Quick answer

If someone creates a fake social media account using your identity, takes over your real account, or uses your personal information online without authority, preserve the evidence first, secure your accounts, report the account to the platform, and promptly report suspected criminal conduct to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD). If the incident also involves unlawful processing or misuse of personal data, a complaint before the National Privacy Commission (NPC) may be appropriate.

Under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. The implementing rules define identifying information broadly to include a person's name and other numbers or information capable of identifying a specific individual. The law expressly contemplates liability even when no damage has yet occurred, although the prescribed penalty is lower in that situation. (Lawphil)

A fake account is not automatically proof that the creator is guilty of computer-related identity theft. Criminal liability depends on the facts and evidence: what identifying information was used, whether it belonged to another person, whether its use was intentional and without right, and what the account was actually used to do. A clearly disclosed parody or fictional account presents different issues from an account deliberately presented as the real person. Likewise, an account that merely uses a similar name is different from one copying a person's identity and contacting others as if it were genuinely that person.

The Supreme Court sustained the constitutionality of the computer-related identity-theft provision in Disini v. Secretary of Justice. Other crimes may also arise depending on what the impostor does—for example, if the account is used to defraud people, gain unauthorized access to an actual account, forge electronic information, threaten a victim, or publish defamatory material. (Judiciary eLibrary)

Preserve the fake account before trying to have it removed

Do this before the profile, messages, or posts disappear.

Preserve as much of the original electronic evidence as possible:

screenshots showing the entire profile or page;
the account's exact username, display name, profile URL, and user ID if visible;
profile and cover photographs;
the date and time when you discovered the account;
posts, stories, comments, advertisements, and other content;
direct messages or chat conversations;
friend or follow requests sent by the account;
messages sent to your relatives, clients, coworkers, or friends;
requests for money, OTPs, identification documents, passwords, or financial details;
bank or e-wallet account numbers supplied by the impostor;
transaction receipts and reference numbers if somebody sent money;
emails or text messages containing security alerts, password resets, or login notifications;
screenshots from people who were contacted by the fake account; and
any evidence connecting the account with a particular suspect.

Whenever possible, keep the original files, not only edited or cropped screenshots. A screen recording showing you opening the account, navigating through its profile, and displaying the URL or username can provide useful context. Keep a separate chronological note of what happened, when you learned about it, whom the impostor contacted, and what actions you took.

Digital evidence can disappear quickly. Republic Act No. 10175 requires service providers to preserve traffic data and subscriber information for at least six months from the relevant transaction. Content data is preserved for six months from receipt of a lawful preservation order, with a possible one-time extension. Law-enforcement authorities can also seek court-authorized disclosure of subscriber, traffic, and relevant computer data. (Lawphil)

This is one reason to report serious cases promptly rather than assuming that an account can always be traced months or years later.

Secure your real accounts immediately

If there is any possibility that the impersonator obtained your password, email access, OTP, recovery code, SIM access, or other credentials, treat the incident as a potential account compromise.

As soon as practicable:

Change the password of your affected account from a trusted device.
Change the password of the email account connected to it.
Do not reuse a password that you use elsewhere.
Enable two-factor authentication.
Review logged-in devices and terminate sessions you do not recognize.
Review recovery email addresses and mobile numbers for unauthorized changes.
Check whether unfamiliar applications have been given access to the account.
Secure banking, e-wallet, shopping, cloud-storage, and other accounts connected to the same email address or mobile number.
Contact your telecommunications provider promptly if you suspect SIM takeover or unauthorized SIM activity.

If your actual Facebook account was hacked, Meta provides a separate account-recovery process in addition to its impersonation-reporting tools. (Facebook)

Do not give passwords, OTPs, recovery codes, or copies of identification documents to someone merely because that person claims to be investigating the fake account. Use only verified government or platform channels.

Report the impersonating account to the social media platform

Platform reporting and criminal reporting serve different purposes. Platform reporting may get the account removed; reporting to law enforcement allows the incident to be investigated as a possible crime. In a serious case, doing one should not automatically replace the other.

For Facebook, Meta states that profiles and Pages pretending to be another person violate its rules. A Facebook impersonation report may be filed directly from the fake profile or Page, and Meta provides a process even for a person who does not have a Facebook account. (Facebook)

TikTok likewise provides an impersonation-reporting procedure through the account's reporting menu and a separate online process for impersonation complaints.

Before submitting a takedown report, save the account URL, screenshots, messages, and other evidence. If the platform removes the account immediately, material that would have helped explain the incident may become harder for you to retrieve.

If the fake account is actively scamming people, tell relatives, coworkers, customers, or other likely targets through your verified or established communication channels that the account is unauthorized. Keep the warning factual. Avoid publicly accusing a specific person unless you have a sufficient factual and legal basis for doing so.

File a cybercrime complaint with the PNP or NBI

Republic Act No. 10175 expressly designates the PNP and NBI as the principal law-enforcement authorities responsible for enforcing the Cybercrime Prevention Act. (Lawphil)

PNP Anti-Cybercrime Group

The PNP-ACG maintains national, regional, provincial, and district cybercrime units. Its current contact directory lists the Cyber Response Unit at:

Email: complaint@acg.pnp.gov.ph
Contact number: 0968 878 3561
PNP-ACG trunkline: (02) 8723-0401, local 7490

The PNP-ACG directory also lists regional and district cybercrime teams throughout the country. (PNP ACG)

When reporting, give investigators a clear chronology and copies of your evidence. Explain specifically how the account is impersonating you or another person and whether it has been used to obtain money, information, passwords, access to accounts, or other benefits.

NBI Cybercrime Division

The NBI also maintains a Cybercrime Division. Its current directory identifies ccd@nbi.gov.ph as the division's official email address. (National Bureau of Investigation)

The NBI Citizen's Charter states that members of the general public may proceed to the Cybercrime Division to file a complaint or request an investigation. The published procedure provides for an initial interview, completion of a sworn complaint sheet, sworn statements or affidavits, submission of supporting evidence, and examination of relevant devices when necessary. It lists no fee for this investigative assistance. Regional Cybercrime Centers can also handle cases. (National Bureau of Investigation)

CICC cybercrime reporting channels

The Cybercrime Investigation and Coordinating Center also accepts reports through its official cybercrime channels. Its published materials identify:

Hotline: 1326
Email: report@cicc.gov.ph
Globe: 0966-976-5971
DITO: 0991-481-4225
Smart: 0947-714-7105

CICC specifically advises victims of online scams to report incidents promptly. (CICC)

For a criminal investigation requiring identification of the account holder, preservation of platform records, cybercrime warrants, or forensic examination, the PNP-ACG or NBI cybercrime units remain particularly important because Republic Act No. 10175 assigns law-enforcement authority to the PNP and NBI.

What investigators may be able to obtain from the platform

Victims generally should not expect a social media company to simply disclose another user's registration details directly to them.

Under the Cybercrime Prevention Act and the Rule on Cybercrime Warrants, investigators may use lawful processes to obtain evidence that is not publicly visible. Depending on the circumstances, law enforcement may seek a Warrant to Disclose Computer Data, a warrant relating to interception, or a warrant authorizing the search, seizure, or examination of computer data. (Lawphil)

Section 14 of Republic Act No. 10175 provides that, after securing the required court warrant, law enforcement may require a person or service provider to disclose relevant subscriber information, traffic data, or other computer data in connection with a valid complaint officially docketed and assigned for investigation. (Lawphil)

This is why a properly documented criminal complaint may matter even after the social media platform has removed the public-facing fake account.

If money was stolen or transferred

Treat a financial loss as urgent.

Immediately notify the sending bank, receiving bank if known, e-wallet provider, payment service provider, card issuer, or other institution involved. Give them:

the amount;
date and time;
transaction reference number;
recipient account or wallet details;
screenshots of the fraudulent conversation;
the fake account's URL or username; and
your written statement that the transaction resulted from fraud or impersonation.

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), authorizes covered financial institutions to temporarily hold funds involved in qualifying disputed transactions and requires a coordinated verification process. The statute caps a temporary hold at the period prescribed by the BSP, which may not exceed 30 calendar days unless a competent court extends it. BSP Circular No. 1215 implemented the temporary-holding and coordinated-verification framework. (Lawphil)

This does not guarantee recovery of transferred funds. Speed nevertheless matters because money may be transferred through several accounts or withdrawn.

Report the criminal incident to the PNP-ACG or NBI as well; do not rely solely on the financial institution's internal dispute process.

When the Data Privacy Act may also apply

Identity theft and fake accounts can also involve the Data Privacy Act of 2012, Republic Act No. 10173, particularly where somebody unlawfully collects, uses, stores, discloses, or otherwise processes personal information.

The Data Privacy Act penalizes, among other conduct, unauthorized processing of personal information and processing for unauthorized purposes. Whether a specific fake-account incident constitutes a DPA violation depends on the nature of the information, how it was obtained and processed, the applicable lawful basis, and the surrounding circumstances. (Lawphil)

The NPC has specifically warned that unauthorized access, use, disclosure, sharing, or further dissemination of another person's personal data may result in civil, administrative, or criminal liability under the DPA and other laws. (National Privacy Commission)

A privacy complaint is different from a criminal cybercrime report. Depending on the facts, a victim may have reason to pursue both.

How to file a complaint with the National Privacy Commission

Under the NPC's current Rules of Procedure, a data subject affected by a privacy violation or personal data breach may file a complaint. Authorized representatives may also file subject to the NPC's requirements. (National Privacy Commission)

As a general rule, the complainant must first inform the respondent or concerned entity in writing of the privacy violation or personal data breach and give it an opportunity to address the problem. If no timely or appropriate action is taken, or no response is received within 15 calendar days from receipt of the written notice, the exhaustion requirement is ordinarily satisfied. Proof of the written notification should be included with the complaint. (National Privacy Commission)

There are exceptions. The NPC may waive the exhaustion requirement for good cause or serious privacy violations, including circumstances involving grave and irreparable harm or the absence of a plain, speedy, and adequate remedy. (National Privacy Commission)

The NPC requires a properly completed, notarized or verified complaint using its current prescribed form, together with supporting documents and witness affidavits where applicable. The NPC announced that a new Complaint-Affidavit template took effect on July 1, 2025, so complainants should download the current form rather than rely on an old copy found elsewhere online. The NPC currently receives complaints through complaints@privacy.gov.ph and at its Complaints and Investigation Division. (National Privacy Commission)

An NPC complaint should not be treated as a substitute for a prompt PNP or NBI report when the identity of the fake-account operator must be investigated or criminal evidence must be preserved.

What information to put in your complaint

A useful complaint should tell the story in chronological order rather than simply stating that you were "hacked" or "impersonated."

Include, as applicable:

Your name and contact information.
The social media platform involved.
Your genuine profile or account.
The fake profile's exact username and URL.
When you first discovered the account.
Why you know the account is unauthorized.
What identifying information was copied or used.
Whether your actual account was accessed.
Who received messages from the fake account.
What the impostor represented to other people.
Whether money, passwords, OTPs, IDs, confidential files, or personal data were requested.
Whether anyone suffered financial or reputational harm.
What reports you already submitted to the platform.
What security measures you have already taken.
The names and contact information of witnesses.
A clear list of the screenshots, recordings, messages, transaction records, and other attachments you are providing.

If other people received fraudulent messages, ask whether they are willing to preserve the original conversations and provide a statement to investigators.

Fake account versus hacked account

These situations should be distinguished.

A fake or cloned account is generally a separate account created by somebody else that imitates another person's identity.

A hacked or compromised account is the victim's genuine account that another person has accessed or taken over.

A hacked account may implicate the Cybercrime Prevention Act's prohibition against illegal access, apart from any identity theft, fraud, or other offenses committed after the intrusion. Illegal access means access to all or part of a computer system without right. (Lawphil)

If both occurred—for example, somebody hacked your genuine account and then created additional fake accounts—identify each account separately in your report.

A fake account can involve more than identity theft

Do not assume that investigators are limited to a single offense.

Depending on the actual conduct and available evidence, an impersonation scheme may involve questions concerning:

computer-related identity theft;
illegal access;
computer-related forgery;
computer-related fraud;
cyber libel;
fraud or estafa;
falsification;
threats or extortion;
unlawful use or disclosure of personal information; or
financial-account scamming.

Section 6 of the Cybercrime Prevention Act also addresses crimes already punishable under the Revised Penal Code or special laws when committed by, through, and with the use of information and communications technologies. The Supreme Court upheld this provision in Disini. (Judiciary eLibrary)

The proper charge depends on the specific acts proved, not merely on the label placed on the complaint by the victim.

Common mistakes to avoid

Reporting the account before saving evidence

A fast takedown is desirable, but an account that disappears may take useful evidence with it. Preserve the public profile, messages, URLs, usernames, and timestamps first when circumstances permit.

Keeping only the fake account's display name

Display names can be changed. Save the profile URL, username, account ID if available, and screenshots of the actual page.

Cropping every screenshot

A tightly cropped image may remove the date, time, username, URL, conversation context, or other details important to authentication. Keep original and full-screen copies.

Deleting embarrassing or threatening messages

Preserve them. What seems unpleasant or unimportant may later establish impersonation, intent, fraud, threats, or the identity of witnesses.

Assuming a Facebook or TikTok report is the same as a police complaint

It is not. Platform moderation can remove an account but does not replace a Philippine criminal investigation.

Publicly naming a suspected culprit without adequate proof

An apparent clue is not necessarily proof of authorship. A fake profile can itself contain false information. Give suspicions and supporting evidence to investigators rather than turning an uncertain attribution into a public accusation.

Trying to hack the fake account back

Do not obtain evidence through unauthorized access. Preserve evidence available to you lawfully and allow investigators to use the legal procedures available under the Cybercrime Prevention Act and the Rule on Cybercrime Warrants.

Waiting for financial institutions to investigate before reporting elsewhere

If money or account credentials are involved, notify the institution and cybercrime authorities promptly. The processes can proceed in parallel.

When legal or investigative help is urgent

Seek prompt assistance when:

money has already been transferred;
the impostor is requesting money from your contacts;
your bank, e-wallet, email, or social media account has been taken over;
your SIM or mobile number appears compromised;
passwords, OTPs, recovery codes, government IDs, or financial information were exposed;
the impostor is threatening or blackmailing you;
intimate photographs or videos are involved;
a child is being targeted;
the account is impersonating a company, professional, public office, or government official;
false transactions, loans, contracts, purchases, or applications are being made in your name;
numerous victims have already been contacted;
the fake account is being deleted or repeatedly recreated; or
identifying the account operator will likely require preservation orders, platform records, or cybercrime warrants.

Where there is an immediate threat to physical safety, contact the police or appropriate emergency authorities instead of limiting the response to an online platform report.

Frequently asked questions

Is creating a fake social media account automatically a crime?

No. The legal conclusion depends on what the creator actually did. For computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, there must be intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. An impersonation account that actually uses another person's identity without authority can present a strong basis for investigation, but criminal liability must still be established from evidence. (Lawphil)

Can I report identity theft even if nobody has lost money?

Yes. Section 4(b)(3) specifically provides for the situation where no damage has yet been caused, although the statutory penalty is lower. Financial loss is therefore not an indispensable condition for reporting suspected computer-related identity theft. (Lawphil)

Should I report to the PNP or the NBI?

Either is legally appropriate. Republic Act No. 10175 designates both the PNP and NBI as cybercrime law-enforcement authorities. A victim may approach the PNP-ACG or NBI Cybercrime Division or their appropriate regional units. (Lawphil)

Can I force Facebook, TikTok, or another platform to tell me who created the account?

Ordinarily, a private victim cannot simply demand another user's confidential subscriber information. In a criminal investigation, law-enforcement authorities can use the judicial processes provided by Republic Act No. 10175 and the Rule on Cybercrime Warrants to seek disclosure of relevant computer data where the legal requirements are met. (Lawphil)

Should I block the fake account?

You may block it for your safety, but first preserve the information you need if doing so will make the account difficult to locate later. If the account is actively communicating with you as part of a serious crime, investigators may also want to know about the ongoing interaction before evidence disappears.

Can friends report the impersonating account too?

Yes, depending on the platform's reporting system. Facebook expressly allows users to report a profile or Page pretending to be themselves, someone they know, or a public figure. (Facebook)

Should I file a complaint with the NPC instead of the PNP or NBI?

Not necessarily. They perform different functions. The NPC handles violations of the Data Privacy Act and related privacy rules. The PNP and NBI investigate possible cybercrimes. A single incident can potentially justify both forms of action depending on the facts.

Official sources and reporting channels

General-information disclaimer

This article provides general information about Philippine law and reporting procedures and is not legal advice for any specific case. Identity-theft, cybercrime, privacy, fraud, and financial-account cases are highly fact-dependent, and the appropriate complaint, respondent, evidence, venue, and legal theory may change depending on what actually occurred. Official procedures and contact details should be rechecked before filing.

Law and official-source check: August 23, 2026.