I. Introduction

An online scam using stolen identity occurs when a person uses another person’s name, photograph, government ID, signature, account, mobile number, business name, or personal information to deceive others online. In the Philippine context, this may involve fake Facebook accounts, fake marketplace sellers, phishing schemes, romance scams, investment scams, impersonation through messaging apps, SIM-based fraud, e-wallet scams, fake loan transactions, fake job offers, or fraudulent use of government IDs and bank accounts.

This kind of scam harms at least two groups of victims:

First, the person whose identity was stolen suffers reputational harm, legal risk, privacy invasion, harassment, and possible financial consequences.

Second, the person who was deceived into sending money or property suffers direct financial loss and may mistakenly blame the identity theft victim.

Because online identity theft often crosses several legal areas, it may involve criminal law, cybercrime law, data privacy law, electronic evidence, banking rules, platform policies, consumer protection, civil liability, and law enforcement procedures.

This article explains the legal nature, common forms, evidence, remedies, defenses, liabilities, and practical steps involving an online scam using stolen identity in the Philippines.

II. What Is an Online Scam Using Stolen Identity?

An online scam using stolen identity generally involves three elements:

Use of another person’s identity or personal information;
Online or electronic communication;
Fraud, deception, or unlawful gain.

The stolen identity may be used to make the scam appear trustworthy. A scammer may pretend to be a real person, a business owner, a licensed professional, a relative, an overseas worker, a government employee, a recruiter, a seller, a lender, a buyer, or a representative of a company.

The scam may involve:

Fake social media profile;
Fake online seller account;
Fake business page;
Fake investment promoter;
Fake loan officer;
Fake recruiter;
Fake charity collector;
Fake romantic partner;
Fake buyer using another person’s ID;
Fake seller using another person’s bank or e-wallet account;
Fake account using stolen photos;
Unauthorized use of screenshots of IDs;
Use of another person’s name in receipts or invoices;
Use of a hacked account to borrow or solicit money.

The central problem is that the scammer hides behind another person’s identity to commit fraud.

III. Common Forms of Online Identity-Based Scams

1. Fake Seller Using a Stolen Identity

A scammer creates a marketplace listing for phones, appliances, vehicles, gadgets, pets, tickets, real estate rentals, or other items. The scammer uses another person’s photos, name, and ID to gain trust. The buyer sends payment but never receives the item.

2. Fake Buyer Using Stolen Identity

A scammer pretends to be a buyer and uses another person’s ID or profile to convince the seller to release goods, accept fake proof of payment, or ship an item before payment clears.

3. Hacked Account Money Request

A scammer takes control of a social media, email, or messaging account and sends messages to friends or relatives asking for emergency money.

4. Romance Scam

A scammer uses stolen photos and personal details to create a fake romantic identity. The victim is slowly manipulated into sending money, gifts, crypto, or sensitive information.

5. Investment Scam

A scammer uses the identity of a real professional, influencer, trader, business owner, or company representative to promote fake investments, crypto schemes, forex trading, online tasks, or “guaranteed profit” programs.

6. Fake Loan or Lending Scam

A scammer uses another person’s identity to offer fast loans, then collects “processing fees,” “insurance fees,” or “advance payments.” The loan is never released.

7. Fake Job Recruitment

A scammer impersonates a recruiter or company officer, collects application fees or personal documents, and may use the applicant’s information for future fraud.

8. Fake Charity or Medical Solicitation

A scammer uses stolen photos of patients, children, disaster victims, or real families to solicit donations.

9. E-Wallet Mule Account Scam

A scammer uses stolen identity documents to open or verify an e-wallet or bank account. The account is then used to receive scam proceeds.

10. SIM-Based Identity Scam

A scammer uses a SIM card registered under another person’s identity or uses a stolen phone number to communicate with victims.

11. Fake Rental or Real Estate Listing

A scammer uses a real owner’s identity or property photos to collect reservation fees, deposits, or advance rentals from prospective tenants.

12. Fake Government or Agency Representative

A scammer uses the name or ID of a government employee, police officer, customs officer, immigration officer, court employee, or barangay official to collect fees or threaten victims.

IV. Personal Information Commonly Used in the Scam

The stolen identity may include:

Full name;
Photographs;
Birthdate;
Home address;
Mobile number;
Email address;
Government ID;
Passport;
Driver’s license;
UMID;
PhilHealth ID;
SSS number;
TIN;
PRC ID;
Student ID;
Company ID;
Signature;
Selfie with ID;
Bank account details;
E-wallet account details;
Social media profile;
Business registration documents;
Certificate of employment;
Professional license;
Screenshots of conversations;
Family photos;
Old online listings;
Publicly posted business information.

A scammer may obtain these from hacked accounts, phishing, fake job applications, fake loan applications, marketplace transactions, data leaks, public posts, unsecured cloud folders, discarded documents, or manipulated victims.

V. Why Stolen Identity Makes Online Scams More Dangerous

Identity theft makes fraud more believable. Victims often trust a scammer because the scammer appears to be a real person with a verifiable online history.

The scammer may send:

A photo of a government ID;
A selfie holding an ID;
A business permit;
A screenshot of a bank account;
A social media profile link;
A fake authorization letter;
A fake receipt;
A fake video call;
A manipulated voice recording;
A copied business page;
A fake transaction history;
Stolen customer reviews.

The victim may think: “This person is real because I saw their ID.” But possession of an ID image does not prove that the person chatting is the true owner of that ID.

VI. Legal Characterization in the Philippines

An online scam using stolen identity may involve several legal wrongs at the same time.

Possible legal classifications include:

Cybercrime;
Computer-related fraud;
Identity theft;
Estafa or swindling;
Falsification;
Use of falsified documents;
Data privacy violation;
Unauthorized access;
Illegal access to accounts;
Unjust enrichment;
Civil fraud;
Defamation or reputational harm;
Harassment or threats;
Violation of electronic commerce rules;
Violation of banking or e-wallet terms;
Possible money laundering concerns, depending on the scale and movement of funds.

The exact charge depends on what the scammer did, what information was used, how the scam was committed, and what evidence is available.

VII. Cybercrime Dimension

Online identity-based scams commonly fall within the field of cybercrime because the fraud is committed through electronic means.

Cybercrime issues may arise when the scam involves:

Use of social media;
Messaging apps;
Email;
Fake websites;
Phishing links;
Hacked accounts;
E-wallet transfers;
Online banking;
Digital wallets;
Computer systems;
Mobile devices;
Electronic documents;
Electronic signatures;
Online marketplaces;
Fraudulent online advertisements.

When traditional crimes are committed using information and communications technology, the use of technology may affect jurisdiction, evidence, penalties, procedure, and investigation.

VIII. Identity Theft

Identity theft involves acquiring, using, misusing, transferring, possessing, altering, or deleting identifying information belonging to another person without right, usually for unlawful purposes.

In online scams, identity theft may occur when a scammer:

Uses another person’s name and photo to create a fake profile;
Uses another person’s ID to verify an e-wallet;
Uses another person’s account to solicit money;
Sends another person’s ID to victims as “proof of identity”;
Pretends to be a licensed professional;
Uses another person’s business name to sell fake products;
Uses a stolen selfie with ID;
Opens accounts using another person’s information;
Signs documents using another person’s name;
Uses another person’s mobile number or SIM identity.

The person whose identity was stolen is also a victim, even if the scammer did not steal money directly from them.

IX. Estafa or Swindling

An online scam using stolen identity often involves estafa, especially when the scammer deceives a victim into giving money, property, or valuables.

The usual theory is that the scammer used deceit, false pretenses, or fraudulent representation before or at the time of the transaction, causing the victim to part with money or property.

Examples:

Pretending to be a seller and collecting payment for a non-existent item;
Pretending to be a recruiter and collecting placement fees;
Pretending to be a relative in emergency and borrowing money;
Pretending to be an investment agent and promising guaranteed returns;
Pretending to be an account owner and receiving funds fraudulently.

If the fraud is committed online, electronic evidence becomes central.

X. Falsification and Use of False Documents

A stolen identity scam may involve falsification if the scammer creates or uses false documents.

Examples include:

Fake government ID;
Altered ID;
Fake authorization letter;
Fake proof of payment;
Fake bank deposit slip;
Fake receipt;
Fake invoice;
Fake business permit;
Fake certificate of employment;
Fake notarized document;
Fake delivery record;
Fake screenshots;
Fake contracts;
Forged signature.

If the scammer sends a fake ID or altered document to the victim, this may support a falsification-related complaint. If the document is used online, screenshots and original files should be preserved.

XI. Data Privacy Issues

A stolen identity scam may also involve violation of data privacy rights because personal information was collected, processed, used, shared, or disclosed without consent and without lawful basis.

The Data Privacy Act protects personal information and sensitive personal information. Government IDs, financial records, addresses, contact numbers, and identity documents may be sensitive or protected information depending on the nature of the data.

Possible data privacy violations include:

Unauthorized use of personal information;
Unauthorized disclosure of ID photos;
Processing data for fraud;
Using personal data beyond the purpose for which it was given;
Failure of a company or platform to protect user data;
Mishandling of customer verification documents;
Leaking of ID submissions;
Use of employment or loan application data for scams.

A data privacy complaint may be appropriate where the issue involves misuse, leak, or unauthorized processing of personal information.

XII. Hacking and Unauthorized Access

If the scammer accessed an account without permission, the case may involve illegal access or hacking.

Examples:

Hacked Facebook account used to borrow money;
Hacked email account used to send fake invoices;
Hacked online banking account;
Hacked e-wallet account;
Hacked marketplace seller account;
Hacked business page;
Hacked messaging app account;
Unauthorized access to cloud storage containing IDs.

The identity theft victim should immediately secure accounts, change passwords, enable two-factor authentication, and preserve evidence of unauthorized access.

XIII. The Two Main Victims

1. The Financial Victim

This is the person who sent money or property because of the scam. Their concerns are recovery of money, identification of the scammer, criminal complaint, bank or e-wallet freezing, and civil remedies.

2. The Identity Theft Victim

This is the person whose name, photo, ID, or account was used. Their concerns are clearing their name, stopping further misuse, preventing harassment, reporting identity theft, protecting accounts, and avoiding wrongful accusations.

Sometimes, the financial victim and identity theft victim are the same person. For example, a hacked account owner may also lose money from the account.

XIV. The Identity Theft Victim Is Not Automatically Liable

A person whose identity was stolen is not automatically liable for the scam merely because their name, ID, photo, or account was used.

Liability depends on participation, negligence, benefit, or legal responsibility.

The identity theft victim may have a defense if they can show:

They did not communicate with the scam victim;
They did not receive the money;
Their ID was stolen or misused;
Their account was hacked;
Their photos were copied without consent;
Their e-wallet or bank account was opened fraudulently;
They reported the misuse promptly;
They did not authorize the scammer;
They did not benefit from the scam.

However, if the identity theft victim knowingly lent their account, allowed use of their ID, received funds, or helped move money, they may face legal exposure.

XV. Money Mules and Account Holders

A major issue in online scams is the use of “money mule” accounts. A money mule is a person whose bank account, e-wallet, crypto wallet, or payment channel is used to receive or transfer scam proceeds.

The account holder may be:

A willing participant;
A person paid to lend an account;
A victim whose identity was used to open the account;
A hacked account owner;
A person deceived into receiving funds;
A negligent account holder who allowed access to credentials.

If scam money entered an account under a person’s name, investigators will look closely at:

Who controlled the account;
Who withdrew the money;
Who owned the phone number;
Who registered the e-wallet;
Who had the SIM card;
Who knew the OTPs;
Whether the account holder received a commission;
Whether there were previous similar transactions;
Whether the account holder reported unauthorized use.

Account holders should never lend bank accounts, e-wallets, SIM cards, IDs, or verified accounts to others.

XVI. Civil Liability

Aside from criminal liability, an online scam using stolen identity may give rise to civil liability.

The financial victim may seek:

Return of money;
Actual damages;
Moral damages;
Exemplary damages;
attorney’s fees;
costs of litigation;
interest.

The identity theft victim may seek:

Damages for reputational harm;
Damages for harassment;
injunction or takedown relief;
correction of records;
compensation for expenses incurred to clear their name;
damages against persons who maliciously spread false accusations.

Civil liability may be pursued against the scammer, conspirators, account holders, facilitators, or others who participated in or benefited from the scam.

XVII. Platform Liability and Takedown

Online scams often happen on platforms such as social media sites, messaging apps, online marketplaces, classified ad sites, or e-commerce platforms.

Victims may report:

Fake profiles;
impersonation accounts;
fraudulent pages;
scam listings;
fake reviews;
unauthorized use of photos;
hacked accounts;
phishing links;
fake business pages.

Platforms may remove accounts or content under their policies, but platform takedown is different from criminal prosecution. A report to the platform may stop further harm but does not by itself identify the scammer or recover money.

Victims should take screenshots and preserve URLs before filing takedown requests, because evidence may disappear after removal.

XVIII. Immediate Steps for the Financial Victim

A person who sent money to a scammer using stolen identity should act quickly.

1. Preserve Evidence

Save:

Chat conversations;
account links;
profile URLs;
screenshots;
phone numbers;
bank account numbers;
e-wallet numbers;
receipts;
proof of transfer;
product listing;
fake ID sent by scammer;
email headers, if available;
tracking numbers;
delivery records;
voice messages;
call logs.

Do not delete the conversation.

2. Contact the Bank or E-Wallet Provider

Report the transaction immediately. Request assistance, account hold, investigation, or reversal if still possible.

Time is critical because scam proceeds may be withdrawn or transferred quickly.

3. Report to the Platform

Report the fake account, marketplace listing, page, or conversation.

Take screenshots before reporting.

4. File a Police or Cybercrime Report

Report to the appropriate law enforcement unit, cybercrime office, or police station. Bring evidence and identification.

5. Consider a Complaint-Affidavit

For formal criminal proceedings, the victim may need to execute a complaint-affidavit detailing the facts and attaching evidence.

6. Avoid Publicly Accusing the Wrong Person

If the scammer used a stolen identity, the person in the ID or photo may also be a victim. Public accusations without verification may expose the accuser to defamation or privacy complaints.

XIX. Immediate Steps for the Identity Theft Victim

A person whose name, photo, ID, or account was used in a scam should also act quickly.

1. Document the Misuse

Save screenshots of:

Fake profiles;
scam posts;
messages from victims;
unauthorized use of ID;
fake pages;
comments accusing you;
transaction details;
account URLs;
phone numbers used;
reports from victims.

2. Report Impersonation

Report the fake account or page to the platform as impersonation or identity misuse.

3. File an Identity Theft Report

Report to law enforcement or a cybercrime unit to create an official record that your identity was misused.

4. Notify Banks and E-Wallets

If your name, ID, phone number, or financial account was used, notify the relevant institution.

5. Secure Your Accounts

Change passwords, enable two-factor authentication, log out unknown sessions, update recovery email and mobile number, and scan devices for malware.

6. Warn Contacts Carefully

Notify friends, family, and business contacts that your identity is being misused. Avoid reposting sensitive ID images.

7. Prepare a Written Statement

A clear statement may help respond to victims, platforms, banks, and authorities.

8. Avoid Direct Threats or Retaliation

Do not threaten the financial victim or suspected scammer. Preserve evidence and proceed through lawful channels.

XX. Evidence Needed in an Online Scam Complaint

Important evidence includes:

Screenshots of chats;
Full profile URL;
username and display name;
phone numbers used;
email addresses;
bank or e-wallet account details;
transaction receipts;
proof of payment;
date and time of transaction;
product listing or offer;
fake ID or stolen ID used;
delivery records;
proof of non-delivery;
demand messages;
platform report confirmation;
affidavits of witnesses;
certification from bank or e-wallet, if available;
device screenshots showing account ownership;
IP logs or platform data, if obtainable through legal process.

Evidence should be organized chronologically.

XXI. Importance of Screenshots and URLs

Screenshots are useful, but they should be preserved properly.

A good screenshot should show:

Date and time;
full conversation;
sender identity;
account name;
profile photo;
URL or username;
amount demanded;
payment instructions;
proof of payment;
confirmation of receipt;
failure to deliver or refusal to refund.

Where possible, preserve the actual link, account handle, phone number, transaction reference number, and device used.

Screenshots can be challenged as edited or incomplete, so they should be supported by original device data, platform records, bank records, and witness testimony.

XXII. Electronic Evidence

Online scam cases rely heavily on electronic evidence.

Electronic evidence may include:

Emails;
chat messages;
screenshots;
call logs;
digital receipts;
e-wallet records;
online banking records;
social media posts;
platform messages;
IP logs;
login alerts;
account recovery notices;
metadata;
audio messages;
video calls;
transaction histories.

To strengthen admissibility and credibility:

Keep original files;
preserve devices;
avoid editing screenshots;
save URLs;
export chat history if possible;
keep transaction reference numbers;
obtain official bank or e-wallet records;
prepare a clear affidavit explaining how the evidence was obtained.

XXIII. Bank and E-Wallet Records

Bank and e-wallet records are crucial because they may show where the money went.

Important details include:

Recipient name;
account number;
e-wallet number;
transaction reference number;
amount;
date and time;
sending account;
receiving account;
cash-out location;
linked mobile number;
device information, if obtainable;
KYC documents;
withdrawal history;
transfer chain.

Banks and e-wallet providers may not release all information directly to private persons due to privacy and banking rules. Law enforcement, prosecutors, or courts may need to request records through proper legal process.

XXIV. SIM Cards and Mobile Numbers

Mobile numbers are often used in online scams. A scammer may use prepaid SIMs, stolen phones, fake registrations, or numbers registered under another person’s identity.

Important evidence includes:

Mobile number used;
screenshots showing the number;
call logs;
text messages;
e-wallet linked to the number;
SIM registration information, if obtainable lawfully;
OTP-related evidence;
device used for transactions.

A number registered under someone’s name does not automatically prove that the registered person committed the scam. Investigators must still determine who controlled the SIM and device.

XXV. The Role of IP Addresses and Device Data

In some cases, IP addresses and device logs may help identify the person behind the scam.

Relevant data may include:

Login IP addresses;
device identifiers;
location history;
browser information;
account recovery logs;
failed login attempts;
SIM/device pairing;
app transaction logs;
platform security logs.

Private individuals usually cannot obtain this information directly from platforms. It may require law enforcement request, subpoena, court order, or cooperation from service providers.

XXVI. Jurisdiction and Venue

Online scams may involve parties in different cities, provinces, or countries.

Possible locations relevant to jurisdiction include:

Place where the victim sent money;
place where the scammer received money;
place where false representations were received;
place where the bank or e-wallet account is located;
place where the offender resides;
place where the account was accessed;
place where the damage occurred.

Cybercrime cases often raise complex venue issues because the act may happen across multiple digital locations. The victim should report where they reside, where they sent the money, or where the relevant transaction occurred, and authorities can guide proper filing.

XXVII. Cross-Border Scams

Some scams involve foreign offenders or foreign-based platforms.

Examples:

Romance scammer pretending to be abroad;
fake investment platform hosted overseas;
crypto wallet outside the Philippines;
foreign phone number;
overseas mule account;
fake shipping or customs scam;
impersonation of an OFW.

Cross-border scams are harder to investigate because evidence may be held by foreign companies or offenders may be outside Philippine jurisdiction.

Still, victims should report locally because Philippine authorities may coordinate through proper channels, and local accounts or money mules may still be involved.

XXVIII. Online Defamation Risk After a Scam

Victims often post online warnings after being scammed. This is understandable, but it carries risk if the scammer used a stolen identity.

Posting the ID, face, name, address, or phone number of a person without verifying whether that person is the scammer may harm an innocent identity theft victim.

A safer public warning focuses on:

account name;
page link;
transaction method;
scam pattern;
phone number used;
cautionary language;
statement that identity may have been stolen;
request for others to verify before transacting.

Avoid declaring that a named person is guilty unless there is sufficient basis.

XXIX. Harassment of the Identity Theft Victim

An identity theft victim may be harassed by scam victims who believe they are the scammer.

Harassment may include:

Threatening messages;
public shaming;
defamatory posts;
repeated calls;
threats to family members;
workplace reports;
barangay complaints;
doxxing;
posting home address;
sending abusive comments.

The identity theft victim may respond by:

Explaining that identity was stolen;
providing a police or cybercrime report reference, if available;
requesting removal of posts using stolen information;
preserving defamatory or threatening messages;
reporting harassment to platforms;
seeking legal remedies if harassment continues.

XXX. Demand Letters and Settlement

A financial victim may send a demand letter to the person believed to be responsible. But if identity theft is possible, the letter should be carefully worded.

A demand letter should identify:

transaction date;
amount sent;
account used;
representation made;
proof of payment;
failure to deliver or refund;
demand for return;
deadline;
reservation of rights.

If the recipient claims identity theft, the victim should verify whether the recipient actually received the money or controlled the account.

Settlement may be possible if the account holder admits involvement or agrees to return funds. But settlement with the wrong person does not solve the actual scam.

XXXI. Complaint-Affidavit

A formal criminal complaint usually requires a complaint-affidavit.

A good complaint-affidavit should contain:

Identity of complainant;
Account of the transaction;
Representations made by the scammer;
Identity used by the scammer;
Amount paid;
Payment channel;
Failure to deliver or refund;
Discovery that the identity may be stolen;
Efforts to contact the suspect;
Documents attached;
Request for investigation and prosecution.

The affidavit should be factual, chronological, and supported by attachments.

XXXII. For the Identity Theft Victim: Affidavit of Denial and Identity Misuse

A person whose identity was stolen may execute an affidavit stating:

They did not create the scam account;
They did not communicate with the victims;
They did not authorize use of their name, photo, ID, or account;
They did not receive the money;
Their ID or account was stolen, hacked, or misused;
They discovered the misuse on a specific date;
They reported the matter to the platform, bank, or authorities;
They request investigation of the real offender.

This affidavit can help in dealing with banks, platforms, employers, victims, and law enforcement.

XXXIII. Recovery of Money

Recovering money in online scam cases can be difficult because funds are often moved quickly.

Possible recovery routes include:

Bank or e-wallet reversal, if timely and allowed;
account freezing or hold request;
voluntary refund by account holder;
settlement;
restitution in criminal case;
civil action for sum of money and damages;
small claims case, if the amount and circumstances fit;
enforcement against identified offender;
tracing funds to mule accounts.

The chance of recovery is higher when the victim reports immediately and the funds have not yet been withdrawn or transferred.

XXXIV. Small Claims Case Possibility

If the scammer or account holder is identified and the amount is within the small claims threshold, the financial victim may consider a small claims case to recover money.

However, small claims is a civil remedy. It does not impose criminal punishment. It may be useful when:

The person who received the money is known;
There is proof of payment;
The amount is definite;
The claim is for return of money;
The claimant wants a faster civil judgment.

If the recipient claims identity theft or unauthorized account use, the case may become factually contested.

XXXV. When the Account Holder Says “My Account Was Hacked”

This is a common defense.

The relevant questions are:

Was the account truly hacked?
When did the account holder discover it?
Was it reported promptly?
Were passwords or OTPs shared?
Did the account holder receive alerts?
Did the account holder withdraw or transfer funds?
Were there prior similar transactions?
Was the account holder negligent?
Did the account holder benefit from the scam?
Did the account holder cooperate with investigation?

A genuine hacking victim should present evidence such as login alerts, account recovery records, platform reports, bank reports, and police complaints.

XXXVI. When the Account Holder Says “I Only Lent My Account”

Lending a bank account, e-wallet, SIM, or verified profile to another person is risky.

The account holder may argue that they did not know the account would be used for fraud. But investigators will examine whether the account holder:

Gave login credentials;
shared OTPs;
allowed cash-in or cash-out;
received a fee;
knew the purpose was suspicious;
ignored red flags;
transferred funds immediately;
allowed repeated transactions;
failed to identify the person using the account.

Lending accounts can expose a person to civil, criminal, and regulatory consequences.

XXXVII. When the Person in the ID Is Innocent

Scammers often send stolen IDs to victims. The person in the ID may be completely innocent.

The financial victim should check:

Did the money go to an account under that person’s name?
Did the person in the ID communicate directly?
Is the ID image possibly stolen from a prior transaction?
Is the profile using the ID fake?
Did the person in the ID file an identity theft report?
Are there multiple victims involving the same stolen ID?
Does the ID owner deny involvement and cooperate?

A stolen ID alone is not enough to prove guilt.

XXXVIII. Role of Barangay Proceedings

Some victims first go to the barangay. Barangay conciliation may be relevant if the parties are known individuals within covered localities.

However, many online scams involve criminal conduct, unknown offenders, parties in different cities, or cybercrime issues that may not be resolved through barangay conciliation.

Barangay proceedings may still be useful for documentation or settlement if the account holder is known and local. But serious online fraud should usually be reported to proper law enforcement authorities.

XXXIX. Role of Police and Cybercrime Units

Law enforcement can help by:

Receiving complaints;
documenting evidence;
coordinating with cybercrime investigators;
requesting preservation of electronic data;
tracing accounts;
coordinating with banks or e-wallets;
identifying suspects;
assisting in filing with prosecutors;
conducting entrapment in proper cases;
preparing investigation reports.

Victims should bring organized documents and avoid relying only on verbal narration.

XL. Role of Prosecutors

After investigation, a criminal complaint may be filed with the prosecutor’s office.

The prosecutor evaluates whether there is probable cause to charge a person in court.

The complainant must present evidence showing:

Fraud or unlawful act;
identity misuse;
participation of the respondent;
damage or prejudice;
connection between the respondent and the scam;
electronic or documentary proof.

The respondent may submit a counter-affidavit denying involvement or claiming identity theft.

XLI. Court Proceedings

If a case is filed in court, the prosecution must prove guilt beyond reasonable doubt.

Evidence may include:

Testimony of the victim;
screenshots and electronic records;
bank or e-wallet records;
platform records;
device evidence;
affidavits;
expert testimony;
account registration documents;
withdrawal records;
CCTV from cash-out locations, if available;
admissions by the accused.

Civil liability may also be awarded in the criminal case if proven.

XLII. Administrative and Regulatory Complaints

Depending on the facts, complaints may also be filed with:

Banks or e-wallet providers;
telecommunications providers;
online platforms;
data privacy regulator;
professional regulatory bodies, if a professional identity was misused;
employer, if employee credentials were used;
business regulator, if fake business documents were used;
consumer protection agencies, for platform or seller issues.

These complaints may not replace criminal or civil action, but they can help stop further harm and preserve evidence.

XLIII. Online Marketplace Scams

Marketplace scams are common because many transactions occur directly between strangers.

Red flags include:

Price too low;
seller refuses meet-up;
seller rushes payment;
seller sends ID but refuses video call;
profile recently created;
comments turned off;
no verifiable transaction history;
payment account name differs from seller name;
courier story keeps changing;
fake tracking number;
repeated excuses;
seller asks for reservation fee;
seller demands payment through multiple accounts;
seller avoids escrow or platform checkout.

Buyers should verify identity, use platform-protected payment methods, and avoid sending full payment to unverified sellers.

XLIV. Fake Rental Scams

Fake rental scams often use stolen photos of real units or stolen identity of landlords.

Common signs:

Rent is unusually cheap;
landlord is abroad and cannot show unit;
immediate reservation fee required;
fake title or tax declaration sent;
fake ID sent;
refusal to allow viewing;
pressure due to “many interested tenants”;
payment to a different person;
no written lease;
fake agent.

Prospective tenants should visit the property, verify ownership or authority, talk to building administration, and avoid paying before confirming.

XLV. Fake Job Scams

Fake recruiters may use stolen identities of HR officers or legitimate companies.

Warning signs:

Application through unofficial channels;
processing fee or training fee required;
request for sensitive documents too early;
job offer without interview;
use of free email instead of company domain;
request to send money through e-wallet;
unrealistic salary;
urgent deadline;
fake employment contract.

Applicants should verify through official company websites, official HR contacts, and avoid sending ID documents to suspicious recruiters.

XLVI. Fake Loan Scams

Fake loan scams collect fees before releasing nonexistent loans.

Warning signs:

Guaranteed approval;
no proper credit check;
processing fee before loan release;
insurance fee;
notarization fee;
release fee;
payment to personal e-wallet;
use of stolen agent ID;
pressure to pay immediately;
threats after refusal.

Legitimate lenders should have verifiable registration, official channels, clear loan documents, and lawful practices.

XLVII. Investment and Crypto Scams

Scammers may impersonate real traders, influencers, or financial professionals.

Warning signs:

Guaranteed high returns;
no risk;
pressure to invest quickly;
referral commissions;
fake screenshots of profits;
stolen celebrity or professional identity;
request to send crypto or e-wallet funds;
refusal to provide registration details;
fake platform dashboard;
withdrawal blocked unless more fees are paid.

Victims should preserve wallet addresses, transaction hashes, platform URLs, and communication records.

XLVIII. Romance Scams

Romance scams often involve long-term emotional manipulation.

Common patterns:

Stolen photos;
fake foreign identity;
sudden love declarations;
emergency medical or travel expenses;
package delivery or customs fees;
investment invitation;
refusal to video call;
inconsistent stories;
request for secrecy;
use of multiple names.

Victims may feel embarrassed, but they should report promptly and preserve evidence.

XLIX. Phishing and Account Takeover

Phishing occurs when a scammer tricks a person into revealing credentials, OTPs, or account recovery codes.

Common phishing methods include:

Fake login pages;
fake bank alerts;
fake delivery links;
fake job application forms;
fake verification requests;
fake marketplace buyer links;
fake e-wallet support;
QR code scams.

Once an account is taken over, the scammer may use the victim’s identity to scam contacts.

Never share OTPs, passwords, recovery codes, or remote access.

L. Deepfakes and AI-Generated Identity Fraud

Modern scams may use manipulated images, voice cloning, or AI-generated videos.

Possible examples:

Fake video call using another person’s face;
AI-generated profile photos;
cloned voice asking for emergency money;
fake celebrity endorsement;
manipulated ID selfie;
synthetic business representative.

Victims should not rely solely on a photo, video, or voice message. Verification should use independent channels.

LI. Protecting Personal Identity Online

To reduce risk:

Limit public posting of IDs;
watermark ID copies with purpose and date;
avoid sending full ID unless necessary;
cover unnecessary ID numbers where allowed;
use strong passwords;
enable two-factor authentication;
avoid reusing passwords;
secure email accounts;
review account login activity;
avoid clicking suspicious links;
update recovery information;
be careful with public Wi-Fi;
avoid storing ID photos in unsecured folders;
verify recipients before sending documents;
report fake accounts quickly.

A copied ID can be reused in many scams.

LII. Watermarking IDs

When sending ID copies for legitimate purposes, consider adding a visible watermark such as:

“For [specific transaction] only”
“Submitted to [company/platform] on [date]”
“Not valid for loans or account opening”
“For identity verification only”

This may not fully prevent misuse, but it makes fraudulent reuse harder.

Avoid covering legally required details if the recipient needs them for a legitimate transaction, but do not overshare unnecessary information.

LIII. Safe Online Transaction Practices

For buyers:

Verify seller identity independently;
prefer platform-protected payments;
avoid full advance payment;
check seller history;
do video verification for high-value items;
confirm account name matches seller;
use meetups in safe public places;
inspect item before payment;
avoid rushed deals.

For sellers:

Verify proof of payment directly in your bank or wallet;
do not rely on screenshots;
wait for cleared funds;
beware of fake courier links;
avoid sharing unnecessary IDs;
document shipment;
use trackable delivery.

For both parties:

Save all transaction records.

LIV. What To Do Before Posting a Scam Warning

Before posting publicly:

Confirm whether the identity used may be stolen.
Avoid posting full ID numbers, addresses, or private information.
Focus on the account, number, and transaction method.
Use cautious language.
Preserve evidence first.
Report to platform and authorities.
Avoid threats.
Remove or correct posts if an innocent person proves identity theft.

Public warnings can help others, but careless accusations can harm innocent people.

LV. Defenses of an Accused Person

A person accused of an online scam may raise defenses such as:

Identity was stolen;
account was hacked;
SIM was lost or stolen;
e-wallet was opened fraudulently;
no participation in the transaction;
no receipt of money;
no control over account;
no fraudulent intent;
transaction was legitimate;
delivery failed due to non-fraudulent reason;
money was refunded;
complainant dealt with another person;
screenshots are incomplete or fabricated;
account name was spoofed;
respondent is merely another victim.

The strength of the defense depends on evidence.

LVI. Evidence for the Identity Theft Defense

A person claiming identity theft should gather:

Police or cybercrime report;
platform impersonation report;
proof of hacked account;
login alerts;
password reset notifications;
SIM replacement records;
lost phone report;
bank or e-wallet dispute report;
proof of location at relevant times;
proof that no money was received;
messages from other scam victims;
screenshots of fake accounts;
prior legitimate use of photos or IDs;
affidavit denying involvement.

Prompt reporting helps establish credibility.

LVII. Red Flags That the Named Person May Be Innocent

The person whose ID was sent may be innocent if:

The account name differs from the ID name;
the ID image is low-resolution or reused;
multiple fake accounts use the same ID;
the person immediately denies involvement;
the person filed an identity theft report;
payment went to a different account;
the profile was recently created;
the real person’s legitimate account warns of impersonation;
the scammer refuses live verification;
the ID was previously posted online;
the ID owner is also receiving harassment from victims.

Victims should distinguish between the real scammer and the person whose identity was misused.

LVIII. Red Flags of Actual Participation

A person may be more likely involved if:

Scam funds went to their own account;
they withdrew the money;
they controlled the phone number;
they communicated with the victim;
they used their own device;
they refused to explain transactions;
they received commissions;
several victims paid the same account;
they lent the account knowingly;
they deleted evidence;
they made inconsistent statements;
they threatened victims;
they continued using the account after complaints.

Actual participation must still be proven.

LIX. Timeline of an Online Scam Using Stolen Identity

A typical timeline may look like this:

Scammer obtains a person’s ID or photo.
Scammer creates fake account or uses hacked account.
Scammer posts an offer or contacts victim.
Victim asks for proof of identity.
Scammer sends stolen ID or fake document.
Victim sends payment to bank or e-wallet.
Scammer confirms receipt.
Scammer delays delivery or blocks victim.
Victim posts warning or reports to platform.
Real identity owner discovers misuse.
Victim reports to bank, platform, and law enforcement.
Authorities trace accounts, numbers, and devices.
Complaint may proceed to prosecutor or court.

A clear timeline helps identify inconsistencies and responsible persons.

LX. Sample Evidence Matrix

Issue	Evidence Needed
Identity used	Screenshots of profile, ID, photo, messages
Fraudulent representation	Chat showing false promise or offer
Payment	Receipt, bank transfer, e-wallet reference
Recipient	Account name, number, wallet details
Non-delivery or loss	Follow-up messages, blocked account, no refund
Identity theft	Real person’s denial, fake account report, hacked account proof
Account control	Bank/e-wallet records, phone number, device logs
Damages	Amount paid, expenses, reputational harm
Platform involvement	URLs, report confirmations, listing details

LXI. Drafting a Strong Narrative

A strong complaint narrative should answer:

Who contacted whom?
What account was used?
What identity was presented?
What exactly was promised?
What amount was paid?
Where was payment sent?
What happened after payment?
How was the identity discovered to be stolen?
Who actually received the funds?
What reports were made?
What evidence is attached?

The narrative should avoid speculation and focus on verifiable facts.

LXII. Practical Mistakes by Financial Victims

Common mistakes include:

Deleting chats after being blocked;
failing to screenshot URLs;
posting full IDs publicly;
accusing the ID owner without verification;
waiting too long to report to bank;
relying only on platform reports;
not saving transaction reference numbers;
sending more money to recover previous payment;
paying “recovery agents”;
failing to file a formal complaint;
not checking account names before transfer;
trusting ID photos without live verification.

LXIII. Practical Mistakes by Identity Theft Victims

Common mistakes include:

Ignoring reports from scam victims;
failing to report impersonation;
arguing publicly without preserving evidence;
not securing accounts;
not notifying banks or e-wallets;
not documenting fake profiles;
deleting messages from victims;
failing to execute an affidavit of identity misuse;
sending more personal documents to strangers to “prove innocence”;
threatening complainants.

The identity theft victim should create a record of innocence and cooperate with lawful investigation.

LXIV. Interaction With Data Privacy Rights

Both victims and investigators should handle personal information carefully.

Financial victims may need to use personal information as evidence, but they should avoid unnecessary public disclosure.

Identity theft victims have a right to object to unauthorized use of their personal data, especially if their ID, face, address, or contact details are being circulated.

A balanced approach is to preserve evidence for authorities while minimizing public exposure of sensitive data.

LXV. Employer and Professional Identity Misuse

Sometimes scammers impersonate employees, lawyers, doctors, accountants, brokers, real estate agents, recruiters, teachers, or public officials.

The real professional may suffer reputational harm.

Actions may include:

Notify employer or professional organization;
issue official clarification;
report fake account;
preserve evidence;
notify clients;
file identity theft report;
request takedown;
monitor for additional misuse.

For licensed professionals, misuse of identity can damage public trust and should be addressed promptly.

LXVI. Business Identity Theft

A scammer may copy a legitimate business name, logo, address, DTI registration, SEC documents, mayor’s permit, or business page.

Victims may pay fake invoices or place orders with fake pages.

Businesses should:

Verify official pages;
warn customers;
report fake pages;
use verified channels;
register trademarks where appropriate;
monitor online impersonation;
coordinate with platforms;
preserve evidence for complaints.

Customers should transact only through official accounts and confirm payment channels.

LXVII. Fake Proof of Payment

Many scams involve fake payment screenshots.

A seller should not release goods based solely on a screenshot. They should check actual account balance or transaction confirmation from the bank or wallet app.

Fake proof of payment may include:

Edited screenshot;
fake bank email;
pending transfer misrepresented as completed;
reversed transaction;
fake check deposit;
fake escrow notice;
fake courier payment confirmation.

A screenshot is not the same as cleared funds.

LXVIII. Chargeback, Reversal, and Freezing

Whether funds can be reversed or frozen depends on timing, payment method, bank or wallet rules, and whether the funds remain in the receiving account.

Victims should report immediately and provide:

transaction reference;
recipient account;
amount;
date and time;
scam details;
police report, if requested;
screenshots.

Even if reversal is not guaranteed, immediate reporting may help preserve records or prevent further transfers.

LXIX. Crypto and Digital Asset Scams

Crypto scams are difficult because transactions may be irreversible and wallets may be pseudonymous.

Victims should preserve:

wallet addresses;
transaction hashes;
exchange account details;
screenshots of platform;
chat messages;
investment promises;
withdrawal error messages;
fake KYC pages;
domain names.

If funds passed through a regulated exchange, legal process may help identify account holders. If funds moved to private wallets or foreign exchanges, recovery becomes harder.

LXX. Online Scam Involving Minors

If a minor’s identity is used or a minor is victimized, additional protection issues arise.

Parents or guardians should:

preserve evidence;
secure accounts;
avoid public exposure of the minor’s identity;
report to platform;
report to authorities;
coordinate with school if school identity was used;
provide emotional support.

If minors are involved in the scam as perpetrators, special rules on juvenile justice may apply.

LXXI. Scam Using a Deceased Person’s Identity

Some scammers use the identity of a deceased person to avoid detection.

Red flags include:

ID belongs to deceased person;
social media profile inactive for years;
relatives deny transaction;
documents are outdated;
account was newly created using old photos.

The family of the deceased person may report identity misuse and request takedown of fake accounts.

LXXII. Scam Using an OFW’s Identity

OFWs are common targets for identity misuse because they may be abroad and unable to immediately respond.

Scammers may use their photos and IDs to:

pretend to sell property or goods;
solicit emergency money;
fake romantic relationships;
borrow from relatives;
conduct fake investments;
open accounts.

OFWs should secure accounts, avoid public posting of IDs and travel documents, and inform family if impersonation occurs.

LXXIII. Scam Using a Lost or Stolen Phone

If a phone is lost or stolen, accounts on that device may be used for scams.

Immediate steps:

Lock or erase device remotely;
report lost SIM to telco;
request SIM replacement or deactivation;
change passwords;
log out of all sessions;
notify banks and e-wallets;
report unauthorized transactions;
warn contacts;
file police report if needed.

A lost phone can lead to account takeover, OTP interception, and identity fraud.

LXXIV. Scam Using a Lost Government ID

If a government ID is lost, it may be used for identity-based scams.

Steps:

File an affidavit of loss;
report to issuing agency if applicable;
monitor for misuse;
avoid posting the lost ID online;
keep proof of loss date;
notify financial institutions if high risk;
report any fake account using the ID.

An affidavit of loss may help show that later misuse was unauthorized.

LXXV. Role of Notarized Affidavits

Affidavits may help document the case.

Common affidavits include:

Complaint-affidavit by financial victim;
affidavit of identity theft;
affidavit of denial;
affidavit of loss;
affidavit of hacked account;
affidavit of non-receipt of funds;
witness affidavit.

Affidavits should be truthful, specific, and supported by attachments.

LXXVI. Practical Prevention for Platforms and Businesses

Businesses that collect IDs should protect them carefully.

Best practices include:

collect only necessary data;
limit access to ID files;
encrypt storage;
delete data when no longer needed;
watermark received documents internally;
audit employee access;
train staff on phishing;
avoid storing IDs in shared folders;
implement incident response;
notify affected persons when appropriate;
verify high-risk transactions through multiple channels.

A data leak can enable large-scale identity fraud.

LXXVII. Practical Prevention for Banks and E-Wallet Users

Users should:

never share OTP;
never lend accounts;
never sell verified wallet accounts;
avoid clicking fake support links;
secure SIM and phone;
check recipient details before transfer;
enable app locks and biometrics;
monitor transaction alerts;
report suspicious transactions immediately;
avoid using public devices for banking.

Banks and e-wallets usually treat account security as a shared responsibility.

LXXVIII. Practical Prevention for Online Sellers

Online sellers should:

verify payment in the actual account;
avoid releasing goods based on screenshots;
use official delivery channels;
record packing and shipment;
be careful with overpayment scams;
avoid clicking buyer-provided links;
watermark IDs if required;
avoid sending unnecessary documents;
keep transaction logs.

Sellers can also become identity theft victims if they send IDs to fake buyers.

LXXIX. Practical Prevention for Online Buyers

Online buyers should:

avoid deals that are too good to be true;
verify seller identity through live video or independent contact;
check account age and reviews;
avoid direct transfers for high-value items;
use escrow or platform checkout;
search for duplicate photos or listings when possible;
confirm recipient account name;
avoid paying multiple fees;
save all evidence;
be cautious when seller sends an ID as proof but refuses real-time verification.

A real ID photo does not guarantee a real transaction.

LXXX. Practical Prevention for Job Applicants

Job applicants should:

verify recruiter email domain;
check official company website;
avoid paying application fees;
limit ID sharing early in the process;
watermark submitted IDs;
beware of unusually fast hiring;
avoid sending bank details unless hired through verified channels;
report fake recruiters.

Job application documents are a common source of stolen identities.

LXXXI. Practical Prevention for Loan Applicants

Loan applicants should:

verify lender legitimacy;
avoid sending fees before loan release;
watermark IDs;
avoid sending selfies with ID to unknown lenders;
read app permissions;
avoid loan apps that access contacts unnecessarily;
keep records of submissions;
report misuse of data.

Fake lenders may collect IDs and then use them for scams.

LXXXII. Practical Prevention for Public Figures and Professionals

Public figures, professionals, and business owners should:

maintain verified official accounts;
post official contact channels;
monitor impersonation;
warn followers against fake solicitations;
avoid posting high-resolution ID images;
report impersonators quickly;
keep a record of fake accounts;
use brand protection measures where possible.

Their identities are often exploited because people already trust them.

LXXXIII. Dealing With Multiple Victims

A single stolen identity may be used to scam many people.

The identity theft victim may receive multiple complaints from strangers. Practical steps include:

Create a standard factual response;
avoid sharing additional sensitive information;
ask victims to preserve evidence;
encourage victims to report to authorities;
collect fake account links;
file a consolidated identity theft report if possible;
coordinate with platform takedown;
avoid admitting liability for acts not committed.

Multiple reports can help prove a pattern of impersonation.

LXXXIV. When to Consult a Lawyer

Legal help is advisable when:

The amount is large;
multiple victims are involved;
the identity theft victim is being publicly accused;
bank accounts are frozen;
police or prosecutor proceedings begin;
a demand letter is received;
a civil case is contemplated;
the scam involves business identity;
sensitive personal information is being spread;
the case involves minors, professionals, or public officials;
the victim wants damages;
the accused claims identity theft.

A lawyer can help frame the case correctly and avoid misdirected accusations.

LXXXV. Key Takeaways

An online scam using stolen identity is a serious legal and practical problem in the Philippines. It may involve cybercrime, estafa, identity theft, falsification, data privacy violations, hacking, civil damages, and platform takedowns.

The most important points are:

A person whose identity was used may also be a victim.
A stolen ID photo does not prove that the ID owner committed the scam.
The financial victim should report quickly to banks, e-wallets, platforms, and authorities.
The identity theft victim should document misuse, secure accounts, and file reports.
Electronic evidence must be preserved carefully.
Bank, e-wallet, SIM, platform, and device records are often crucial.
Public accusations should be made cautiously to avoid harming innocent people.
Account holders who lend accounts or allow others to use verified wallets may face serious liability.
Recovery of money depends heavily on speed and traceability.
Prevention requires careful handling of IDs, accounts, passwords, OTPs, and online transactions.

Online identity-based scams thrive on urgency, trust, and poor verification. The best protection is a combination of skepticism, documentation, prompt reporting, and careful legal action.