Quick answer

If someone is pretending to be you online, preserve the evidence before the account disappears, report the profile through the platform’s impersonation process, secure your real accounts, and file a report with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD) when the account is being used to deceive, harass, threaten, defame, solicit money, or misuse personal information.

A fake account is not automatically a crime merely because it is anonymous, uses a nickname, or shares a name with another person. It may become computer-related identity theft when identifying information belonging to another person or organization is intentionally acquired, used, misused, transferred, possessed, altered, or deleted without right. The surrounding purpose and conduct matter.

Reporting to the social-media platform seeks removal or account recovery. Reporting to law enforcement seeks identification, investigation, and possible prosecution. One does not replace the other.

If there is an immediate threat to life or safety, call 911 or go to the nearest police station. If money has just been transferred, contact the bank or e-wallet provider immediately before doing anything else.

First determine what happened

Situation	What it may involve	First action
A new account copied your name, photo, biography, or business identity	Impersonation and possible identity theft	Preserve the profile, then report it to the platform
Your genuine account was taken over	Possible illegal access and identity theft	Use the platform’s account-recovery process and secure your email
The account asks your contacts for money or collects payments in your name	Fraud, estafa, identity theft, or offenses under the Anti-Financial Account Scamming Act	Alert contacts, notify financial institutions, and report to PNP-ACG or NBI
The account posts defamatory accusations	Possible cyberlibel, depending on the words, audience, identity, and malice	Preserve each post and seek legal advice promptly
The account threatens, stalks, sexualizes, or impersonates a victim to cause distress	Possible gender-based online sexual harassment	Report to PNP-ACG or the PNP Women and Children Protection Desk
Personal data was unlawfully collected, disclosed, or used, or an organization failed to protect it	Possible Data Privacy Act violation	Notify the responsible entity in writing and consider an NPC complaint
The account is clearly marked as parody, commentary, or a fan account	May be lawful, depending on whether it is deceptive and what it does	Review the actual conduct, not merely the account name

When impersonation may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person, without right.

Identifying information can include a person’s name, address, contact details, date of birth, occupation, account credentials, identification numbers, photographs, or other data that identifies a particular person. For a business or organization, it may include its name and identifying account information.

In Disini v. Secretary of Justice, the Supreme Court upheld this offense and explained that identity information must be taken or used for an illegitimate purpose. Merely acquiring or disseminating information that the person made public is not, by itself, identity theft. The deceptive repurposing of public information to impersonate, defraud, or harm someone is a different matter and must be assessed from the complete facts. See the Supreme Court’s decision in Disini.

A person convicted of a Section 4(a) or 4(b) cybercrime generally faces prision mayor—six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If computer-related identity theft has not yet caused damage, Section 4(b)(3) directs that the imposable penalty be one degree lower. The court determines the proper penalty after conviction; the existence and amount of damage must be proved.

What to do immediately

1. Preserve evidence before reporting or blocking

Capture enough information to show what the account looked like, what it did, when you found it, and how it was connected to you.

Preserve:

The full profile URL, not only the display name
The exact username or handle and, if visible, the platform’s numeric account ID
Full-screen screenshots showing the browser address bar, date, and time
A screen recording that opens the profile and scrolls through relevant posts, messages, comments, and account details
Individual URLs for posts, videos, stories, listings, or advertisements
The profile photograph, cover image, biography, contact details, and changes in username
Complete message threads, including dates, times, sender information, attachments, and payment instructions
Original emails with headers, text messages, voice messages, and files
Platform acknowledgments, report numbers, and takedown decisions
Messages from people who were approached, deceived, or asked for money
Transaction references, receipts, bank or e-wallet statements, and recipient-account details
Proof of your identity or ownership of the genuine account, page, trademark, or business name
A written timeline stating when you discovered each account or post and what happened afterward

Keep the original files. Do not crop, annotate, compress, rename, or repeatedly forward the only copy. Make a separate working copy and back up the originals securely. Do not reset, reformat, sell, or discard a device that may contain relevant evidence.

Philippine electronic evidence must still be authenticated. Under the Rules on Electronic Evidence, the person offering a private electronic document bears the burden of showing its authenticity, integrity, and reliability. Screenshots are useful, but their source and accuracy may still have to be established.

Do not secretly record private voice calls without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties, even when the recorder is one of the participants. Different statutory rules may apply in specific child-exploitation cases.

2. Secure your genuine accounts

If your real account or email may have been compromised:

Recover the account only through the platform’s official website or app.
Change the password of the connected email account first, then change the social-media password.
Use unique passwords and enable multi-factor authentication.
Review active sessions and log out unfamiliar devices.
Remove unknown recovery addresses, phone numbers, linked applications, payment methods, and administrators.
Check the email account for unauthorized forwarding rules or deleted security notices.
Save security alerts and login-history records before removing access.
Notify the issuer if a government ID, SIM, bank card, or account credential was exposed.

For a compromised Facebook account, use Facebook’s official account-recovery page. Do not give passwords, one-time PINs, recovery codes, or copies of IDs to accounts claiming to be “support” through Messenger or direct messages.

3. Warn contacts without making unsupported accusations

Post a brief notice from a trusted account stating that the identified profile is not yours and that people should not send money, disclose information, or follow its instructions. Include the fake account’s exact URL or screenshot.

Do not publicly identify a suspected operator unless the evidence supports it and legal counsel has assessed the risk. An incorrect public accusation can create a separate defamation dispute.

Report the account to the platform

Report the profile and each harmful post, message, advertisement, or listing. A profile report may not automatically cover all of its content.

Official reporting options include:

Facebook: Report an impersonating account
Instagram or Threads: Impersonation report form
TikTok: Report an impersonation account
X: Report impersonation

Select the most accurate reason, such as “pretending to be me,” “pretending to be someone I represent,” “scam or fraud,” “harassment,” or “private information.” If the platform asks for identification, upload it only through the verified help center or in-app process. Redact information the form does not require when the platform permits it.

Save the confirmation and case number. There is no single Philippine statutory deadline requiring every social-media platform to decide an ordinary impersonation report within a fixed number of hours. Removal time depends on the platform, evidence, account type, and applicable law.

File a cybercrime report

PNP Anti-Cybercrime Group

The PNP-ACG is a specialized law-enforcement unit for cybercrime. Under the Safe Spaces Act, it is also the primary PNP unit designated to receive complaints of gender-based online sexual harassment.

You may approach the nearest police station and request referral to the regional anti-cybercrime unit, or use the PNP-ACG official website for its current office and reporting information. Ask for the complaint or reference number and the investigator’s official contact details.

NBI Cybercrime Division

The NBI is expressly designated, together with the PNP, to enforce the Cybercrime Prevention Act. The NBI’s published procedure allows a complainant to undergo an interview, execute sworn statements, submit supporting documents, and make a relevant device available for examination. See the NBI Cybercrime Division Citizen’s Charter.

An initial report may also be sent through the NBI Online Complaint page. An online submission may still require personal appearance, a sworn complaint, further evidence, or device examination.

CICC Cybercrime Complaint Center

The Cybercrime Investigation and Coordinating Center provides reporting assistance and inter-agency referral through its cybercrime report portal and hotline 1326. A CICC report can help route an incident, particularly an active scam, but it should not be assumed to replace the sworn complaint or evidence required by the investigating agency or prosecutor.

What to bring

Bring a valid ID, a concise chronology, printed copies of the most important screenshots, the original electronic files, URLs, names and contact details of witnesses, platform report numbers, and financial records where applicable. Bring the relevant device if the investigator asks to examine it, but keep a secure backup of personal files.

Explain the facts plainly. You do not need to select the final criminal charge yourself. Depending on the evidence, investigators or prosecutors may consider identity theft, illegal access, computer-related fraud, forgery, estafa, cyberlibel, threats, gender-based online sexual harassment, data-privacy offenses, or another law.

Ask promptly about data preservation

A private complainant generally cannot compel a platform to disclose the person behind an account. Subscriber information, traffic data, IP records, and other protected data are normally obtained through lawful investigation and, where required, a cybercrime warrant.

Under Sections 13 and 14 of the Cybercrime Prevention Act:

Subscriber information and traffic data must be preserved for a minimum of six months from the transaction.
Content data must be preserved for six months after a law-enforcement preservation order.
Law enforcement may order a one-time extension for another six months.
Disclosure of protected computer data requires a court warrant; after receiving a valid disclosure order tied to an officially docketed investigation, the provider is directed by the statute to disclose the relevant data within 72 hours.

The 72-hour period is a deadline for the recipient of a valid government order, not a promise that the victim will learn the account owner’s identity within three days. Warrants, foreign-platform procedures, incomplete registration data, VPN use, and international cooperation can affect the investigation.

Report promptly and ask the assigned investigator whether an immediate preservation request is appropriate. Do not attempt to hack, trace, entrap, or publicly expose the account owner yourself.

When a prosecutor’s complaint may be needed

A police blotter, platform report, or hotline referral does not necessarily commence a criminal case. A case intended for prosecution will ordinarily require a sworn complaint-affidavit, supporting affidavits, authenticated records, and the forms required by the prosecution office.

The current 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings govern preliminary investigations conducted by the National Prosecution Service. The DOJ’s filing guidance identifies the Investigation Data Form, complaint-affidavit or sworn statement, and supporting evidence among the required documents.

A complaint-affidavit should clearly state:

The complainant’s identity and contact details
When and how the account or post was discovered
The exact URLs, usernames, and platforms involved
Which information was copied or misused
What the account represented to other people
Any threat, demand, transaction, publication, or resulting harm
The basis for identifying a suspected respondent, if one is named
The witnesses and documents supporting each material fact

If the operator is unknown, report the account and available technical identifiers to the cybercrime investigators. Do not invent a name or address simply to complete a form.

Important deadlines and urgent financial steps

Cyberlibel has a short prescriptive period

If the fake account published defamatory statements, obtain legal advice without delay. In Causing v. People, the Supreme Court held that cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to the rules on interruption and recommencement of prescription. See the Supreme Court’s decision in Causing.

Do not assume that an in-app report, takedown request, private demand letter, or ordinary incident report stops the one-year period. Whether prescription was interrupted can depend on what was filed, where it was filed, and the case record.

Contact the bank or e-wallet immediately

For unauthorized transfers or scam payments, call the originating financial institution through its official hotline and report a disputed transaction. Ask it to trace the funds, coordinate with receiving institutions, secure your account, and give you a reference number.

Under BSP Circular No. 1215, disputed funds may initially be held for up to five calendar days and, when the regulatory conditions are met, the holding may be extended for up to 25 additional calendar days. The source-account owner may be asked to submit a sworn complaint, affidavit, police report, or other supporting document within the initial holding period. A hold and recovery are not guaranteed, especially if the funds have already been withdrawn or moved outside the covered financial system.

The financial institution’s consumer-assistance mechanism is the first level of recourse. If the complaint remains unresolved, it may be escalated through the BSP Online Buddy and other BSP consumer-assistance channels.

When the National Privacy Commission may help

Consider a complaint with the National Privacy Commission when personal information was collected, processed, disclosed, or used without a lawful basis, or when a company, school, employer, platform, or other responsible entity failed to address a privacy violation or personal-data breach. NPC proceedings are not a substitute for a criminal complaint and do not automatically identify an anonymous account operator.

Under the NPC Rules of Procedure, as amended, a complainant ordinarily must:

Notify the personal information controller, processor, or concerned entity in writing and allow it to act.
Show that it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.
File a written, verified complaint containing the required facts, reliefs, evidence, correspondence, and certification against forum shopping.
Pay the applicable filing fee unless exempted or the fee is waived.

The NPC may waive prior exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm or the absence of an adequate remedy. If the respondent’s identity is unknown, the complaint should state the circumstances that may lead to identification.

Use the current NPC Complaint-Affidavit form and follow the official NPC filing instructions.

Special situations requiring faster help

Threats, stalking, doxxing, or sexual harassment

The Safe Spaces Act covers certain online conduct that terrorizes or intimidates a targeted person, including threats, cyberstalking, incessant messaging, nonconsensual sharing of photos or sexual content, impersonating a victim, or posting lies to harm the victim’s reputation.

Gender-based online sexual harassment is punishable by prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both. A higher penalty may apply when the victim falls within a qualifying category, such as a minor, senior citizen, or person with disability.

Report to PNP-ACG or the nearest PNP Women and Children Protection Desk. If appropriate, a court may issue an order directing the perpetrator to stay away from the victim, home, school, workplace, or another specified place.

A current or former intimate partner is responsible

If the victim is a woman and the conduct is committed by a husband, former husband, dating partner, former dating partner, or a person with whom she has a common child, the facts may also fall under the Anti-Violence Against Women and Their Children Act. Psychological violence, harassment, threats, and economic abuse require fact-specific assessment. Ask the Women and Children Protection Desk, prosecutor, or counsel about a barangay, temporary, or permanent protection order.

A child is targeted or sexual material is involved

If an account solicits sexual material from a child, distributes child sexual-abuse or exploitation material, arranges online exploitation, or threatens a child, report immediately to PNP, NBI, the local social welfare and development office, or the DSWD MAKABATA Helpline 1383.

Do not download, forward, repost, or circulate suspected child sexual-abuse material. Preserve the URL, account details, messages, and device, and let trained investigators make the necessary forensic copy. The Anti-OSAEC and Anti-CSAEM Act provides specialized reporting, preservation, investigation, and victim-protection rules.

Common mistakes to avoid

Reporting or blocking before saving the URLs and evidence
Keeping only cropped screenshots with no account name, date, or context
Deleting a hacked account, device, email, or conversation before investigators can examine it
Paying an impersonator or extortionist without coordinating with law enforcement
Secretly recording private calls without checking the Anti-Wiretapping Act
Clicking “support” links sent by the fake account
Giving an OTP, password, recovery code, or ID to an unverified person
Publicly accusing a suspected operator without reliable evidence
Asking friends to harass, threaten, or mass-report an innocent account
Creating another fake account to entrap the suspect
Assuming that a platform report is already a criminal complaint
Waiting for takedown results while financial records, logs, or legal periods are running
Forwarding intimate or child sexual material as “proof”

Frequently asked questions

Can I report the account if I do not know who created it?

Yes. Provide the profile URL, exact username, messages, payment details, and any other identifiers. Law enforcement may seek preservation and disclosure of subscriber or traffic data through lawful processes. Identification is not guaranteed, particularly when false registration information or overseas services were used.

Are screenshots enough to file a report?

They are enough to begin many reports, but they may not be sufficient by themselves to prove a criminal case. Preserve original files, URLs, devices, witnesses, platform responses, and financial records. Electronic evidence must be authenticated and shown to be reliable.

Is every “dummy account” illegal?

No. An anonymous or pseudonymous account is not unlawful merely because the operator does not use a real name. Liability depends on what the person intentionally did—such as impersonation, fraud, illegal access, threats, harassment, unlawful data use, or defamatory publication.

Can a clearly labeled parody or fan account still be reported?

It can be reported if it violates platform rules or commits independently unlawful acts. A conspicuous parody or fan label may reduce deception, but it does not excuse threats, fraud, harassment, unlawful disclosure, or other prohibited conduct.

Can a family member report for the victim?

A relative or witness may give information to the platform or law enforcement. The victim’s own sworn statement is usually important. For a minor, a parent or lawful guardian may act and should provide proof of the relationship when required. NPC representation generally requires a special power of attorney, except that a parent representing a minor may submit the child’s birth certificate as proof under the amended NPC rules.

What if the offender is outside the Philippines?

Philippine cybercrime jurisdiction may exist when an element occurred in the Philippines, a computer system used was wholly or partly situated here, the offender is Filipino, or the offense caused damage to a person who was in the Philippines when it occurred. Investigation and enforcement abroad may require international cooperation and can take longer.

Should I confront the account owner?

Usually not. Confrontation may cause deletion of evidence, escalation, retaliation, or movement of stolen funds. Preserve the evidence and coordinate with the platform, financial institution, or investigator. Do not conduct your own sting operation unless law enforcement directs and supervises it.

Will reporting guarantee removal, arrest, or recovery of money?

No. The platform determines removal under its rules, law enforcement must establish evidence and identify a suspect, prosecutors must assess whether charges are supportable, and courts decide guilt. Financial recovery depends heavily on how quickly the transaction is reported and whether the funds remain traceable and intact.

Official references

General-information disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any investigation or case. The correct remedy, offense, venue, deadline, and evidence depend on the particular facts and documents. Official legal and procedural sources were checked as of 4 August 2026.