Quick answer

If someone creates a fake social media account using your name, photos, personal details, business identity, or other identifying information and pretends to be you, preserve the evidence first, report the account to the platform, secure your real accounts, and report the incident promptly to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division if the impersonation is fraudulent, harmful, threatening, or being used to obtain money or information.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. The Supreme Court upheld this provision in Disini v. Secretary of Justice and explained that identifying information commonly includes a person's name, address, contact number, date and place of birth, occupation, spouse's name, and similar information. (Lawphil)

A fake account is not automatically a criminal case merely because it resembles another account. The surrounding facts matter. The case becomes significantly more serious when the account actually passes itself off as you, copies identifying information without authority, messages people in your name, solicits money, damages your reputation, obtains confidential information, or is used to facilitate another crime.

What Philippine law covers

The most directly applicable offense is computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175. The law expressly covers identifying information belonging to either a natural person or a juridical person, such as a corporation. It also contemplates situations where no damage has yet occurred, because the statute provides for a lower imposable penalty when no damage has yet been caused. This means a victim does not necessarily have to wait until somebody loses money before seeking law-enforcement assistance. (Lawphil)

Section 8 of the Cybercrime Prevention Act generally punishes computer-related offenses under Section 4(b) with prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. The precise charge and penalty will depend on the proven acts and circumstances. (Lawphil)

The Supreme Court in Disini specifically sustained the constitutionality of the computer-related identity-theft provision. The Court noted that ordinary identifying information includes such details as a person's name, citizenship, residence address, contact number, place and date of birth, occupation, and similar data. (E-Library)

Other offenses may apply depending on what the impersonator does. Unauthorized takeover of your genuine account may involve illegal access under Republic Act No. 10175. Defamatory statements published through the fake account may raise cyberlibel issues. Using the account to deceive victims into surrendering money may support fraud or estafa-related charges. If financial-account credentials are obtained through deception, Republic Act No. 12010, the Anti-Financial Account Scamming Act, may also apply. That law expressly covers social-media messages and penalizes specified social-engineering schemes involving financial accounts. (Lawphil)

The correct charge should therefore be determined from the actual acts and evidence rather than from the label "fake account" alone.

What to do immediately

Preserve the fake account before trying to have it removed. Take screenshots showing the profile name, username or handle, profile photo, posts, messages, dates, and other identifying details. Copy the complete profile URL and URLs of important posts where possible. Save messages, emails, payment instructions, QR codes, phone numbers, bank or e-wallet details, transaction references, and any communications received by people who were contacted by the impersonator. Avoid cropping away information that establishes where and when the material appeared.
Preserve the original electronic material. Keep the original messages on the device or account where they were received. Export conversations or account data if the platform allows it. Electronic evidence is not automatically excluded simply because it is digital, but authenticity and reliability may later have to be established. Philippine Rules on Electronic Evidence place the burden on the person offering a private electronic document to establish its authenticity. (E-Library)
Report the fake account to the social-media platform. Use the platform's impersonation, fake-account, fraud, or "pretending to be someone" reporting category rather than merely blocking the account. TikTok, for example, provides specific procedures for reporting impersonating accounts both through the app and through an online form. Meta likewise provides reporting and account-recovery mechanisms for impersonation and compromised accounts.
Secure your real accounts immediately. If there is any possibility that your actual account or email was compromised, change passwords, sign out unfamiliar sessions, enable multi-factor authentication, review recovery email addresses and phone numbers, and secure the email account connected to your social-media profiles. If your real Facebook account has been hacked rather than merely copied, Meta has a separate hacked-account recovery process. (Facebook)
Report serious impersonation to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Republic Act No. 10175 expressly designates the PNP and NBI as the principal law-enforcement authorities responsible for enforcing the Cybercrime Prevention Act. The PNP Anti-Cybercrime Group currently lists a Cyber Response Unit and regional cybercrime units, while the NBI Citizen's Charter provides a formal process for victims of computer crimes to seek investigative assistance from its Cybercrime Division and regional centers. (Lawphil)
If money, bank credentials, or an e-wallet is involved, contact the financial institution immediately. Do not wait for the police investigation before reporting an unauthorized or suspicious financial transaction to your bank or payment provider. Under the Anti-Financial Account Scamming Act, a complaint concerning a disputed transaction can trigger coordinated verification by the financial institutions and account owners involved. (Lawphil)
Consider a National Privacy Commission complaint when the facts involve unlawful processing of your personal data. The Data Privacy Act may provide an additional remedy where personal information is unlawfully processed by a person or entity covered by the law. This route is separate from a criminal complaint for identity theft and is not automatically applicable to every fake profile. (Lawphil)

Where to report the crime

PNP Anti-Cybercrime Group

The PNP Anti-Cybercrime Group is one of the agencies specifically designated by Republic Act No. 10175 to investigate cybercrime. Its official contact page currently lists its Cyber Response Unit at complaint@acg.pnp.gov.ph, with contact number 0968-878-3561, as well as regional and provincial cybercrime units throughout the country. Because contact information can change, check the official PNP ACG page before filing. (PNP ACG)

A report is especially appropriate when the fake account is soliciting money, threatening people, communicating with clients or relatives in your name, publishing harmful material, or attempting to obtain passwords, OTPs, identification documents, or financial information.

NBI Cybercrime Division

The NBI's current Citizen's Charter states that members of the public may seek investigative assistance for computer crimes through the Cybercrime Division. The initial process includes filing a complaint or request for investigation, a preliminary interview, execution of a sworn complaint sheet or statement, and submission of supporting documents or relevant devices when necessary. The Citizen's Charter lists no fee for this investigative-assistance process and also recognizes regional cybercrime centers. (National Bureau of Investigation)

The NBI's official divisions directory identifies its Cybercrime Division and presently lists ccd@nbi.gov.ph as its contact email. (National Bureau of Investigation)

Cybercrime Investigation and Coordinating Center

The Cybercrime Investigation and Coordinating Center, or CICC, coordinates cybercrime-prevention and investigation efforts among government agencies. Its official anti-scam materials presently direct victims to Hotline 1326 and report@cicc.gov.ph, together with published mobile contact numbers. The CICC can be an additional reporting and coordination channel, but the NBI and PNP remain the law-enforcement agencies expressly charged under Republic Act No. 10175 with enforcing the Cybercrime Prevention Act. (CICC)

What evidence should you preserve?

The goal is to show both what the fake account did and why it can reasonably be connected to an identifiable user or transaction.

Keep the fake profile's complete URL, username, display name, account or profile ID if visible, screenshots, copied photographs, posts, comments, messages, call records, emails, payment demands, recipient bank or e-wallet information, transaction receipts, phone numbers, and names of people contacted by the impersonator.

Ask recipients of fraudulent messages to preserve their own original conversations rather than merely forwarding screenshots to you. Their testimony and devices may help establish what was actually received.

Keep a simple timeline recording when you first discovered the account, when each fraudulent message was sent, when you reported it to the platform, when it was removed or changed, and whether anyone suffered financial or reputational harm.

Do not alter the original screenshots or electronic files. If you need to highlight something for convenience, keep the untouched original separately. The Supreme Court has emphasized that screenshots and other electronic evidence remain subject to authentication requirements. (E-Library)

Why you should report quickly even if you already have screenshots

Screenshots can document what appeared on your screen, but law enforcement may need subscriber information, traffic information, account-registration data, IP-related records, payment information, or other records held by service providers.

Section 13 of Republic Act No. 10175 requires preservation of traffic data and subscriber information for a minimum of six months from the transaction and permits law-enforcement authorities to order preservation of content data for six months, with a possible one-time six-month extension. Section 14 permits disclosure of specified computer data pursuant to a court warrant in connection with a valid complaint that has been officially docketed for investigation. (E-Library)

The Supreme Court's Rule on Cybercrime Warrants also provides for a Warrant to Disclose Computer Data, which can authorize law-enforcement authorities to require a person or service provider to disclose subscriber information, traffic data, or other relevant computer data. (E-Library)

This is one reason prompt reporting matters. A victim ordinarily cannot compel a foreign social-media company to reveal an anonymous user's subscriber information merely by sending a private demand. Law enforcement can use the procedures established by the Cybercrime Prevention Act and the Rule on Cybercrime Warrants when the legal requirements are satisfied.

What if you do not know who created the fake account?

You can still report it.

Do not assume that you must first identify the person behind the account yourself. Give investigators whatever digital identifiers you have: the account URL, username, profile ID, email address, phone number, payment account, messages, timestamps, and related accounts.

The Rule on Cybercrime Warrants recognizes that information identifying the relevant individuals or entities may be provided if available, and a properly supported investigation can use disclosure procedures to seek records from service providers. (E-Library)

Avoid attempting to hack, trace, access, or take over the suspect's account yourself. Apart from potentially violating the law, doing so can alter evidence and complicate the investigation.

When the National Privacy Commission may help

Identity theft and data privacy overlap, but they are not identical.

Republic Act No. 10173, the Data Privacy Act, regulates the processing of personal information and gives data subjects rights concerning unauthorized or unlawful use of their information. Unauthorized processing and processing for unauthorized purposes are among the acts penalized by the statute, subject to the law's coverage, exceptions, and particular facts. (Lawphil)

If you intend to file a formal complaint with the National Privacy Commission, its 2021 Rules of Procedure, as amended, generally require the complainant first to notify the personal information controller, processor, or concerned entity in writing and give it an opportunity to address the violation. Ordinarily, the requirement is satisfied when no timely or appropriate action is taken or there is no response within 15 calendar days from receipt of the written notice. The NPC may waive exhaustion requirements for good cause or in serious cases involving sufficient risk of harm, including circumstances involving grave and irreparable damage.

The NPC's current complaint guidance calls for a notarized complaint-assisted form or verified complaint, together with evidence and witness affidavits where applicable. (National Privacy Commission)

A privacy complaint does not replace a police or NBI report when criminal identity theft, fraud, hacking, extortion, or another crime is involved.

If the fake account is asking people for money

Warn likely targets promptly, but preserve the account and messages first. If someone has already transferred funds, obtain the transaction reference, recipient account or e-wallet number, amount, date and time, screenshots of the demand, and the recipient institution's response.

Contact the bank, e-wallet, or payment provider immediately and characterize the transaction accurately as disputed or fraudulent. Republic Act No. 12010 specifically addresses financial-account scams, including social-engineering schemes carried out through electronic communications such as social-media messages. It also provides mechanisms for coordinated verification of disputed transactions. (Lawphil)

Then report the incident to the PNP ACG or NBI and provide the financial details. Those details can be valuable investigative leads even when the social-media account itself uses a false name.

If the fake account is attacking your reputation

Preserve the exact statements, complete posts, comments, URLs, publication dates, and evidence showing who could see them.

A fake account's use of your identity and its defamatory content can involve different legal issues. Computer-related identity theft concerns unauthorized use of identifying information. Cyberlibel concerns defamatory publication through a computer system. In Disini, the Supreme Court upheld the cyberlibel provision with respect to the original author of the offending post but invalidated its application to persons who merely received and reacted to the post under the provisions challenged there. (E-Library)

Avoid retaliating by publicly accusing a particular person unless you have a sufficient factual and legal basis. A mistaken public accusation can create a separate dispute.

Common mistakes that can weaken a complaint

One common mistake is getting the fake account deleted before recording its username, URLs, messages, and payment details. Another is keeping only cropped screenshots with no visible account information or context.

Do not delete conversations after reporting the account. Do not reset or dispose of a device containing important evidence until you have preserved the relevant material. Do not impersonate the offender, hack back, or manufacture conversations in an effort to obtain proof.

Another mistake is assuming that a report to Facebook, TikTok, Instagram, or another platform automatically starts a Philippine criminal investigation. Platform moderation and criminal investigation are different processes. If the conduct appears criminal, report it separately to law enforcement.

Conversely, a police or NBI complaint does not necessarily cause the social-media platform to remove the account immediately. Use both channels when appropriate.

When legal or law-enforcement help is urgent

Seek immediate assistance when the impersonator is actively obtaining money, using your bank or e-wallet credentials, threatening violence, blackmailing you, publishing or threatening to publish intimate material, contacting customers or employers in your name, impersonating a business or public office, targeting children, or repeatedly creating new accounts after previous accounts are removed.

Urgency is also justified if you believe your actual email, social-media account, SIM, bank account, or cloud storage has been compromised. In those situations, account security and preservation of digital evidence should happen alongside reporting rather than waiting for one process to finish before starting another.

Frequently asked questions

Is using my photo on a fake Facebook account automatically identity theft?

Not necessarily. The complete facts matter. Section 4(b)(3) requires intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. A profile that actually impersonates you, communicates as you, combines your photograph with your name and details, or uses your identity to mislead others presents a much stronger identity-theft issue than mere similarity or an isolated use whose circumstances show no impersonation. (Lawphil)

Do I need to suffer financial loss before reporting?

No. The Cybercrime Prevention Act expressly contemplates computer-related identity theft where no damage has yet been caused and provides for a lower imposable penalty in that situation. You may report the conduct before somebody loses money. (Lawphil)

Can I report an anonymous fake account?

Yes. Preserve every available identifier and allow investigators to determine whether subscriber, traffic, financial, or other records can lawfully be obtained. Cybercrime warrants provide mechanisms through which law-enforcement authorities can seek disclosure of relevant computer data when the legal requirements are met. (E-Library)

What if the person operating the account is abroad?

Philippine jurisdiction may still exist in appropriate cases. Section 21 of Republic Act No. 10175 provides jurisdiction where, among other circumstances, an element of the offense was committed in the Philippines or the cybercrime caused damage to a natural or juridical person who was in the Philippines when the offense occurred. The law also provides mechanisms for international cooperation. (Lawphil)

Should I report to the PNP or the NBI?

Either may investigate cybercrime. Republic Act No. 10175 expressly assigns cybercrime law enforcement to both agencies. In practice, you may approach the PNP Anti-Cybercrime Group or the NBI Cybercrime Division depending on accessibility and the nature of the case. (Lawphil)

Should I report the account to the platform before going to the police?

Normally, preserve the evidence first and then do both promptly. If there is an immediate threat, extortion attempt, account takeover, or ongoing financial fraud, contact law enforcement and the affected bank or payment provider immediately rather than waiting for the platform to complete its review.

Are screenshots enough?

They are useful and should be preserved, but do not rely on screenshots alone when more evidence is available. Preserve the original messages, URLs, electronic files, account identifiers, and devices because electronic evidence may ultimately have to be authenticated as genuine and reliable. (E-Library)

Official sources

Cybercrime Prevention Act of 2012, Republic Act No. 10175: Official text on Lawphil

Supreme Court, Disini v. Secretary of Justice, G.R. No. 203335, February 11, 2014: Supreme Court E-Library decision

PNP Anti-Cybercrime Group contact information: PNP ACG official contact page

NBI investigative assistance for victims of computer crimes: NBI Cybercrime Division Citizen's Charter

National Privacy Commission complaint procedure: NPC Mechanics for Complaints

Data Privacy Act of 2012, Republic Act No. 10173: Official text on Lawphil

Anti-Financial Account Scamming Act, Republic Act No. 12010: Official text on Lawphil

TikTok impersonation reporting guidance: TikTok official support page

General-information disclaimer

This article provides general legal information about Philippine law and is not a substitute for advice based on the particular facts, digital evidence, identities of the parties, platform involved, or related financial transactions. Criminal charges, jurisdiction, evidentiary requirements, and available remedies can differ substantially depending on what the fake account actually did. Sources and official procedures were checked as of August 25, 2026.