Quick answer

If someone is using your name, photos, personal details, or documents through a fake social media account:

Preserve the evidence before reporting the account. Save the exact profile URL, username, screenshots, posts, messages, dates, transaction records, and reports from people contacted by the impostor.
Secure your real accounts and email. Change compromised passwords, enable two-factor authentication, review active sessions, and remove unknown recovery details or connected apps.
Report the account through the platform’s impersonation process.
Warn your contacts through your genuine account without publishing unnecessary personal information or making unverified accusations.
Report promptly to Philippine authorities if the account is soliciting money, obtaining loans, threatening or harassing anyone, publishing private material, accessing accounts, or otherwise causing harm. You may contact the Cybercrime Investigation and Coordinating Center through 1326, or file with the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
Notify affected banks, e-wallets, lenders, telecommunications companies, employers, or government agencies immediately if accounts, money, SIMs, IDs, or records are involved.

A fake account is not automatically a crime. The account may violate platform rules even when the available facts do not yet prove criminal liability. Whether it constitutes identity theft or another offense depends on what information was used, whether the use was intentional and unauthorized, and what the person did with the account.

When a fake account may constitute identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information, through a computer system, without right.

This may apply when an impostor deliberately uses another person’s name, photograph, contact information, identification document, account credentials, signature, or similar identifying information without authority. Evidence that the account was used to deceive relatives, solicit money, obtain credit, gain account access, or represent itself as the victim can be especially important.

The Supreme Court upheld the computer-related identity-theft provision in Disini v. Secretary of Justice. The prosecution must still prove every element beyond reasonable doubt. A shared name, obvious parody, disclosed fan page, anonymous account, or use authorized by the person concerned does not automatically establish the offense.

For computer-related identity theft, Section 8 of the Cybercrime Prevention Act provides a penalty of prision mayor or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. The actual charge and penalty depend on the proven conduct.

Other laws may apply depending on the facts:

Deception that causes financial loss may support estafa or another fraud charge.
Unauthorized processing or disclosure of personal information may raise issues under the Data Privacy Act of 2012.
Defamatory publications, threats, falsified documents, unauthorized account access, or extortion may constitute separate offenses if their particular elements are proven.
Gender-based online sexual harassment can include online impersonation and lies intended to harm a victim’s reputation in circumstances covered by the Safe Spaces Act.
Sexual images, especially material involving a child, may trigger other serious laws. Do not redistribute such material merely to show other people what happened.

The appropriate charge should be determined from the actual posts, messages, account records, documents, and resulting harm—not merely from the label “fake account.”

Preserve evidence before the account disappears

Platforms may remove or rename an account after a report. Capture the evidence first, unless viewing or preserving it would place someone in immediate danger.

Save the following:

The complete profile URL—not only the displayed name
The username or handle, profile name, profile photograph, bio, and account ID if visible
Full-screen screenshots showing the browser address bar or the relevant app screen
A screen recording showing how you reached the profile, posts, or messages
The date, time, and time zone when each item was captured
Posts, stories, advertisements, comments, direct messages, emails, voice messages, and call logs
Phone numbers, email addresses, QR codes, payment links, bank or e-wallet details, and transaction reference numbers used by the impostor
Requests for money, loans, passwords, one-time PINs, identification documents, or intimate material
Reports or messages from relatives, customers, employers, or other people whom the impostor contacted
Platform report confirmations, ticket numbers, and responses
Proof that the genuine name, photo, business, or account belongs to you
A chronological account of what happened, including when you first learned of it and every action you took

Keep original files and messages on the device where possible. Back up copies without editing, cropping, annotating, or repeatedly re-saving the originals. Philippine rules recognize electronic evidence, but its authenticity and integrity may need to be established. A screenshot is useful; it is not necessarily a complete substitute for the original message, file, account record, or testimony of a person with direct knowledge.

Do not hack the account, trick the suspected operator into revealing credentials, publish their alleged address, or ask others to submit false reports. These actions can create new legal and evidentiary problems.

Secure your identity and genuine accounts

If your genuine account was taken over, use the platform’s hacked-account recovery process. An account takeover and a newly created impersonation account require different reports.

Immediately:

Change the password of the email account linked to social media.
Use a new, unique password that has not been used elsewhere.
Enable two-factor authentication, preferably through an authenticator app or another secure method offered by the service.
Review active sessions and sign out unknown devices.
Check recovery email addresses, phone numbers, forwarding rules, connected applications, and advertising accounts.
Change passwords for other services that reused the compromised password.
Contact your mobile provider if your SIM stopped working unexpectedly or you suspect unauthorized SIM activity.
Notify financial institutions if IDs, account information, card details, passwords, or one-time PINs were exposed.
Ask affected institutions to record the incident, restrict suspicious activity, and explain their formal dispute or account-recovery procedure.

Do not send passwords or one-time PINs to anyone claiming to be an investigator, platform employee, bank representative, or “account recovery expert.”

Report the account to the social media platform

Open the fake profile and use its Report option, selecting impersonation, pretending to be someone else, fake identity, fraud, or the closest available category. Also report individual scam posts, advertisements, messages, or intimate material when the platform provides separate reporting routes.

Official reporting pages include:

The platform may request an identification document or proof that you are authorized to represent the person or organization being impersonated. Submit documents only through the platform’s genuine app or official help-center domain. Give only what the official process requires.

If the account is impersonating a business, organization, deceased person, child, or someone you legally represent, follow the platform’s specific form. Authorization, guardianship documents, trademark records, or proof of relationship may be required.

A platform report is a request for enforcement under platform rules. It is not a criminal complaint, police report, or guarantee that account information will be preserved for investigators.

Report criminal conduct to Philippine authorities

You do not need to identify the operator before making a report. Supply the profile URL, handle, messages, transaction details, and all known identifiers. Law-enforcement agencies can assess whether legal process should be used to seek subscriber, traffic, or content information.

CICC and Hotline 1326

The Cybercrime Investigation and Coordinating Center receives and coordinates cybercrime reports through the government’s 1326 channel. The DICT contact page also identifies 1326@dict.gov.ph for feedback or complaints.

A CICC report can facilitate assistance or referral, but investigators may still require a sworn statement and personal appearance.

PNP Anti-Cybercrime Group

You may approach the PNP Anti-Cybercrime Group or its appropriate regional or provincial cybercrime unit. Verify current contact details through the official PNP Anti-Cybercrime Group website or its verified official page, because published mobile hotlines can change.

If there is an immediate physical threat, call 911 or go to the nearest police station. Ask that the threat and related online conduct be documented and referred to the appropriate cybercrime unit.

NBI Cybercrime Division

The NBI accepts complaints concerning identity theft and other computer crimes. Its published procedure involves an initial interview, a complaint sheet, sworn statements or prepared affidavits, supporting documents, and examination of a relevant device when necessary. See the NBI’s investigative-assistance procedure for computer-crime victims.

You may also use the NBI online complaint page for initial reporting. The NBI lists ccd@nbi.gov.ph for its Cybercrime Division on its official divisions directory. An email or online submission may not replace the sworn complaint and personal participation required for a formal investigation.

What to bring

Prepare:

A government-issued ID
A clear incident chronology
Printed and electronic copies of the evidence
The device containing the original messages or files, if requested
Transaction records and communications with banks or e-wallets
Names and contact details of witnesses
Platform report confirmations
Proof of ownership of the genuine account, photograph, business, or contact information
A draft affidavit describing facts within your personal knowledge

Ask for a receiving copy, complaint number, or other acknowledgment. Keep a log of the investigator’s name, office, date, and any additional requirements.

A blotter entry, hotline report, platform report, and formal complaint serve different purposes. Confirm with the receiving office what further document or appearance is necessary if you want the incident investigated for possible prosecution.

Act quickly when money or credit is involved

If the impostor has obtained money, opened an account, sought a loan, or induced someone to transfer funds:

Contact the bank, e-wallet, lender, card issuer, or payment service through its official fraud channel immediately.
Request restrictions, credential resets, card replacement, or transaction tracing as appropriate.
Dispute unauthorized transactions or accounts in writing and keep the ticket number.
Preserve statements, receipts, reference numbers, beneficiary details, and the institution’s responses.
Report the incident to CICC, PNP-ACG, or NBI without waiting for the platform to remove the account.
Tell affected contacts to report their own losses and preserve their direct conversations with the impostor.

Do not promise that funds will be recovered. Recovery depends on factors such as how quickly the institution is notified, whether funds remain traceable, the payment method, and the evidence available.

When a National Privacy Commission complaint may help

The National Privacy Commission handles violations involving personal-data processing and data-subject rights. It is not simply an alternative takedown desk for every anonymous or fake account.

An NPC complaint may be appropriate when a platform, company, lender, employer, agency, or other covered person or organization unlawfully processed, disclosed, retained, or failed to protect your personal data. Coverage, lawful basis, exemptions, the proper respondent, and available evidence must be assessed from the facts.

Under the amended 2021 NPC Rules of Procedure, a complainant ordinarily must first inform the respondent in writing of the claimed privacy violation. The complaint generally will not be given due course if the respondent takes timely and appropriate action, or before the respondent has failed to respond within 15 calendar days after receiving the written notice. Proof of notice should be attached. The NPC may waive this requirement for good cause or a serious violation or breach, including circumstances involving grave and irreparable harm.

A formal complaint generally requires a notarized Complaints-Assisted Form or verified complaint, supporting evidence, and applicable witness affidavits. Follow the NPC’s current complaint mechanics and filing page exactly; an informal email does not necessarily satisfy the requirements for a formal case.

Filing with the NPC does not prevent a separate criminal report when criminal conduct is involved.

Why prompt reporting matters

There is no single platform deadline or complaint period that applies to every identity-theft incident. Criminal prescription and civil filing periods depend on the offense, the dates of commission or discovery, interruptions of the period, and the remedy pursued. Obtain legal advice rather than assuming an old incident can no longer be reported.

Delay can nevertheless make identification much harder. Under Section 13 of the Cybercrime Prevention Act, service providers must preserve specified subscriber and traffic data for a minimum of six months from the transaction date. Content data is preserved for six months from receipt of a law-enforcement preservation order. Law enforcement may order a one-time extension for another six months, and data connected with a filed case must be preserved until the proceedings conclude.

This does not mean a private individual can compel a platform to preserve data by sending an ordinary message. Promptly give the exact account identifiers to investigators so they can determine whether an official preservation order or other legal process is warranted.

Common mistakes to avoid

Reporting the profile before saving its URL, messages, and transaction details
Saving only a cropped screenshot with no username, date, or context
Deleting the conversation, resetting the device, or discarding the SIM before investigators advise what is needed
Treating a platform acknowledgment as a police or prosecutor complaint
Accusing a suspected person publicly without reliable evidence
Paying an unverified “hacker,” “fixer,” or recovery service
Sending an ID through direct messages or unofficial forms
Giving investigators only the displayed profile name, which can be changed
Asking friends to submit fabricated reports
Waiting for platform takedown before notifying a bank or reporting an urgent threat
Forwarding intimate images, especially material involving a child
Assuming that every fake account satisfies the legal elements of identity theft

When help is urgent

Seek immediate assistance when:

There is a credible threat of violence, stalking, kidnapping, or self-harm.
Funds are being transferred or unauthorized transactions are still occurring.
The impostor is collecting passwords, one-time PINs, IDs, or account-recovery codes.
A fake account is contacting children or distributing child sexual-abuse material.
Intimate images are being threatened, sold, or circulated.
Your SIM, email, bank account, e-wallet, government account, or social media account has been taken over.
Loans, contracts, employment records, or official documents are being created in your name.
The impersonation is producing continuing business, professional, or reputational harm.

Call 911 for immediate danger. For urgent financial or cybercrime assistance, contact the affected institution and CICC through 1326, then coordinate with PNP-ACG or NBI as appropriate.

Frequently asked questions

Is using my photograph enough to prove identity theft?

Not necessarily. It is important evidence, but criminal liability depends on the entire act, including intentional and unauthorized use of identifying information through a computer system. The account’s representations, messages, purpose, and resulting harm matter.

Can I report an account if I do not know who created it?

Yes. Report the exact URL, username, dates, messages, payment details, and other identifiers. Do not guess the operator’s identity in your affidavit. State what you personally know and distinguish it from suspicion.

Are screenshots enough for a complaint?

They may support a complaint, but investigators can require original messages, devices, platform records, witness statements, and proof of authenticity. Preserve both screenshots and the underlying electronic material.

Can relatives or friends report the impostor?

They may use any bystander-reporting option offered by the platform. The impersonated person—or an authorized representative—should also submit the platform’s formal impersonation report. Anyone who directly received a scam message or lost money should preserve and report their own evidence.

Will the account be removed immediately?

Not necessarily. Platform review times and outcomes vary. Law-enforcement reporting also does not guarantee immediate takedown, identification, arrest, or recovery. Continue documenting new accounts or renamed profiles.

Should I contact the suspected operator?

Usually, preserve the evidence and seek guidance first. Confrontation can lead to deletion of evidence, escalation, or further harassment. Never threaten, pay, hack, or arrange an entrapment operation on your own.

Can I pursue more than one remedy?

Possibly. A platform report, criminal investigation, NPC complaint, civil claim, and institutional dispute can address different issues. Whether they may proceed together—and against whom—depends on the facts, applicable law, and rules against improper multiple filings.

What if the person operating the account is abroad?

Report it. The Cybercrime Prevention Act contains jurisdiction provisions that can apply when relevant elements, offenders, systems, or damage have a sufficient connection to the Philippines. Cross-border identification and evidence gathering may require cooperation with foreign providers or authorities and can take longer.

General-information notice

This article provides general Philippine legal information, not individualized legal advice. The correct remedy, respondent, offense, deadline, and evidence requirements depend on the actual account, messages, documents, location, harm, and procedural history. For significant financial loss, ongoing threats, intimate material, a child victim, or possible court proceedings, consult a Philippine lawyer promptly.

Official sources and procedures checked as of 3 August 2026.