Quick answer
If someone creates a social media account that uses your name, photos, personal details, business identity, or other identifying information to impersonate you, preserve the evidence first, report the account to the social media platform, and report the incident to Philippine cybercrime authorities if the impersonation appears deliberate, fraudulent, harmful, threatening, or otherwise unlawful.
Under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or juridical entity's identifying information, without right. The Supreme Court upheld this provision in Disini v. Secretary of Justice and explained that the law is directed at identity information used for an illegitimate purpose. (Lawphil)
Not every anonymous, fictional, parody, fan, or "fake" account is automatically a criminal case. The important questions are whose identity is being used, whether the use is authorized, how the account presents itself, what the operator is doing with the identity, and whether the circumstances show an illegitimate purpose. A platform may also remove an account for impersonation even when the facts are insufficient to establish a Philippine criminal offense.
For an actual cybercrime investigation, the principal statutory law-enforcement authorities under RA 10175 are the Philippine National Police (PNP) and the National Bureau of Investigation (NBI). Complaints may also be reported through the Cybercrime Investigation and Coordinating Center (CICC), including Hotline 1326 and its cybercrime reporting channels. (Lawphil)
When a fake social media account may amount to identity theft
Section 4(b)(3) of RA 10175 covers identifying information belonging to either a natural person or a juridical person, such as a corporation or organization. The Supreme Court has identified ordinary identifying information as including a person's name, citizenship, residence address, contact number, place and date of birth, spouse's name, occupation, and similar information. (Lawphil)
A typical impersonation case may involve an account that uses another person's name and photograph, represents itself to friends or customers as that person, sends messages in the person's name, solicits money or information, makes transactions, damages the person's reputation, or otherwise uses the assumed identity for an illegitimate purpose.
The Supreme Court's ruling in Disini is important because it prevents the identity-theft provision from being read too broadly. The Court explained that simply obtaining and disseminating information that a person has publicly made available cannot, by itself, be regarded as identity theft. It emphasized that the theft or misuse of identity information must involve an illegitimate purpose. (Lawphil)
That does not mean that anything posted publicly becomes free for deceptive impersonation. Copying a publicly visible photograph is different from using the photograph, name, employment details, or other identifying information to create an account falsely representing that it belongs to the victim. Whether that conduct satisfies Section 4(b)(3) depends on the complete facts and evidence.
A fake account can also involve offenses other than identity theft. For example, the operator may use the account to commit fraud, make threats, publish defamatory accusations, obtain banking credentials, extort the victim, distribute intimate material, or commit another offense through information and communications technology. RA 10175 also provides that crimes under the Revised Penal Code and special laws committed through ICT may fall within its Section 6 framework. (Lawphil)
What to do as soon as you discover the fake account
Preserve the account before trying to have it removed. Take clear screenshots showing the profile name, username or handle, profile photograph, biography, posts, messages, comments, dates, and other identifying details. Copy the complete profile URL and the URLs of important posts. If possible, make a screen recording showing how you reached the account and the relevant content. Keep the original digital files rather than relying only on screenshots forwarded through messaging applications.
Preserve communications and transaction records. Save direct messages, emails, text messages, call logs, payment requests, bank or e-wallet details, receipts, QR codes, telephone numbers, account numbers, links, and any message sent by people who were contacted by the impersonator. Ask witnesses to retain their own copies.
Secure your real accounts. If there is any possibility that your legitimate account or email was compromised, change the password using a trusted device, enable multi-factor authentication, review logged-in devices and active sessions, check recovery email addresses and telephone numbers, and secure the email account connected to your social media profiles.
Report the impersonating profile to the social media platform. Select the platform's impersonation or "pretending to be someone" category where available. Preserve your evidence before doing this because a successful report may cause the profile or content to disappear. Facebook expressly allows reports against profiles or Pages impersonating another person, while TikTok and X maintain specific impersonation-reporting procedures. (Facebook)
Report serious cases to Philippine cybercrime authorities promptly. Give investigators the URLs, screenshots, narrative of events, dates, witnesses, transaction records, and any information supporting the identity of a suspected operator. Clearly distinguish what you personally know from what you merely suspect. If you already know the suspected offender, explain why and provide supporting evidence rather than simply naming the person.
If money, bank credentials, an e-wallet, or a financial account is involved, contact the financial institution immediately. Do not wait for the social media account to be removed. The Anti-Financial Account Scamming Act, RA 12010, specifically addresses social-engineering schemes involving sensitive identifying information and financial accounts and provides mechanisms concerning disputed transactions and temporary holding of funds.
Reporting through the CICC
The CICC provides a national cybercrime-reporting channel. Current government guidance identifies Hotline 1326 and the CICC reporting page as channels for cybercrime complaints. Government guidance has also directed users of the eGovPH application's eReport feature to submit the suspicious link together with a short narrative. (CHED)
For an impersonating account, provide the actual profile or content link whenever possible. A screenshot is useful evidence, but a live URL may allow authorities to examine the account and preserve information associated with it before it disappears.
The CICC's anti-scam materials also publish report@cicc.gov.ph and Hotline 1326 as reporting channels. (CICC)
Filing with the PNP Anti-Cybercrime Group
The PNP Anti-Cybercrime Group maintains a Cyber Response Unit and regional or provincial cybercrime units around the country. Its current official contact directory lists the Cyber Response Unit through (02) 8723-0401 local 7490, mobile 0968-878-3561, and complaint@acg.pnp.gov.ph. The same directory identifies regional Anti-Cybercrime Units and local Cyber Response Teams throughout the Philippines. (PNP ACG)
A victim does not need to know the real identity of the fake-account operator before reporting. Identifying an unknown account operator is one of the reasons a formal cybercrime investigation may be necessary.
Filing with the NBI Cybercrime Division
The NBI's current Citizen's Charter expressly provides investigative assistance to victims of computer crimes through its Cybercrime Division. The service is available to the general public and has no filing fee stated in the Charter. The process includes filing a complaint sheet, undergoing an initial interview, executing sworn statements or submitting prepared affidavits, and supplying relevant supporting documents or devices. Regional Cybercrime Centers may handle appropriate provincial cases. (National Bureau of Investigation)
The NBI currently lists its Cybercrime Division at the NBI Building, Taft Avenue, Ermita, Manila, with trunkline (02) 8523-8231 to 38, local 3455, and email ccd@nbi.gov.ph. (National Bureau of Investigation)
You may bring a prepared affidavit, although the NBI's published procedure does not make a pre-drafted affidavit a prerequisite to initially seeking assistance. Its Citizen's Charter states that complainants may execute sworn statements during the investigative process. (National Bureau of Investigation)
Why reporting quickly matters
Digital evidence can disappear rapidly. The impersonator may delete the account, change the username, erase conversations, replace photographs, or move to another platform.
RA 10175 contains mechanisms allowing law-enforcement authorities to require preservation of certain computer data. It also provides, subject to the required judicial process, for disclosure of subscriber information, traffic data, and other relevant computer data. Section 14 requires a court warrant for disclosure and contemplates a valid complaint that has been officially docketed and assigned for investigation. (Lawphil)
This is one reason a police or NBI complaint can serve a different purpose from merely pressing "Report" on Facebook, TikTok, Instagram, X, or another platform. Platform reporting is primarily aimed at platform enforcement and removal; a criminal complaint is aimed at investigation, attribution, evidence gathering, and possible prosecution.
Neither process guarantees that the offender will immediately be identified. Providers may possess different amounts of subscriber, device, connection, or account information, and investigators must comply with constitutional and procedural requirements when seeking protected data. The Rule on Cybercrime Warrants governs judicial authorization for obtaining various categories of digital evidence. The Supreme Court continues to recognize that Rule as part of the governing framework for cybercrime investigations. (Supreme Court of the Philippines)
What evidence should you preserve?
Try to preserve evidence in a way that shows not just what was said, but where it came from and when you saw it.
For the fake account itself, preserve the complete profile URL, username, displayed name, photographs, biography, follower information if relevant, and screenshots of the profile. For individual posts or messages, keep the post URL, date and time, account name, complete conversation, attachments, and surrounding context.
If other people were deceived because they believed they were communicating with you, preserve their messages and contact details as potential witnesses. If the account requested money, preserve the destination bank or e-wallet account, QR code, telephone number, transaction reference, amount, date, and financial institution involved.
Keep confirmation emails or reference numbers generated by Facebook, TikTok, X, CICC, PNP, NBI, your bank, or other entities after you report the incident.
Avoid editing, cropping, annotating, or repeatedly re-saving the only copy of important digital evidence. You can make working copies, but retain the originals whenever possible.
If the account is pretending to be your business
RA 10175's identity-theft provision expressly covers identifying information belonging to a juridical person as well as a natural person. (Lawphil)
A fake company page may therefore deserve more than a routine social-media report, particularly when it copies the company's name and branding and then sends quotations, collects payments, recruits applicants, solicits customer information, or impersonates officers or employees.
Preserve evidence showing your legitimate business identity, official social media pages, registration or trademark documents where relevant, communications from deceived customers, fraudulent payment instructions, and evidence distinguishing the fake account from the genuine one.
If the fake account is being used for a financial scam
Treat a financial impersonation case as urgent.
RA 12010, the Anti-Financial Account Scamming Act, defines social-engineering schemes involving deception or fraud to obtain another person's sensitive identifying information resulting in unauthorized access and control over a financial account. The law specifically covers false representations made to solicit sensitive identifying information and the use of electronic communications to obtain such information.
If an impersonator asks your contacts for an OTP, password, PIN, bank credentials, e-wallet credentials, or money, immediately warn affected people through a trusted channel. Anyone who has already transferred money should contact the bank or e-wallet provider without delay and separately preserve the transaction records for law enforcement.
Do not assume that reporting the social media account automatically freezes or reverses a bank or e-wallet transaction. The platform, financial institution, CICC, PNP, and NBI perform different functions.
Common mistakes that can weaken a complaint
A frequent mistake is reporting the profile immediately and only later realizing that no copy of the URL, username, messages, or fraudulent posts was preserved.
Another is saving only a cropped screenshot that shows the offensive words but not the account name, URL, date, or surrounding conversation. A screenshot can be useful, but investigators are in a better position when it is supported by the underlying profile link, messages, device records, witnesses, and other corroborating evidence.
Do not publicly accuse a particular person of operating the fake account merely because you suspect that person. Attribution based only on writing style, personal disputes, mutual friends, or intuition may be wrong. Give investigators the facts supporting your suspicion and allow the evidence to be evaluated.
Do not send additional money, OTPs, passwords, identification documents, or banking information merely to "test" the impersonator.
Do not hack, attempt to enter, or take over the fake account yourself. Unauthorized access to another computer system is separately regulated by RA 10175. (Lawphil)
When legal or law-enforcement help is urgent
Seek prompt assistance when the fake account is actively collecting money, obtaining bank or e-wallet credentials, threatening violence, blackmailing or extorting someone, publishing intimate material, approaching children, impersonating you in business transactions, contacting clients or employers, repeatedly returning after takedowns, or causing substantial financial or reputational harm.
Urgent reporting is also advisable when the account appears likely to be deleted soon or when identifying the operator will probably require preservation or disclosure of information held by a social media platform, telecommunications provider, financial institution, or other service provider.
If there is an immediate threat to someone's physical safety, contact the police or emergency authorities rather than relying solely on a social-media reporting form.
Frequently asked questions
Is creating a fake Facebook or social media account automatically illegal?
No. The mere existence of an account using a fictional name does not automatically establish computer-related identity theft. Criminal liability depends on the particular acts committed. An account that intentionally uses another person's identifying information without right for an illegitimate purpose presents a materially different situation from an ordinary pseudonymous or clearly fictional account. (Lawphil)
Platform policies may also prohibit impersonation more broadly than Philippine criminal law does.
What if the impersonator copied photographs that I posted publicly?
Public availability matters, but it is not necessarily the end of the inquiry. In Disini, the Supreme Court stated that simply acquiring and disseminating information made public by the user cannot itself be regarded as identity theft. But creating a deceptive account and using another person's identity for an illegitimate purpose may involve additional conduct beyond merely viewing or sharing public information. (Lawphil)
The entire manner and purpose of the use should therefore be examined.
Can I report an impersonator even if nobody has lost money yet?
Yes. Section 4(b)(3) expressly contemplates cases in which no damage has yet been caused and provides for a lower imposable penalty in that situation. Lack of completed financial loss therefore does not necessarily mean that there can be no identity-theft offense. (Lawphil)
What is the penalty for computer-related identity theft?
Computer-related identity theft is an offense under Section 4(b) of RA 10175. Section 8 generally provides for prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both for offenses under Sections 4(a) and 4(b). Section 4(b)(3) separately states that where no damage has yet been caused, the imposable penalty is one degree lower. The actual penalty in a criminal case depends on the charge, proven facts, and applicable sentencing rules. (Lawphil)
Can the police simply ask Facebook or another platform to reveal who owns the account?
Not without observing the applicable legal process. RA 10175 provides for preservation of computer data and requires a court warrant for disclosure of specified subscriber information, traffic data, or other relevant data. Cybercrime warrants provide the procedural framework for lawfully obtaining digital evidence. (Lawphil)
A report therefore does not guarantee that the account owner will immediately be identified.
Should I report to CICC, PNP, or NBI?
Any of these may be a reasonable starting point. CICC operates cybercrime-reporting and coordination channels, while RA 10175 specifically identifies the PNP and NBI as law-enforcement authorities responsible for enforcement of the Act. For a case requiring a formal criminal investigation, the PNP Anti-Cybercrime Group or NBI Cybercrime Division is particularly relevant. (Lawphil)
You do not ordinarily need to file the same complaint repeatedly with every agency unless coordination or the circumstances of the case make that useful.
Should I wait for the social media platform to act before going to the police?
No, particularly if there is ongoing fraud, extortion, threats, financial loss, or a need to identify the account operator. Platform removal and criminal investigation are separate processes. Preserve the evidence first and use the appropriate channels in parallel when the circumstances justify it.
Can I have the fake account taken down immediately?
You can request removal through the platform's impersonation-reporting process, but removal is not automatic and no Philippine agency can guarantee a particular platform's immediate action merely because a complaint was made.
The Supreme Court declared Section 19 of RA 10175—which had authorized the DOJ itself to restrict or block access to computer data based on a prima facie finding—unconstitutional in Disini. Takedown, preservation, disclosure, and criminal investigation should therefore not be treated as interchangeable legal procedures. (Lawphil)
Official and primary sources
The principal legal text is the Cybercrime Prevention Act of 2012 (RA 10175), hosted by the PNP Anti-Cybercrime Group.
For reporting and agency contacts, see the PNP Anti-Cybercrime Group contact directory, the NBI procedure for victims of computer crimes, and the CICC cybercrime reporting page.
For platform impersonation reports, see the official Facebook impersonation-reporting guidance, TikTok impersonation-reporting guidance, and X impersonation-reporting guidance.
The Supreme Court's controlling discussion of Section 4(b)(3) is Disini v. Secretary of Justice, G.R. Nos. 203335, et al., February 11, 2014. (Lawphil)
General-information disclaimer
This article provides general Philippine legal information, not legal advice for a particular case. Whether a fake social media account constitutes computer-related identity theft or another offense depends on the actual account, the information used, the operator's conduct and purpose, the resulting harm, and the available digital evidence. Procedures and agency or platform contact channels may also change.
Sources and procedures checked as of August 23, 2026.