Quick answer

If someone is pretending to be you, your business, or a family member online:

Preserve the evidence before the account disappears. Capture the full profile, exact URL or username, posts, messages, dates, payment details, and the names of people contacted.
Report the account through the platform’s impersonation channel.
Secure your email, social-media, mobile, banking, and e-wallet accounts.
Report suspected criminal activity to the PNP Anti-Cybercrime Group (PNP-ACG), the NBI Cybercrime Division, or the Cybercrime Investigation and Coordinating Center (CICC).
Contact the bank or e-wallet immediately if money, cards, loans, or financial accounts are involved.

A fake, anonymous, fan, or parody account is not automatically a crime. Under the Cybercrime Prevention Act of 2012, computer-related identity theft involves intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting another person’s or organization’s identifying information without right. Whether an account meets this definition depends on what information was used, whether its use was authorized, and what the account actually did.

You may report even if you do not know who controls the account. Give investigators every available lead rather than naming a suspected person without reliable evidence.

When a fake account may violate Philippine law

Computer-related identity theft

Section 4(b)(3) of Republic Act No. 10175 covers the unauthorized, intentional handling or use of identifying information belonging to another natural or juridical person. The Supreme Court upheld this provision in Disini Jr. v. Secretary of Justice.

The general penalty for offenses under Section 4(b) is prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. Prision mayor runs from six years and one day to twelve years. If no damage has yet occurred, the law provides for a penalty one degree lower. The actual charge and sentence remain for prosecutors and courts to determine from the evidence and applicable sentencing rules.

Damage is not necessarily limited to money. Investigators may consider misuse of identity, reputational injury, deception of contacts, unauthorized transactions, loss of account control, and other proven consequences.

Other possible offenses

The same conduct may raise other legal issues, depending on the facts:

Illegal access, if someone entered your real account, email, phone, or computer system without right.
Estafa or another fraud offense, if the impersonator deceived people into sending money, property, or valuable information.
Cyberlibel, threats, extortion, or other offenses, if the account published defamatory accusations, threatened harm, or demanded money.
Gender-based online sexual harassment, when impersonation is part of conduct covered by the Safe Spaces Act. The law expressly includes impersonating a victim online or posting lies to harm the victim’s reputation within its definition, when the conduct is gender-based online sexual harassment.
Data-privacy violations, where personal information is unlawfully processed, disclosed, or obtained, subject to the coverage and exceptions of the Data Privacy Act of 2012.
Civil liability, including possible damages for an unlawful invasion of dignity, privacy, personality, or peace of mind under the Civil Code.

Not every objectionable account satisfies every offense. For example, an account that merely shares a common name, clearly identifies itself as parody, or does not pretend to be affiliated with the person may be treated differently from an account using a person’s photograph, biography, and contacts to deceive others.

Platform rules are also separate from criminal law. A platform may remove an account for impersonation even when no Philippine criminal case is filed.

Preserve evidence before requesting removal

Take evidence first unless viewing or remaining in contact creates an immediate safety risk.

Record or save:

The complete profile as it appeared, including the name, photograph, biography, follower count, creation information if visible, and links.
The exact profile URL, username, handle, account ID, page transparency information, or channel identifier.
Screenshots and, where practical, a continuous screen recording showing how you reached the profile.
Each relevant post, advertisement, comment, story, livestream, or direct message.
Visible dates and times. Note the date, time, and time zone when you captured the material.
Phone numbers, email addresses, QR codes, bank or e-wallet details, payment links, delivery addresses, and cryptocurrency wallet addresses used.
Transaction receipts, reference numbers, bank statements, order records, and communications with financial institutions.
Messages from relatives, customers, or friends who were contacted. Ask them to retain the original conversation on their devices.
Your legitimate profile, identification, business registration, trademark records, or other documents showing the identity being copied.
Platform-report confirmations, ticket numbers, emails, and takedown notices.
A written chronology stating when you discovered the account, what it did, who was affected, and what action you took.

Keep the original files. Do not crop every screenshot, overwrite files, edit message exports, factory-reset the device, or delete the conversation after making only one copy. Back up the material in at least two secure locations.

Electronic evidence must still be authenticated if used in proceedings. Under the Supreme Court’s Rules on Electronic Evidence, the party offering a private electronic document carries the burden of showing its authenticity, integrity, and reliability. Full context, original files, witness accounts, and the device on which the material was received can therefore matter.

Secure your accounts and warn likely targets

If your real account was hacked or may have been compromised:

Secure the email account connected to it first.
Change passwords using a trusted device. Use a unique password for every service.
Turn on multi-factor authentication, preferably through an authenticator app or security key where available.
Review active sessions and sign out devices you do not recognize.
Check recovery email addresses, phone numbers, linked apps, forwarding rules, and account administrators.
Contact your mobile provider if your SIM suddenly stopped working or you suspect an unauthorized replacement.
Review bank, card, e-wallet, shopping, advertising, and business accounts for unfamiliar activity.
Use the platform’s hacked-account recovery process instead of negotiating with the person controlling the account.

Tell people who are likely to be approached. A short notice from your genuine account can state that the other account is unauthorized and that no one should send money, passwords, one-time PINs, identification documents, or verification codes to it. Avoid publicly accusing a named person unless you have reliable evidence.

Report the account to the social-media platform

Open the fake profile and use the platform’s reporting menu. Select the option for impersonation or “pretending to be someone else,” not merely spam, when that is the real issue.

Official reporting resources include:

In most apps, the route is similar to Profile → Options or Share → Report → Report account → Pretending to be someone. Interfaces can change, so follow the current prompts.

The platform may request proof of identity or authority. Upload identification only through the platform’s genuine app or official domain. Provide only what is required, and review whether unnecessary numbers or details may be covered without making the document unusable.

Save the report number and confirmation. If the first report is rejected, use the dedicated impersonation form and clearly identify:

The legitimate account or identity.
The fake account’s exact URL.
The information copied.
The deceptive or harmful conduct.
Your authority to report for a child, business, or other person, if applicable.

A platform report seeks restriction or removal. It is not a substitute for a criminal complaint, financial dispute, or privacy complaint.

Report to Philippine authorities

CICC Hotline 1326 and online reporting

For immediate assistance or referral, contact the CICC through:

The government describes 1326 as a 24-hour central reporting channel for scams and cybercrime. Give the responder a concise chronology, the account URL, contact and payment details used by the perpetrator, the harm or attempted harm, and any urgent safety or financial concern.

A hotline or online report can start assistance and referral, but an investigator may still require a personal interview, sworn statement, original evidence, or formal complaint.

PNP Anti-Cybercrime Group

The PNP is one of the law-enforcement authorities expressly designated under Republic Act No. 10175. You may approach the PNP-ACG or the appropriate regional anti-cybercrime unit.

For gender-based online sexual harassment, the Safe Spaces Act specifically identifies the PNP-ACG as the primary PNP unit responsible for receiving complaints and enforcing pertinent cybercrime laws. A victim may also approach the Women and Children Protection Desk where appropriate.

NBI Cybercrime Division

You may file with the NBI Cybercrime Division in Manila or the appropriate NBI regional cybercrime office. The NBI’s Citizen’s Charter procedure for computer-crime victims provides for a complaint sheet, preliminary interview, sworn statements or affidavits, submission of supporting documents, and examination of a relevant device when necessary.

The NBI lists its Cybercrime Division contact information on its official Divisions and Services page.

What to bring

Bring or prepare:

A government-issued ID.
A one- or two-page chronological account.
Printed and electronic copies of the evidence.
The original device, if the investigator asks to examine it.
Your real account details and proof that the copied identity belongs to you or your organization.
Names and contact details of witnesses or people who received messages.
Financial records and institution complaint numbers, if money is involved.
Copies of your platform, bank, CICC, PNP, NBI, or NPC reports.
A list of the specific harm, attempted harm, or transactions involved.

State honestly what you personally observed and what other people merely told you. Label estimates as estimates. Do not guess the offender’s identity.

Ask promptly about preserving platform data

A public username rarely reveals who actually operated an account. Subscriber information, traffic data, login records, and content held by a service provider generally require proper legal process.

Under Section 13 of Republic Act No. 10175:

Traffic data and subscriber information relating to communication services must be preserved for at least six months from the transaction.
Content data must be preserved for six months from receipt of a law-enforcement preservation order.
Law enforcement may order one extension of another six months.
If preserved data becomes evidence in a case, notice of its transmittal to the prosecutor requires continued preservation until the case ends.

These periods are not promises that every social-media record will remain available indefinitely, and they are not deadlines a victim should wait out. Report promptly and ask the investigator whether a preservation request should be issued. A private complainant ordinarily cannot compel the platform to disclose another user’s subscriber or login information; Section 14 generally requires a court warrant for compelled disclosure.

If money or financial accounts are involved

Contact the bank, card issuer, e-wallet, remittance company, or payment service immediately through its official fraud channel. Request appropriate action on pending transfers, account access, cards, or compromised credentials, and obtain a reference number.

Also:

Do not send another payment as a “release,” “verification,” or “refund” fee.
Change affected passwords and PINs.
Preserve the recipient account, QR code, transaction reference, amount, date, and time.
Ask each person deceived by the fake account to report their own transaction to their financial institution and retain their records.
Do not assume that reporting automatically reverses a transfer. Recovery depends on timing, the payment channel, available funds, and the institution’s investigation.

If a financial institution does not properly address a consumer complaint, follow its formal complaints mechanism before escalating through the Bangko Sentral ng Pilipinas consumer-assistance process, where applicable.

When to consider a National Privacy Commission complaint

Consider the NPC route when your personal information was misused, maliciously disclosed, improperly processed, or exposed through the acts of a business, employer, school, platform, personal-information controller, processor, or other covered entity. NPC jurisdiction and the Data Privacy Act’s exclusions are fact-dependent; not every disagreement with an individual social-media user is automatically an NPC case.

Under the amended NPC Rules of Procedure, a complainant generally must first:

Inform the personal-information controller, processor, or concerned entity in writing of the privacy violation or breach; and
Show that it failed to take timely and appropriate action, or did not respond within 15 calendar days after receiving the written notice.

The NPC may waive these requirements for good cause or a serious violation or breach, including grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

A formal NPC complaint generally must be written, signed, verified, supported by evidence and correspondence, and accompanied by a certification against forum shopping. Filing fees apply unless the complainant is exempt or the fee is waived. Use the NPC’s current formal-complaint instructions and form.

An NPC complaint is separate from a police or NBI investigation. One does not automatically replace the other.

Special situations requiring faster action

Seek immediate assistance when the account is connected with:

A credible threat of physical harm, stalking, or disclosure of your home, school, or workplace.
Extortion or a demand for money in exchange for not publishing information or images.
Intimate photographs or recordings shared without consent.
Sexual exploitation, grooming, or any sexual content involving a child.
Unauthorized loans, credit applications, SIM replacement, bank access, or government transactions made in your name.
Continuing withdrawals or transfers.
Control of a business page used to collect customer payments.
Impersonation of a public office, financial institution, school, hospital, or other organization that may expose many people to harm.

For immediate danger, contact emergency services or the nearest police station. If a child may be involved, report immediately to the PNP Women and Children Protection Desk, PNP-ACG, or NBI. Do not download, reproduce, or forward suspected child sexual abuse or exploitation material merely to “collect evidence”; preserve the URL and report it.

Common mistakes that can weaken a report

Reporting the profile before saving its full URL and content.
Keeping only cropped screenshots that omit the username, date, or surrounding conversation.
Deleting a hacked account, resetting the device, or clearing messages too early.
Paying the impersonator or sharing a one-time PIN to “prove ownership.”
Sending identification to an unofficial account claiming to represent the platform or government.
Publicly naming a suspected operator based only on writing style, mutual contacts, or rumor.
Trying to enter, disable, or take over the fake account without authorization.
Editing screenshots or combining several messages without retaining the originals.
Assuming that mass reporting will identify the operator or preserve evidence.
Treating a platform takedown as proof that a crime was committed.
Waiting for visible financial loss before reporting attempted misuse.
Giving materially different versions of events to the platform, bank, police, and other agencies.

What happens after a report

A platform may remove, restrict, or require changes to the account under its own policies. It may also reject the report if the evidence does not establish impersonation.

The PNP or NBI may interview the complainant and witnesses, examine relevant devices, seek preservation of data, and apply for appropriate cybercrime warrants. Investigators may refer a supported case to the prosecutor. The prosecutor determines whether probable cause exists to file charges; guilt must ultimately be proved in court beyond reasonable doubt.

Reporting does not guarantee immediate identification, takedown, arrest, reimbursement, or conviction. Outcomes often depend on the quality and timing of the evidence, platform cooperation through lawful process, the location of the operator, and proof connecting a person to the account.

Frequently asked questions

Can I report an account if I do not know who created it?

Yes. Identify the respondent as unknown and provide every available lead: URLs, handles, phone numbers, email addresses, payment accounts, linked pages, messages, and witnesses. Investigators can determine whether legal process should be used to seek additional records.

Are screenshots enough?

They are useful but may not be sufficient by themselves. Retain full-resolution files, URLs, original messages, screen recordings, witnesses, report confirmations, and the device containing the material. Electronic evidence may need authentication.

Can I force the platform to reveal the account owner?

Ordinarily, no. Platforms generally do not disclose another user’s subscriber, login, or traffic information merely because a private person requests it. Philippine law provides for compelled disclosure through authorized law enforcement and a court warrant.

Should I confront the person I suspect?

Usually not before preserving evidence and assessing safety. Confrontation may lead to deletion of the account or records and may escalate threats. Give your evidence and suspicions to investigators, clearly distinguishing facts from inferences.

Must I have a notarized affidavit before making a report?

Not usually for an initial platform report or Hotline 1326 call. The PNP or NBI may require a sworn complaint, statement, or affidavit as the case progresses. A formal NPC complaint must be verified and must comply with the NPC’s procedural requirements.

What if the account has not yet caused financial loss?

You may still report it. Republic Act No. 10175 expressly contemplates computer-related identity theft in which no damage has yet been caused, although the applicable penalty is lower. Early reporting may also prevent harm and preserve evidence.

Is a parody or fan account illegal?

Not automatically. Clear labeling, context, authorization, the information used, and whether people are being deceived all matter. An account that deceptively presents itself as the real person or organization is more likely to violate platform impersonation rules and may raise legal issues.

Can I claim damages?

Possibly. A civil claim may be available for proven financial loss, injury to reputation, invasion of privacy, or other legally compensable harm. The proper defendants, legal basis, evidence, and amount depend on the facts, so obtain advice from a Philippine lawyer before filing.

Official references

This article provides general legal information, not advice for a particular case. Facts, documents, jurisdiction, and the conduct of the account can change the legal analysis. For an urgent threat, significant loss, possible criminal charge, or approaching procedural deadline, consult Philippine counsel or the appropriate authority promptly. Sources and procedures checked as of August 3, 2026.