Investigation

You may submit an initial report through the NBI Online Complaint page or proceed to the NBI Cybercrime Division or an appropriate regional office. The NBI lists the Cybercrime Division’s official email as ccd@nbi.gov.ph on its Divisions and Services directory.

The NBI’s published procedure includes an interview, a duly sworn complaint sheet, sworn statements or prepared affidavits, submission of supporting documents, and, where relevant, examination of the device. See the NBI Citizen’s Charter procedure.

CICC and the 1326 hotline

For initial assistance or referral, contact the Cybercrime Investigation and Coordinating Center through the DICT’s national anti-scam hotline 1326 or email 1326@dict.gov.ph. CICC assistance is useful when you are unsure which agency should handle the report, but investigators may still direct you to execute a formal complaint with the PNP or NBI.

What to bring or submit

Prepare:

A valid government-issued ID.
A concise chronological statement identifying what happened, when it happened, and how you discovered it.
The fake account’s exact URL and username.
Printed and electronic copies of the evidence.
Names and contact details of witnesses or people who received messages.
Transaction records and the receiving financial-account details, if money was involved.
Copies of platform, bank, e-wallet, telecommunications, and other reports.
The original device, if requested for lawful forensic examination.

You may report even if the account operator is unknown. Give investigators every available lead rather than guessing the person’s identity. Obtain and retain the report, complaint, or reference number.

Platform subscriber and traffic information ordinarily cannot simply be demanded by a private complainant. Under the Cybercrime Prevention Act, disclosure to law enforcement requires legal process, including a court warrant where applicable.

If money or a financial account is involved

Contact the bank, e-wallet, card issuer, remittance company, or other institution immediately through its verified fraud channel. Ask it to:

Secure or suspend the affected account.
Record the transaction as disputed.
Trace the recipient and any onward transfers.
Apply the temporary-hold and coordinated-verification procedures that are legally available.
Preserve relevant account, authentication, and transaction records.
Give you a case or reference number.

The Anti-Financial Account Scamming Act and BSP Circular No. 1215 provide mechanisms for temporarily holding disputed funds and coordinating verification among institutions. The BSP rules state that account owners should report disputed transactions immediately. A report does not guarantee recovery, especially if the funds have already left the regulated financial system.

If the institution does not resolve the complaint, escalate it through the BSP Consumer Assistance Mechanism. BSP generally expects the consumer to have first used the institution’s own consumer-assistance process.

When to complain to the National Privacy Commission

An NPC complaint may be appropriate when the incident involves unlawful collection, use, disclosure, alteration, or other processing of personal information, or when a personal-information controller fails to respect applicable data-subject rights. The Data Privacy Act of 2012 gives data subjects rights that can include correction and, upon the required proof and circumstances, blocking, removal, or destruction of personal information unlawfully obtained or used for unauthorized purposes.

Before filing, the current NPC Rules of Procedure, as amended generally require the complainant to:

Inform the personal-information controller, processor, or concerned entity of the violation in writing.
Allow it to take appropriate action.
Show that it did not take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive these requirements for properly established good cause or a serious violation, including circumstances involving grave and irreparable harm.

A formal NPC complaint must be written, signed, verified, and supported by evidence and relevant correspondence. It must include the required certification against forum shopping and filing fee unless an exemption or waiver applies. Follow the current instructions and form on the NPC complaint page.

An NPC proceeding serves a different purpose from a criminal investigation. Filing with the NPC does not replace reporting fraud or identity theft to the PNP or NBI.

Important time limits

There is no single short deadline that applies to every fake-account incident, but delay can seriously damage a case.

Under Section 13 of the Cybercrime Prevention Act, service providers must preserve the integrity of subscriber information and traffic data for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, and law enforcement may order one extension for another six months. A victim cannot assume that deleted content or older records will remain available indefinitely.

The Act does not state a special prescriptive period for computer-related identity theft. Act No. 3326 generally provides a 12-year period for special-law offenses punishable by imprisonment of six years or more. The calculation can depend on when the offense was committed or discovered, what exact offense and penalty apply, and whether proceedings interrupted prescription. Obtain case-specific legal advice instead of using the outer period as a reason to wait.

For identity theft under Section 4(b)(3), a conviction is punishable under Section 8 by prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The no-damage proviso provides for a penalty one degree lower. Only a court can determine guilt and the proper penalty.

Common mistakes to avoid

Reporting or blocking the account before saving its URL, content, and messages.
Keeping only cropped or edited screenshots.
Deleting chats, resetting the phone, or discarding the SIM used during the incident.
Sending money, an OTP, or additional identification to “verify” your identity.
Treating a platform takedown as a complete criminal complaint.
Waiting for the platform’s response while stolen funds continue moving.
Publicly naming a suspected operator without reliable evidence.
Threatening, harassing, doxxing, or attempting to hack the suspected account.
Filing inconsistent versions of the incident with different agencies.
Giving evidence to unofficial “cyber investigators” who demand payment or account credentials.

When help is urgent

Call Unified 911 and contact the police immediately if there is a credible threat of violence, stalking, abduction, self-harm, or another immediate danger.

Seek prompt law-enforcement and legal assistance when:

The account is extorting or threatening you.
Money is currently being solicited or transferred.
A bank, e-wallet, SIM, email, or government account was taken over.
Intimate images, sexual material, or information involving a child is being used.
The account is issuing fake contracts, invoices, loan applications, or government documents.
Clients, employers, or relatives are being deceived in your name.
The platform removed the account before you obtained adequate evidence.
You need urgent preservation of subscriber, traffic, or content data.

Do not redistribute intimate or child sexual-abuse material while gathering evidence. Preserve the URL and surrounding information and follow investigators’ instructions.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Preserve the account identifiers and describe any circumstances that may help identify the operator. Do not invent a name or accuse someone based only on suspicion.

Can a friend report an impersonation account?

A friend can usually report it through the platform and can give a witness statement about messages received. A formal legal complaint is generally strongest when made by the person impersonated or a properly authorized representative. A parent or guardian may act for a minor subject to the agency’s documentation requirements.

Should I confront the fake account?

Usually not. Confrontation may cause the operator to delete evidence, threaten the victim, or move stolen funds. Preserve evidence and report first. Follow law-enforcement advice if contact might be relevant to an investigation.

What if the fake account has already been deleted?

Report it anyway. Submit the URL, username, screenshots, messages, transaction records, witness information, and the date it disappeared. Service-provider records may still exist, but timely lawful preservation is important.

Will the platform tell me who operated the account?

Usually not through an ordinary user report. Subscriber or traffic information may require a law-enforcement investigation, court warrant, or other lawful process.

Is a notarized affidavit required immediately?

Not necessarily for an initial online tip. However, a formal investigation will commonly require you and relevant witnesses to execute sworn statements or a complaint-affidavit. Follow the receiving agency’s instructions.

Do I need a lawyer?

A lawyer is not normally required to make an initial platform, bank, PNP, or NBI report. Legal help is advisable when there is significant financial loss, threats, intimate material, possible defamation, multiple possible offenses, uncertainty about prescription, or a need for urgent court relief.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the account, messages, documents, losses, and other evidence. Laws and official procedures were checked as of 2 August 2026.