How to Report Identity Theft and Fake Social Media Accounts

Quick answer

If someone creates a social media account using your name, photographs, personal details, business identity, or other identifying information without authority, preserve the evidence first, report the account to the platform, secure your real accounts, and report the incident to Philippine cybercrime authorities if the impersonation involves identity theft, fraud, hacking, threats, harassment, or another unlawful purpose.

Philippine law expressly punishes computer-related identity theft. Section 4(b)(3) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175) covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or juridical entity's identifying information without right. The Supreme Court has upheld this provision and explained that identifying information ordinarily includes such information as a person's name, address, contact details, birth information, occupation, and similar data. (Lawphil)

A fake account is not automatically a criminal case merely because it uses a fictitious name or resembles someone else. The facts matter. A parody, fan page, duplicate name, or anonymous account is different from an account deliberately using another person's identity without right. Criminal exposure becomes much more serious when the account copies your identity, pretends to be you, contacts other people as you, solicits money, obtains confidential information, harms your reputation, or is connected with unauthorized access to your real account.

If the impersonator has already obtained money, taken over an account, threatened someone, contacted your clients or employer, or is continuing to victimize other people, report immediately rather than waiting for the platform to act.

When a fake social media account can amount to identity theft

The Cybercrime Prevention Act defines computer-related identity theft broadly. It covers the intentional acquisition or use of identifying information belonging to another natural or juridical person without right. The law therefore protects both individuals and entities such as corporations or organizations. (Lawphil)

Examples that may warrant investigation include an account that:

  • uses your real name and photograph while pretending to be you;
  • copies your professional profile and contacts your clients or customers;
  • impersonates your business and provides false payment instructions;
  • messages your relatives or friends asking them to send money;
  • uses copies of your government IDs or personal records;
  • creates fake conversations or documents in your name;
  • takes over your legitimate account and posts or sends messages as you; or
  • combines your name, photographs, contact information, employment details, or other identifying data to make the false identity believable.

The exact offense depends on what happened. Unauthorized entry into your genuine account may constitute illegal access under Section 4(a)(1). Manipulation of data may implicate data interference. Fraudulent manipulation of computer data may potentially constitute computer-related fraud or forgery. Other offenses under the Revised Penal Code or special laws may also apply when committed through information and communications technology. (Lawphil)

For computer-related identity theft and the other offenses under Sections 4(a) and 4(b), Section 8 of RA 10175 generally prescribes prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. For identity theft, the statute provides for a penalty one degree lower when no damage has yet been caused. Actual charges and penalties still depend on the offense proven and the circumstances of the case. (Lawphil)

What to do as soon as you discover the fake account

1. Preserve the evidence before the account disappears

Do this before blocking the impersonator or asking everyone to mass-report the account, unless immediate account security requires faster action.

Save:

  • screenshots showing the entire profile or page;
  • the exact username and display name;
  • the full profile or page URL;
  • screenshots of the account's photographs, bio, contact information, posts, stories, advertisements, and other content;
  • messages sent by the account;
  • comments from people who were contacted or deceived;
  • dates and approximate times when you discovered the account or received messages;
  • screenshots showing that your photographs or information were copied from your genuine account;
  • payment instructions, QR codes, bank or e-wallet details, telephone numbers, email addresses, and links supplied by the impersonator;
  • transaction receipts if money was sent;
  • emails or notifications from the social media platform; and
  • your own genuine profile showing the information that was copied.

A screen recording that begins with the fake account's profile and moves through the relevant posts or conversations can provide useful context in addition to screenshots.

Keep the original electronic files. Do not merely paste everything into a Word document or repeatedly edit, crop, annotate, or compress the only copies you have. Investigators may eventually need the original device, messages, files, URLs, timestamps, or other digital information.

2. Secure your real accounts

Even when the offender created a separate fake profile rather than hacking your genuine account, check whether your credentials may also have been compromised.

Prioritize the email account used for password recovery, then:

  • change compromised or reused passwords;
  • use a different strong password for each important account;
  • review logged-in devices and terminate unfamiliar sessions;
  • check whether the recovery email address or telephone number was changed;
  • enable two-factor authentication;
  • remove unknown connected applications;
  • review recent posts, messages, advertisements, payment settings, and administrative roles; and
  • secure associated business pages and advertising accounts.

If your genuine Facebook account was taken over, Meta directs users to its hacked-account recovery process, preferably from a device previously used to access the account. (Facebook)

3. Report the impersonating account to the social media platform

Use the platform's impersonation, fake-account, harassment, scam, or account-security reporting mechanism, whichever best describes what occurred.

For Meta services, impersonation is expressly prohibited in relevant reporting channels; for example, Messenger provides a report category for an account pretending to be another person. Facebook also provides reporting and account-recovery resources through its Help Center. (Facebook)

When reporting:

  1. identify your genuine account;
  2. identify the impersonating account;
  3. select impersonation or pretending to be another person when that option is available;
  4. provide identification only through the platform's official submission process if requested; and
  5. save the report confirmation, ticket, reference number, email, or screenshot of the submission.

Platform removal and a criminal complaint are separate remedies. A platform may remove an account without identifying or prosecuting its operator, while law-enforcement investigation does not guarantee immediate platform removal. When the conduct is serious, pursue both tracks.

How to report identity theft to Philippine authorities

PNP Anti-Cybercrime Group

RA 10175 specifically designates the Philippine National Police and National Bureau of Investigation as the principal law-enforcement authorities responsible for enforcing the Cybercrime Prevention Act. (Lawphil)

The PNP Anti-Cybercrime Group publishes contact information for its Cyber Response Unit and its regional, provincial, and district cybercrime offices. As currently listed by PNP ACG, the Cyber Response Unit may be contacted through complaint@acg.pnp.gov.ph, and the ACG website maintains updated contact details for offices around the country. (PNP ACG)

Bring or make available:

  • a valid identification document;
  • your evidence folder;
  • URLs and usernames;
  • relevant devices;
  • a chronological narration of events;
  • details of witnesses or persons contacted by the impersonator; and
  • financial records if money was involved.

You do not need to know the offender's true name before asking authorities to investigate. Give investigators everything that may help identify the account operator.

NBI Cybercrime Division

You may alternatively seek investigative assistance from the NBI Cybercrime Division or an appropriate NBI regional cybercrime office.

The NBI's current Citizen's Charter states that investigative assistance for victims of computer crimes is available to the general public. A complainant proceeds to the Cybercrime Division, completes a complaint sheet, undergoes a preliminary interview, and may execute a sworn statement or submit a prepared affidavit and relevant supporting documents. The NBI may also examine a device relevant to the investigation. The listed service has no fee. (National Bureau of Investigation)

The NBI currently identifies its Cybercrime Division on its official website and publishes its divisional contact information. (National Bureau of Investigation)

CICC Cybercrime Hotline 1326

The Cybercrime Investigation and Coordinating Center (CICC) also receives reports and coordinates cybercrime response. Its current public anti-scam guidance tells victims to report online scams immediately through Hotline 1326 and lists report@cicc.gov.ph as a reporting email. (CICC)

CICC is particularly useful as a cybercrime reporting and coordination channel, but RA 10175 specifically assigns law-enforcement responsibility to the NBI and PNP. For a case requiring criminal investigation, preservation of platform records, identification of a suspect, or an arrest, involvement of the appropriate law-enforcement unit is important. (Lawphil)

Why reporting quickly matters even if you already have screenshots

Screenshots are useful, but they may not contain everything needed to identify the person operating an account.

A service provider may possess information such as subscriber records, traffic information, and other computer data. RA 10175 provides procedures through which authorized law-enforcement officers can seek preservation and, where required, obtain court authority for disclosure or examination of computer data. The law generally requires preservation of subscriber information and traffic data relating to communication services for at least six months from the transaction, while content data may be preserved following a lawful preservation order. A one-time extension may also be ordered in circumstances authorized by law. (Lawphil)

This does not mean that every social media platform necessarily retains every item you need for six months or that a private complainant can demand disclosure directly. The important practical point is to report promptly so investigators can determine whether preservation or a cybercrime warrant is appropriate before potentially useful records disappear.

The Supreme Court's Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, establishes specialized procedures for lawful preservation, disclosure, search, seizure, and examination of computer data during cybercrime investigations. (E-Library)

If the fake account has scammed someone out of money

Act immediately.

The person who transferred money should:

  1. contact the bank, e-wallet, card issuer, or other payment provider at once;
  2. report the transaction as fraudulent through the provider's official fraud channel;
  3. obtain and preserve the case or reference number;
  4. save the transfer receipt and recipient-account information;
  5. preserve the messages that induced the payment; and
  6. report the incident to cybercrime authorities.

Do not assume that deleting a transfer receipt or conversation after reporting it will help. Preserve it.

Identity theft may exist alongside other possible offenses, including computer-related fraud or offenses under other penal statutes, depending on how the deception was carried out. RA 10175 expressly allows liability under other applicable laws. (Lawphil)

Whether funds can still be frozen or recovered depends on facts including the payment method, elapsed time, movement of the funds, available account information, and lawful action by the financial institution or authorities. No one should promise recovery simply because a report has been filed.

If the impersonator obtained your information from a data breach

There may be a separate Data Privacy Act issue when personal data were unlawfully obtained, processed, disclosed, or exposed.

Republic Act No. 10173 penalizes several forms of unlawful handling of personal information, including unauthorized processing and certain forms of unauthorized access or disclosure. The precise provision depends on who processed the information, what data were involved, how they were obtained, and whether the Data Privacy Act applies to the particular processing activity. (National Privacy Commission)

The National Privacy Commission has also reminded the public that unauthorized access, use, disclosure, sharing, or further dissemination of another person's personal data may create civil, administrative, or criminal liability under the Data Privacy Act and other laws. (National Privacy Commission)

An NPC complaint is not a substitute for a PNP or NBI cybercrime complaint. The NPC route is appropriate when the facts involve a privacy violation or personal-data breach falling within its jurisdiction.

Under the NPC's rules, a complainant generally should first give the respondent an opportunity to address the privacy concern, subject to recognized exceptions, including circumstances involving sufficiently serious violations or where an adequate remedy is unavailable. A formal complaint must contain the required factual allegations and supporting evidence. (National Privacy Commission)

The NPC's current Citizen's Charter allows submission of complaints and supporting documents through complaints@privacy.gov.ph or in person, subject to its current procedural and filing requirements.

What evidence should you preserve?

Create one folder containing, as applicable:

  • your genuine profile URL;
  • the fake account's URL and username;
  • screenshots and screen recordings;
  • original photographs being misused;
  • messages sent by the fake account;
  • names and contact details of recipients;
  • platform reporting confirmations;
  • email and SMS security alerts;
  • login-history screenshots;
  • password-reset notifications;
  • suspicious IP or device information displayed by the platform;
  • telephone numbers used by the offender;
  • email addresses;
  • bank and e-wallet account details;
  • QR codes;
  • transaction records;
  • advertisements placed by the fake account;
  • copies of false documents or IDs circulated in your name;
  • threats or demands;
  • records showing harm to your employment, business, clients, or reputation; and
  • a simple chronology identifying what happened and when.

For important evidence, retain an untouched copy. If you prepare annotated screenshots for easier explanation, keep the original files separately.

Common mistakes to avoid

Confronting the offender before preserving evidence

A warning may cause the offender to delete the account, change usernames, erase conversations, or move funds.

Preserve first. If police are considering an entrapment or other investigative measure, follow their instructions rather than conducting your own operation.

Asking everyone to mass-report immediately

Community reporting may help remove an impersonating account, but removal can also make publicly accessible evidence disappear. Capture the evidence and URLs first whenever circumstances permit.

Assuming a barangay blotter alone starts a cybercrime investigation

A barangay or ordinary police record may document that you made a report, but serious online identity-theft cases should be brought to the proper cybercrime investigators, particularly the PNP Anti-Cybercrime Group or NBI.

Posting the suspect's personal information online

Do not respond to identity theft by doxxing, threatening, hacking, or publicly accusing someone based only on suspicion. Preserve what you know and give it to investigators.

Paying the impersonator to delete the account

Payment does not guarantee deletion and may invite further demands. If there is extortion or a demand for money, preserve the communication and seek law-enforcement assistance.

Treating platform removal as the end of the matter

If people lost money, accounts were hacked, threats were made, confidential information was obtained, or the offender may create another account, consider pursuing the formal complaint even after the profile is removed.

When legal or law-enforcement help is urgent

Seek immediate assistance when:

  • the fake account is actively asking people for money;
  • your bank, e-wallet, or email account has also been compromised;
  • the offender has obtained government IDs, financial credentials, passwords, or OTPs;
  • threats of violence, kidnapping, extortion, or sexual exploitation are involved;
  • intimate images are being threatened or circulated;
  • a child's identity or images are being exploited;
  • the account is impersonating a business to divert customer payments;
  • the offender appears to know confidential information not publicly available;
  • substantial funds have already been transferred;
  • the account is rapidly contacting many victims; or
  • you believe digital records may soon be deleted.

If there is an immediate threat to physical safety, contact the police or appropriate emergency authorities instead of relying only on a social media report.

Frequently asked questions

Is using my photo on a fake Facebook account automatically identity theft?

Not necessarily. Context and intent matter. But using your identifying information without right while pretending to be you may fall within Section 4(b)(3) of RA 10175, particularly when the account is designed to pass itself off as you or cause harm. (Lawphil)

Do I need to know who created the fake account before reporting it?

No. Report the account, URLs, usernames, messages, payment details, phone numbers, and every other available identifier. Identifying an unknown account operator is one reason formal cybercrime investigation may be necessary.

Should I report to both PNP ACG and NBI?

You may seek assistance from either. Both the PNP and NBI are designated cybercrime law-enforcement authorities under RA 10175. Avoid creating unnecessary duplicate complaints without informing investigators if the same incident is already being actively handled elsewhere. (Lawphil)

Can I have the fake account removed without filing a criminal case?

Possibly. Social media platforms have their own impersonation and abuse-reporting procedures. Removal under platform rules is separate from criminal liability.

What if my real account was hacked rather than copied?

Report the takeover through the platform's recovery system immediately, secure your connected email and other accounts, and preserve security notifications. Unauthorized access to a computer system is itself an offense expressly covered by RA 10175. (Lawphil)

What if the fake account has already been deleted?

You may still report the incident. Preserve whatever screenshots, messages, emails, URLs, transaction records, and witness information remain. Whether additional platform information can still be obtained will depend on available records and the lawful investigative process.

Can the social media company simply give me the offender's identity?

Ordinarily, a private complainant should not assume that a platform will disclose another user's subscriber or account records on request. Philippine cybercrime law and the Rule on Cybercrime Warrants establish lawful mechanisms through which investigators may seek relevant computer data when the requirements are satisfied. (Lawphil)

Should I file with the National Privacy Commission too?

Consider an NPC complaint when the incident involves a genuine Data Privacy Act issue—for example, unlawful processing or disclosure of your protected personal data by a person or entity subject to the law. It is a separate remedy and does not replace reporting a suspected cybercrime to the PNP or NBI. (National Privacy Commission)

Official sources and reporting channels

This article provides general Philippine legal information and is not a substitute for advice based on the specific evidence and circumstances of a particular case. Cybercrime classifications can overlap, and the proper complaint, respondents, venue, evidence, and remedies may depend on facts that are not apparent from a social media profile alone. Laws, agency procedures, contact details, and platform reporting systems were checked against official or primary sources as of August 25, 2026.

Disclaimer: This content is not legal advice and may involve AI assistance. Information may be inaccurate.

Privacy Policy

Terms of Use

Lawyer Login

 
 
Privacy Policy         Terms of Use         Lawyer Login