Quick answer

Preserve the evidence before the account or posts disappear, report the account through the social-media platform’s impersonation channel, secure your real accounts, and promptly file a complaint with the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD) if your identity is being used without authority—especially for scams, threats, harassment, sexual content, or financial transactions.

These are separate actions:

A platform report seeks removal or restriction of the fake account.
A law-enforcement complaint can lead to identification, investigation, and prosecution.
A bank or e-wallet report is necessary if money or a financial account is involved.
A National Privacy Commission complaint may be appropriate when personal information has been unlawfully processed, disclosed, or misused.

Do not wait for the platform to act before approaching law enforcement. Subscriber and content data may not remain available indefinitely.

Is every fake social-media account illegal?

No. Using a pseudonym, operating a clearly disclosed parody or fan account, or creating a fictional persona is not automatically identity theft.

The legal concern becomes stronger when an account intentionally uses another person’s or organization’s identifying information without authority. This may include a name, photograph, contact details, employment information, signature, identification document, business identity, or other data that makes people believe the account belongs to or is authorized by the victim.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s or juridical entity’s identifying information without right.

Whether a particular profile amounts to that offense depends on evidence of intentional conduct, lack of authority, the information used, and the surrounding acts. Actual damage is not always required: the law provides for a penalty one degree lower when no damage has yet been caused.

The ordinary statutory penalty for offenses under Section 4(b) is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. The precise charge and penalty remain for the prosecutor and court to determine. The Supreme Court upheld the identity-theft provision in Disini v. Secretary of Justice.

Depending on what the account does, other laws may also apply. Possible issues include fraud, threats, extortion, unlawful access, data-privacy violations, access-device fraud, cyberlibel, or the unauthorized use of intimate material. Do not assume that every harmful post supports every possible charge; each offense has its own elements.

What to do immediately

1. Preserve the account before reporting it

A platform may remove or alter content after receiving reports. Capture the evidence first unless viewing or saving it would expose a child or another person to further sexual exploitation.

Preserve:

The complete profile URL, not only the displayed name or username.
The username, handle, account name, profile photograph, bio, and creation details shown by the platform.
Screenshots and, where useful, a screen recording showing the profile, posts, comments, stories, messages, and their surrounding context.
The URL of every relevant post, photo, video, message, group, Page, or marketplace listing.
Visible dates and times, including your device’s date and time if the platform does not display them.
Messages sent to your family, friends, customers, co-workers, or other victims.
Requests for money, bank or e-wallet details, QR codes, account numbers, payment instructions, and transaction references.
Emails in their original form, including headers, and original SMS or chat messages.
Security alerts, password-reset notices, login notifications, and SIM-related messages.
The names and contact details of people who received messages or lost money.
Your authentic account URL and older records showing that the name, photograph, business identity, or other information belongs to you.

Keep the original files. Do not rely only on cropped screenshots pasted into a document. Save working copies separately, avoid editing the originals, and prepare a dated timeline explaining who discovered each item and how it was obtained. Under the Rules on Electronic Evidence, a person offering a private electronic document may have to establish its integrity and reliability.

If law enforcement may need your phone or computer, do not factory-reset it, delete the conversations, or install “cleaner” software. Back up essential personal data, but ask the investigator before materially changing the device.

2. Secure your legitimate accounts

If your real account was taken over, use the platform’s hacked-account recovery process rather than treating it only as a separate impersonation account.

Immediately:

Change the password of the email account connected to social media.
Change social-media passwords and do not reuse them.
Sign out unknown devices and revoke suspicious app access.
Turn on multi-factor authentication, preferably through an authenticator app or security key where available.
Review recovery email addresses, mobile numbers, forwarding rules, and recent login locations.
Contact your mobile provider if your SIM suddenly stopped working or you suspect a SIM swap.
Notify your employer’s or school’s IT or security office if an institutional account is involved.

Use only the platform’s official app or help-center domain. Do not send an ID, password, one-time password, or recovery code to someone claiming in a private message that they can remove the fake account.

3. Warn people without creating a new legal problem

Post a brief notice through your verified or established channels stating that the fake account is unauthorized and that people should not send money, disclose information, or follow its instructions.

Avoid naming an unverified suspect or publishing accusations you cannot support. Do not repost intimate images, child sexual-abuse material, identity documents, or other sensitive content merely to prove that the account exists.

Report the account to the platform

Use the dedicated impersonation process when available. A general “spam” report may not clearly tell the platform that someone is misusing your identity.

Official reporting links include:

When completing the report:

Select impersonation or “pretending to be someone.”
Provide the exact profile URL and your authentic account URL.
Explain what identifying information was copied.
State clearly whether the account is soliciting money, contacting children, making threats, or distributing sexual material.
Upload identification only through the platform’s official form and only as required.
Save the confirmation email, report number, submission date, and copies of everything submitted.
Report specific scam posts, messages, or intimate content separately if the platform provides additional reporting categories.

Platform action is governed by its policies and does not establish criminal liability. Removal also does not guarantee that the account operator has been identified.

File a cybercrime complaint

The Cybercrime Prevention Act assigns cybercrime enforcement to the NBI and PNP. You may approach either:

The PNP Anti-Cybercrime Group, one of its regional or local cybercrime units, or the nearest police station for referral; or
The NBI Cybercrime Division or an NBI Regional Cybercrime Center.

The NBI provides an online complaint page, a directory of divisions and services, and official guidance for investigative assistance to victims of computer crimes.

An online submission may be an initial step. For a formal investigation, expect to identify yourself, undergo an interview, complete a duly sworn complaint sheet or

Quick answer

Preserve the evidence before reporting the account, then take separate action through:

The social-media platform, to request removal or restriction.
The NBI Cybercrime Division or PNP Anti-Cybercrime Group, if someone intentionally used your identity without authority, defrauded others, threatened or harassed you, accessed an account, or caused other harm.
Your bank or e-wallet provider immediately, if money or financial credentials are involved.
The National Privacy Commission (NPC), when the incident also involves unlawful processing, disclosure, or misuse of personal data.

A platform report is not the same as a criminal complaint. Likewise, a police or barangay blotter entry does not necessarily complete the sworn complaint and evidence needed for a cybercrime investigation.

Is every fake account illegal?

No. An account using a nickname, pseudonym, fan identity, or clearly disclosed parody is not automatically a crime. The facts matter: what information was used, whether there was authority or consent, whether the account was intended to mislead, and what the account actually did.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012, computer-related identity theft covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

This can potentially include an account that uses another person’s name, photographs, contact information, work details, business identity, identification documents, or other identifying information without authority. However, the mere presence of a name or photograph does not by itself establish every element of the offense. Investigators and prosecutors must evaluate the account’s content, purpose, conduct, authorization, and evidence.

For computer-related identity theft, the statutory penalty is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law provides for a penalty one degree lower. The Supreme Court upheld the identity-theft provision in Disini v. Secretary of Justice.

Other offenses may apply when the account is also used for fraud, unauthorized account access, threats, extortion, defamatory posts, intimate-image abuse, or sexual harassment. The proper charges depend on the exact acts and available evidence.

Preserve evidence before requesting takedown

Fake accounts can be renamed, blocked, deactivated, or deleted quickly. Capture the evidence first unless waiting would expose someone to immediate danger.

Preserve:

The complete profile URL, not only the displayed username.
The current username, display name, biography, profile photograph, cover photograph, and account-creation information if visible.
Screenshots and a screen recording showing the profile, posts, comments, stories, advertisements, groups, and messages.
The date and time of each capture. Note your time zone.
Direct URLs for individual posts, photographs, videos, or messages where available.
The fake account beside your authentic account or official records showing the identity being copied.
Messages sent by the account to relatives, customers, employers, or other victims.
Requests for money, bank or e-wallet details, QR codes, account numbers, telephone numbers, email addresses, and payment instructions.
Transaction receipts, reference numbers, bank alerts, call logs, SMS messages, and emails. Preserve original emails with their headers when possible.
Platform notifications confirming that you submitted a report.
Names and contact details of witnesses or other people contacted by the impersonator.
Evidence of harm, such as lost money, cancelled transactions, customer complaints, disciplinary action, threats, or medical and counselling records.

Keep the original files. Do not rely only on cropped screenshots forwarded through Messenger, which may lose context and metadata. Save a working copy separately, and avoid editing, annotating, or compressing the originals. Philippine rules require a party offering a private electronic document to establish its authenticity, integrity, and reliability.

Do not hack the account, trick the suspected operator into installing software, or attempt to obtain private records illegally. Subscriber information ordinarily must be obtained by law enforcement through lawful process.

Report the account to the platform

Use the in-app reporting function and, when available, the platform’s dedicated impersonation form:

Select the most accurate category, such as “pretending to be me,” “pretending to be someone else,” “scam,” “harassment,” or “private information.” Report both the profile and any specific posts or messages that violate platform rules.

A platform may ask for identification or proof that you represent the person or organization being impersonated. Upload documents only through a verified platform domain or official app. Do not send an ID to an account claiming to be “support” through a direct message.

Keep the report number, confirmation email, and screenshots of the completed submission. A platform may remove the account without identifying its operator, and removal does not guarantee that underlying provider records will remain available.

Secure your real accounts

If your genuine account was taken over rather than copied, use the platform’s hacked-account or account-recovery process. Then:

Change the password of the email account linked to social media before changing other passwords.
Use a new, unique password for each important account.
Enable multi-factor authentication, preferably through an authenticator app or security key when supported.
Review active sessions and sign out unfamiliar devices.
Remove unknown recovery addresses, telephone numbers, connected apps, administrators, and advertising accounts.
Preserve password-reset messages, login alerts, and notices of changed account details.
Contact your mobile provider immediately if your SIM suddenly stops working or you suspect a SIM-swap attempt.
Warn contacts through a trusted channel that the fake account is unauthorized.

Keep any public warning factual and neutral. Identify the fake profile and say that it is unauthorized, but avoid publicly naming an unverified suspect or making accusations that cannot yet be proved.

File a cybercrime complaint

Republic Act No. 10175 designates the NBI and PNP as the principal law-enforcement authorities for cybercrime cases. You may approach:

The NBI Cybercrime Division or an NBI Regional Cybercrime Center.
The PNP Anti-Cybercrime Group or its regional cybercrime unit.
The nearest police station, particularly when there are immediate threats, stalking, or an ongoing crime. Ask that the matter be referred to the appropriate cybercrime unit.

The NBI provides an official online complaint page, but formal investigative assistance may still require an interview, a duly sworn complaint sheet or affidavit, supporting documents, witness statements, and examination of a relevant device. These steps are described in the NBI Citizen’s Charter for computer-crime victims. The NBI’s current directory lists the Cybercrime Division and regional offices.

Bring or prepare:

A valid government-issued ID.
A chronological written account of what happened.
The date you discovered the account and, if known, when it first appeared.
Your authentic profile and the fake profile’s URLs.
Original digital evidence and organized printed copies.
Proof that the information or photographs belong to you or your organization.
Proof that the account had no authority to use the identity.
Platform report confirmations.
Witness details and affidavits, if already available.
Financial records and evidence of damage, if applicable.
The device on which you received relevant messages, if investigators request it.

Ask for the complaint or reference number and the investigator’s official contact details. If identifying the account holder will require provider records, ask whether an immediate preservation request is appropriate.

Why prompt reporting matters

There is no single short deadline that applies to every platform report or every possible criminal charge. Prescription depends on the offense ultimately charged. Do not wait for the legal deadline: digital evidence may disappear much earlier.

Under Republic Act No. 10175, service providers must preserve traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. Actual retention by a foreign platform and the availability of particular records may vary.

Disclosure of subscriber, traffic, or relevant data generally requires a court warrant under the Rule on Cybercrime Warrants. The law’s 72-hour disclosure period runs only after the provider receives the appropriate order relating to a valid, officially docketed investigation. It is not a 72-hour deadline for police to solve the case or for a platform to remove an account.

If money or financial accounts are involved

Immediately call the bank or e-wallet provider using the number in its official app, website, or the back of your card. Do not wait for a police appointment.

Ask the provider to:

Block or secure affected accounts and cards.
Record the transactions as disputed or unauthorized.
Attempt to trace or temporarily hold disputed funds where legally available.
Secure the recipient account information for lawful investigation.
Give you a case or reference number.
Explain its affidavit, dispute, and documentation requirements.

The BSP’s current rules on disputed transactions require account owners to report disputed transactions immediately. If the institution’s Financial Consumer Protection Assistance Mechanism does not resolve the concern, escalate it through the BSP Consumer Assistance Mechanism or BSP Online Buddy.

Reporting to the bank, BSP, platform, and police serves different purposes. One does not automatically replace the others.

When a National Privacy Commission complaint may help

Consider an NPC complaint when the incident involves unlawful collection, use, disclosure, or other processing of your personal data under the Data Privacy Act of 2012. NPC jurisdiction and liability still depend on the respondent, the processing involved, applicable exclusions, and supporting evidence.

Under the 2021 NPC Rules of Procedure, as amended, a complainant ordinarily must first:

Inform the personal information controller, processor, or concerned entity of the privacy violation in writing.
Give it an opportunity to act.
Wait for its response. The exhaustion requirement is generally met if there is no response within 15 calendar days from receipt, or the entity fails to take timely or appropriate action.

The NPC may waive these requirements for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

A formal NPC complaint normally must be verified, notarized, supported by evidence and correspondence, and accompanied by a certification against forum shopping. Use the NPC’s current complaint instructions and form. Filing fees may apply, subject to exemptions or waiver under NPC rules.

An NPC case is distinct from a criminal cybercrime investigation. Tell the NPC about other related cases and comply with the certification-against-forum-shopping requirements.

Special situations

Gender-based or sexual harassment

The Safe Spaces Act expressly covers certain online impersonation, identity theft, threats, cyberstalking, unauthorized sharing, and reputational attacks when they constitute gender-based online sexual harassment. The PNP Anti-Cybercrime Group receives these complaints, while PNP Women and Children’s Protection Desks must attend to complaints covered by the Act.

A court may issue an appropriate stay-away order under the Act. Gender-based online sexual harassment is punishable by prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both. Whether the Act applies depends on the nature, target, context, and effect of the conduct—not merely the existence of a fake account.

Intimate images or sexual content

Do not repost intimate images to “warn” other people. Preserve the URL, account details, report confirmation, and other lawful evidence, then contact the platform and law enforcement urgently. Tell investigators if images were recorded or shared without consent.

Children

If a fake account sexualizes, exploits, solicits, threatens, or distributes sexual material involving a child, report it immediately to the PNP, NBI, or PNP Women and Children’s Protection Desk. Do not download, forward, or circulate child sexual abuse or exploitation material. Preserve the location or link and follow law-enforcement instructions.

Workplace or school impersonation

Report the account to the employer or school when it affects employment, students, customers, official communications, or institutional safety. Preserve the internal complaint and response. If the conduct is gender-based sexual harassment, workplace or school grievance mechanisms and statutory duties may also apply.

Common mistakes to avoid

Reporting the profile before saving its URLs and content.
Keeping only one cropped screenshot.
Deleting conversations, resetting the device, or discarding the SIM used during the incident.
Assuming mass-reporting will identify the offender or preserve provider records.
Paying an impersonator or extortionist to remove an account.
Negotiating privately when there are threats, stalking, sexual exploitation, or ongoing financial fraud.
Sending IDs, passwords, OTPs, or evidence to unofficial “support” accounts.
Publicly accusing a suspected person without reliable evidence.
Reposting harmful or illegal material as proof.
Treating a barangay or police blotter entry as the entire cybercrime complaint.
Waiting because no money has been lost yet. The absence of completed damage does not make preservation unnecessary.

When help is urgent

Seek immediate assistance when:

There is a credible threat of violence, kidnapping, self-harm, or physical stalking.
The account publishes your home address, live location, children’s information, or travel details.
Money is currently being transferred or accounts are being taken over.
Your SIM, email, bank, e-wallet, or government identification has been compromised.
The account is demanding money, sexual acts, or more images.
Intimate content or material involving a child is being circulated.
The impersonator is contacting your employer, customers, school, or family at scale.

For an immediate danger or crime in progress, call the Philippines’ Unified 911 Emergency Hotline. For financial loss, contact the institution’s official fraud channel at once, even while arranging a police or NBI complaint.

Frequently asked questions

Can I report an account impersonating someone else?

Yes. Platforms commonly allow bystander reports, although some impersonation forms require the affected person, parent, guardian, or authorized representative. A formal criminal or NPC complaint is usually strongest when filed by the affected person or a properly authorized representative.

Do I need to know who created the account?

No. State that the operator is unknown and provide every fact that may help identify them, including URLs, telephone numbers, email addresses, payment accounts, messages, mutual contacts, and timing. Do not guess or name a suspect without a factual basis.

Can I personally demand the account holder’s name from the platform?

Usually not. Subscriber and traffic information may be protected and generally requires lawful process. Investigators may apply for the appropriate cybercrime warrant after a valid complaint is docketed and assigned.

Do I need a lawyer to make the initial report?

Not ordinarily. The NBI or PNP can receive a complaint and sworn statement from the victim. Legal help becomes especially useful when there are multiple possible offenses, substantial losses, a known influential respondent, threatened litigation, intimate material, cross-border evidence, or a need for urgent court relief.

Is a screenshot enough?

It may be useful, but it should not be the only evidence when more can be preserved. Include the URL, full context, original files, witness testimony, transaction records, and information showing when and how the material was obtained.

What if the platform removes the account?

Keep the removal notice and all previously preserved evidence. Tell the investigator promptly. Account removal does not necessarily erase provider records, but availability is not guaranteed.

What if I am outside the Philippines?

Report the account through the platform and contact the NBI through its official online channel. Philippine jurisdiction may exist when the statutory connection to the Philippines is present, but cross-border evidence can require international cooperation. For an NPC complaint by a non-resident Filipino without a Philippine representative, the amended rules require notarization through a Philippine embassy or consulate or an apostille from the country of origin.

This article provides general legal information, not advice for a particular case. Outcomes depend on the account’s content, authorization, evidence, harm, parties, and applicable laws. Official sources and procedures were checked as of 31 July 2026.