Quick answer

If someone is using your name, photos, business identity, contact details, or other identifying information to impersonate you online, preserve the evidence before the account disappears, report the account through the platform’s impersonation process, secure your real accounts, and file a formal report with the PNP Anti-Cybercrime Group or NBI Cybercrime Division.

Act immediately if the fake account is collecting money, accessing financial accounts, threatening anyone, distributing intimate material, or targeting a child. Contact the affected bank or e-wallet first if money or account credentials are at risk.

A fake or anonymous account is not automatically criminal. Under the Cybercrime Prevention Act of 2012, computer-related identity theft involves intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting another person’s—or company’s—identifying information without right. Whether a particular profile qualifies depends on its content, purpose, use of identifying information, authority or consent, and evidence linking it to the person responsible.

What to do first

1. Preserve the account and its activity

Before blocking or reporting the account, save:

The complete profile URL, username, handle, display name, profile photograph, bio, and visible contact details.
Screenshots showing the full screen, including the date and time displayed on your device.
URLs and copies of relevant posts, comments, stories, reels, advertisements, group posts, and marketplace listings.
Complete conversations—not only selected messages—including dates, timestamps, attachments, voice messages, and call logs.
Messages received by relatives, customers, employers, friends, or other people whom the impersonator contacted.
Payment instructions, bank or e-wallet names, account numbers, QR codes, transaction references, receipts, and amounts lost.
Emails in their original form, including headers where available.
Notices from the platform, report confirmations, ticket numbers, and takedown decisions.
A written chronology stating when you discovered the account, what it did, whom it contacted, and every response you made.

Keep the original files unchanged. Store backups on a separate device or secure cloud account. If you need to highlight or annotate something, work on a copy. Do not delete conversations, factory-reset the affected device, or discard a SIM card that may contain relevant messages.

Evidence connecting a suspected person to the account is also important. Preserve admissions, distinctive language, private facts known only to a few people, earlier messages from the same account, common payment details, and witnesses who saw the person operate it.

In XXX v. People, G.R. No. 274842, October 22, 2025, the Supreme Court explained that ownership, access, or authorship of a social-media account may be proved through direct or circumstantial evidence. Relevant proof may include admissions, eyewitness observations, information known only to the perpetrator, distinctive communication patterns, provider records, geolocation, device examinations, and conduct consistent with the posts. A name or profile photo alone does not necessarily establish who controlled the account. See the Supreme Court decision.

2. Secure your real accounts

Using a trusted device:

Change the password of your primary email account first, followed by social-media, banking, e-wallet, shopping, and government-service accounts.
Use a different, strong password for each account.
Turn on multifactor authentication, preferably through an authenticator app or security key where available.
Review logged-in devices, active sessions, forwarding rules, linked applications, recovery email addresses, and recovery phone numbers.
Sign out unfamiliar devices and remove unknown applications.
Ask your mobile provider to secure or replace a compromised SIM.
Check whether unauthorized accounts, loans, cards, purchases, advertisements, or listings have been created in your name.

If your genuine social-media account was taken over, use the platform’s hacked-account recovery process as well as its impersonation-reporting process. These are different problems and may require separate reports.

Warn contacts through a channel you still control. Keep the warning factual: identify your genuine account, state that the other account is unauthorized, and tell people not to send money, credentials, or one-time passwords.

Report the account to the platform

Report both the profile and any harmful posts, messages, advertisements, or listings. Different reports may be reviewed under different platform policies.

Official reporting pages include:

For other platforms, use the in-app “Report,” “Impersonation,” “Pretending to be someone,” “Fraud,” or “Harassment” option. If you are reporting for a child, company, brand, or another person, the platform may require proof that you are the parent, guardian, owner, or authorized representative.

A platform report can lead to restriction or removal, but it is not a criminal complaint. A takedown also does not identify the operator or establish criminal liability. Platforms generally will not give private subscriber or login information directly to a victim merely upon request; law-enforcement and court processes may be needed.

File a cybercrime report

The NBI and PNP are the law-enforcement authorities designated under Section 10 of the Cybercrime Prevention Act.

PNP Anti-Cybercrime Group

Report to the nearest PNP Regional Anti-Cybercrime Unit, the PNP Anti-Cybercrime Group, or a local police station for referral. The PNP-ACG is specifically tasked to receive complaints involving gender-based online sexual harassment under the Safe Spaces Act.

NBI Cybercrime Division

You may:

Use the NBI online complaint page.
Visit the NBI Cybercrime Division or an NBI Regional Cybercrime Center.
Contact the Cybercrime Division through the current details listed on the NBI Divisions and Services page.

The NBI’s current Citizen’s Charter states that a complainant may file a complaint or request for investigation, undergo an interview, execute a sworn statement, submit supporting records, and make a relevant device available for examination. The service has no listed government fee. See the NBI procedure for victims of computer crimes.

CICC assistance and referral

The Cybercrime Investigation and Coordinating Center can provide assistance and coordinate referrals. Contact the national anti-scam/cybercrime channel by calling 1326 or emailing 1326@dict.gov.ph, as listed by the Department of Information and Communications Technology.

A hotline or online report may begin triage, but ask whether you must still execute a sworn complaint with the PNP or NBI. For a formal report, bring:

A valid government-issued ID.
A chronological complaint narrative.
Printed and electronic copies of your evidence.
A list of witnesses and their contact details.
Proof that the identity, photographs, business, or accounts being copied belong to you or the represented person.
Proof of losses, threats, harassment, or corrective expenses.
Proof of authority if acting for a child, company, or another person.

Describe facts rather than guessing. If the offender is unknown, say so and provide every available lead. Ask for receiving proof, a complaint or reference number, and the assigned office or investigator.

Prompt reporting matters. Under Section 13 of the Cybercrime Prevention Act, providers must preserve traffic data and subscriber information for at least six months from the transaction. Content data is preserved for six months after a law-enforcement preservation order, subject to a one-time six-month extension. These periods do not guarantee that every provider—especially one located abroad—still possesses particular data. Only authorized investigators can issue the statutory preservation order and seek the necessary disclosure warrant.

If money or financial accounts are involved

Contact the bank, card issuer, payment service, or e-wallet immediately through its official application, website, branch, or published telephone number. Do not use contact details supplied by the impersonator.

Ask the institution to:

Block or secure the affected account, card, or wallet.
Record a fraud or unauthorized-transaction dispute.
Preserve account-opening records, login records, transaction logs, recipient details, and communications.
Provide a complaint or case reference number.
Explain what additional affidavit, identification, or dispute form is required.

The implementing rules of the Anti-Financial Account Scamming Act direct account owners to report disputed transactions immediately and cooperate with the institution’s investigation. A report does not guarantee reversal or recovery; the outcome depends on the evidence, applicable rules, and where the money went.

For an unresolved complaint against a BSP-supervised institution, complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If its action is unsatisfactory or it fails to act, escalate through the BSP Online Buddy or BSP Consumer Assistance channels.

When to complain to the National Privacy Commission

Consider an NPC complaint when the incident involves unauthorized processing, disclosure, misuse, or inadequate protection of personal data under the Data Privacy Act of 2012. This route is particularly relevant when a known person, company, platform, employer, lender, or other organization possesses or mishandles the data.

The NPC is a privacy regulator; it is not a substitute for a PNP or NBI criminal report.

Under the current NPC Rules of Procedure, as amended, you normally must:

Notify the personal information controller, processor, or concerned entity in writing.
Give it an opportunity to act.
Show that it did not take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.
Attach proof of the notice and any response to your complaint.

The NPC may waive this exhaustion requirement for properly proved good cause or a serious privacy violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

The complaint must generally be written, signed, verified, supported by evidence and witness affidavits where applicable, and accompanied by a certification against forum shopping. Filing fees may apply unless an exemption or waiver is available. Follow the NPC’s official complaint mechanics and current forms rather than relying on older online instructions.

What laws may apply

The correct charge depends on what the account actually did and what the evidence proves.

Computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act covers intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another natural or juridical person without right.

Upon conviction, Section 8 provides for prision mayor—six years and one day to 12 years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the prescribed penalty is one degree lower. The precise sentence and fine are determined by the court.

Other possible offenses

Depending on the facts, the same conduct may also involve:

Computer-related fraud or forgery.
Estafa, threats, coercion, or extortion.
Cyberlibel.
Unauthorized access to an existing account.
Access-device or financial-account fraud.
Unlawful processing or unauthorized disclosure of personal data.
Gender-based online sexual harassment, including online impersonation used to harm a victim’s reputation.
Psychological violence under the Anti-VAWC Act, where the required relationship, acts, and harm are proved.
Violations involving nonconsensual intimate images or child sexual abuse or exploitation material.

These offenses have different elements, defenses, penalties, and prescriptive periods. Do not assume that every offensive or deceptive profile satisfies all of them.

Common mistakes to avoid

Reporting or blocking the account before preserving its URL and content.
Saving only cropped screenshots that omit the handle, date, context, or surrounding conversation.
Publicly accusing a suspected person without adequate proof.
Threatening, hacking, doxxing, or using an “IP grabber” to identify the operator.
Paying an extortion demand or arranging a meeting without police guidance.
Forwarding intimate or child sexual material to friends to “prove” it exists.
Giving passwords, PINs, or one-time passwords to anyone claiming to investigate the case.
Assuming that a barangay or police blotter alone triggers platform preservation or a specialist cybercrime investigation.
Treating a platform takedown as proof that the operator committed a crime.
Expecting the police to identify an account solely from its display name or photograph.
Editing, deleting, or resetting the device that contains the original evidence.

When help is urgent

Call 911 and contact the PNP or NBI immediately if there is an imminent threat of physical harm, stalking connected to a real-world location, blackmail, extortion, or a planned meeting.

Contact the financial institution and CICC immediately if money is moving or account credentials were exposed.

If a child is being impersonated, groomed, sexually exploited, or associated with sexual material, report the account and content immediately to the platform and law enforcement. Preserve the URL, account details, and report confirmations, but do not download, reproduce, or forward unlawful sexual material.

Consult a lawyer promptly when substantial money was lost, intimate material is involved, the perpetrator is a current or former partner, the incident affects employment or a business, several possible offenses overlap, or investigators or platforms are not acting despite continuing harm.

Frequently asked questions

Can I report the account if I do not know who created it?

Yes. State that the operator is unknown and provide all available identifying clues. Law enforcement may seek provider records through the required legal process. Identification is not guaranteed, particularly where records have expired, false registration details were used, or the operator is abroad.

Is using my public photo automatically identity theft?

Not automatically. Public availability does not by itself give someone a right to impersonate you, but criminal liability still depends on intentional use of identifying information without right and the surrounding facts. A clearly labeled fan, commentary, or parody account may be treated differently from an account designed to deceive people into believing it is you.

Can I force the platform to reveal the operator’s name or IP address?

Usually not through an ordinary user request. Subscriber, traffic, and content data may require a law-enforcement preservation request, court warrant, or cross-border legal process. Report quickly so investigators can assess preservation before data becomes unavailable.

Is a barangay blotter enough?

No. A blotter may help document when you reported the incident, but it does not replace a platform report or a formally received cybercrime complaint with the PNP-ACG or NBI.

Do I need a lawyer to report identity theft?

No lawyer is required for an initial platform, bank, CICC, PNP, or NBI report. Legal assistance is useful when preparing affidavits, identifying the proper offenses and respondents, seeking urgent court protection, or pursuing civil, criminal, or administrative remedies.

Can a parent report a fake account involving a child?

Yes. Platforms and agencies may ask for proof of parentage or guardianship. For an NPC complaint, the amended rules recognize representation of a minor by a parent or guardian and specify the supporting proof required.

What if the fake account has already been deleted?

Report it anyway. Submit saved screenshots, links, messages, report receipts, witness statements, and any transaction records. Deleted public content may still leave provider, recipient, or device records, but recovery depends on retention and lawful access.

How long will removal or investigation take?

There is no single guaranteed period. Platform review, provider cooperation, warrant applications, cross-border requests, forensic examination, and the complexity of identifying the operator can all affect timing. A report number and regular written follow-ups help document the status.

This article provides general Philippine legal information, not advice for a particular case. Facts, documents, relationships, and available evidence can change the appropriate remedy. Laws, procedures, and official reporting channels were checked against current primary and government sources on August 4, 2026.