Quick answer

If someone creates a fake social media account using your name, photos, business identity, contact details, or other identifying information, preserve the evidence first, report the account to the platform, and consider filing a formal cybercrime complaint with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD). Do not wait for the platform to delete the account before preserving URLs, screenshots, messages, usernames, transaction details, and other evidence.

Philippine law specifically punishes computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012. It covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or juridical entity's identifying information without right. The law expressly provides for liability even when no damage has yet been caused, although the imposable penalty is then one degree lower. (Lawphil)

A fake account is not automatically a criminal case merely because it uses a similar name or resembles another profile. The particular facts matter: what information was copied, whether it actually belongs to another person or organization, whether its use was intentional and without right, what the account represented itself to be, and what the operator did with it. The Supreme Court has upheld the constitutionality of the computer-related identity-theft provision and recognized that identifying information may include such information as a person's name, citizenship, address, contact number, birth information, spouse, occupation, and similar data. (eLibrary)

When a fake account may amount to computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act is broader than scams involving stolen credit cards or bank accounts. It applies to identifying information belonging to either a natural person or a juridical person, such as a corporation or organization. The prohibited conduct includes intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting that identifying information without right. (Lawphil)

Accordingly, a profile that deliberately assumes another person's identity, copies identifying details, and presents itself to other users as that person can raise a serious identity-theft issue. The same may be true where a fake account impersonates a company and communicates with customers as though it were an authorized company account.

Actual monetary loss is not necessarily required before the law can apply. Section 4(b)(3) itself addresses the situation in which "no damage has yet been caused" by providing for a lower penalty. For completed computer-related offenses under Section 4(b), Section 8 generally provides the penalty of prision mayor, or a fine of at least ₱200,000 up to an amount commensurate to the damage incurred, or both, subject to the specific provisions of the statute. (Lawphil)

Not every use of somebody else's name or information, however, should be automatically labeled criminal identity theft. The statute requires conduct involving another's identifying information without right, which the Cybercrime Prevention Act defines to include conduct undertaken without or beyond authority and conduct not protected by an applicable legal defense, justification, court order, excuse, or relevant legal principle. (Lawphil) A clearly identified parody, commentary page, fan page, authorized business account, or other fact pattern may therefore require a different legal analysis from a deceptive account pretending to be the victim.

What to do as soon as you discover the fake account

Preserve the account before reporting it. Record the exact profile URL, username or handle, display name, profile and cover photos, biography, follower information where relevant, and the date and time you accessed it. Take screenshots showing the entire screen when practicable rather than only isolated text. If the account has sent messages, save the complete conversation and the account information connected with it.
Preserve the original electronic evidence. Keep original photos, emails, message exports, downloaded files, transaction receipts, security alerts, login notifications, and other electronic records. Avoid unnecessarily editing, annotating, cropping, or resaving your only copy. If witnesses received messages from the fake account, ask them to preserve their own copies rather than merely forwarding screenshots to you.
Report the impersonating profile through the social-media platform's official reporting system. Choose the category for impersonation, pretending to be another person, fake identity, or the closest equivalent. Platforms may request identification or other proof that you are the person or authorized representative being impersonated. TikTok, for example, provides both in-app reporting and an impersonation-reporting process; X likewise maintains a dedicated impersonation procedure.
Secure your genuine accounts. If there is any possibility that the offender obtained your credentials, change passwords beginning with your email account, terminate unknown sessions, review recovery email addresses and phone numbers, and enable multi-factor authentication. If the offender actually took control of your genuine Facebook account rather than merely creating a separate clone, Meta maintains a separate hacked-account recovery process. (Facebook)
Warn likely targets without destroying or contaminating evidence. You may tell family members, employees, customers, or contacts that the named account is unauthorized and that they should not send money, passwords, OTPs, identification documents, or personal information to it. Avoid publicly naming a suspected offender as fact unless you have a sound evidentiary and legal basis for doing so.
File a cybercrime complaint when the impersonation is serious, persistent, fraudulent, threatening, or harmful. Both the PNP and NBI are designated law-enforcement authorities under the Cybercrime Prevention Act. The NBI's current Citizen's Charter provides for complaints to its Cybercrime Division, including an initial interview, a sworn complaint sheet, collection of supporting documents and sworn statements, and examination of relevant devices when appropriate. (National Bureau of Investigation)
Tell investigators if evidence may disappear. Philippine cybercrime law contains specific preservation mechanisms for computer data. Traffic data and subscriber information must generally be preserved by service providers for at least six months from the transaction, while content data may be preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. Disclosure of protected computer data ordinarily involves the legal procedures and court warrants applicable to cybercrime investigations. (Cybercrime Division)
If money or financial accounts are involved, contact the bank or e-wallet provider immediately as well. Preserve account numbers, reference numbers, transaction timestamps, recipient information, payment confirmations, conversations, and any notices sent to the financial institution. A platform report alone does not freeze a fraudulent transfer or begin a criminal investigation.

Where to report identity theft in the Philippines

The PNP Anti-Cybercrime Group is one of the principal law-enforcement bodies authorized to investigate offenses under the Cybercrime Prevention Act. Its official contact directory lists the Cyber Response Unit and regional anti-cybercrime units around the country. The Cyber Response Unit currently lists complaint@acg.pnp.gov.ph and its official contact numbers on the PNP-ACG website. (PNP ACG)

The NBI Cybercrime Division likewise accepts requests for investigative assistance from the general public. The NBI's current Citizen's Charter states that a complainant may proceed to the Cybercrime Division, complete a complaint sheet, undergo an initial interview, execute sworn statements or submit prepared affidavits, and provide supporting documents or relevant devices for examination when required. The service itself carries no listed fee. (National Bureau of Investigation) The NBI also maintains an official Online Complaint page and regional and district offices. (National Bureau of Investigation)

A useful practical distinction is that reporting the account to Facebook, Instagram, TikTok, X, or another platform seeks platform action, such as restricting or removing the profile, while filing with the PNP or NBI seeks law-enforcement investigation. One does not automatically replace the other.

Why filing quickly matters even if you already have screenshots

A screenshot can be useful evidence, but the service provider may possess additional evidence that an ordinary user cannot obtain, such as subscriber information or other computer data. Investigators may use the procedures under the Cybercrime Prevention Act and the Supreme Court's Rule on Cybercrime Warrants to seek appropriate disclosure, search, seizure, or examination orders when the legal requirements are met. The Rule on Cybercrime Warrants includes mechanisms such as a Warrant to Disclose Computer Data and warrants dealing with the search, seizure, and examination of computer data. (eLibrary)

This is one reason prompt reporting can matter. Republic Act No. 10175 establishes particular data-preservation periods, including the six-month periods described above. (eLibrary) You should therefore not assume that an account can be investigated equally well months or years later simply because you retained a few screenshots.

If the account suddenly disappears after being reported to the platform, the evidence you preserved beforehand may become particularly important.

What if the offender hacked your real account instead of creating a clone?

A hacked account and a cloned account are different problems.

With a cloned or impersonating account, the offender normally operates a separate account that represents itself as you.

With an account takeover, someone obtains unauthorized access to the genuine account. Depending on the facts, this may implicate illegal access under Section 4(a)(1) of the Cybercrime Prevention Act, as well as identity theft or other offenses arising from what the intruder subsequently does. The Act expressly defines computers broadly enough to include devices such as mobile phones and smartphones. (Lawphil)

For an account takeover, begin the platform's official recovery process immediately, secure the associated email and phone number, preserve the security alerts showing changed passwords or recovery information, and still consider reporting the incident to the PNP-ACG or NBI if unauthorized access or resulting fraud occurred.

What if the fake account is asking people for money?

Preserve every solicitation and transaction record. Ask recipients to save the actual messages they received, the fake account's profile URL, the payment instructions, recipient bank or e-wallet details, QR codes, account names, transaction references, and timestamps.

The legal issue may extend beyond identity theft. Depending on exactly how the scheme operated, investigators may examine whether computer-related fraud, forgery, estafa, offenses involving financial accounts, or other laws are implicated. The appropriate charge depends on the evidence and should not be assumed solely from the appearance of the fake profile.

If somebody has already transferred money, notify the financial institution as soon as possible. Do not wait for the social-media platform to finish its investigation before reporting the financial transaction.

When the Data Privacy Act may also apply

Identity theft and data privacy overlap, but they are not identical legal remedies.

Republic Act No. 10173, or the Data Privacy Act of 2012, regulates the processing of personal information and creates offenses including unauthorized processing and processing for unauthorized purposes. It also grants data subjects rights concerning unlawfully obtained or unauthorized use of their personal information. (Privacy Commission)

A complaint before the National Privacy Commission (NPC) may therefore be relevant when the facts involve a privacy violation or personal-data processing covered by the Data Privacy Act. This route is particularly important when an identifiable person, company, organization, platform, employer, service provider, or other entity has processed personal information unlawfully. It is not a substitute for reporting an anonymous cybercriminal to the PNP or NBI.

Under the NPC's 2021 Rules of Procedure, a complainant must generally first inform the personal information controller, personal information processor, or concerned entity in writing and allow it to address the violation. Ordinarily, a complaint will not be given due course if appropriate action has been taken or until there has been no response within 15 calendar days from receipt of the written notice. The NPC may waive these requirements for good cause or serious violations, including circumstances involving grave and irreparable damage, the absence of an adequate remedy from the respondent, or patently illegal action.

A formal NPC complaint must comply with its procedural requirements and generally include verification, identification of the parties, material facts, supporting evidence, the relief sought, relevant correspondence, and other required documents. The NPC currently provides a complaints-assisted form and accepts complaints through the filing methods stated on its official website. (Privacy Commission)

Evidence worth preserving

For most impersonation cases, the strongest file is one that allows an investigator to reconstruct what existed online, when it existed, what the offender represented, and what happened because of it. Preserve the fake profile's URL and handles; screenshots and screen recordings showing context; dates and times; messages and attachments; copies of photos or documents used by the fake account; your genuine profile showing the information copied; account-security notifications; email headers where relevant; payment records; names and contact details of people approached by the impostor; platform-report confirmations and case numbers; and any communications with banks, e-wallet providers, employers, customers, or other affected entities.

Keep the original electronic versions whenever possible. A printed screenshot may be convenient for filing, but keeping the electronic source gives investigators more to work with. The PNP's published cybercrime complaint procedures likewise identify screenshots, transaction receipts, account statements, and social-media conversations as examples of online evidence used for cybercrime complaints. (NCRPO SPD)

Common mistakes that can weaken your response

One common mistake is reporting the account before preserving anything. The platform may suspend or remove the account, making its public contents harder for you to retrieve.

Another is keeping only a cropped screenshot without the username, URL, date, surrounding conversation, or other context. Preserve enough information to identify where the material came from.

Do not assume that having friends mass-report the profile automatically creates a criminal complaint. Platform moderation and Philippine criminal investigation are separate processes.

Avoid paying someone who promises that they can "hack back," reveal the offender's identity, or guarantee account removal. Unauthorized access can itself create legal problems, and supposed recovery specialists are sometimes another layer of the scam.

Do not impersonate the offender, attempt unauthorized access to the fake account, or alter another person's device in an effort to collect evidence. Law-enforcement investigators have legal mechanisms for obtaining non-public computer data when the necessary legal requirements are satisfied.

Finally, do not delay solely because you do not know who created the account. Cybercrime investigations frequently begin with an unknown online user. What matters initially is giving investigators enough reliable information to identify the account and preserve potentially relevant data.

When legal or law-enforcement help is urgent

Treat the matter as urgent when the fake account is actively collecting money, requesting OTPs or identification documents, threatening physical harm, extorting you, obtaining intimate material, impersonating you in business transactions, contacting your customers or employer, taking control of financial accounts, or rapidly deleting evidence.

The same is true where the offender appears to have accessed your actual email, social-media account, cloud storage, banking account, or mobile device. Secure the affected accounts and contact the appropriate platform, financial institution, and law-enforcement agency promptly.

If there is an immediate threat to someone's physical safety, seek immediate police or emergency assistance rather than waiting for an online platform's moderation process.

Frequently asked questions

Can I report a fake Facebook account even if I do not know who created it?

Yes. Lack of a known real-world identity does not prevent you from preserving evidence and reporting the account. PNP or NBI investigators can evaluate whether further investigative measures are justified. Give them the exact URL, username, screenshots, messages, dates, and any other information that may connect the account to its operator.

Is using my photo and name enough to constitute identity theft?

Possibly, but the conclusion depends on the complete facts. Section 4(b)(3) requires intentional conduct involving another person's identifying information without right. A deceptive profile actually presenting itself as you is materially different from an account merely mentioning you or lawfully using information in another context. (Lawphil)

Do I need to lose money before I can complain?

No. The Cybercrime Prevention Act expressly contemplates computer-related identity theft in which no damage has yet occurred, although the penalty is then one degree lower. (Lawphil) You therefore do not have to wait for the impostor to successfully scam someone before preserving evidence or approaching investigators.

Should I report to PNP or NBI?

Either is legally authorized to investigate cybercrime. Republic Act No. 10175 designates both the PNP and NBI as law-enforcement authorities for the Act. (Cybercrime Division) Which office is more convenient may depend on your location and the circumstances of the case.

Can I have the police obtain the identity behind a social-media account?

Potentially, but non-public subscriber or computer data cannot simply be demanded informally whenever a complainant requests it. Philippine cybercrime law and the Rule on Cybercrime Warrants establish preservation, disclosure, search, seizure, and examination procedures, including judicial warrants where required. (eLibrary)

Should I report the account to the platform or the government first?

Preserve the evidence first. After that, the two reports can proceed in parallel. Platform reporting can help stop ongoing impersonation, while a PNP or NBI complaint can begin the law-enforcement process. If there is an immediate scam, threat, or financial loss, do not postpone the law-enforcement or financial-institution report while waiting for the platform's response.

Can a company also be the victim of computer-related identity theft?

Yes. Section 4(b)(3) expressly covers identifying information belonging to another natural or juridical person. (Lawphil) A fake account posing as a corporation or other juridical entity can therefore require investigation under the same provision, depending on the facts.

Official sources and reporting pages

The full text of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) is available through the Supreme Court E-Library and Lawphil. Cybercrime Prevention Act of 2012 — Supreme Court E-Library

The Supreme Court's decision in Disini v. Secretary of Justice, G.R. No. 203335, February 18, 2014, discusses computer-related identity theft and upheld Section 4(b)(3) as constitutional. Disini v. Secretary of Justice — Lawphil

For a criminal cybercrime report, consult the official PNP Anti-Cybercrime Group contact directory. PNP Anti-Cybercrime Group — Contact Us The NBI Cybercrime Division also publishes its investigative-assistance procedure and an online complaint page. NBI Cybercrime Division — Investigative Assistance NBI Online Complaint

For data-privacy complaints, consult the National Privacy Commission's official complaint guidance. National Privacy Commission — File a Complaint

For platform action, use the platform's own impersonation-reporting tools: Facebook Help Center — impersonation reports, Instagram Help Center — impersonation accounts, TikTok — Report an Impersonation Account, and X Help — Report Impersonation Accounts.

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice based on the complete facts, electronic evidence, account records, and documents of a particular case. Whether a fake social-media account constitutes computer-related identity theft, a Data Privacy Act violation, fraud, illegal access, or another offense depends on the evidence and the specific acts involved. Procedures and platform reporting interfaces can also change.

Law and official-source check: August 25, 2026.