Quick answer

If someone creates a fake social media account using your identity, hacks your real account, or uses your personal information online without authority, preserve the evidence first, report the account to the platform, secure your real accounts, and report the incident promptly to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD) if criminal conduct may be involved.

Philippine law expressly recognizes computer-related identity theft. Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. The Supreme Court upheld this provision in Disini v. Secretary of Justice. (Lawphil)

A fake account is not automatically proof that the crime has been committed. Investigators and prosecutors must still determine what identifying information was used, whether its use was intentional and without right, who operated the account, and what the account was used to do. But an account that deliberately presents itself as you—particularly one used to deceive your contacts, solicit money, damage your reputation, access accounts, or obtain information—should be documented and reported promptly.

If your personal data was also unlawfully collected, disclosed, or otherwise processed, a separate complaint may be available before the National Privacy Commission (NPC) under the Data Privacy Act of 2012. (Lawphil)

What counts as computer-related identity theft?

Republic Act No. 10175 defines computer-related identity theft as the intentional:

acquisition;
use or misuse;
transfer;
possession;
alteration; or
deletion

of identifying information belonging to another natural or juridical person, when done without right. (Lawphil)

The Cybercrime Prevention Act defines conduct "without right" to include conduct undertaken without or beyond authority, as well as conduct not covered by a legal defense, excuse, court order, justification, or relevant principle of law. (Lawphil)

In Disini, the Supreme Court explained that ordinary identifying information may include such matters as a person's name, citizenship, residential address, contact number, place and date of birth, spouse's name, occupation, and similar information. The Court upheld the constitutionality of the computer-related identity-theft provision. (Lawphil)

The statutory provision also expressly contemplates cases in which no damage has yet occurred: when no damage has yet been caused, the law states that the penalty imposable is one degree lower. Accordingly, you do not necessarily have to wait until the fake account successfully obtains money or causes another completed loss before reporting it. (Lawphil)

Is every fake Facebook, Instagram, TikTok, or other social media account a crime?

No. The existence of a duplicate, anonymous, parody, fan, or similarly named account does not by itself establish all the elements of computer-related identity theft.

What matters is the actual evidence. Relevant facts can include whether the operator:

copied your identifying information and represented that the account was genuinely yours;
used your name together with your photographs, workplace, business details, contact information, or other identifying data;
contacted your relatives, clients, employees, customers, or friends while pretending to be you;
asked for money, passwords, OTPs, investments, loans, or confidential documents;
issued statements intended to make others believe that you made them;
used the account to obtain access to other accounts;
altered or took control of your genuine account; or
used the false identity for fraud, threats, harassment, extortion, defamation, or another unlawful purpose.

Whether particular conduct is criminal depends on the evidence and applicable elements. Public availability of a person's name or photograph does not, by itself, decide whether a particular impersonation was lawful or unlawful.

A fake account and a hacked account are different

It is useful to identify which problem you actually have.

A fake or impersonating account is a separate account created by someone else that claims, directly or by implication, to be you.

A hacked account is your genuine account that another person has accessed or taken over without authority.

Unauthorized access to a computer system is itself an offense under Section 4(a)(1) of Republic Act No. 10175. The statutory definition of a computer system is broad enough to cover devices such as computers and mobile phones. (Lawphil)

The DOJ Office of Cybercrime specifically advises victims of unlawfully accessed Facebook accounts to use Facebook's account-recovery mechanisms and states that cybercrime complaints may be brought to either the NBI Cybercrime Division or the PNP Anti-Cybercrime Group. (Cybercrime Division)

What to do immediately

1. Preserve the evidence before the account disappears

Before blocking or reporting the fake account, collect as much evidence as reasonably possible.

Preserve:

screenshots of the entire profile;
the exact username or handle;
the full profile or account URL;
profile and cover photographs;
biography and other identifying details;
posts, stories, reels, videos, comments, and advertisements;
private messages and chat conversations;
dates and times visible on posts or messages;
names of people contacted by the impersonator;
requests for money, OTPs, passwords, identification documents, or other information;
bank, e-wallet, cryptocurrency, or payment details supplied by the impersonator;
telephone numbers and email addresses associated with the account;
notifications showing unauthorized logins or password changes;
emails from the social-media platform concerning account access or recovery;
your reports to the platform and the resulting case or ticket numbers;
communications from witnesses who were deceived or contacted; and
proof showing which account is genuinely yours.

When possible, retain the original electronic files, not only cropped screenshots. Avoid editing, annotating, or compressing the only copy of an important file. If you need an annotated copy for explanation, keep the unaltered original separately.

A screen recording showing the account, its handle, URL, posts, and navigation through the platform may supplement screenshots, although investigators may still require other authentication and evidence.

2. Record the exact URL, not merely the display name

Display names can be changed easily. A screenshot showing only "Juan Dela Cruz," for example, may be much less useful than a record containing the account's URL, username, profile identifier if visible, and the date and time you accessed it.

Do the same for individual posts, videos, or messages whenever the platform provides a direct link.

3. Secure your genuine accounts

If there is any possibility that your own account, email, or telephone number was compromised:

change your password using a trusted device;
use a new password that you do not use elsewhere;
change the password of the email account connected to the social-media account;
enable multi-factor or two-factor authentication;
review logged-in devices and terminate unfamiliar sessions;
review recovery email addresses and telephone numbers;
remove unknown connected applications;
check whether your email forwarding settings were altered; and
secure financial accounts if payment information may have been exposed.

If your Facebook account itself was taken over, Meta provides a dedicated hacked-account recovery process. (Facebook)

4. Warn people who may be targeted

If the fake account is contacting your friends, relatives, customers, employees, or clients, warn them through a trusted channel.

A simple notice can state that the identified account is not controlled by you and that recipients should not send money, OTPs, passwords, identification documents, or confidential information to it.

Avoid making unsupported public accusations about the identity of the suspected operator. It is usually safer to identify the fake account and its conduct unless you have reliable evidence establishing who controls it.

Report the account to the social-media platform

Platform reporting and a criminal complaint are separate remedies. You can generally pursue both.

Use the platform's official impersonation, fake account, hacked account, or identity reporting process. Include enough information to establish which genuine person or organization is being impersonated.

For TikTok, its official support materials specifically provide procedures for reporting an impersonating account through the application, browser, or designated reporting form.

Facebook likewise provides reporting and account-recovery mechanisms, and its Help Center states that accounts pretending to be another person can be reported. If the problem is takeover of your genuine account rather than creation of a copy, use the hacked-account recovery process. (Facebook)

Take screenshots before submitting the takedown request. If the platform removes the account immediately, evidence that was not previously saved may become harder to recover.

Where to report identity theft in the Philippines

PNP Anti-Cybercrime Group

The PNP and NBI are the two law-enforcement authorities specifically designated by Republic Act No. 10175 to enforce the Cybercrime Prevention Act. (Lawphil)

The PNP Anti-Cybercrime Group maintains national and regional cybercrime units. Its current contact directory lists, among others, its Cyber Response Unit at:

Email: complaint@acg.pnp.gov.ph
Contact number: 0968-878-3561

The PNP-ACG website also provides contact information for its regional anti-cybercrime units. (PNP ACG)

You may also personally approach the appropriate PNP Anti-Cybercrime Group office and bring your evidence.

NBI Cybercrime Division

You may likewise report the incident to the National Bureau of Investigation Cybercrime Division. The DOJ Office of Cybercrime expressly identifies both the NBI Cybercrime Division and the PNP Anti-Cybercrime Group as agencies to which members of the public may proceed when filing a cybercrime complaint. (Cybercrime Division)

DOJ Office of Cybercrime

The DOJ Office of Cybercrime coordinates cybercrime investigation and prosecution matters and is the Philippine central authority for international cooperation involving cybercrime. Its official functions include acting on complaints and referrals, facilitating investigations and prosecution, and issuing preservation orders addressed to service providers. (Cybercrime Division)

This can become particularly important when the relevant platform, records, or suspected offender is outside the Philippines.

CICC hotline 1326

For cybercrime and online-scam assistance, the Cybercrime Investigation and Coordinating Center also operates Hotline 1326. Its official anti-scam material lists the following reporting channels:

Hotline: 1326
Email: report@cicc.gov.ph
Globe: 0966-976-5971
Smart: 0947-714-7105
DITO: 0991-481-4225

(CICC)

The CICC has coordination and cybercrime-response functions, while the PNP and NBI remain the law-enforcement authorities expressly identified in Republic Act No. 10175. (Lawphil)

What should you bring when reporting?

Prepare an organized folder containing, where applicable:

A valid government-issued ID.
A chronological written account of what happened.
The fake account's URL and username.
Screenshots and original electronic files.
Copies of messages sent by the fake account.
Evidence showing that you are the genuine person being impersonated.
Names and contact information of witnesses.
Copies of reports submitted to the platform.
Account-recovery or security notifications.
Financial transaction records if money was sent.
Telephone numbers, email addresses, account numbers, wallet numbers, or other identifiers used by the offender.
A list of losses or other harm already caused.

Arrange the events by date and time. A concise chronology often makes the initial investigation easier to understand.

Do you need to know who created the fake account?

Not necessarily before making the initial report.

One purpose of a cybercrime investigation is to identify the person behind an account. A complainant ordinarily does not have access to the platform's confidential subscriber information, IP records, or other backend records.

Under the Cybercrime Prevention Act and the Rule on Cybercrime Warrants, law-enforcement authorities can use court-authorized procedures to obtain relevant computer data. A Warrant to Disclose Computer Data may authorize law enforcement to require a person or service provider to disclose specified data in its possession or control. (eLibrary)

Section 14 of Republic Act No. 10175 provides that, after securing the required court warrant, law enforcement may issue a disclosure order concerning subscriber information, traffic data, or relevant data in connection with a valid complaint officially docketed for investigation. The statutory 72-hour period concerns compliance with that law-enforcement disclosure order after receipt; it is not a promise that an ordinary citizen's social-media report will be answered within 72 hours. (Lawphil)

Why reporting quickly matters

Electronic evidence can disappear.

Section 13 of Republic Act No. 10175 requires service providers to preserve traffic data and subscriber information for a minimum of six months from the transaction. Content data must be preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time six-month extension under the statute. The Supreme Court upheld these preservation provisions in Disini. (Lawphil)

Those provisions do not mean that every piece of material you see online will automatically remain accessible forever. Users can delete content, accounts can be removed, and platforms maintain different systems and retention practices. Early documentation and early referral to cybercrime investigators can therefore be important.

What penalty applies to computer-related identity theft?

For offenses under Section 4(b), which includes computer-related identity theft, Republic Act No. 10175 prescribes prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. The identity-theft provision further states that if no damage has yet been caused, the penalty imposable is one degree lower. (Lawphil)

Whether an accused is ultimately convicted, what exact penalty applies, and whether other offenses may also be charged depend on the evidence and circumstances of the particular case.

Other crimes may be involved

Impersonation is sometimes only one part of a larger scheme.

Depending on what the offender actually did, investigators and prosecutors may examine possible liability for such matters as:

illegal access to an account;
computer-related forgery;
computer-related fraud;
fraud or estafa;
threats or extortion;
falsification;
unlawful use or disclosure of personal data; or
cyber libel arising from defamatory online publications.

Republic Act No. 10175 also provides rules concerning offenses under the Revised Penal Code or special criminal laws when committed through information and communications technology. The appropriate charge should be determined from the actual evidence rather than simply attaching every possible offense to the complaint. (Lawphil)

For online libel specifically, Disini sustained the Cybercrime Prevention Act's application to the original author of the defamatory online post while striking down its application to persons who merely receive and react to it. (Lawphil)

When the Data Privacy Act may also apply

Identity theft frequently involves personal data, but the Cybercrime Prevention Act and Data Privacy Act address different legal issues.

Republic Act No. 10173 regulates the processing of personal information and requires processing to satisfy the law's applicable lawful bases and data-privacy principles. It also grants data subjects rights that include access, correction, blocking or erasure in qualifying circumstances, the right to complain, and the right to damages for certain unlawful or unauthorized uses of personal information. (Lawphil)

Possible Data Privacy Act violations depend on how the information was obtained, processed, disclosed, and used. The mere fact that information concerns you does not automatically mean that every use of it violates the Data Privacy Act; the law contains several lawful grounds for processing besides consent. (Lawphil)

How to file a complaint with the National Privacy Commission

If the incident involves a privacy violation or misuse of your personal data, you may consider an NPC complaint in addition to a cybercrime report.

The NPC currently instructs complainants to submit a notarized complaint-assisted form or verified complaint, together with evidence and witness affidavits. Its public filing instructions allow submission personally, by courier or registered mail, and through authorized electronic filing. The NPC website states that complaints may be scanned and sent to its designated complaints email. (Privacy Commission)

Use the current NPC complaint form. The Commission announced that a new Complaint-Affidavit template took effect on July 1, 2025. (Privacy Commission)

The NPC's 15-day exhaustion rule

This requirement is easy to overlook.

Under the NPC's 2021 Rules of Procedure, a complainant generally must first inform the personal information controller, processor, or concerned entity in writing about the alleged privacy violation and allow it an opportunity to act. If appropriate action is not taken, or there is no response within 15 calendar days from receipt, an NPC complaint may proceed.

There are exceptions. The NPC may waive this exhaustion requirement for good cause or in serious cases, including circumstances involving grave and irreparable damage, the absence of a plain, speedy, and adequate remedy, or conduct that is patently illegal.

Accordingly, do not assume that you must always wait 15 days in an emergency. Explain the urgency and supporting facts if you are asking the NPC to waive the requirement.

Can you file directly with a prosecutor?

A criminal complaint may ultimately proceed through the prosecution service. The DOJ's published filing requirements for complaints submitted directly for preliminary investigation include an Investigation Data Form, a complaint-affidavit or sworn statement, witness affidavits when applicable, and supporting documents. (Department of Justice)

The 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings are now part of the governing prosecution framework. The Supreme Court upheld those rules in 2025, including the DOJ's use of the evidentiary standard of prima facie evidence with reasonable certainty of conviction for covered preliminary investigations. (Lawphil)

For an anonymous social-media account, however, going first to a cybercrime investigative unit can be particularly useful because investigators may need to identify the operator, preserve platform data, conduct digital forensics, or apply for cybercrime warrants before the case is ready for prosecution.

What if the fake account is based abroad?

An overseas operator does not automatically place the conduct beyond Philippine law.

Republic Act No. 10175 provides Philippine jurisdiction in specified situations, including when an element of the offense occurs in the Philippines, when the relevant computer-system connection described by the law exists, or when damage is caused to a natural or juridical person who was in the Philippines when the offense was committed. (Lawphil)

The DOJ Office of Cybercrime is also designated as the central authority for international mutual assistance and extradition relating to cybercrime. (Cybercrime Division)

Cross-border identification and evidence gathering can nevertheless take considerably more procedural work, so early reporting is especially important.

If money was sent because of the fake account

Treat this as urgent.

Immediately:

notify the bank, e-wallet, payment service, or other financial institution;
request that the transaction and recipient account be investigated under its fraud procedures;
retain the transaction reference number and recipient details;
preserve the messages that induced the transfer;
report the matter promptly to the PNP-ACG or NBI; and
provide investigators with the complete payment trail.

Do not wait for the social-media platform to finish its internal review before reporting a rapidly developing financial fraud.

If the impersonator is threatening or extorting you

Preserve the threats and seek law-enforcement assistance promptly, particularly if the person:

threatens physical harm;
demands money;
threatens to release private images or confidential information;
is actively contacting your employer, family, customers, or children;
has obtained access to your home, financial, or identity documents; or
appears to know your current physical location.

Do not pay merely because the offender promises to delete an account or stop posting. Payment does not guarantee that the conduct will stop, and additional demands may follow.

Evidence from people who were contacted

People who received messages from the fake account can become important witnesses.

Ask them, if willing, to preserve:

the original conversation;
screenshots showing the account identity;
dates and times;
any telephone number or payment account supplied;
voice messages and files;
any money-transfer receipt; and
the URL or handle of the fake account.

They should avoid deleting the conversation simply because the account has already been blocked.

For a formal case, investigators or prosecutors may later request sworn statements or affidavits from relevant witnesses.

Common mistakes to avoid

Deleting everything after taking one screenshot

One screenshot may not establish the account's URL, chronology, context, or relationship between several messages. Preserve the original material more comprehensively before blocking the account.

Reporting to the platform but nowhere else

Platform removal can stop immediate impersonation, but a successful takedown is not the same thing as a criminal investigation.

If serious fraud, hacking, threats, extortion, or identity theft occurred, separately report it to the appropriate authorities.

Waiting for the scammer to cause financial loss

The Cybercrime Prevention Act expressly contemplates computer-related identity theft even where damage has not yet been caused, although the penalty provision operates differently in that situation. (Lawphil)

Publicly accusing a particular person without adequate proof

Knowing who dislikes you is not the same as proving who controlled an anonymous account.

Preserve suspicions and supporting facts for investigators instead of converting speculation into potentially harmful public accusations.

Trying to obtain the offender's private subscriber records yourself

Platforms normally will not simply turn over confidential subscriber information because a private individual requests it. Philippine cybercrime procedure provides mechanisms through which authorized investigators can seek disclosure under appropriate court process. (eLibrary)

Altering the original evidence

Do not make the only copy of an important screenshot a heavily cropped, highlighted, or edited image.

Keep originals and make separate working copies.

Sharing sensitive evidence unnecessarily

If the evidence includes IDs, addresses, private conversations, bank records, intimate material, or children's information, provide it only to persons and agencies that genuinely need it. Evidence preservation does not require publicly reposting sensitive material.

When legal help is especially important

Consider obtaining legal assistance promptly when:

the impersonator has caused significant financial loss;
several fake accounts are being operated as part of a coordinated campaign;
the offender is threatening or extorting you;
private or intimate material is involved;
a business, professional practice, or public reputation is being materially harmed;
the suspected offender is known but disputes responsibility;
the account operator appears to be abroad;
an NPC complaint, prosecutor's complaint, or court application is being prepared;
important evidence may require immediate preservation; or
multiple criminal, civil, and data-privacy remedies may overlap.

A lawyer can help separate provable facts from assumptions, identify the appropriate causes of action, organize electronic evidence, and avoid filing incompatible or poorly supported allegations.

Frequently asked questions

Can I report a fake account even if it has not scammed anyone yet?

Yes. You may report the account to the platform immediately, and suspected computer-related identity theft may also be reported to cybercrime investigators. Republic Act No. 10175 expressly addresses the situation where no damage has yet been caused. (Lawphil)

Is using my photograph automatically identity theft?

Not automatically. Criminal liability depends on the entire factual setting and whether the statutory elements are proved. A photograph used together with your name and other information to impersonate you can be important evidence, but investigators must evaluate the complete conduct.

What if the account was already deleted?

Report it if the incident was serious and preserve whatever remains: screenshots, URLs, messages received by other people, platform notices, emails, transaction records, and witnesses. Deletion of the public-facing account does not necessarily establish that all relevant provider records have disappeared.

Can police identify an anonymous Facebook or social-media account?

Potentially, but identification depends on available records and lawful investigative process. Cybercrime investigators may seek preservation and court-authorized disclosure of relevant data under Republic Act No. 10175 and the Rule on Cybercrime Warrants. (Lawphil)

Should I report to PNP or NBI?

Either is authorized to investigate violations of Republic Act No. 10175. The DOJ itself directs the public to the NBI Cybercrime Division or PNP Anti-Cybercrime Group for cybercrime complaints. (Lawphil)

Do I need both a PNP/NBI complaint and an NPC complaint?

Not in every case. They address different issues. A PNP or NBI investigation concerns possible criminal conduct, while the NPC deals with violations involving personal-data protection under the Data Privacy Act. Depending on the facts, one, both, or neither may be appropriate.

Is a police blotter enough?

A blotter can document that an incident was reported, but it should not be treated as a substitute for a properly supported cybercrime investigation or complaint. Provide the evidence and follow the investigating agency's requirements for the case.

Can I force Facebook or another platform to reveal who made the account?

Ordinarily, a private complainant cannot simply compel disclosure of confidential subscriber information. Cybercrime investigators can use the procedures established by law and the Rule on Cybercrime Warrants when the legal requirements are met. (eLibrary)

Should I confront the person I suspect?

Usually, preserving evidence and reporting first is safer. Confrontation can lead to deletion of evidence, creation of additional accounts, threats, or fabrication of explanations. If there is an immediate safety concern, seek law-enforcement assistance rather than confronting the person yourself.

Official sources

General-information disclaimer

This article provides general information about Philippine law and procedure and is not a substitute for legal advice on a particular incident. The correct remedy, offense, venue, evidence required, and persons who may be liable depend on the actual facts, available electronic records, and applicable procedural rules. Government contact details and platform reporting procedures can also change, so verify them through the linked official sources before filing.

Law and official-source check: August 25, 2026.