Quick answer

If someone is using your name, photos, documents, business identity, or account details without permission, act on three tracks at once:

Preserve the evidence before the account disappears.
Report the account and each harmful post or message to the social-media platform.
Report possible crimes to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.

Also contact your bank, e-wallet, lender, telecom provider, employer, or government agency immediately if any related account, money, SIM, document, or record may be compromised. File a separate complaint with the National Privacy Commission when personal data has been unlawfully processed or disclosed.

A platform report may remove an account, but it does not replace a criminal or privacy complaint. Likewise, a police report does not automatically remove the profile. When appropriate, do both.

When a fake account may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

The Supreme Court explained in Disini v. Secretary of Justice that the prohibited conduct involves using another person’s identifying data for an illegitimate purpose. Merely acquiring or sharing information that the person made public is not, by itself, identity theft. But publicly available information is not blanket permission to create a deceptive profile, solicit money, open accounts, or transact as that person.

A fake or pseudonymous account is therefore not automatically a criminal identity-theft case. The facts matter:

Is it using another person’s name, photograph, contact details, signature, ID, voice, or business identity?
Is it designed to make people believe that the account belongs to, or is authorized by, that person?
Is it soliciting money, obtaining information, damaging reputation, threatening someone, or accessing other accounts?
Is it clearly labeled as parody, commentary, or a fan account, or is it deceptively presented as genuine?

Even when no damage has yet occurred, computer-related identity theft may still be punishable, although RA 10175 states that the imposable penalty is one degree lower. The ordinary statutory penalty is prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. Only a court can determine guilt and the proper penalty.

Depending on what the account actually did, other laws may also apply, including:

The Data Privacy Act of 2012, Republic Act No. 10173, for unlawful processing, disclosure, or misuse of personal or sensitive personal information;
Estafa, forgery, threats, coercion, or other offenses under the Revised Penal Code;
The Anti-Financial Account Scamming Act, Republic Act No. 12010, when deception is used to obtain financial credentials, control financial accounts, or operate mule accounts;
The Anti-Photo and Video Voyeurism Act, Safe Spaces Act, Anti-OSAEC and Anti-CSAEM Act, or laws protecting women and children, when intimate images, sexual abuse, harassment, or minors are involved; and
Cyber libel, if the account publishes a defamatory imputation satisfying all the legal elements of libel.

Do not assume that every fake account violates every one of these laws. The applicable charge depends on the account’s content, purpose, conduct, victims, and available evidence.

What to do immediately

1. Preserve the account before reporting or confronting it

Record the evidence while it is still accessible. Save:

The complete profile URL, not just the display name;
The exact username, account handle, profile name, and any visible account or user ID;
Full-page screenshots showing the browser address bar, date, time, profile, posts, comments, and messages;
A screen recording showing how you reached the profile and relevant content;
Original messages, emails, voice notes, images, videos, and attachments;
Login alerts, password-reset notices, unfamiliar device or session records, and security emails;
Payment instructions, account names and numbers, QR codes, receipts, transaction references, and bank or e-wallet confirmations;
Names and contact details of people who received messages or were deceived;
Links to your genuine account and documents showing that the identity, photograph, business, or brand belongs to you;
Every platform report number, email acknowledgment, and government complaint reference.

Keep the original files. Make separate copies before cropping, annotating, converting, or forwarding anything. Maintain a short incident log stating what happened, when you discovered it, who was contacted, and what action each recipient took.

Do not publish unredacted IDs, bank details, addresses, or private conversations merely to warn others. A warning post should disclose only what is necessary.

2. Secure your genuine accounts

If the offender may have accessed your real account:

Use a trusted device to secure your primary email account first.
Change reused or compromised passwords and use a unique password for each important account.
Sign out unknown devices and revoke unfamiliar connected apps.
Enable multi-factor authentication, preferably through an authenticator app or other secure method supported by the service.
Check whether the recovery email, mobile number, forwarding rules, or security questions were changed.
Save the security logs and alerts before clearing sessions.

A cloned profile and a hacked account are different. A clone is a separate account copying your identity; an account takeover means the offender controls your genuine account. Use the platform’s account-recovery process for a takeover and its impersonation-reporting process for a clone.

3. Warn likely targets privately

Tell family, friends, customers, coworkers, or business contacts not to send money, disclose one-time passwords, click links, or transact with the fake account. Give them the exact fraudulent username and a link to your genuine account.

Ask recipients to preserve the messages they received. Their screenshots and sworn statements may help establish deception, damage, and the account’s purpose.

Report the account to the platform

Report both the profile and the specific posts, advertisements, messages, or payment solicitations. Select impersonation, pretending to be someone, fraud, scam, or the closest available category.

Official reporting pages include:

Facebook impersonation reporting — Facebook states that an impersonating profile or Page may be reported even if the victim does not have a Facebook account.
Instagram or Threads impersonation form
TikTok impersonation reporting instructions
X impersonation reporting

Use the platform’s current form and follow its identity-verification instructions. Submit identification only through the official platform form, not through a link sent by the suspected impersonator.

Save the report confirmation. If the report is rejected, use the available appeal or follow-up process and identify the exact misleading features: copied photos, identical name, false biography, payment requests, or messages claiming to come from you.

A private user normally cannot compel a platform to disclose the offender’s IP address, subscriber details, or private records. That information ordinarily requires the appropriate law-enforcement and court process.

Report possible crimes to law enforcement

RA 10175 designates the Philippine National Police and National Bureau of Investigation as the principal law-enforcement authorities for cybercrime.

You may report to:

The nearest PNP Anti-Cybercrime Group regional or provincial cybercrime unit;
The NBI Cybercrime Division or an NBI Regional Cybercrime Center;
The NBI online complaint page; or
The CICC National Anti-Scam Hotline 1326 or 1326@dict.gov.ph for cyber-scam reporting and coordination. The DICT lists the email on its official website.

The NBI lists ccd@nbi.gov.ph for its Cybercrime Division on its official divisions directory. Its Citizen’s Charter for computer-crime victims provides for complaint intake, sworn statements, supporting documents, and examination of relevant devices.

Bring or prepare:

A government-issued ID;
A clear chronological account of events;
Printed and electronic copies of the evidence;
The fake account’s URLs and usernames;
Details of the identity or personal information used;
Proof that the information, photographs, account, or business identity belongs to you;
Names and contact details of witnesses or people contacted by the impersonator;
Financial records and institution report numbers, if money or accounts were involved; and
Platform report confirmations.

Ask for the official reference, docket, or complaint number. An initial email or hotline report may lead to further instructions and may not, by itself, complete the sworn complaint required for an investigation or prosecution.

Report promptly. Under RA 10175, service providers must preserve certain traffic data and subscriber information for at least six months from the transaction. Content data may be preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time extension. A victim’s screenshot remains important, but it is not a substitute for provider records obtained through lawful process.

If money, bank details, or an e-wallet is involved

Contact the financial institution through its official hotline or app immediately. Report the transaction as disputed and ask whether the account, transfer, card, or recipient funds can be blocked or temporarily held. Record the time of the report, the representative’s name, and the case number.

Under RA 12010 and BSP Circular No. 1215, BSP-supervised institutions may temporarily hold disputed funds while conducting coordinated verification. The combined holding period cannot exceed 30 calendar days unless extended by a competent court. This does not guarantee recovery; speed matters because the money may already have left the financial system.

If the offender may have applied for credit in your name, obtain your CIC credit report and dispute inaccurate, incomplete, or fraudulent entries through the Credit Information Corporation’s online dispute process. Also notify the lender shown in the report.

Never pay a “recovery agent” who promises guaranteed reimbursement, account tracing, or immediate arrest.

When to file a National Privacy Commission complaint

Consider an NPC complaint when your personal or sensitive personal information was unlawfully collected, copied, published, disclosed, or otherwise processed, particularly when a company, platform, lender, employer, government office, or identifiable person failed to address the misuse.

Under the 2021 NPC Rules of Procedure, as amended, the usual process requires you to:

Notify the personal information controller, processor, or concerned entity in writing about the privacy violation or breach.
Give it an opportunity to act.
Show that it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.
File a verified, notarized complaint with the evidence, correspondence, requested relief, and certification against forum shopping.

The NPC may waive the exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable damage, the absence of a plain and adequate remedy, or patently illegal conduct. Explain and prove the reason if waiting would expose you or others to serious harm.

Use the NPC’s current Complaint-Affidavit or Reklamong Salaysay. A respondent may be identified through available circumstances even when the real person behind the account is not yet known.

The notarized complaint may be filed personally, by registered mail, by courier, or through an electronic method authorized by the NPC. The NPC’s complaint-filing page currently directs complainants to complaints@privacy.gov.ph.

The basic NPC complaint filing fee is ₱500, with additional fees for damages claims under NPC Circular No. 2023-01. Government complainants and qualified indigent complainants are exempt, and the NPC may waive fees for good cause upon motion.

An NPC proceeding addresses data-privacy violations. It does not replace a PNP or NBI criminal complaint.

Common mistakes to avoid

Reporting the profile before saving its URL, messages, and payment details;
Keeping only cropped screenshots that do not show the account or context;
Deleting conversations, security alerts, receipts, or original files;
Resetting or disposing of the affected phone before preserving relevant evidence;
Confronting the suspected offender and prompting deletion of the account;
Sending government IDs to unofficial “support” accounts;
Assuming that mass-reporting will identify the offender or preserve platform records;
Treating a platform acknowledgment, barangay blotter, or hotline call as a completed cybercrime complaint;
Publicly accusing a named person without reliable evidence; or
Waiting for financial loss before acting, even though attempted or no-damage conduct may still be legally relevant.

When help is urgent

Call 911 or contact the nearest police station immediately if there is an imminent threat of violence, stalking, abduction, self-harm, or physical danger.

Seek prompt assistance from the PNP or NBI when:

The offender is demanding money or threatening to release private material;
Intimate images or sexual content are involved;
A child is being impersonated, groomed, threatened, or sexually exploited;
The fake account is directing people to a physical location;
A bank, e-wallet, SIM, email, or government account has been taken over;
Loans, contracts, purchases, or government transactions are being made in your name; or
The account is rapidly contacting victims or moving money.

Consult a Philippine lawyer promptly if you need a preservation strategy, cease-and-desist demand, damages claim, prosecutor’s complaint, or urgent court relief. Separate offenses have different prescriptive periods. For example, the Supreme Court held in its April 8, 2026 resolution in Causing v. People that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents. Do not wait until a deadline is near.

Frequently asked questions

Can I report a fake account if I do not know who created it?

Yes. Preserve the URLs, usernames, messages, payment details, and other clues. Law enforcement may seek subscriber or traffic information through lawful procedures. In an NPC complaint, explain the circumstances that may lead to identification of an unknown respondent.

Is using my photograph enough to prove identity theft?

Not necessarily. It is important evidence, but criminal liability depends on the complete facts, including intentional use without right and an illegitimate purpose. A copied photograph combined with your name, biography, messages, and solicitations creates a stronger factual record than the photograph alone.

Should I ask friends to report the account?

They may report it, especially if they received fraudulent messages. First ensure that you and the recipients have preserved the account, messages, links, and transaction details. Multiple platform reports are not a substitute for a properly documented government complaint.

Can I demand the account owner’s identity directly from the platform?

You may ask, but platforms generally do not disclose private subscriber or IP information to an ordinary user. Police, investigators, prosecutors, and courts have procedures for preservation and lawful disclosure.

What if the account has already been deleted?

Report anyway. Submit your screenshots, emails, messages, URLs, witnesses, and platform acknowledgments. Deleted public content may make investigation harder, but it does not necessarily mean that all provider or recipient records are gone.

Will reporting guarantee that the account is removed or the offender is charged?

No. The platform applies its own rules, while investigators and prosecutors assess whether the evidence establishes a legal offense and identifies a responsible person. Complete, prompt, and authentic evidence materially improves the report.

This article provides general Philippine legal information, not advice for a particular case and not an assurance of takedown, prosecution, or recovery. Procedures and legal conclusions may change or depend on the evidence, platform, and documents involved. Official sources and procedures were checked as of July 27, 2026.