Quick answer

If someone creates a fake social media account using your name, photographs, personal details, or other identifying information, preserve the evidence first, report the account to the platform, secure your real accounts, and report the incident promptly to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division if the circumstances indicate identity theft, fraud, harassment, threats, account hacking, or another crime.

Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information without right. The law applies to identifying information belonging to natural persons and juridical persons such as corporations. (Lawphil)

A fake account is not automatically a criminal case merely because it uses a similar name. The actual facts matter: what information was copied, whether the account was intended to pass itself off as the victim, what the operator did with it, and whether the conduct caused or was intended to cause harm, fraud, harassment, reputational injury, or unauthorized access. A parody, fan, commentary, or similarly labeled account therefore raises different issues from an account deliberately impersonating a real person to deceive others.

If money, bank accounts, e-wallets, OTPs, passwords, or financial credentials are involved, contact the bank or financial institution immediately, in addition to reporting the incident to cybercrime authorities. The Anti-Financial Account Scamming Act expressly covers certain social-engineering schemes and misuse of identities in relation to financial accounts. (Lawphil)

What Philippine law says about online identity theft

Section 4(b)(3) of RA 10175 defines computer-related identity theft broadly. It covers intentional acts involving another person's identifying information without right, including acquiring, using, misusing, transferring, possessing, altering, or deleting that information. (Lawphil)

In Disini v. Secretary of Justice, the Supreme Court upheld the provision against constitutional challenge. The Court noted that ordinary identifying information can include a person's name, citizenship, residence address, contact number, place and date of birth, spouse's name, occupation, and similar information. (eLibrary)

For offenses under Section 4(b), RA 10175 generally provides the penalty of prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. For computer-related identity theft specifically, Section 4(b)(3) provides that where no damage has yet been caused, the penalty imposable is one degree lower. (Lawphil)

The exact criminal charge should not be assumed from the appearance of the fake profile alone. Depending on what the account operator actually did, other laws may also become relevant.

A fake account used to defraud people

If the impersonator pretends to be you and asks relatives, customers, employees, or friends to send money, the conduct may support computer-related identity theft and potentially computer-related fraud or other fraud offenses, depending on the evidence.

Where financial accounts are targeted, RA 12010, or the Anti-Financial Account Scamming Act (AFASA), may also apply. It covers, among other things, certain social-engineering schemes involving deception to obtain sensitive identifying information that results in unauthorized access and control over another person's financial account. It also addresses the use of another person's identity or identification documents in connection with financial accounts. (Lawphil)

A fake account used to harass or sexually target someone

The Safe Spaces Act (RA 11313) expressly addresses certain forms of online identity impersonation as part of gender-based online sexual harassment. Section 12 includes, among the prohibited conduct when the statutory context and elements are present, impersonating a victim's identity online or posting lies about a victim to harm the victim's reputation. The law specifically assigns the PNP-ACG a role in receiving complaints involving gender-based online sexual harassment. (Lawphil)

This does not mean every fake account is automatically a Safe Spaces Act violation. The gender-based and harassment-related elements of the law must still be established.

A fake account used to publish defamatory accusations

If the operator uses the account to publish statements that allegedly constitute libel, cyber libel under RA 10175 in relation to the Revised Penal Code may become relevant. The Supreme Court in Disini sustained the cyber-libel provision as applied to the original author of the offending post, while invalidating its application merely to people who receive and react to it. (eLibrary)

Whether a particular statement is defamatory and criminally actionable depends on its actual wording, publication, identification of the person allegedly defamed, surrounding circumstances, applicable defenses, and other elements. A negative, insulting, or false statement should therefore not automatically be labeled cyber libel without examining the facts.

A fake account involving misuse of personal data

Misuse of photographs, IDs, contact information, private records, or other personal data can also raise issues under the Data Privacy Act of 2012 (RA 10173). The National Privacy Commission accepts complaints concerning alleged privacy violations and misuse of personal information. (Privacy Commission)

An NPC case is different from a criminal cybercrime complaint. The appropriate route depends on who processed the information, how it was obtained and used, and whether the matter falls within the Data Privacy Act and the NPC's jurisdiction.

What to do as soon as you discover the fake account

1. Preserve the evidence before trying to have the account removed

Do this before confronting the person, blocking the account, or organizing a mass-reporting campaign.

Save:

screenshots showing the entire profile, including the username and profile photograph;
the account's exact profile URL or other unique account identifier;
screenshots or copies of posts, stories, comments, advertisements, and messages;
the date and approximate time you discovered each item;
messages received by your relatives, customers, co-workers, or friends from the impersonator;
transaction receipts, bank records, e-wallet references, QR codes, account numbers, or payment instructions used by the fake account;
emails or notifications from the social media platform;
the platform's confirmation or reference number after you report the account;
evidence establishing which account is genuinely yours; and
records showing actual harm, such as lost money, customer complaints, threats, reputational consequences, or unauthorized account access.

Whenever possible, keep the original electronic copies, not merely cropped images pasted into another document. A screen recording that shows you navigating from the platform to the offending profile can provide useful context, but it should supplement rather than replace the original URLs and screenshots.

If another person received messages from the fake account, ask that person to preserve the messages on the original device. Do not rely only on forwarded screenshots.

Digital evidence can disappear quickly. Under the Rule on Cybercrime Warrants, service providers generally preserve traffic data and subscriber information for a minimum period of six months from the transaction, while content data may be preserved for six months from receipt of a law-enforcement preservation order, with a one-time extension permitted. Prompt reporting can therefore matter greatly when investigators need provider-held records. (Office of the Court Administrator)

2. Report the impersonating account to the social media platform

Use the platform's official reporting mechanism and select impersonation, pretending to be someone, or the closest available category.

Do not merely post publicly that the account is fake. Submit an actual platform report.

The platform may request identification or other information proving that you are the person being impersonated. Facebook, for example, maintains procedures for account security and hacked-account recovery, while TikTok provides a specific impersonation-reporting process. (Facebook)

Keep a screenshot of the completed report, confirmation email, ticket number, or Support Inbox response.

If the fake account is actively scamming people, warn likely targets through your real account or another verifiable communication channel, but avoid making unsupported public accusations about who you believe created it.

3. Secure your genuine accounts

A cloned account and a hacked account are not the same thing.

A cloned account is normally a separate profile copying your identity.

A hacked account involves unauthorized access to your genuine account.

If there is any possibility that your real account, email, or phone number has been compromised:

change the password from a trusted device;
change the password of the email account connected to the social media account;
enable multi-factor authentication;
review active sessions and log out unfamiliar devices;
check whether recovery email addresses or phone numbers were changed;
revoke suspicious connected applications;
review recent password-reset emails and login alerts; and
preserve evidence of unauthorized logins before removing them where possible.

Do not reuse the compromised password on other accounts.

4. Report the matter to the PNP Anti-Cybercrime Group

The PNP-ACG maintains cyber-response units and regional offices around the country. Its current contact directory identifies the Cyber Response Unit as a complaint-receiving unit, with complaint@acg.pnp.gov.ph, telephone (02) 8723-0401 local 7490, and mobile 0968-878-3561. Regional and provincial cyber-response teams are also listed on the PNP-ACG website. (PNP ACG)

A PNP citizen's charter for cybercrime walk-in complaints lists evidence such as screenshots, social-media conversations, transaction records, and valid identification among materials commonly presented by complainants. (NCRPO SPD)

You can start by explaining:

who you are;
the genuine account that belongs to you;
the fake account's username and URL;
when you discovered it;
what information the account copied;
what the operator has done;
who has been contacted;
whether money has been requested or transferred;
whether there were threats, harassment, sexual content, or extortion; and
what evidence you have preserved.

The investigators, not the complainant, ultimately determine what offenses should be investigated based on the available facts.

5. You may also seek investigation by the NBI Cybercrime Division

The National Bureau of Investigation maintains a Cybercrime Division (NBI-CCD) and currently lists ccd@nbi.gov.ph for the division. (National Bureau of Investigation)

The NBI's Citizen's Charter states that members of the general public may proceed to the Cybercrime Division to file a complaint or request an investigation. The process may include completing a sworn complaint sheet, preliminary interview, execution of sworn statements, submission of supporting documents, and examination of a device relevant to the investigation. The stated investigative-assistance service itself has no fee. (National Bureau of Investigation)

The NBI continues to investigate computer-related identity theft cases; in July 2026, for example, the NBI reported an operation involving alleged computer-related identity theft and computer-related fraud. (National Bureau of Investigation)

6. CICC can also receive reports and coordinate cybercrime concerns

The Cybercrime Investigation and Coordinating Center (CICC) currently publishes hotline 1326 for reporting online scams and cybercrime concerns. Its official materials also list report@cicc.gov.ph, Globe 0966-976-5971, DITO 0991-481-4225, and Smart 0947-714-7105. (CICC)

For a criminal investigation, however, do not assume that reporting to a hotline alone replaces the sworn complaint, supporting evidence, interviews, or other procedures that the PNP, NBI, or prosecutors may require.

If money or an e-wallet is involved, contact the financial institution immediately

Do not wait for the social media platform to finish reviewing the fake account.

Immediately contact the bank, e-wallet, credit-card issuer, or payment service involved and clearly identify the transaction as disputed or fraudulent.

AFASA authorizes regulated financial institutions, subject to BSP rules, to temporarily hold funds involved in qualifying disputed transactions and establishes a coordinated verification process among institutions and account owners. (Lawphil)

Timing can be crucial because funds may be transferred through several accounts or withdrawn quickly.

Preserve:

transaction reference numbers;
recipient account numbers and names displayed by the service;
timestamps;
amount transferred;
screenshots of the payment request;
messages directing you to make the payment; and
your fraud-report reference number with the bank or e-wallet.

Never send an additional payment because the impersonator promises to "refund" the original amount.

When an NPC privacy complaint may be appropriate

If the dispute involves the unlawful or unauthorized processing of your personal information, you may consider a complaint before the National Privacy Commission in addition to, or instead of, other remedies depending on the circumstances.

Under the NPC's current Rules of Procedure, the general rule is that a complainant must first inform the personal information controller, processor, or concerned entity in writing about the claimed violation and give it an opportunity to act. If it does not take timely or appropriate action, or does not respond within 15 calendar days from receipt, the exhaustion requirement may be satisfied. Proof of this step should accompany the complaint. (Privacy Commission)

The NPC can waive the exhaustion requirement in appropriate cases, including serious violations or circumstances presenting a risk of grave or irreparable harm. (Privacy Commission)

The NPC currently requires a properly accomplished and notarized complaint-assisted form or verified complaint, together with supporting evidence and applicable witness affidavits. Filing may be made through the channels authorized by the Commission. (Privacy Commission)

A simple disagreement over a social media username should not automatically be converted into a Data Privacy Act complaint. The underlying processing of personal data and the respondent's role must first be examined.

Can police identify who created an anonymous fake account?

Potentially, but the complainant normally cannot compel the platform to disclose another user's subscriber information.

Investigators may need provider records and, depending on the information sought, judicial authority under the Rule on Cybercrime Warrants. The Rule provides procedures for warrants involving disclosure, interception, search, seizure, examination, and other handling of computer data. A Warrant to Disclose Computer Data, for example, allows law-enforcement authorities, upon judicial authorization, to require disclosure of relevant computer data or subscriber information. (Office of the Court Administrator)

Where a service provider is outside the Philippines, the Rule provides for service of warrants and other court processes through the DOJ Office of Cybercrime in accordance with applicable international instruments or arrangements. (LegalDex AI)

This is another reason to report promptly: account deletion does not necessarily mean all provider records disappear immediately, but the availability of particular records depends on the provider, the type of data, applicable retention periods, and how quickly lawful preservation measures are undertaken.

Common mistakes that can weaken a complaint

Deleting or blocking everything before preserving evidence

Removing the account from view may make you feel safer, but first save the username, URL, messages, posts, dates, and other evidence you may need later.

Keeping only cropped screenshots

A screenshot showing only a single sentence may omit the account name, URL, date, or surrounding conversation. Preserve enough context to demonstrate where the material came from.

Confronting the suspected operator immediately

If you confront someone before evidence is secured, the account may be deleted or altered. If there are threats, extortion, or an ongoing scam, obtain law-enforcement advice before arranging meetings or attempting an entrapment yourself.

Trying to hack the fake account

Do not attempt to discover the perpetrator by breaking into the account, guessing passwords, installing spyware, or illegally obtaining private records. Unauthorized access can itself create legal problems and may compromise otherwise useful evidence.

Publicly naming an alleged culprit without sufficient evidence

An IP address, profile photograph, nickname, writing style, telephone number, or personal suspicion does not necessarily establish who legally controlled an account. Preserve your suspicions for investigators unless you have a proper reason to make a public statement.

Reporting only to the social media platform

Platform removal and criminal investigation are different processes. A platform can suspend an account without establishing criminal liability, while police or NBI investigators may need evidence even after the profile has disappeared.

Waiting because "nothing has happened yet"

RA 10175 expressly contemplates computer-related identity theft even where damage has not yet been caused, although the statutory penalty treatment differs. (Lawphil)

Early reporting may also improve the chances of preserving digital records before they are deleted or become unavailable.

When help is urgent

Seek immediate law-enforcement assistance if the fake account is being used to:

threaten physical harm;
demand money or property;
blackmail or extort you;
impersonate you while soliciting money from other people;
gain access to your bank account or e-wallet;
distribute intimate images or sexual material;
target a child;
reveal your home address or other information in circumstances creating a safety risk;
repeatedly stalk or harass you;
take over your genuine account; or
arrange an in-person meeting as part of a threat, scam, or extortion attempt.

For an immediate threat to life or physical safety, the Philippines' Unified 911 is the nationwide emergency number for police, medical, fire, and other emergency response. (DILG-NCR)

Practical complaint checklist

Before going to the PNP-ACG or NBI, organize one folder containing:

your valid identification;
the URL and username of the fake account;
screenshots of the complete profile;
screenshots and original copies of relevant posts and messages;
a short chronological summary with dates;
proof showing your genuine identity or genuine account;
names and contact details of witnesses or recipients of messages;
platform-report confirmations;
proof of financial loss, if any;
bank or e-wallet fraud-report references;
evidence of unauthorized logins or account changes, if your real account was hacked; and
any threats, demands, or other communications from the impersonator.

A simple chronological narrative is usually more useful than hundreds of unsorted screenshots.

Frequently asked questions

Is using my photograph on a fake Facebook account automatically identity theft?

Not necessarily. The photograph may be important identifying information, but criminal liability depends on all relevant statutory elements and circumstances. An account deliberately using your photograph, name, personal information, and communications to impersonate you and deceive others presents a substantially different case from an account that merely reposts a photograph for an otherwise lawful purpose.

Do I need to know the real name of the person behind the fake account before reporting it?

No. You can report an unknown account operator. Give investigators the account's URL, username, messages, telephone numbers, payment information, and any other identifiers available to you.

Should I report the account before taking screenshots?

Preserve the evidence first whenever it is safe to do so, then report it promptly. Platform enforcement may cause the profile or content to become inaccessible.

Can I ask Facebook or another platform to give me the fake user's IP address?

Ordinarily, private users cannot simply demand another user's confidential subscriber records. Law enforcement may pursue appropriate disclosure and preservation procedures, including cybercrime warrants where legally required.

Can I file both a platform report and a police complaint?

Yes. They serve different purposes. The platform report seeks action under the platform's rules. The law-enforcement complaint concerns possible violations of Philippine law.

Can I file with both the PNP and NBI?

Both agencies have cybercrime investigative functions. Duplicating substantially identical complaints without informing the agencies may cause unnecessary confusion, so tell the receiving investigators if another agency is already handling the matter.

What if the fake account already disappeared?

Report it if the conduct was serious and you preserved evidence. Investigators may still assess whether provider records, recipient messages, transaction records, or other evidence remain available.

What if no money was lost?

Financial loss is not required in every identity-theft case. Section 4(b)(3) of RA 10175 expressly addresses situations in which damage has not yet been caused, although it provides a different penalty treatment. (Lawphil)

Can a company or business be a victim of computer-related identity theft?

Yes. Section 4(b)(3) expressly refers to identifying information belonging to another person, whether natural or juridical. (Lawphil)

Official sources and reporting resources

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice based on the specific facts, evidence, identities of the parties, and platforms involved. Cybercrime, privacy, harassment, financial-fraud, and defamation cases can overlap, and the correct remedy or charge depends on the circumstances. Official procedures and contact channels should be rechecked before filing.

Law and official-source check: August 25, 2026.