Quick answer

If someone is using your name, photo, business identity, or personal details in a fake social media account, act immediately:

Preserve the evidence before blocking or reporting the account.
Report the profile and each harmful post or message to the platform.
Secure your email, social media, mobile number, and financial accounts.
File a formal complaint with the PNP Anti-Cybercrime Group or NBI Cybercrime Division if there is impersonation, fraud, harassment, threats, reputational harm, or unauthorized use of identifying information.
Contact your bank, e-wallet provider, lender, or telco immediately if money, credit, an account, or your SIM is involved.
Consider a National Privacy Commission complaint if personal data was unlawfully collected, disclosed, or used.

A platform report can remove an account, but it is not the same as a criminal complaint. The Cybercrime Investigation and Coordinating Center’s 1326 hotline can help receive and route cybercrime reports, but a case may still require a sworn complaint and supporting evidence before the PNP, NBI, or prosecutor.

Call 911 or go to the nearest police station immediately if there is a credible threat of violence, stalking, extortion, sexual exploitation, or danger to a child.

Is every fake social media account illegal?

No. An account using a fictitious name, a clearly disclosed parody, or a fan identity is not automatically a crime. The facts, purpose, information used, and harm caused matter.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 punishes computer-related identity theft: the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person.

The Supreme Court explained in Disini v. Secretary of Justice that the prohibited use of identity information must be for an illegitimate purpose. Merely acquiring or disseminating information that the person made public is not, by itself, identity theft.

A fake account is more likely to raise criminal issues when it:

Pretends to be you or your business to deceive other people;
Uses your name, photograph, contact details, identification documents, signatures, account credentials, or other identifying information without authority;
Solicits money, loans, investments, goods, passwords, or one-time PINs;
Makes transactions or opens accounts in your name;
Sends threats, blackmail, sexual messages, or fraudulent offers;
Publishes defamatory statements while appearing to speak for you;
Harasses, stalks, or targets you through gender-based or sexual conduct; or
Uses hacked credentials to take over your real account.

Even when the evidence does not establish a crime, the account may still violate the platform’s impersonation, authenticity, privacy, harassment, or fraud policies.

Possible offenses and remedies

The correct charge depends on what the account actually did. Do not assume that “identity theft” is the only possible offense.

Computer-related identity theft

A conviction under Section 4(b)(3) of Republic Act No. 10175 may carry prisión mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law provides for a penalty one degree lower. The court determines the proper penalty after considering the proven facts.

Fraud, falsification, or access to an account

An impersonator who obtains money, manufactures false electronic records, or accesses your real account may face other offenses under the Cybercrime Prevention Act, the Revised Penal Code, or special laws. A failed attempt may also be punishable in circumstances covered by the Act.

Data-privacy violations

Names, photographs, contact details, government identifiers, account information, and similar data may be personal information under the Data Privacy Act of 2012. Unauthorized collection, use, disclosure, or processing can result in administrative, civil, or criminal consequences when the Act applies.

An NPC case is not automatic merely because a fake account exists. Coverage, lawful basis, the identity and role of the respondent, applicable exclusions, and proof of the alleged processing must still be established.

Online harassment and impersonation with a gender-based or sexual element

The Safe Spaces Act expressly includes certain forms of online impersonation, cyberstalking, threats, unwanted sexual or sexist remarks, unauthorized sharing, and posting lies intended to harm a victim’s reputation within gender-based online sexual harassment. The PNP Anti-Cybercrime Group is designated to receive these complaints.

Defamatory posts

A fake account that publishes malicious defamatory imputations may raise cyber-libel issues, but not every insult, criticism, mistake, or unfavorable statement is libel. Publication, identification, defamatory meaning, malice, privileges, and other defenses are fact-sensitive.

The Supreme Court has confirmed with finality that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents, subject to the rules on interruption of prescription. See the April 8, 2026 Resolution in Causing v. People. Civil actions for defamation also have a short filing period. Obtain legal advice promptly if defamatory posts are involved.

Intimate images or child sexual material

Nonconsensual publication of qualifying intimate recordings may violate the Anti-Photo and Video Voyeurism Act. Material involving children may fall under the Anti-OSAEC and Anti-CSAEM Act.

Do not download, forward, or redistribute suspected child sexual abuse or exploitation material. Record the account name and URL without reproducing the content, then report it immediately to law enforcement and the platform.

What to do immediately

1. Preserve evidence before the account disappears

Save evidence in its original form as far as possible:

The complete profile URL, username, display name, profile photograph, bio, and visible account identifiers;
Full-screen screenshots showing the URL, date, time, and surrounding context;
A screen recording showing how you reached the profile and relevant posts;
Links to individual posts, stories, advertisements, videos, comments, or messages;
Messages sent to you or to people who believed they were communicating with you;
Names and contact details of recipients or witnesses;
Emails, text messages, login alerts, password-reset notices, and platform notifications;
Transaction records, account numbers, recipient details, receipts, reference numbers, and bank or e-wallet alerts;
Copies of the photographs or information taken from your legitimate account;
The date and manner in which you first discovered the account; and
Confirmation numbers and emails for every platform, police, bank, or agency report.

Keep the original files. Do not crop, annotate, filter, rename repeatedly, or overwrite them. Store a backup on another secure device or drive. Prepare a chronological list of events while your memory is fresh.

If someone else received the messages, ask that person to preserve the original conversation on their device. A screenshot forwarded to you is useful, but the original recipient and device may provide stronger context.

2. Secure the accounts that control your identity

If your real account was hacked, start with the email account connected to it:

Change the email password from a trusted device;
Use a new, unique password;
Sign out unknown sessions and remove unfamiliar recovery addresses, devices, and applications;
Turn on multi-factor authentication, preferably through an authenticator app or security key;
Change your social media and financial passwords;
Review recent posts, messages, advertisements, linked pages, and payment methods;
Check whether your mobile number has unexpectedly lost service; and
Contact your telco immediately if you suspect an unauthorized SIM replacement or SIM swap.

Do not wipe, reset, sell, or discard a possibly compromised device until important evidence has been preserved or an investigator advises you.

3. Report the account through the platform’s official channel

Report both the profile and any specific posts, advertisements, or messages that violate the rules. Save the report confirmation.

Official impersonation channels include:

A platform may request identification to confirm who is being impersonated. Submit it only through the platform’s official application or help center—not through comments, direct messages, or a person offering paid “recovery” services.

If the account is impersonating a company or organization, use the platform’s business, brand, trademark, or organization-reporting option and provide proof that you are authorized to act for the entity.

4. Warn likely targets carefully

Tell relatives, employees, customers, or business partners not to transact with the account. A short factual notice is usually safer than publicly naming a suspected operator without proof.

For example:

An account using my name and photograph is not controlled or authorized by me. Please do not send money, information, passwords, or verification codes to it. The account has been reported to the platform and authorities.

Preserve evidence before posting a warning. Do not engage in threats, retaliation, doxxing, or public accusations based only on suspicion.

How to report to Philippine authorities

PNP Anti-Cybercrime Group

The PNP and NBI are the law-enforcement authorities expressly designated under Section 10 of Republic Act No. 10175. You may approach the PNP Anti-Cybercrime Group, a regional anti-cybercrime unit, or the nearest police station for assistance and referral.

Bring:

A valid government-issued ID;
A clear written chronology;
Printed and electronic copies of the evidence;
Exact profile and content URLs;
Your phone or device, if requested for examination;
Transaction records and communications with banks or platforms;
Names and contact details of witnesses; and
Proof that the identity, photograph, business, or account belongs to you.

Ask for the complaint, docket, incident, or reference number and the investigator’s official contact details.

NBI Cybercrime Division

You may also use the NBI online complaint page or go to the Cybercrime Division or an appropriate NBI regional or district office.

The NBI’s published procedure for investigative assistance to computer-crime victims includes a preliminary interview, a sworn complaint sheet or affidavit, collection of supporting documents and witness statements, and possible examination of a relevant device. The listed investigative-assistance service has no fee.

CICC hotline and report portal

Cybercrime may also be reported through the CICC hotline 1326 or the CICC online report portal. This can help with initial intake, coordination, or referral.

Keep in mind that a hotline report does not necessarily complete the requirements for a criminal case. Cooperate if you are directed to execute a sworn statement or appear before the PNP, NBI, or prosecutor.

Why prompt reporting matters

Service-provider information is not available to private complainants merely on request. Investigators may need preservation orders and court-issued cybercrime warrants to obtain subscriber information or other computer data.

Under Section 13 of Republic Act No. 10175, traffic data and subscriber information relating to communication services must generally be preserved for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension. These rules are not a reason to wait: accounts and content can disappear, and the available data depends on the provider and the date of the activity.

When to contact a bank, e-wallet, lender, or telco

Contact the institution immediately if the impostor:

Transferred or attempted to transfer money;
Used your card or account;
Opened an account, loan, or credit facility in your name;
Asked contacts to send money to a bank or e-wallet account;
Obtained a one-time PIN or changed your account credentials; or
Took control of your mobile number.

Ask the institution to secure the account, record the dispute, preserve relevant records, and provide a reference number. The Bangko Sentral ng Pilipinas advises consumers to report unauthorized or suspicious transactions immediately.

Your bank or BSP-supervised institution is the first-level complaint channel. If it does not resolve the matter or fails to act, you may escalate the complaint through the BSP Consumer Assistance Mechanism.

A police report does not automatically reverse a transaction, and a financial complaint does not replace a criminal complaint. Pursue the appropriate channels at the same time.

When and how to file with the National Privacy Commission

Consider an NPC complaint when the incident involves unlawful processing, disclosure, misuse, failure to secure, or refusal to correct or remove personal data covered by the Data Privacy Act.

Under the 2021 NPC Rules of Procedure, as amended, a complainant generally must first:

Inform the personal information controller, processor, platform, or concerned entity in writing about the privacy violation or data breach; and
Give it an opportunity to act. If there is no response within 15 calendar days from receipt, or no timely and appropriate action, the complainant may proceed.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or patently illegal conduct. A complainant should not assume that a waiver will be granted; explain and prove why it is necessary.

Use the NPC’s current Complaint-Affidavit form effective July 1, 2025. The complaint generally must be verified and notarized and should include:

The identities and contact information of the parties, or facts that may identify an unknown respondent;
A complete narration and supporting evidence;
The relief requested;
Copies of correspondence with the respondent;
Witness affidavits, when available;
A valid government-issued ID; and
A certification against forum shopping.

The NPC’s filing page permits submission in person, by courier, or by scanning and emailing the completed complaint to its authorized complaint address. The current basic filing fee is ₱500, with possible additional fees for certain claims or applications. Indigent complainants may qualify for an exemption under the NPC’s rules.

An NPC proceeding is separate from a police investigation. It should not be treated as a substitute when fraud, threats, hacking, or another crime may have occurred.

Common mistakes to avoid

Reporting or blocking the account before saving its URL and content;
Keeping only cropped screenshots with no date, username, or context;
Deleting security alerts, emails, messages, or transaction records;
Continuing to converse with the impersonator after evidence has been secured;
Paying a “hacker,” fixer, recovery agent, or supposed law-enforcement contact;
Sending identification documents through unofficial accounts or email addresses;
Publicly accusing a particular person without reliable evidence;
Assuming the account’s displayed name, phone number, location, or photograph identifies its operator;
Treating a police blotter entry as a completed sworn criminal complaint;
Waiting for platform action before notifying a bank or e-wallet provider;
Resetting or wiping a relevant device too early;
Forwarding intimate or child sexual material while trying to gather proof; or
Assuming that account deletion prevents an investigation.

When legal help is urgent

Consult a Philippine lawyer promptly when:

The fake account published defamatory material, because the applicable filing period can be short;
Money, loans, tax records, government benefits, or corporate transactions are involved;
You received a demand letter, collection notice, subpoena, warrant, or notice of a case filed in your name;
The offender is an intimate partner or former partner and the conduct includes threats, stalking, or psychological abuse;
Intimate images, sexual blackmail, or a child are involved;
The account is still causing substantial business or reputational damage;
A platform refuses to preserve or remove important material;
You need an urgent court order, protection order, or damages; or
Several proceedings may involve the same facts, requiring careful compliance with forum-shopping rules.

Those who cannot afford private counsel may inquire with the Public Attorney’s Office or the Integrated Bar of the Philippines National Center for Legal Aid, subject to their current eligibility and case-assessment rules.

Frequently asked questions

Do I need to know who created the account before reporting it?

No. State that the operator is unknown and provide every available identifier. Law enforcement may seek subscriber or account information through lawful preservation and disclosure procedures. Do not identify a suspect based only on writing style, mutual friends, or an unverified phone number.

Is a police blotter enough?

Usually not. A blotter records that an incident was reported, but investigation or prosecution may require a sworn complaint-affidavit, supporting documents, witness statements, and further cooperation.

Can I demand the account owner’s IP address from the platform?

Ordinarily, no. Platforms generally do not disclose private account or subscriber records directly to an alleged victim. Investigators may need a court-issued cybercrime warrant or another lawful process.

Should friends mass-report the account?

They may submit truthful reports, but the person being impersonated should use the dedicated impersonation form whenever possible. A direct report supported by identification and exact URLs is generally more useful than repeated reports containing incomplete or inconsistent information.

What if the account has already been deleted?

Still report it. Preserve screenshots, URLs, notification emails, messages received by witnesses, and any platform report confirmation. Providers may retain some information for a limited period, so prompt law-enforcement reporting remains important.

What if the fake account used only a photograph I posted publicly?

Public availability does not give someone unlimited permission to impersonate you. However, the Supreme Court has said that merely acquiring or disseminating information made public by the user is not itself identity theft. The account’s deceptive presentation, purpose, other information used, messages, and resulting harm will matter.

Can I report on behalf of a child or another person?

A parent or lawful representative may report for a child or person who cannot act alone. For an NPC complaint, the amended rules require proof of the relationship or authority—such as a birth certificate for a parent representing a minor or the appropriate guardianship document.

Will reporting guarantee that the account is removed or that money is recovered?

No. Removal depends on the platform’s investigation and policies. Criminal, privacy, and financial complaints follow separate evidentiary and procedural rules. Reporting promptly improves the chance that evidence and funds can be traced, but no agency or platform can guarantee recovery, identification, prosecution, or conviction.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Applicable remedies depend on the account’s content, purpose, evidence, parties, and resulting harm. Laws, procedures, and official reporting channels were checked against primary and official sources on August 3, 2026.