Quick answer

If someone creates a fake Facebook, Instagram, TikTok, X, Messenger, or other online account using your name, photos, personal details, or identity, preserve the evidence first, report the account to the platform, secure your own accounts, and promptly report serious impersonation to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. If the impersonator is soliciting money, accessing bank or e-wallet accounts, threatening people, or obtaining sensitive information, contact the affected financial institution and law enforcement immediately.

Philippine law expressly punishes computer-related identity theft. Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or entity's identifying information without right. The law even provides for a lower penalty when no damage has yet been caused, which means you do not necessarily have to wait for actual financial loss before taking the matter seriously. (Lawphil)

Not every duplicate, parody, fan, or similarly named account automatically constitutes criminal identity theft. The facts still matter: what identifying information was used, whether the use was intentional, whether the person had consent or another lawful basis, whether the account was presented as genuinely belonging to you, and what the operator did with it.

When a fake social media account may amount to identity theft

The Cybercrime Prevention Act defines computer-related identity theft broadly. The Supreme Court, in Disini, Jr. v. Secretary of Justice, upheld the provision and explained that ordinary identifying information can include a person's name, citizenship, residence address, contact number, place and date of birth, spouse's name, occupation, and similar information. (Lawphil)

A fake account therefore raises a stronger identity-theft issue when, for example, someone copies your name and profile photograph, represents the account as genuinely yours, contacts your relatives or clients in your name, uses your personal information to transact, obtains money or credentials through the impersonation, or opens or operates other accounts using your identity.

The basic penalty for offenses under Section 4(b), including computer-related identity theft, is prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. Section 4(b)(3), however, provides for a penalty one degree lower when no damage has yet been caused. The precise penalty in an actual case depends on the charge, proven facts, and applicable sentencing rules. (Lawphil)

A fake account can also lead to other charges depending on what it is used for. Republic Act No. 10175 separately covers computer-related forgery and computer-related fraud. Impersonation used to obtain money may involve estafa or other fraud offenses. Defamatory online publications, threats, extortion, unauthorized intimate images, or unlawful processing of personal information may implicate still other laws. Charges should therefore be based on the actual conduct, rather than assuming that every impersonation case involves only one offense.

What to do as soon as you discover the fake account

Preserve the evidence before asking for removal. Capture the entire profile, exact username, profile URL, profile photograph, biography, posts, comments, messages, dates and times, follower or friend information relevant to the impersonation, and any phone numbers, email addresses, payment details, QR codes, bank accounts, or e-wallet accounts used. Save screenshots and, where useful, screen recordings showing how you reached the account. Keep the original electronic files rather than only cropped or edited copies.
Preserve messages received by other people. Ask relatives, customers, coworkers, or other recipients to save the original conversation instead of merely forwarding a screenshot. Record who received each message and when. Witnesses who were deceived by the account can become important later.
Secure your real accounts. Change compromised or reused passwords, enable multi-factor authentication, review logged-in devices and recovery information, revoke unfamiliar applications, and secure the email account connected to your social media profiles. If your genuine account itself was taken over, use the platform's hacked-account recovery process as well as its impersonation-reporting mechanism.
Report the impersonating account to the platform. Choose the option for impersonation, pretending to be someone else, fraud, or the closest applicable violation. Save the confirmation email, ticket number, or screenshot showing that the report was submitted. Platform removal and a criminal investigation are separate processes; one does not automatically replace the other.
Warn people who may be targeted. A brief notice from your genuine account can tell contacts not to transact with the fake profile. Avoid publicly accusing a particular person unless you have reliable evidence establishing who actually operates the account.
Report serious cases promptly to cybercrime authorities. This is especially important where the fake account is asking for money, collecting personal information, threatening someone, damaging a business or profession, opening accounts in your name, or repeatedly reappearing after takedowns.
If money or a financial account is involved, contact the bank or e-wallet immediately. Use the institution's official fraud channel rather than communicating with numbers supplied by the impersonator. Give the transaction reference numbers and request that the disputed transaction be investigated under applicable anti-fraud procedures.

Where to report identity theft in the Philippines

PNP Anti-Cybercrime Group

The Philippine National Police Anti-Cybercrime Group (PNP-ACG) investigates cybercrime complaints and maintains regional and district cybercrime units.

As checked on August 23, 2026, the PNP-ACG's Cyber Response Unit lists complaint@acg.pnp.gov.ph, telephone (02) 8723-0401 local 7490, and mobile number 0968-878-3561. Its official contact page also lists Regional Anti-Cybercrime Units and provincial or district cyber response teams around the country. (PNP ACG)

You can consult the PNP Anti-Cybercrime Group contact directory for the current unit nearest you.

When reporting, bring or send the evidence you have preserved and be prepared to explain chronologically when you discovered the account, what identity information was copied, who was contacted, what the impersonator represented, and what harm or attempted harm occurred.

NBI Cybercrime Division

You may also seek investigative assistance from the National Bureau of Investigation Cybercrime Division (NBI-CCD).

The NBI's current Citizens' Charter states that members of the public may proceed to the Cybercrime Division to file a complaint or request an investigation. The process includes a complaint sheet, preliminary interview, sworn statements or affidavits, collection of supporting documents, and, when relevant, examination of devices. The listed service carries no filing fee. (National Bureau of Investigation)

The NBI currently identifies ccd@nbi.gov.ph as the Cybercrime Division's email address. Its main office is on Taft Avenue, Manila, while cybercrime matters may also be handled through regional facilities. (National Bureau of Investigation)

See the NBI's official investigative-assistance procedure for computer-crime victims.

Cybercrime Investigation and Coordinating Center

The Cybercrime Investigation and Coordinating Center (CICC) also provides a national reporting channel for cybercrime and online scams. Its official materials currently identify 1326 as its hotline, together with report@cicc.gov.ph and mobile reporting numbers 0966-976-5971 (Globe), 0991-481-4225 (DITO), and 0947-714-7105 (Smart). (CICC)

See the Cybercrime Investigation and Coordinating Center for current advisories and reporting information.

Why reporting quickly matters

Electronic evidence is not necessarily kept forever.

Under Section 13 of Republic Act No. 10175, service providers must preserve the integrity of traffic data and subscriber information for a minimum of six months from the transaction. Content data is preserved for six months from receipt of a lawful preservation order, and law enforcement may order a one-time extension for another six months under the circumstances specified by law. (Lawphil)

The Supreme Court's Rule on Cybercrime Warrants provides procedures allowing law-enforcement authorities to obtain court authority for disclosure, interception, search, seizure, and examination of relevant computer data. (Judiciary eLibrary)

This is one reason not to spend months arguing with an impersonator before seeking help. A victim ordinarily cannot compel a social-media company to disclose confidential subscriber information simply by demanding an IP address or account owner's identity. Law enforcement may instead use preservation measures and, where legally justified, apply for the appropriate cybercrime warrant.

If the fake account is asking people for money

Financial impersonation requires especially fast action.

Republic Act No. 12010, or the Anti-Financial Account Scamming Act (AFASA), separately criminalizes several forms of financial-account abuse. These include certain social-engineering schemes involving deceptive electronic communications and obtaining sensitive identifying information resulting in unauthorized access and control of a financial account. The law also prohibits opening financial accounts under fictitious names or using another person's identity or identification documents in specified circumstances. (Lawphil)

Current BSP rules require supervised financial institutions to maintain fraud-reporting arrangements. Under BSP Circular No. 1215, a source account owner's complaint through the institution's 24/7 fraud-reporting channel can initiate the temporary-holding and coordinated-verification process for disputed funds. Depending on the circumstances, disputed funds may be temporarily held for periods governed by the BSP rules, with the total statutory temporary-holding period generally not exceeding 30 calendar days unless extended by a competent court. (Bureau of the Treasury)

Accordingly, if you or one of your contacts has already transferred money to an account supplied by an impersonator, report the transaction to the sending bank or e-wallet immediately. Do not wait for the social-media platform to decide the impersonation report.

The financial institution is ordinarily the first-level recourse for a banking or e-wallet complaint. If its response is unsatisfactory and the institution is BSP-supervised, the matter may be escalated through the BSP Consumer Assistance Mechanism. (Bureau of the Treasury)

See the BSP Consumer Assistance Mechanism and the BSP's AFASA information and regulations.

When the National Privacy Commission may also be relevant

A fake account may involve a data-privacy issue when personal information, photographs, contact information, identification documents, or other personal data are collected, used, disclosed, or otherwise processed unlawfully.

The National Privacy Commission has specifically warned that unauthorized use or dissemination of another person's personal data may create liability under the Data Privacy Act and other laws. It has also recognized that photos and videos containing personal data can be exploited for identity theft and fraud. (National Privacy Commission)

An NPC complaint, however, is not automatically the correct remedy for every fake social-media account, and it is not a substitute for reporting a suspected crime to the PNP or NBI.

Under the NPC's current Rules of Procedure, a complainant generally must first inform the respondent or concerned entity in writing of the privacy violation and allow it an opportunity to act. Ordinarily, the complaint proceeds when the respondent fails to take timely or appropriate action or gives no response within 15 calendar days from receipt. The NPC may waive this exhaustion requirement for good cause or serious violations, including circumstances involving grave and irreparable harm. (National Privacy Commission)

The NPC currently requires a filled-out and notarized complaint-assisted form or a verified complaint, together with supporting evidence and relevant witness affidavits. Because the NPC introduced a new Complaint-Affidavit template effective July 1, 2025, use the form currently published on its website rather than relying on an old saved copy. (National Privacy Commission)

See the National Privacy Commission complaint page and its current complaint procedures and exhaustion requirements.

Evidence worth preserving

A strong complaint normally identifies the fake account precisely and shows what it actually did. Preserve the complete profile URL and username, screenshots and screen recordings, copies of posts and comments, direct messages, email notifications, timestamps, payment instructions, transaction receipts, telephone numbers, email addresses, QR codes, bank or e-wallet details, platform-report confirmations, and communications from witnesses who received messages from the impersonator.

Keep the original files whenever possible. Do not overwrite them by repeatedly editing, highlighting, cropping, or adding text. If you want annotated copies for explanation, retain the untouched originals separately.

If the impersonation affected a business, profession, employment, or reputation, also preserve customer complaints, cancelled transactions, inquiries asking whether the account was genuine, notices sent to clients, and records showing measurable losses or other consequences.

Common mistakes that can weaken a complaint

A frequent mistake is having friends mass-report the account immediately while nobody first records its URL, messages, posts, and payment details. Removal may protect the victim, but evidence should be preserved beforehand whenever this can be done safely.

Another mistake is confronting the suspected operator and revealing exactly what evidence has been collected. This can lead to deletion of accounts, messages, or other traces.

Do not attempt to hack the fake account, trick the platform into disclosing confidential data, install spyware, or unlawfully access another person's device. Being the victim of impersonation does not authorize unlawful access.

Avoid publicly naming a suspected perpetrator merely because of a guess based on writing style, a profile photograph, a telephone number, or hearsay. The operator of an account may have used still another person's stolen information. Unsupported public accusations can create separate legal problems.

Do not assume that a successful platform takedown means the criminal issue has been resolved. Conversely, the fact that a platform has not yet removed an account does not determine whether Philippine criminal law was violated.

When legal or law-enforcement help is urgent

Seek prompt assistance where the impersonator is collecting money, opening financial accounts or loans in your name, obtaining passwords or OTPs, threatening violence, demanding money or sexual acts, publishing intimate material, impersonating a professional or public official, contacting children, repeatedly recreating removed accounts, or causing substantial business or reputational harm.

Urgency is also warranted if identification documents such as a passport, driver's license, National ID, company ID, signature specimen, bank information, or other sensitive credentials have been exposed. In those circumstances, the fake social-media account may be only one part of a broader identity-fraud scheme.

Frequently asked questions

Is a fake Facebook account automatically computer-related identity theft?

No. A fake or duplicate account by itself does not automatically establish every element of a criminal offense. The prosecution must still prove the acts required by law, including intentional use or other prohibited handling of identifying information belonging to another without right. A clearly labeled fan or parody account, a coincidentally identical name, and an account deliberately pretending to be the victim present very different factual situations.

What if no money has been lost yet?

Actual monetary loss is not necessarily required before computer-related identity theft can become legally relevant. Section 4(b)(3) expressly provides for a penalty one degree lower when no damage has yet been caused. (Lawphil)

Do I need to know the real name of the person behind the account before reporting?

No. Report the account and the facts you can establish. Subscriber information, traffic data, devices, financial trails, and other identifying evidence may require investigative powers or court-authorized processes that an ordinary user does not possess.

Can I demand the impersonator's IP address from Facebook or another platform?

You may report the account and provide information requested by the platform, but confidential subscriber and traffic information generally involves legal process. Philippine law and the Rule on Cybercrime Warrants provide mechanisms through which authorized law-enforcement officers can seek preservation and court-authorized disclosure of relevant computer data. (Lawphil)

Should I report to the PNP, NBI, CICC, or NPC?

For suspected criminal impersonation or identity theft, the PNP Anti-Cybercrime Group and NBI Cybercrime Division are direct investigative options, while the CICC also provides cybercrime reporting and coordination channels. An NPC complaint may be appropriate when there is a separate Data Privacy Act or privacy-rights issue. Depending on the facts, more than one remedy can exist at the same time.

What if the fake account has already been deleted?

A complaint may still be possible. Preserve whatever evidence remains, including the former profile URL, screenshots, notifications, messages received by third parties, platform correspondence, and transaction records. Tell investigators when the account disappeared. Service-provider records may still exist, but prompt reporting becomes particularly important.

What if the impersonator is outside the Philippines?

Do not assume that Philippine authorities automatically lack jurisdiction. Republic Act No. 10175 provides jurisdiction in several circumstances, including where an element of the cybercrime occurred in the Philippines, a relevant computer system was wholly or partly situated here, or the offense caused damage to a natural or juridical person who was in the Philippines when the offense was committed. The law also recognizes international cooperation for cybercrime investigations and electronic evidence. (Lawphil)

Should I publicly expose the person I suspect?

Usually, preserve the evidence and give it to investigators instead. Unless the operator's identity has been reliably established, publicly accusing someone can harm an innocent person and may expose the accuser to separate legal risk. It can also alert the actual offender and encourage destruction of evidence.

Official sources

The principal statute is Republic Act No. 10175, Cybercrime Prevention Act of 2012. The Supreme Court's constitutional ruling on computer-related identity theft is Disini, Jr. v. Secretary of Justice, G.R. No. 203335 et al., February 18, 2014. Current cybercrime complaints may be directed to the PNP Anti-Cybercrime Group, the National Bureau of Investigation, or the Cybercrime Investigation and Coordinating Center.

For privacy complaints and procedures, consult the National Privacy Commission. For financial-account scams, consult Republic Act No. 12010, the Anti-Financial Account Scamming Act and the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism.

Disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice based on the specific evidence, documents, identities of the parties, platform records, financial transactions, and surrounding circumstances of a particular case. Procedures, agency contact details, platform reporting systems, and implementing rules can change. Law and official-source information checked as of August 23, 2026.