Quick answer

If someone is using your name, photos, personal information, or hacked account to impersonate you, preserve the evidence first, secure your accounts, report the profile and individual posts to the platform, and file a complaint promptly with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or National Bureau of Investigation Cybercrime Division (NBI-CCD). For scams, you may also contact the Cybercrime Investigation and Coordinating Center (CICC) through hotline 1326 or 1326@dict.gov.ph.

If money, banking credentials, an e-wallet, or a SIM is involved, contact the financial institution or telecommunications provider immediately—before waiting for the platform or police to respond. If there is an immediate threat to anyone’s safety, call 911 or go to the nearest police station.

A platform report can remove or restrict an account, but it is separate from a criminal complaint. Likewise, reporting to CICC does not necessarily replace the sworn complaint and supporting evidence that the PNP, NBI, or prosecutor may require.

Is every fake account a crime?

No. Using a pseudonym, maintaining a fan account, or creating clearly identified satire or parody is not automatically identity theft. The facts matter: what information was used, whether the person had authority or consent, whether the account was intended to deceive, and what harm or unlawful purpose followed.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another natural or juridical person’s identifying information, without right.

In Disini v. Secretary of Justice, the Supreme Court explained that the prohibited use must be directed toward an illegitimate purpose. Merely acquiring or disseminating information that the person made public is not, by itself, identity theft. An impersonation account used to deceive relatives, solicit money, obtain credentials, damage a reputation, or facilitate another offense presents a very different case. Read the Supreme Court decision.

Computer-related identity theft is generally punishable by prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The statute provides for a penalty one degree lower when no damage has yet been caused. Actual charges and penalties depend on the proven acts and applicable law; they are determined by prosecutors and courts, not by the platform or complainant.

Depending on the conduct, other laws may also apply:

Hacked account: Unauthorized entry into an account may constitute illegal access under the Cybercrime Prevention Act.
Fraud or solicitation: Forged messages, fabricated transactions, and obtaining money by deceit may support computer-related fraud, estafa committed through information and communications technology, or another offense.
Bank or e-wallet takeover: The Anti-Financial Account Scamming Act covers specified money-muling and social-engineering conduct, including obtaining sensitive identifying information through deception that results in unauthorized access to and control of a financial account.
Sexualized or gender-based harassment: The Safe Spaces Act expressly includes certain online identity theft, impersonation, cyberstalking, unauthorized sharing, and reputation-harming lies within gender-based online sexual harassment. Its requirements must still be established from the facts.
Misuse of personal data: The Data Privacy Act of 2012 and National Privacy Commission rules may apply when personal information was unlawfully collected, used, disclosed, or insufficiently protected.
Defamatory posts: Posts made through an impostor account may raise cyber-libel issues if all legal elements are present. Being false, offensive, or embarrassing does not automatically establish libel.

An account can violate a platform’s impersonation policy even when the available evidence is insufficient for a criminal case.

What to do immediately

1. Preserve the account before it disappears

Before blocking the account or organizing mass reports, preserve what is visible. Save:

The exact profile URL—not only the displayed name;
The username, handle, account number, channel ID, or other platform identifier;
Full-screen screenshots showing the profile, address bar, date, and time;
A screen recording that opens the app or website, navigates to the profile, and shows relevant posts or messages;
Direct URLs for each harmful post, story, video, advertisement, or fundraising page;
Original messages, emails, attachments, and voice recordings in the format received;
Email headers, where relevant;

Quick answer

If someone is using your name, photo, personal details, or hacked account to impersonate you, preserve the evidence first, secure your accounts, report the profile through the platform’s impersonation channel, and file a complaint promptly with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD). For coordinated assistance or scam reporting, contact the Cybercrime Investigation and Coordinating Center through hotline 1326 or 1326@dict.gov.ph.

If money, an e-wallet, a bank account, a credit card, an OTP, or online-banking credentials are involved, contact the financial institution immediately—before waiting for the platform or police. If the incident involves threats or immediate physical danger, call 911 or go to the nearest police station.

A “fake account” is not automatically a crime. Pseudonymous, fan, commentary, and clearly labeled parody accounts may be lawful. The stronger legal case is impersonation involving another person’s identifying information without right and for an illegitimate purpose, especially when used to deceive, defraud, harass, damage reputation, or gain access to an account.

When impersonation may be identity theft

The Supreme Court explained in Disini v. Secretary of Justice that the prohibited conduct must involve an illegitimate purpose. Merely acquiring or sharing information that the person has made public is not, by itself, identity theft. The surrounding facts—deception, unauthorized use, intent, and actual or intended harm—matter. Read the Supreme Court decision.

Computer-related identity theft is generally punishable by prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. When no damage has yet been caused, the law provides for a penalty one degree lower. The exact charge and penalty remain for prosecutors and courts to determine from the evidence.

Depending on what the account did, other laws may also apply:

Hacking or account takeover: Illegal access or other offenses under the Cybercrime Prevention Act.
Scams or fraudulent transactions: Computer-related fraud, estafa committed through information and communications technology, or the Anti-Financial Account Scamming Act.
Misuse of personal data: The Data Privacy Act of 2012, subject to its elements and exceptions.
Sexualized or gender-based harassment: The Safe Spaces Act, which expressly covers certain forms of online identity theft, impersonation, cyberstalking, unauthorized sharing, and reputational attacks as gender-based online sexual harassment.
Defamatory posts: Cyber libel may be considered if all legal elements are present. A false or unpleasant post is not automatically libel.
Non-consensual intimate images or child sexual abuse material: Special protective laws may apply and require immediate, careful reporting.

Report the facts rather than insisting on a particular charge. One incident may support several possible offenses, or none, depending on the evidence.

What to do immediately

1. Preserve evidence before reporting or blocking

A platform may remove the account quickly, but removal can also make evidence harder to collect. Before blocking or confronting the user, save:

The exact profile URL, username, display name, and any visible account or user ID.
Full-screen screenshots showing the browser address bar or in-app profile, date, and time.
A screen recording that starts from the platform and navigates to the profile and offending posts.
Direct-message conversations, preferably using the platform’s download or export function.
Individual URLs for posts, stories, advertisements, listings, or fundraising pages.
Photos, videos, voice messages, emails, and original attachments.
Email headers and SMS sender numbers, where relevant.
Bank or e-wallet account names, numbers, transaction references, receipts, and timestamps.
Names and contact details of witnesses or people approached by the impersonator.
Copies of reports submitted to the platform and every acknowledgment or reference number.
A short chronological account of what happened, when you discovered it, and what harm followed.

Keep untouched originals. Make working copies if you need to crop, highlight, or annotate something. Do not delete conversations, reset a device, or wipe an account until important evidence has been preserved—unless continued access presents an immediate security risk.

Electronic evidence must still satisfy admissibility and authentication requirements. Under the Rules on Electronic Evidence, a readable printout may be treated as an original if it accurately reflects the electronic data, but the person presenting electronic evidence generally bears the burden of authenticating it. This is why original files, devices, URLs, timestamps, and testimony about how the evidence was collected are valuable.

2. Secure your real accounts

Using a trusted device:

Change the password of your primary email first, followed by social-media, financial, shopping, and cloud accounts.
Use a different, strong password for every account.
Enable multi-factor authentication, preferably through an authenticator app or security key where available.
Review active sessions, connected devices, recovery addresses, phone numbers, and third-party applications.
Sign out unfamiliar sessions and revoke unknown app access.
Check whether the impersonator changed account recovery information or created forwarding rules in your email.
Inform trusted contacts that an impostor may ask them for money, OTPs, documents, or personal information.

If you suspect malware, disconnect the affected device from the internet and obtain technical or forensic assistance before wiping it.

3. Act immediately if money or financial credentials are involved

Call the bank, credit-card issuer, lender, or e-wallet through the number in its official app, website, or the back of the card. Ask it to:

Lock or secure the affected account.
Record a fraud complaint and give you a reference number.
Dispute or attempt to recall unauthorized transactions.
Coordinate with the receiving institution where possible.
Preserve transaction, access, and verification records.

Under the Anti-Financial Account Scamming Act, covered institutions may temporarily hold funds involved in a disputed transaction under BSP rules, for a period that cannot exceed thirty calendar days unless extended by a court. This does not guarantee recovery, so minutes and hours can matter.

Never send an additional “release,” “verification,” or “recovery” fee to the impersonator.

4. Contact the relevant issuer if an ID or SIM was compromised

Notify the government agency that issued an exposed passport, driver’s license, PhilID, professional license, or other credential and follow its replacement or security process. For a suspected SIM swap, unauthorized replacement, or loss of mobile service, contact the telecommunications provider immediately. Scam or spoofed text messages may also be reported through the NTC’s official channels.

Report the account to the platform

Use the specific impersonation category, not only “spam” or “fake account.” Report both the profile and any individual posts, advertisements, messages, or listings that violate separate rules.

Official reporting pages include:

Other platforms usually place the option under Report profile, Report account, Pretending to be someone, or Impersonation.

When submitting identification:

Use only the platform’s official app or help-center domain.
Provide only what the form requires.
Do not send an ID through direct messages to anyone claiming to be platform support.
Keep the submission confirmation and case number.
Use the appeal or follow-up channel if the first report is rejected.

If your genuine account was taken over, use the platform’s hacked or compromised account recovery process instead of—or in addition to—the impersonation process.

A platform report and a legal complaint serve different purposes. The platform may remove an account under its private rules even when no crime is established. Conversely, an account’s removal does not prevent you from reporting possible criminal conduct.

Report to Philippine authorities

Where to report	Appropriate situations	What to expect
PNP Anti-Cybercrime Group or the nearest police station/cybercrime unit	Identity theft, hacking, threats, harassment, fraud, extortion, or an active impersonation scheme	Initial interview, evidence review, and possible sworn complaint or referral to the appropriate investigative unit
NBI Cybercrime Division or a regional cybercrime center	The same cybercrime complaints, especially cases requiring digital investigation	The NBI’s process includes a complaint sheet, preliminary interview, sworn statements or affidavits, supporting documents, and examination of a relevant device when necessary
CICC hotline 1326 or 1326@dict.gov.ph	Scam reports and coordinated cybercrime assistance	Intake, guidance, and inter-agency coordination; a hotline report may not replace the sworn complaint required for a criminal investigation
National Privacy Commission	Unlawful collection, use, disclosure, or other processing of personal data	A separate administrative privacy complaint following NPC procedures
PNP Women and Children Protection Desk	Gender-based online sexual harassment, sexualized impersonation, stalking, or cases involving women or children	Gender-sensitive assistance and coordination with cybercrime investigators

The Cybercrime Prevention Act assigns both the NBI and PNP responsibility for enforcing the law. The NBI Cybercrime Division Citizen’s Charter states that investigative assistance is free and may require sworn statements, affidavits, supporting documents, and examination of a relevant device. The NBI also maintains an online complaint page, although investigators may still require personal appearance or additional sworn documents.

Bring or prepare:

A valid ID.
Your written timeline.
The fake account’s URLs and identifiers.
Printed and electronic copies of the evidence.
The device on which the messages or account were received, if requested.
Financial records and institutional complaint references, if money was involved.
Names and affidavits of witnesses, if available.
Proof that you reported the account to the platform.
Evidence showing that the identity belongs to you, such as your genuine account or relevant records.

State clearly which facts you personally observed and which facts were reported to you by others. If the perpetrator’s real identity is unknown, identify the respondent by the username, profile URL, account ID, phone number, email address, or financial account information available. You do not need to identify the person conclusively before making an initial report.

Ask for the complaint, docket, or reference number; the investigator’s name and unit; and the method for submitting additional evidence.

Why prompt reporting matters

Service providers must generally preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, and law enforcement may order a one-time six-month extension. Authorities may then seek court-authorized disclosure or other cybercrime warrants.

These rules do not mean that a platform must disclose an account holder’s identity directly to you. Subscriber records, IP information, and private content normally require lawful investigative and judicial process. Early reporting gives investigators a better opportunity to seek preservation before records disappear.

Philippine courts may have jurisdiction when an element of the offense occurred in the Philippines, a computer system situated wholly or partly here was used, or the offense caused damage to a person who was in the Philippines. A foreign account operator or overseas platform can nevertheless make identification, evidence collection, and enforcement slower.

Filing a privacy complaint with the NPC

Consider an NPC complaint when your personal information was unlawfully collected, used, disclosed, or otherwise processed—not merely because you dislike an account’s content.

As a general rule, the current NPC procedure requires you first to notify the personal information controller, processor, or concerned entity in writing and give it an opportunity to act. You may proceed when it fails to take timely or appropriate action or does not respond within 15 calendar days after receiving your written notice. Keep proof of delivery and any reply.

A formal complaint generally requires:

A completed and notarized complaint-assisted form or a properly verified complaint.
Supporting documents.
Witness affidavits, when applicable.
Proof that you first notified the respondent.
Compliance with the NPC’s filing and service requirements.

The complaint may be submitted personally, by registered mail, courier, or authorized electronic means. Check the NPC’s current filing instructions and form and its complaint mechanics before filing. The NPC currently lists complaints@privacy.gov.ph for complaints.

An NPC case is separate from a police or NBI investigation. If there is fraud, hacking, extortion, stalking, or an urgent threat, do not wait for the NPC process before contacting law enforcement.

Special situations

Threats, stalking, or exposure of your location

Call 911 or go to the nearest police station if there is a credible threat, someone is approaching your home or workplace, your live location is being exposed, or a crime appears to be in progress. Preserve the threat, but do not keep engaging the sender.

Gender-based or sexualized impersonation

The Safe Spaces Act covers specified forms of gender-based online sexual harassment, including online identity theft, impersonation, cyberstalking, unauthorized sharing, sexualized content, and lies intended to harm a victim’s reputation. The PNP-ACG receives these complaints, while PNP Women and Children Protection Desks must attend to covered cases.

Intimate images

Do not negotiate, pay, or send more images. Preserve the account details, messages, demands, and URLs without redistributing the material. Report immediately to the platform and law enforcement.

Material involving a child

Do not download, save additional copies, or forward suspected child sexual abuse material. Record the URL, username, date, and circumstances without opening or redistributing more content, then report immediately to the PNP, NBI, or 911 if a child is in imminent danger.

Defamatory posts

Preserve every version and date of publication. Cyber-libel questions are fact-specific, and the Supreme Court has applied a one-year prescriptive period counted from discovery by the offended party, authorities, or their agents. Obtain legal advice promptly rather than assuming that a longer cybercrime period applies. See Causing v. People, G.R. No. 258524.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and content.
Keeping only cropped screenshots with no username, timestamp, or surrounding context.
Assuming that many mass reports will substitute for a detailed impersonation report.
Publicly accusing or “doxxing” an unverified suspect.
Threatening, baiting, hacking, or trying to trace the account yourself.
Sending an OTP, password, recovery code, selfie, or ID to supposed support personnel.
Paying the impersonator to remove an account or return stolen information.
Deleting the genuine account, conversations, or affected device too early.
Waiting for a platform decision before notifying a bank or e-wallet.
Treating a CICC hotline report as automatically equivalent to a sworn criminal complaint.
Exaggerating losses or submitting information you know is false.
Forwarding intimate images or material involving a child while trying to collect evidence.

When to consult a lawyer urgently

Seek individual legal advice promptly when:

Significant money, loans, contracts, or business transactions were made in your name.
The impersonator obtained government IDs, financial credentials, or confidential records.
A warrant, subpoena, collection demand, employment problem, or official record has resulted.
The account is publishing defamatory, intimate, or fabricated material.
The suspect is known to you and retaliation or physical violence is possible.
A platform, financial institution, employer, or government agency refuses to preserve or correct important records.
You need a complaint-affidavit, preservation request, civil remedy, restraining order, or representation during preliminary investigation.
The incident crosses national borders or involves several victims.

FAQ

Can I report an account if I do not know who created it?

Yes. Preserve and report the username, profile URL, account ID, phone number, email address, payment details, and other available identifiers. Investigators may use lawful preservation and disclosure procedures to seek additional information.

Are screenshots enough?

They are useful but may not be enough by themselves. Preserve original messages, URLs, files, devices, timestamps, account exports, and witnesses who can explain how the evidence was obtained.

Should I report to the platform or police first?

Preserve evidence, then do both as soon as practical. Contact police first for an immediate threat. Contact the bank or e-wallet first when funds or financial credentials are at risk.

Can I force the platform to tell me who owns the fake account?

Usually not through an ordinary user request. Subscriber and access information is generally obtained through lawful requests or court-authorized processes handled by investigators.

Is every parody, fan account, or account using another person’s photo illegal?

No. Context and purpose matter. A clearly disclosed parody or fan account is different from an account designed to deceive people into believing it is the real person. Platform rules may still prohibit conduct that does not amount to a Philippine criminal offense.

What if the account has already been deleted?

Report it anyway. Submit the old URL, username, screenshots, messages, and the date it disappeared. Relevant records may still exist, but prompt reporting improves the chance of preservation.

Do I need a notarized affidavit?

For an initial platform or hotline report, generally no. A formal NBI, police, prosecutor, or NPC proceeding may require a sworn, verified, or notarized complaint and supporting affidavits.

Will reporting guarantee removal, arrest, or recovery of money?

No. Removal depends on platform rules, criminal action requires sufficient evidence and due process, and recovery depends on where the funds went and how quickly institutions were notified. Obtain and retain reference numbers so you can follow up.

Official references

This article provides general Philippine legal information, not advice for a specific case and not a guarantee of any agency, platform, or court outcome. Legal characterization depends on the actual accounts, communications, records, intent, and resulting harm. Sources, procedures, deadlines, and official channels were checked as of 3 August 2026; verify the linked official pages before filing.