Quick answer

If someone creates a fake Facebook, Instagram, TikTok, X, messaging, or other online account using your name, photograph, likeness, contact details, or other identifying information without authority, especially to impersonate you, deceive your contacts, solicit money, damage your reputation, or obtain information, do not limit your response to reporting the account to the platform.

In the Philippines, the conduct may amount to computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012. The law covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or entity without right. The Supreme Court has upheld this provision and has identified names, addresses, contact numbers, birth details, occupation, and similar information as examples of identifying information. (Judiciary eLibrary)

The safest practical response is to act on several tracks at once:

Preserve the evidence before the account disappears.
Report the impersonating account to the social-media platform.
Secure your real accounts, email, mobile number, and financial accounts.
Report the incident promptly to the PNP Anti-Cybercrime Group or NBI Cybercrime Division if your identity is actually being misused, particularly if there is fraud, account hacking, threats, extortion, reputational harm, or financial loss.
Consider a complaint with the National Privacy Commission (NPC) when the incident involves unlawful processing or misuse of your personal data or likeness.

These remedies are different. A platform report aims primarily at removing or restricting the fake account. A cybercrime complaint aims at identifying and prosecuting the offender. An NPC complaint concerns violations of data-privacy rights and may lead to privacy-related orders and remedies.

When does a fake account become identity theft?

A social-media account is not automatically criminal merely because it is anonymous, uses a nickname, or contains fictional information.

The important question is whether someone is intentionally using identifying information that belongs to another person without right. Section 4(b)(3) of the Cybercrime Prevention Act specifically punishes computer-related identity theft. (Judiciary eLibrary)

Examples that may justify investigation include an account that:

uses your name and photographs while pretending to be you;
messages your relatives, clients, employees, or friends while representing itself as you;
asks people to send money in your name;
uses your identity to obtain passwords, OTPs, financial information, loans, goods, or services;
publishes statements and makes transactions as though they came from you;
uses identifying information obtained from a hacked account;
creates altered or AI-generated photographs or videos designed to make people believe that you said or did something that you did not; or
combines your photograph, name, employment information, telephone number, address, or other details to create a convincing false identity.

The Supreme Court explained in Disini v. Secretary of Justice that Section 4(b)(3) regulates the unauthorized acquisition or use of another person's identifying data and upheld the provision as constitutional. (Judiciary eLibrary)

There can nevertheless be legitimate uses of names, images, and information. News reporting, commentary, satire, parody, artistic expression, or other legally protected activity may present different issues. Whether a particular account crosses the line into criminal identity theft therefore depends on what information was used, how it was obtained, whether the user had a lawful right to use it, what the account represented to other people, and what harm or intended harm resulted.

A cloned account and a hacked account are legally different

It helps to identify what actually happened.

A cloned or impersonating account is a newly created account that copies your identity. Your genuine account may remain fully under your control.

A hacked or compromised account involves someone gaining unauthorized access to your actual account. In that situation, illegal access under Section 4(a)(1) of the Cybercrime Prevention Act may be investigated in addition to computer-related identity theft. The PNP Anti-Cybercrime Group has publicly documented cases in which an unlawfully accessed Facebook account was then used to impersonate the victim and solicit money from the victim's contacts. (Lawphil)

Tell investigators clearly which situation applies. If both happened—for example, someone hacked your account and later created additional accounts using your identity—document each account separately.

Preserve evidence before reporting or confronting the account

Fake accounts can disappear quickly once the operator realizes that the victim knows about them. Preserve evidence before blocking the account or requesting its removal, whenever doing so is safe.

Save as much of the following as possible:

the complete profile or page URL;
the username or handle;
the profile name as displayed;
the profile or page ID, if visible;
profile and cover photographs;
the account's “About” information;
posts, stories, reels, advertisements, comments, and listings;
direct messages and complete conversation threads;
dates and timestamps;
telephone numbers, email addresses, websites, QR codes, and links used by the account;
bank, e-wallet, cryptocurrency, or payment information supplied by the impersonator;
transaction receipts and reference numbers;
screenshots received by relatives, friends, customers, or other people whom the fake account contacted;
password-reset messages, login alerts, security emails, and notices from the genuine platform account if hacking is suspected;
the platform's acknowledgment or reference number after you report the account; and
evidence of actual consequences, such as lost money, cancelled transactions, damaged business relationships, customer complaints, or people who believed the impersonation.

Take screenshots that show enough surrounding information to establish where the material came from. Whenever possible, preserve the complete original image, video, message, email, or downloaded file rather than keeping only a cropped screenshot.

Electronic records can be used as evidence, but authenticity and reliability may later have to be established. The Supreme Court's Rules on Electronic Evidence recognize electronic documents while requiring proper authentication. Keeping original files, devices, accounts, and contextual information makes that process easier. (Lawphil)

Do not alter screenshots to make them more visually attractive. If you need annotated copies for explanation, keep the untouched originals separately.

Report the account to the social-media platform

Use the platform's dedicated impersonation, fake account, scam, or identity reporting mechanism rather than merely reporting an individual post.

For Facebook, Meta states that profiles and Pages pretending to be another person violate its rules. A user can open the impersonating profile or Page, select the reporting option, and follow the prompts for impersonation. Meta also provides a process for a person who has no Facebook account or has lost access to the account. (Facebook)

Instagram likewise provides an impersonation-reporting procedure. Its current instructions direct users to the impostor's profile, select Report, choose Report account, and indicate that the account is pretending to be someone else. (Facebook)

For other platforms, look specifically for the official impersonation or identity-reporting process. Procedures change, so use the platform's current Help or Safety Center rather than instructions copied from an old post.

Keep the acknowledgment email, ticket number, screenshot, or other proof that you submitted the report.

Do not delete your evidence just because the platform removes the account

Removal is useful, but it can also make evidence harder for the victim to retrieve. The platform may retain information that investigators can lawfully seek, but your own copies remain important.

Report serious impersonation to the PNP Anti-Cybercrime Group

Republic Act No. 10175 expressly designates the Philippine National Police and National Bureau of Investigation as the law-enforcement authorities responsible for cybercrime enforcement. (Lawphil)

The PNP Anti-Cybercrime Group maintains regional and district cybercrime offices nationwide. Its current contact directory lists the Cyber Response Unit at:

Email: complaint@acg.pnp.gov.ph
Mobile: 0968 878 3561
PNP ACG hotline: (02) 8723-0401, local 7490

The PNP ACG also publishes contact details for its Regional Anti-Cybercrime Units and provincial or district cyber-response teams. (PNP ACG)

When reporting, bring or make available your identification, a chronological account of what happened, URLs, screenshots, conversations, payment records, witnesses, and your original electronic evidence.

Be precise. Instead of simply saying “someone made a fake Facebook,” explain:

when you discovered it;
what identifying information was copied;
what the account represented itself to be;
whom it contacted;
what messages were sent;
whether money or information was requested;
whether anyone relied on the impersonation;
whether you suffered financial or reputational harm; and
whether your genuine account, email, or phone was also compromised.

You may also report to the NBI Cybercrime Division

The NBI's Cybercrime Division accepts requests for investigative assistance from victims of computer crimes.

Under the NBI's current Citizens' Charter, a complainant may proceed to the Cybercrime Division, complete a complaint sheet, undergo an initial interview and investigation, and execute a sworn statement or submit a prepared affidavit. Investigators may collect supporting documents and examine a device relevant to the investigation. The NBI lists no fee for this investigative-assistance service. (National Bureau of Investigation)

The NBI also handles complaints through its regional structure for cases outside Metro Manila. (National Bureau of Investigation)

You ordinarily do not need to know the real name of the fake-account operator before seeking investigative assistance. One reason for reporting the matter to cybercrime investigators is precisely that the person behind an account may have to be identified through legally obtainable digital records.

CICC's 1326 hotline is another reporting and assistance channel

The Cybercrime Investigation and Coordinating Center (CICC) operates the 1326 cybercrime hotline and encourages victims of online scams to report promptly. Its official anti-scam guidance also lists report@cicc.gov.ph as a reporting channel. (CICC)

The CICC's statutory role is principally cybercrime coordination, assistance, monitoring, and inter-agency action, while the PNP and NBI are expressly designated by Republic Act No. 10175 as cybercrime law-enforcement authorities. (Lawphil)

For a case in which you want the perpetrator identified and criminally investigated, it is prudent to ensure that the incident reaches the PNP ACG or NBI rather than assuming that removal of the social-media account ends the matter.

Why you should report promptly even if you already have screenshots

Cybercrime investigations may depend on information that victims themselves cannot obtain, including subscriber information, traffic data, account-registration records, IP-related information, and other records held by service providers.

Republic Act No. 10175 requires service providers to preserve the integrity of traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, and law-enforcement authorities may order a one-time six-month extension. Disclosure of protected computer data generally requires the applicable court warrant. (Lawphil)

The Supreme Court has likewise reiterated that disclosure of subscriber, traffic, and relevant computer data for cybercrime investigations is governed by warrant requirements and the Rule on Cybercrime Warrants. (Judiciary eLibrary)

This is one reason delay can matter. A screenshot may prove what you saw, but identifying the person behind an account can depend on records controlled by third parties.

When the National Privacy Commission may also help

Identity impersonation can involve both cybercrime and data privacy.

The Data Privacy Act defines personal information broadly as information from which an individual is identifiable. Processing includes activities such as collection, recording, storage, use, modification, retrieval, and destruction of personal information. Unauthorized processing can carry criminal liability when the requirements of the Act are met. (Judiciary eLibrary)

This does not mean every use of somebody's photograph or every fake social-media account automatically violates the Data Privacy Act. The applicable lawful basis, statutory exclusions, the nature and purpose of the processing, and the particular actor involved all matter.

The NPC has, however, specifically warned that photographs and other social-media content containing personal data can be exploited for identity theft and fraud. In April 2026, it further clarified that the fact that personal information is publicly accessible online does not by itself amount to consent for unrestricted further processing. (National Privacy Commission)

The issue is especially important where artificial intelligence is used. In an August 11, 2026 advisory, the NPC stated that a person's face and likeness are personal information, that creating and publishing AI-generated depictions of an identifiable person constitutes processing of personal data, and that use without a lawful basis may amount to unauthorized processing. The NPC also emphasized that satire, parody, commentary, journalism, and similar protected purposes require a fact-specific analysis. (National Privacy Commission)

A person whose personal data is false, unlawfully obtained, or used for unauthorized purposes may invoke rights under the Data Privacy Act, including appropriate blocking, removal, or destruction. (Judiciary eLibrary)

How to file an NPC complaint

An NPC complaint is a separate process from a criminal complaint with the PNP or NBI.

Under the current 2021 NPC Rules of Procedure, as amended, a complainant ordinarily must first inform the personal information controller, processor, or concerned entity in writing about the alleged privacy violation and give it an opportunity to act. If the entity does not take timely or appropriate action, or does not respond within 15 calendar days from receipt of the written notice, the exhaustion requirement is satisfied. The NPC may waive this requirement for good cause or serious violations involving significant risk of harm.

This 15-day rule concerns the NPC privacy-complaint process. It does not require you to wait 15 days before reporting suspected criminal identity theft to the police or NBI.

The NPC rules require, among other things, a written and verified complaint identifying the complainant and respondent where possible, the material facts, supporting evidence, relief requested, correspondence with the respondent, and a certification against forum shopping. If the respondent's identity is unknown, the rules permit the complainant to state circumstances that may lead to identification.

The NPC currently provides a Complaints-Assisted Form and requires supporting evidence. Its current contact information lists:

complaints@privacy.gov.ph
(02) 5322-1322, locals 114 or 115
0970 818 0555
0905 506 1478
25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City. (National Privacy Commission)

Filing fees may apply under NPC rules, subject to recognized exemptions or waiver. Check the NPC's current Complaints-Assisted Form, Service Request and Assessment Form, Citizens' Charter, and fee schedule before filing.

What penalties can apply to computer-related identity theft?

For offenses under Section 4(b) of the Cybercrime Prevention Act, including computer-related identity theft, Section 8 generally provides for prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both.

Section 4(b)(3) additionally provides that when no damage has yet been caused, the penalty imposable is one degree lower. (Lawphil)

The final charge and penalty cannot be determined merely from the existence of a fake account. Investigators and prosecutors must examine the actual conduct and evidence.

Depending on what the impersonator did, additional offenses may also become relevant. For example, hacking the victim's real account can raise illegal-access issues; obtaining money through deception may raise fraud or estafa issues; threats, extortion, falsified documents, or defamatory publications may implicate other laws. The proper charges depend on the specific acts and should not be assumed from screenshots alone.

If the fake account is asking people for money

Treat the incident as both an identity problem and a possible financial-fraud emergency.

Immediately:

warn the people most likely to be contacted;
post a short notice through your genuine account if doing so will not interfere with an active police operation;
ask victims not to delete conversations;
obtain transaction reference numbers and recipient-account details;
have anyone who transferred money immediately notify the sending bank or e-wallet;
report the recipient account through the financial institution's official fraud channel; and
give the financial records to the cybercrime investigator.

Do not send the impersonator money simply to discover where it goes unless you are acting under instructions from law enforcement. An attempted private “entrapment” can expose you to additional risk and may complicate evidence.

If your real account has also been compromised

Secure the email account first if it controls password recovery for your social-media accounts.

Then:

change the email password and social-media passwords using a trusted device;
use unique passwords rather than reusing the old password;
activate multifactor or two-factor authentication;
sign out unknown devices and active sessions;
review recovery email addresses and telephone numbers;
remove unauthorized third-party apps;
check whether message-forwarding rules or unfamiliar email filters were created;
save all login and security alerts before deleting anything; and
contact your mobile carrier promptly if you suspect SIM replacement, SIM takeover, or loss of control of your phone number.

If the attacker changed your password, email address, or recovery details, use the platform's official compromised-account recovery process rather than links sent to you through messages.

Common mistakes to avoid

Reporting the profile before preserving its URL and contents. Removal may happen quickly, leaving you with little evidence.

Keeping only one screenshot of the profile picture. Investigators need context: URLs, messages, dates, usernames, transactions, witnesses, and evidence of how people were deceived.

Assuming that knowing the offender personally means digital evidence is unnecessary. Attribution still has to be proved.

Publicly accusing a specific person without adequate evidence. A suspicion about who controls an account is not the same as proof. Give the evidence to investigators and distinguish facts from assumptions.

Trying to hack the fake account. Unauthorized access can itself create legal problems and can contaminate evidence.

Paying someone who claims they can reveal the account's IP address. Subscriber and traffic information ordinarily requires lawful investigative processes. Victims generally cannot compel platforms or telecommunications providers to disclose protected subscriber information merely by sending a private request. (Lawphil)

Assuming the platform's removal decision determines criminal liability. It does not. Platform rules and Philippine criminal law are separate.

Waiting for financial loss before reporting. Section 4(b)(3) expressly contemplates situations in which damage has not yet occurred, although that circumstance affects the imposable penalty. (Lawphil)

When legal or law-enforcement help is urgent

Seek immediate assistance when the impersonator is:

actively collecting money from other people in your name;
threatening you or another person;
demanding payment to stop posting information;
distributing intimate or sexual material;
impersonating you in business or professional transactions;
using your identity to open financial accounts or obtain credit;
communicating with children while pretending to be you;
publishing your address or other information that creates a physical-security risk;
using hacked accounts, email, or mobile numbers;
using falsified government identification;
threatening to destroy or delete evidence; or
continuing the activity through new accounts after earlier accounts have been removed.

In such situations, platform reporting alone may be inadequate. Preserve the material and contact a cybercrime law-enforcement unit promptly.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. Lack of a real name does not prevent you from reporting the incident. Provide the account URLs, usernames, communications, telephone numbers, payment details, and every other identifier available. Cybercrime investigators may use appropriate legal processes to seek records needed to identify an account operator.

Is using my Facebook photograph automatically identity theft?

Not necessarily. Criminal liability depends on the circumstances, including whether identifying information belonging to you was intentionally acquired or used without right and the purpose and consequences of that use. But using your photograph together with your name and other details to impersonate you is considerably more serious than merely reposting a photograph and may warrant investigation under Section 4(b)(3).

What if the photograph was publicly available?

Public availability does not automatically authorize every subsequent use. The NPC's 2026 guidance expressly states that publicly available personal data does not by itself amount to consent for unrestricted processing beyond the applicable lawful purpose. (National Privacy Commission)

What if the fake account has already been deleted?

Report it anyway if the incident was serious. Give investigators the evidence you preserved, links, screenshots, messages received by other people, transaction records, and any platform correspondence. Whether useful provider records remain available will depend on the circumstances and applicable retention and preservation rules.

Should I report to Facebook or to the police first?

When possible, preserve the evidence first, then do both. Platform reporting is useful for stopping the impersonation. A PNP or NBI complaint is the appropriate route when identification and criminal investigation of the offender are needed.

Do I have to wait for the social-media company to answer before going to the PNP or NBI?

No. The NPC's ordinary 15-day prior-notice requirement applies to the administrative privacy-complaint process before the NPC, not to filing a cybercrime report with the PNP or NBI.

Can the police simply ask Facebook for the name behind the account?

Certain computer data are protected by legal process. Republic Act No. 10175 and the Rule on Cybercrime Warrants regulate preservation and disclosure of subscriber, traffic, content, and other relevant data. A court warrant is generally required for protected disclosure. (Lawphil)

Can an AI-generated fake photograph or video be reported?

Yes. The NPC's August 11, 2026 advisory expressly recognizes a person's face and likeness as personal information and states that unauthorized creation and dissemination of synthetic media using a real person's likeness can, depending on the circumstances, violate the Data Privacy Act. The affected person may demand removal and may file an NPC complaint. (National Privacy Commission)

Official sources

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice on a particular incident. Whether a fake or impersonating account constitutes computer-related identity theft, a Data Privacy Act violation, fraud, illegal access, or another offense depends on the precise conduct, evidence, purpose, harm, and identity of the persons involved. Procedures and online reporting channels can also change.

Law and official-source check: August 23, 2026.