I. Introduction

Online threats from dummy accounts are now a common legal problem in the Philippines. A person may receive threatening private messages, comments, tagged posts, fake accusations, blackmail, harassment, or intimidation from an account that uses a fake name, stolen photo, no profile picture, newly created profile, or unverifiable identity.

The use of a dummy account does not make the act lawful. It may make identification harder, but it does not prevent criminal, civil, administrative, or platform-based remedies. Philippine law recognizes that crimes and unlawful acts may be committed through computers, mobile phones, social media platforms, messaging apps, email, gaming accounts, e-wallet accounts, and other digital channels.

A victim of online threats should focus on three things:

Preserving evidence properly;
Identifying the possible offenses;
Filing the complaint with the proper authority.

The law does not require the victim to personally know the real identity of the person behind the dummy account before seeking help. Law enforcement and prosecutors may use available procedures to trace accounts, request data, preserve digital evidence, and determine the person responsible, subject to legal requirements.

II. What Is a “Dummy Account”?

A dummy account is not a technical legal term, but in ordinary use it refers to an online account that hides the user’s true identity.

It may be:

A fake Facebook, Instagram, TikTok, X, Telegram, Viber, WhatsApp, Discord, Reddit, or email account;
An account using another person’s photo or name;
A newly created account with little activity;
An account with no personal details;
An account using a fake number or fake email;
An account pretending to be someone else;
An account created only to threaten, harass, extort, stalk, or defame.

A dummy account can be used for many unlawful purposes, including threats, cyberlibel, identity theft, blackmail, sextortion, doxing, stalking, harassment, fraud, and intimidation.

III. Online Threats: What Counts as a Threat?

A threat is not limited to direct words like “I will kill you.” It can include statements, images, voice messages, videos, emojis, memes, or coded language that communicate an intention to harm, expose, intimidate, or coerce another person.

Examples include:

“I will kill you.”
“I know where you live.”
“Your family will pay.”
“I will post your private photos.”
“I will ruin your reputation.”
“Withdraw your complaint or something bad will happen.”
“Pay me or I will expose you.”
Sending a photo of a gun or weapon with a menacing message;
Sending the victim’s home address with a threatening caption;
Tagging the victim in posts encouraging others to attack them;
Threatening to leak intimate images;
Threatening to accuse the victim falsely unless money is paid;
Threatening harm to the victim’s child, spouse, parent, or business.

The legal classification depends on the exact words, context, relationship of the parties, intent, surrounding acts, and evidence.

IV. Main Philippine Laws That May Apply

Several laws may apply depending on the content of the message and surrounding facts.

1. Revised Penal Code

The Revised Penal Code may apply to threats, coercion, grave coercion, unjust vexation, slander, libel, grave oral defamation, light threats, grave threats, and related offenses.

For online threats, the most relevant provisions are usually those involving:

Grave threats;
Light threats;
Other light threats;
Grave coercions;
Unjust vexation;
Libel or defamation;
Alarms and scandals, depending on the circumstances;
Intriguing against honor, in limited situations.

The fact that the threat was made online does not necessarily remove it from the Revised Penal Code. The online medium may instead trigger the application of the Cybercrime Prevention Act.

2. Cybercrime Prevention Act

The Cybercrime Prevention Act applies when certain crimes are committed through information and communications technology.

For online threats, the law may become relevant in two main ways:

A. Cybercrime offenses directly defined under the law

These include offenses such as:

Illegal access;
Illegal interception;
Data interference;
System interference;
Misuse of devices;
Cyber-squatting;
Computer-related forgery;
Computer-related fraud;
Computer-related identity theft;
Cybersex;
Child pornography-related cyber offenses;
Unsolicited commercial communications;
Cyberlibel.

B. Crimes under the Revised Penal Code committed through ICT

Certain traditional crimes may be committed through a computer system, mobile device, social media account, email, or messaging app. The use of information and communications technology may affect prosecution and penalties.

Thus, a threatening message sent through a dummy Facebook account, Messenger, email, or chat app may involve both traditional criminal concepts and cybercrime procedures.

3. Cyberlibel

If the dummy account posts or sends defamatory accusations online, the case may involve cyberlibel.

Cyberlibel may arise where a person publicly imputes a crime, vice, defect, dishonorable act, or condition against another person, causing dishonor, discredit, or contempt, through an online platform.

Examples:

Posting that a person is a thief, scammer, mistress, drug user, corrupt official, prostitute, rapist, or criminal without proof;
Creating a fake account to spread false accusations;
Tagging the victim’s employer, school, relatives, or customers;
Posting edited screenshots or false narratives;
Reposting defamatory material with malicious commentary.

Cyberlibel is separate from a threat, but the same dummy account may commit both.

4. Computer-Related Identity Theft

If the dummy account uses another person’s name, photo, personal information, or identity to cause damage, commit fraud, threaten, harass, or mislead others, computer-related identity theft may be considered.

This may apply where the perpetrator:

Uses the victim’s photo and name to create a fake account;
Pretends to be the victim while sending messages;
Uses another person’s identity to threaten someone;
Creates a fake profile using stolen personal data;
Uses screenshots, IDs, phone numbers, or private information to impersonate another person.

The key issue is whether identifying information was misused through a computer system.

5. Data Privacy Act

The Data Privacy Act may be relevant if the dummy account collects, posts, shares, threatens to expose, or misuses personal information.

Examples:

Posting the victim’s address, phone number, workplace, school, or family details;
Publishing private messages, IDs, medical details, financial information, or personal records;
Doxing;
Threatening to release private information;
Using personal data to harass or intimidate the victim;
Sharing intimate information without consent.

The National Privacy Commission may become relevant for data privacy violations, but criminal threats and cybercrime complaints may still belong before law enforcement and prosecutors.

6. Anti-Photo and Video Voyeurism Law

If the threat involves intimate photos or videos, the Anti-Photo and Video Voyeurism Law may apply.

This is especially important where the dummy account threatens to:

Upload intimate photos;
Send private sexual images to relatives, classmates, co-workers, or employers;
Post videos taken during a private act;
Use intimate images to extort money or force compliance;
Share screenshots from video calls or private exchanges.

The law may apply even if the images were originally taken with consent, if later publication or distribution is without consent.

7. Violence Against Women and Their Children

If the victim is a woman and the offender is a current or former spouse, sexual partner, dating partner, or person with whom she has or had a sexual or dating relationship, online threats may fall under the law on violence against women and their children.

Cyber harassment, threats, intimidation, controlling behavior, emotional abuse, stalking, humiliation, and threats to release intimate materials may be relevant if connected to the relationship.

VAWC can include psychological violence, not just physical harm. Online messages may be evidence of harassment, intimidation, control, or emotional abuse.

8. Safe Spaces Act

The Safe Spaces Act may apply to gender-based online sexual harassment.

Examples:

Unwanted sexual comments;
Threats involving sexual humiliation;
Sending unsolicited sexual images;
Repeated sexual harassment online;
Misogynistic, homophobic, or transphobic harassment;
Threatening to expose sexual information;
Online stalking with sexual or gender-based content.

The law may be relevant especially when the online threat has a gender, sexuality, or sexual harassment component.

9. Special Protection of Children Against Abuse, Exploitation and Discrimination

If the victim is a minor, stricter laws may apply. Online threats against minors may involve child abuse, online sexual abuse or exploitation, child pornography-related offenses, trafficking, cyberbullying, or other special protections.

Threats involving intimate images of minors are especially serious and may trigger severe criminal liability.

10. Anti-Bullying Law and School Remedies

If the threat involves students, classmates, school chats, group messages, or school-related social media, school remedies may also be available.

The Anti-Bullying framework may apply where the conduct involves cyberbullying among students. Schools may have duties to investigate, protect the student, impose discipline, and coordinate with parents or authorities.

This does not prevent the filing of criminal complaints where the facts justify it.

V. Is an Online Threat a Cybercrime?

It can be.

An online threat may be treated as a cybercrime when the unlawful act is committed through information and communications technology. A dummy account used through a phone, app, website, or computer system may bring the matter within cybercrime investigation mechanisms.

However, the exact charge depends on the content:

Online conduct	Possible legal issue
“I will kill you” sent by Messenger	Grave threats or related offense, possibly cyber-related
“Pay me or I will post your photos”	Threats, coercion, robbery/extortion-type conduct, cybercrime, voyeurism if intimate images
Fake account using victim’s photo	Identity theft, data privacy issues, platform violation
False accusation posted publicly	Cyberlibel
Publishing victim’s address and inviting harm	Threats, harassment, data privacy, possible incitement issues
Threatening ex-partner online	VAWC, threats, coercion, cyber harassment
Sexual threats online	Safe Spaces Act, VAWC, cybercrime, voyeurism depending on facts
Threat against minor	Child protection laws, cybercrime, threats
Hacking account then threatening victim	Illegal access, identity theft, threats, data interference

VI. The Importance of Evidence Preservation

Evidence is the foundation of any cybercrime complaint. Dummy account cases often fail or become difficult when victims delete messages, block accounts too early, fail to capture URLs, or rely only on incomplete screenshots.

The victim should preserve evidence before confronting the account.

A. Screenshots

Take screenshots showing:

The threatening message;
The sender’s account name;
Profile picture;
Username or handle;
Date and time;
Full conversation thread;
Message status;
Links, attachments, images, videos, or voice messages;
Group chat name and members, if applicable;
Public post comments and reactions;
URL or web address of the profile or post.

Screenshots should not be cropped unnecessarily. Full-screen screenshots are better because they show context.

B. Screen Recording

A screen recording may show:

Opening the app;
Going to the profile;
Showing the threatening message;
Showing the account URL;
Scrolling through the conversation;
Opening the profile details;
Showing the date and time;
Showing public posts or comments.

Screen recordings can help prove that screenshots were not fabricated.

C. URLs and Account Identifiers

For Facebook, Instagram, TikTok, X, and similar platforms, the account URL, username, profile ID, or handle is very important. Display names can be changed easily, but URLs and IDs may provide better leads.

The victim should copy and save:

Profile link;
Post link;
Comment link;
Message link, if available;
Username or handle;
Email address, phone number, or recovery details if visible;
Group link;
Page link.

D. Preserve Original Files

If the threat includes images, videos, documents, voice notes, or attachments, save the original files if possible. Do not edit, compress, or rename them unnecessarily.

E. Save the Device

The phone, laptop, or tablet that received the threat may itself be important evidence. Avoid factory reset, deletion, or app reinstallation before evidence is preserved.

F. Export Data

Some platforms allow users to download account data or message history. This may help preserve evidence, especially if the perpetrator later unsends messages or deletes the account.

G. Notarization or Affidavit

Screenshots may be attached to a sworn complaint-affidavit. In some cases, lawyers recommend notarized affidavits describing how and when the screenshots were taken. A formal cybercrime investigation may require more technical validation.

VII. Should the Victim Reply to the Dummy Account?

Usually, the victim should avoid emotional replies, threats, insults, or counter-harassment. Replies may worsen the situation or be used against the victim.

A short preservation-minded response may be acceptable in some cases, such as:

“Do not contact me again.”
“I am preserving these messages and will report this to the authorities.”
“Stop sending threats.”

But if the threat involves immediate danger, extortion, or violence, the safer step is to preserve evidence and report promptly.

The victim should avoid:

Threatening revenge;
Posting the suspected person’s identity without proof;
Doxing the suspected perpetrator;
Hacking or attempting to trace the account illegally;
Paying extortion money without legal advice;
Deleting messages;
Creating a fake account to retaliate.

VIII. Blocking, Reporting, and Taking Down the Account

Blocking may protect the victim from further messages, but it may also make it harder to view the account. The better sequence is usually:

Capture screenshots and videos;
Save links and identifiers;
Ask trusted witnesses to preserve public posts, if any;
File a platform report;
Then block or restrict if needed for safety.

Platform reporting may lead to account suspension, removal of content, or preservation of logs depending on the platform’s rules. However, platform takedown does not automatically create a criminal case. If the victim wants prosecution, the matter must still be reported to the proper authorities.

IX. Where to File a Complaint

A victim may file or seek assistance from several offices depending on the facts.

1. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group handles cybercrime investigations, digital evidence assistance, and cyber-related complaints.

2. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division also receives cybercrime complaints and conducts investigations.

3. City or Provincial Prosecutor’s Office

A criminal complaint may be filed before the prosecutor’s office through a complaint-affidavit and supporting evidence. In many cases, victims first go to PNP or NBI for technical assistance, then proceed to prosecution.

4. Women and Children Protection Desk

If the victim is a woman, child, or the case involves VAWC, sexual harassment, child abuse, exploitation, or threats against children, the Women and Children Protection Desk may be involved.

5. Barangay

Barangay conciliation may be relevant for certain disputes between individuals in the same city or municipality. However, serious criminal cases, offenses punishable above certain thresholds, cases involving urgent danger, cybercrime investigations, and cases involving parties in different places may not be suitable for simple barangay settlement.

Victims should not rely only on barangay proceedings when there is a real threat of violence, extortion, sexual exploitation, or ongoing cyber harassment.

6. National Privacy Commission

If the conduct involves unauthorized disclosure, misuse, or exposure of personal information, the National Privacy Commission may be relevant. This is often in addition to criminal remedies, not necessarily a replacement.

7. School, Employer, or Platform

Where the threat is connected to a school, workplace, organization, or platform, administrative complaints may also be filed. These remedies may result in discipline, account removal, suspension, or protective action, but criminal remedies may still be available.

X. Filing a Cybercrime Complaint: Practical Requirements

Requirements may vary, but a victim should usually prepare:

Valid government ID;
Printed screenshots;
Digital copies of screenshots and videos;
URLs and account links;
Device used to receive the threats;
SIM card or phone number involved, if relevant;
Sworn complaint-affidavit;
Timeline of incidents;
Names of suspected persons, if any;
Names of witnesses;
Platform reports, if already made;
Copies of related messages, emails, or posts;
Proof of relationship with suspect, if relevant;
Proof of identity theft, if the dummy account used the victim’s identity;
Medical, psychological, or security reports, if harm occurred;
Police blotter, if there is immediate danger.

It is better to bring both printed and digital copies. Investigators may ask to inspect the device or request the victim to provide files through official channels.

XI. The Complaint-Affidavit

A complaint-affidavit should be clear, chronological, and factual.

It should state:

The complainant’s identity;
The platform used;
The account name, username, and link of the dummy account;
The date and time of each threat;
The exact threatening words or acts;
Why the complainant felt threatened;
Whether the threat was repeated;
Whether the dummy account knows private information;
Whether there is a suspected real person behind the account;
Why the complainant suspects that person, if applicable;
The harm suffered;
The evidence attached;
The relief requested.

If the suspect is unknown, the complaint may be against an unidentified person, with the dummy account details provided for investigation.

XII. Can a Case Be Filed If the Real Person Behind the Dummy Account Is Unknown?

Yes, a complaint may still be reported. The initial complaint can identify the account, URL, handle, phone number, email, or other digital identifiers even if the real-world name is unknown.

Law enforcement may seek to determine:

IP logs;
Login locations;
Device identifiers;
Registered email or phone;
Linked accounts;
Recovery contacts;
Payment information, if any;
SIM registration details, if phone numbers are involved;
Subscriber information;
Platform metadata;
Related messages and accounts.

Access to some information may require formal legal processes and cooperation from platforms, telecoms, or service providers.

The victim should not attempt illegal tracing, hacking, phishing, or unauthorized access. Doing so may expose the victim to criminal liability.

XIII. Preservation Orders and Platform Data

Cybercrime cases often require data that only platforms or service providers have. This may include login records, IP addresses, timestamps, account registration data, and related metadata.

Authorities may seek preservation of computer data, but victims should act quickly because platforms may retain certain data only for limited periods. A dummy account may also be deleted, renamed, or deactivated.

This is why early reporting matters.

XIV. Anonymous Speech Versus Criminal Threats

Not all anonymous online speech is illegal. People may use pseudonyms online for privacy, political speech, whistleblowing, artistic expression, or personal safety.

However, anonymity does not protect:

Threats of violence;
Extortion;
Cyberlibel;
Identity theft;
Doxing;
Sexual harassment;
Distribution of intimate images;
Child exploitation;
Stalking;
Fraud;
Coercion;
Harassment that violates law.

The legal issue is not merely that the account is fake. The issue is what the account did.

XV. Distinguishing Threat, Insult, Defamation, and Harassment

Online disputes often involve overlapping conduct.

A. Threat

A threat communicates possible harm, intimidation, or coercive pressure.

Example: “I will hurt you if you report me.”

B. Insult

An insult may be offensive but not always criminal.

Example: “You are useless.”

Depending on context, repeated insults may form part of harassment, unjust vexation, VAWC, Safe Spaces, or workplace/school discipline.

C. Defamation

Defamation involves statements that injure reputation.

Example: “She stole company money,” if false and maliciously published.

D. Harassment

Harassment may include repeated unwanted contact, intimidation, humiliation, sexual comments, stalking, or coordinated attacks.

Example: dozens of messages from multiple dummy accounts after the victim blocks the first one.

XVI. Immediate Danger: What to Do

If the online threat appears immediate or credible, the victim should prioritize safety.

Indicators of serious risk include:

The account knows the victim’s address;
The account sends photos of the victim’s house, workplace, or child;
The account describes the victim’s routine;
The threat includes weapons;
The sender has a history of violence;
The sender demands money or compliance;
The threat is repeated and escalating;
The victim is being followed offline;
The sender threatens family members;
The sender knows private information not publicly available.

Practical steps:

Call local police or emergency contacts;
Go to a safe place;
Inform family, security, school, or workplace;
Avoid meeting the sender;
Preserve evidence;
File a police blotter if appropriate;
Seek protection orders in VAWC or child-related cases where applicable;
Coordinate with building, barangay, school, or employer security.

XVII. If the Threat Is From an Ex-Partner

Online threats from an ex-partner may involve ordinary threats, but may also involve VAWC, stalking, coercion, sexual image threats, or psychological abuse.

Relevant facts include:

Past dating or sexual relationship;
Threats to release intimate images;
Threats against children;
Repeated unwanted messages;
Monitoring the victim’s whereabouts;
Using dummy accounts after being blocked;
Threatening self-harm to control the victim;
Threatening to ruin the victim’s reputation;
Contacting the victim’s family, employer, or friends;
Demanding reconciliation, sex, money, or silence.

Victims should preserve all messages, including from known and dummy accounts, because patterns matter.

XVIII. If the Threat Involves Intimate Photos or Videos

Threats involving intimate materials are especially serious.

The victim should:

Save evidence of the threat;
Save proof that the account has or claims to have the images;
Avoid sending more images or money;
Report immediately if publication is threatened;
Report the content to the platform;
Ask the platform to remove non-consensual intimate images;
Consider criminal complaints for threats, coercion, cybercrime, voyeurism, VAWC, Safe Spaces, or child protection laws, depending on the facts.

If the victim is a minor, the case becomes more urgent and may involve child sexual abuse or exploitation laws.

XIX. If the Dummy Account Uses the Victim’s Name or Photo

This may involve identity theft, data privacy violations, defamation, and platform impersonation.

The victim should preserve:

Screenshot of the fake profile;
URL of the fake profile;
Photos or personal details copied;
Posts or messages sent by the fake profile;
Reports from people who received messages;
Any confusion or harm caused;
Evidence that the real person did not create the account.

The victim may report the account to the platform for impersonation and file a complaint with cybercrime authorities if the account is used for unlawful acts.

XX. If the Threat Comes Through Text or Phone Number

If the threat is sent by SMS, messaging app linked to a number, or calls, the SIM registration framework may help investigators, but the victim should still preserve:

Screenshots of messages;
Phone number;
Date and time;
Call logs;
Voice recordings, if lawfully obtained;
SIM or network details;
Any linked e-wallet or account;
Proof of demands or threats.

Victims should not assume that a registered SIM automatically identifies the real offender, because SIMs may be borrowed, stolen, fraudulently registered, or controlled by another person. But it can be an investigative lead.

XXI. If Money Is Demanded

If the dummy account demands money in exchange for not harming, exposing, accusing, or embarrassing the victim, the case may involve extortion-like conduct, threats, coercion, cybercrime, and possibly fraud.

The victim should preserve:

The demand;
Amount requested;
Payment deadline;
E-wallet number, bank account, crypto wallet, or remittance details;
QR codes;
Names used by the recipient;
Screenshots of payment instructions;
Any proof of prior payment.

The victim should avoid paying without advice. If payment is made, it may not stop the threats and may encourage further demands. However, if payment has already been made, the transaction records can become evidence.

XXII. If the Threat Is in a Group Chat or Public Comment

Group chats and public posts may provide additional witnesses.

The victim should preserve:

Group name;
List of visible members;
Admins, if relevant;
The exact post or comment;
Reactions, replies, and shares;
Date and time;
Link to the post;
Identity of people who saw it;
Screenshots from other members, if the victim loses access.

If many people join in, there may be multiple offenders, not just the dummy account.

XXIII. Witnesses

Witnesses may include:

People who saw the post;
People who received messages from the dummy account;
Friends who know the suspected perpetrator’s writing style;
Persons who were told by the suspect about the account;
Platform group admins;
Co-workers, classmates, or relatives who received defamatory or threatening messages;
Security staff if online threats matched physical stalking.

Witnesses may execute affidavits describing what they saw, received, or know.

XXIV. Identifying the Suspect Behind the Dummy Account

A victim may suspect a real person because of:

The content refers to private events;
The account uses phrases known to the suspect;
Threats match prior disputes;
The timing follows an argument;
The account knows non-public information;
The account sends photos only the suspect has;
The dummy account is connected to known accounts;
Mutual friends or contacts overlap;
The account uses the same phone number, email, or username pattern;
The suspect previously threatened to create dummy accounts.

Suspicion should be stated carefully. The complaint may say, “I suspect X because…” and then list factual reasons. Avoid making unsupported public accusations online.

XXV. Defenses Commonly Raised

A respondent may argue:

The account is not theirs;
The screenshots are fake or edited;
The words were a joke;
There was no real threat;
The complainant provoked the exchange;
The statement was opinion, not threat or defamation;
The post was not public;
The account was hacked;
Someone else used the device;
The complainant cannot prove authorship;
The message was taken out of context;
The alleged victim did not actually fear harm;
The account was parody or satire.

Because authorship is often contested, evidence preservation and technical investigation are crucial.

XXVI. Civil Remedies

Apart from criminal liability, the victim may consider civil remedies.

Civil claims may involve:

Damages for injury to reputation;
Damages for emotional distress where legally recoverable;
Damages for invasion of privacy;
Damages for loss of employment or business;
Injunction or restraining relief in appropriate cases;
Removal or takedown-related relief;
Recovery of expenses caused by the unlawful act.

Civil remedies may be pursued together with, or separately from, criminal proceedings depending on procedure and strategy.

XXVII. Protection Orders

Protection orders may be available in certain cases, especially involving VAWC or children. These may include orders prohibiting contact, harassment, threats, or approaching the victim.

For online abuse, a protection order may be relevant where the offender is an intimate partner, former partner, or covered person under the applicable protective law.

A protection order may address:

Online contact;
Contact through dummy accounts;
Contact through relatives or friends;
Threats to release images;
Stalking;
Harassment;
Approaching home, school, or workplace;
Possession or use of private materials.

XXVIII. Workplace and School Situations

Online threats may also create administrative liability.

Workplace

If the offender is a co-worker, employee, manager, client, or contractor, the victim may report to:

Human resources;
Compliance office;
Security office;
Management;
Data protection officer;
Labor authorities, in some cases.

Workplace remedies may include investigation, suspension, termination, protective measures, transfer, or security arrangements.

School

If students are involved, the school may investigate cyberbullying, harassment, threats, sexual misconduct, or conduct prejudicial to the school community.

School remedies may include:

Protective measures;
Parent conference;
Disciplinary proceedings;
Counseling;
Suspension;
Referral to authorities.

Administrative remedies do not necessarily prevent criminal complaints.

XXIX. Barangay Blotter Versus Police or Cybercrime Complaint

A barangay blotter or police blotter is a record of an incident. It is not the same as a full criminal complaint.

A blotter may help show that the victim reported the incident early, but prosecution usually requires:

Complaint-affidavit;
Supporting evidence;
Identification of offense;
Investigation;
Prosecutor’s evaluation;
Filing in court if probable cause is found.

For serious online threats, especially from dummy accounts, direct consultation with cybercrime authorities is often more useful than relying only on a blotter.

XXX. Prescriptive Periods

Criminal and civil claims must be filed within the applicable prescriptive periods. The period depends on the offense charged and the penalty provided by law.

Victims should not delay because:

Platform data may be deleted;
Accounts may be deactivated;
Logs may expire;
Phones may be lost or reset;
Witnesses may forget details;
Posts may be removed;
The perpetrator may change usernames;
Prosecution deadlines may run.

Prompt action improves the chance of identifying the account owner.

XXXI. Practical Complaint Checklist

Before going to PNP, NBI, prosecutor, or a lawyer, prepare:

Government ID;
Written timeline;
Screenshots of threats;
Screen recordings;
Profile links and post links;
Username, handle, account name, profile ID;
Printed copies of evidence;
Digital copies in a USB drive or cloud folder;
The phone or device that received the threats;
Names of suspected persons, if any;
Explanation for the suspicion;
Witness names and contact details;
Platform report reference numbers;
Police or barangay blotter, if any;
Proof of harm, such as medical, employment, school, or security records.

XXXII. How to Write the Timeline

A timeline should be simple and precise.

Example format:

Date and time	What happened	Evidence
January 5, 2026, 8:15 p.m.	Dummy account “Juan Secret” messaged “I know where you live.”	Screenshot A
January 5, 2026, 8:20 p.m.	Same account sent photo of my house gate.	Screenshot B
January 6, 2026, 9:00 a.m.	I reported the account to the platform.	Report confirmation
January 6, 2026, 10:30 a.m.	I went to the police station.	Blotter copy

This makes the case easier to understand and investigate.

XXXIII. Mistakes Victims Should Avoid

Victims should avoid:

Deleting messages;
Cropping screenshots too tightly;
Forgetting to save profile links;
Blocking before preserving evidence;
Posting accusations without proof;
Hacking the dummy account;
Threatening the suspected person;
Paying extortion demands without advice;
Sending more private images;
Using another dummy account to retaliate;
Relying only on verbal reports;
Waiting too long before reporting;
Assuming the platform will preserve all evidence automatically;
Giving the phone to unqualified persons who may alter evidence;
Signing settlements without understanding them.

XXXIV. What If the Threat Was Deleted?

Deleted threats may still be proven through:

Screenshots taken before deletion;
Notifications showing message preview;
Email notifications from the platform;
Other recipients’ screenshots;
Platform data downloads;
Backup files;
Device forensic examination;
Witness affidavits;
Server logs requested through proper channels.

The earlier the victim reports, the better the chance of preserving platform data.

XXXV. What If the Dummy Account Is Overseas?

The account may be operated from abroad, or the platform may be based outside the Philippines. This complicates but does not automatically defeat the case.

Possible issues include:

International cooperation;
Platform data requests;
Jurisdiction;
Location of victim;
Location where the harmful effects were felt;
Location of suspect, if known;
Availability of local respondent;
Mutual legal assistance requirements.

If the victim is in the Philippines and the harmful effects are suffered in the Philippines, local authorities may still evaluate possible remedies.

XXXVI. What If the Threat Is “Just a Joke”?

Whether a statement is a joke depends on context. A person cannot automatically escape liability by later claiming that a threat was humorous.

Relevant factors include:

Exact words used;
Relationship between parties;
Prior conflict;
Use of weapons, addresses, or private information;
Repetition;
Reaction of the victim;
Whether a reasonable person would feel threatened;
Whether the sender demanded action or money;
Whether the sender took steps consistent with the threat.

A single vague rude comment may be weak. A specific threat with private information and repeated messages is stronger.

XXXVII. What If the Victim Also Insulted the Sender?

The sender may claim provocation. Provocation may affect context, but it does not automatically justify threats, extortion, identity theft, doxing, or sexual blackmail.

However, the victim’s own messages may be reviewed. This is another reason to avoid retaliatory threats or insults.

XXXVIII. What If the Victim Wants Only Takedown, Not a Criminal Case?

The victim may focus on platform remedies:

Report impersonation;
Report harassment;
Report threats;
Report non-consensual intimate images;
Report hate speech or bullying;
Ask friends not to engage;
Adjust privacy settings;
Block or restrict the account;
Preserve evidence first.

For reputational damage, the victim may also ask a lawyer to send a demand letter, but care is needed if the perpetrator is unknown.

XXXIX. What If the Victim Wants to Sue Immediately?

A lawyer can help assess whether to file:

Criminal complaint;
Civil action for damages;
Petition for protection order;
Complaint before school or employer;
Complaint before the National Privacy Commission;
Complaint against known persons involved;
Request for assistance from cybercrime authorities.

In many dummy-account cases, investigation comes first because the real identity of the account user must be established.

XL. Role of Lawyers

A lawyer may help:

Identify possible offenses;
Draft complaint-affidavit;
Organize evidence;
Avoid weak or excessive allegations;
Prepare witness affidavits;
Coordinate with investigators;
Request preservation of digital evidence;
Assess defamation risks before public statements;
Negotiate settlements;
File civil or criminal actions;
Protect the victim from counterclaims.

Legal advice is especially important when the case involves intimate images, minors, public officials, workplace disputes, ex-partners, or large reputational damage.

XLI. Practical Safety Measures

Victims should also protect their digital and physical safety.

Digital safety

Change passwords;
Enable two-factor authentication;
Check account recovery emails and numbers;
Review logged-in devices;
Remove suspicious apps;
Update privacy settings;
Limit public posts;
Avoid sharing real-time location;
Warn friends not to accept suspicious accounts;
Save evidence in multiple secure locations.

Physical safety

Tell trusted family or friends;
Inform workplace or school security if needed;
Change routines if there is credible risk;
Avoid meeting the sender;
Report stalking or surveillance;
Keep emergency contacts ready.

XLII. Frequently Asked Questions

1. Can I file a complaint even if I do not know who owns the dummy account?

Yes. You can report the account and provide links, screenshots, and other identifiers for investigation.

2. Are screenshots enough?

Screenshots are helpful but stronger when supported by URLs, screen recordings, device inspection, witnesses, platform data, and affidavits.

3. Should I block the account?

Preserve evidence first. After that, blocking may be appropriate for safety.

4. Can the police or NBI trace the account?

They may investigate using lawful procedures. Success depends on available data, platform cooperation, timeliness, and technical evidence.

5. Can I post the suspect’s name online?

Be careful. Publicly accusing someone without sufficient proof may expose you to defamation or privacy claims.

6. Is a fake account automatically illegal?

No. The fake account becomes legally significant when used for unlawful acts such as threats, fraud, identity theft, harassment, or defamation.

7. Can I sue the platform?

Usually, the practical remedy is to report the content and seek account takedown or data preservation. Suing a platform is more complex and depends on the specific facts and applicable law.

8. What if the threat was sent in disappearing messages?

Take screenshots or recordings immediately if lawful and possible. Report quickly because disappearing messages may reduce available evidence.

9. What if the account unsent the message?

Notifications, screenshots, backups, witnesses, or platform logs may still help.

10. What if the account threatens to leak intimate photos?

Treat it as urgent. Preserve evidence, do not send more materials, avoid paying without advice, report to the platform, and seek help from cybercrime authorities.

XLIII. Practical Legal Strategy

A victim should use a layered approach:

First layer: Evidence

Preserve screenshots, links, recordings, files, device data, and witnesses.

Second layer: Safety

Assess immediate risk, inform trusted people, and involve police if danger is credible.

Third layer: Platform action

Report threats, impersonation, harassment, or intimate-image abuse.

Fourth layer: Formal complaint

File with PNP Anti-Cybercrime Group, NBI Cybercrime Division, prosecutor, Women and Children Protection Desk, school, employer, or NPC depending on the case.

Fifth layer: Legal follow-through

Prepare affidavits, cooperate with investigation, respond to prosecutor requirements, and preserve additional evidence.

XLIV. Conclusion

Online threats from a dummy account are legally serious in the Philippines. The use of a fake profile does not shield the perpetrator from liability. Depending on the facts, the act may involve threats, coercion, cyberlibel, computer-related identity theft, data privacy violations, VAWC, Safe Spaces Act violations, voyeurism, child protection offenses, extortion, or other crimes and civil wrongs.

The victim’s strongest move is to preserve evidence immediately, avoid retaliation, document the account details, assess safety risks, and report to the proper authorities. Even if the real identity behind the dummy account is unknown, the complaint can begin with the account name, URL, screenshots, messages, and surrounding facts. Early reporting is important because digital evidence can disappear quickly.

The best cases are built on complete screenshots, account links, clear timelines, witness statements, preserved devices, and prompt complaints. A dummy account may hide a name, but it does not erase digital traces, legal responsibility, or the victim’s right to seek protection and accountability.