Quick answer

If someone creates a social media account using your name, photographs, personal details, or identity to make other people believe the account is yours, preserve the evidence before trying to have the account removed. Report the account to the social media platform, secure your genuine accounts, warn people who may be targeted, and report the incident to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation Cybercrime Division (NBI-CCD) if the impersonation involves identity theft, fraud, threats, harassment, account hacking, financial loss, or other criminal conduct.

Under Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or juridical entity, without right. The Supreme Court has sustained this provision and explained that identifying information ordinarily includes such information as a person's name, citizenship, address, contact number, date and place of birth, spouse's name, occupation, and similar identifying data. (eLibrary)

A fake account is not automatically a criminal case simply because it uses a similar name or resembles another account. The particular facts matter. An obvious parody, an unrelated person who happens to have the same name, or an account that does not use another person's identifying information without right presents a different issue from an account deliberately posing as a real person. Conversely, an account that copies your identity and then messages your relatives, solicits money, pretends to conduct business for you, posts statements as though they came from you, or obtains financial credentials may involve several offenses in addition to identity theft.

What Philippine law covers

The most directly applicable provision is computer-related identity theft under the Cybercrime Prevention Act. The statutory penalty for offenses under Section 4(b), which includes computer-related identity theft, is prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. The identity-theft provision further states that if no damage has yet been caused, the imposable penalty is one degree lower. The actual charge and penalty will depend on the offense proven and the circumstances established by the evidence. (Lawphil)

There is an important distinction between a cloned account and a hacked account. A cloned account is a separate account created to imitate you. A hacked account is your genuine account that another person has accessed or taken over. Unauthorized access to a computer system is separately punishable under Section 4(a)(1) of Republic Act No. 10175, so an account takeover can raise issues beyond identity theft. (Lawphil)

Other offenses may also apply depending on what the impersonator does. For example, fraudulent transactions, defamatory publications, threats, extortion, unauthorized use of financial information, or other acts committed through information and communications technology can trigger provisions of the Revised Penal Code or special laws together with Republic Act No. 10175. Section 6 of the Cybercrime Prevention Act provides that crimes under the Revised Penal Code and special laws committed by, through, and with the use of information and communications technology are subject to the relevant cybercrime provision, with the statutory consequence specified in that section. (Lawphil)

If the scheme involves bank accounts, credit cards, electronic wallets, passwords, or other credentials used to obtain control over a financial account, Republic Act No. 12010, the Anti-Financial Account Scamming Act, may also become relevant. Among other things, that law covers social-engineering schemes involving deceptive acquisition of sensitive identifying information that results in unauthorized access and control over another person's financial account, as well as certain uses of another person's identity or identification documents in financial-account schemes. (eLibrary)

What to do immediately

Preserve the fake account before it disappears. Save the exact username or handle, profile URL, display name, profile photograph, biography, posts, comments, messages, dates, timestamps, and any account identifier that the platform displays. Take screenshots showing the entire screen where practical, not only tightly cropped portions. If the account changes usernames, record both the old and new handles. Preserve the original messages and devices as well.
Document what the impersonator actually did. Save messages asking for money, OTPs, passwords, personal documents, investments, loans, purchases, or favors. If relatives, customers, employees, or friends received messages, ask them to preserve their own copies rather than merely forwarding screenshots to you.
Save evidence proving which account is really yours. Keep the URL of your legitimate profile, older posts, account-registration or recovery emails, verification records, business documents where appropriate, and other materials establishing that you are the person or organization being impersonated.
Report the account to the platform. Use the platform's impersonation, fake-account, scam, or account-reporting mechanism. On Facebook and related Meta services, distinguish between an imposter account and a takeover of your genuine account; Facebook maintains a separate hacked-account recovery process. TikTok has a specific impersonation-reporting process, while X allows impersonation reports through its Help Center and, in appropriate cases, directly from the offending profile. (Facebook)
Secure your real accounts. Change compromised or reused passwords, sign out unknown sessions, review recovery email addresses and phone numbers, remove suspicious connected applications, and activate multi-factor authentication. If you believe your email account itself has been compromised, secure the email account first because it may be used to reset your other accounts.
Warn potential victims without making unsupported accusations. You can announce that a particular profile or handle is fake and that people should not send money, OTPs, documents, or sensitive information to it. Avoid publicly accusing a particular person of operating the fake account unless you have reliable evidence.
Report serious cases promptly to cybercrime investigators. This is particularly important when the fake account is actively scamming people, threatening someone, impersonating a business or professional, accessing financial accounts, distributing private material, or repeatedly changing or deleting evidence.

What evidence should you preserve?

Screenshots are useful, but they should not be your only evidence. Investigators may eventually need information that ordinary users cannot see, including subscriber information, login records, IP-related data, account-registration information, traffic data, or other records held by the service provider.

Republic Act No. 10175 requires service providers to preserve traffic data and subscriber information for a minimum period of six months from the transaction, while content data may be preserved for six months from receipt of a law-enforcement preservation order. Law-enforcement authorities may order a one-time extension for another six months. Disclosure of subscriber information, traffic data, or relevant computer data under Section 14 requires the procedures prescribed by law, including a court warrant. (Lawphil)

This is one reason not to delay reporting a serious incident. A victim generally cannot compel Facebook, Instagram, TikTok, X, an email provider, or another service provider to reveal an anonymous user's registration or technical information simply by demanding it. Proper legal process may be necessary. The Supreme Court's Rule on Cybercrime Warrants governs preservation, disclosure, interception, search, seizure, and examination of computer data, and the Court has continued to apply that framework in cybercrime investigations. (eLibrary)

Reporting to the PNP Anti-Cybercrime Group

Republic Act No. 10175 specifically assigns the NBI and PNP responsibility for law enforcement of the Cybercrime Prevention Act and requires them to maintain specialized cybercrime units. (Lawphil)

The PNP Anti-Cybercrime Group maintains a Cyber Response Unit as well as regional and provincial cyber-response offices. Its current official contact page lists the Cyber Response Unit at complaint@acg.pnp.gov.ph, telephone (02) 8723-0401 local 7490, and mobile number 0968-878-3561, together with contact details for Regional Anti-Cybercrime Units and local cyber-response teams throughout the country. Because government contact information can change, verify the details on the PNP-ACG website before submitting sensitive documents. (PNP ACG)

When reporting, give investigators a chronological account rather than simply saying that someone made a fake account. Identify your real account, the fake account, when you discovered it, what identifying information was copied, what the account did, who received messages, whether money or information was obtained, and what evidence you preserved.

Reporting to the NBI Cybercrime Division

You may also seek investigative assistance from the NBI Cybercrime Division. The NBI's current Citizens' Charter states that members of the general public may proceed to the Cybercrime Division to file a complaint or request an investigation. The process includes an initial interview, preparation of a complaint sheet, execution of sworn statements or submission of prepared affidavits, and collection of supporting documents. The NBI lists no fee for this investigative assistance and states that comparable complaints may be handled through its regional cybercrime centers. (National Bureau of Investigation)

If the fake account is anonymous, approaching the PNP-ACG or NBI-CCD first is often more practical than trying to identify the operator yourself. Investigators can evaluate whether legal process should be sought for information held by a platform, internet service provider, financial institution, or other relevant entity.

Can you file directly with the prosecutor?

If the suspected offender has been identified and you have sufficient evidence, a criminal complaint may also proceed through the appropriate prosecutor's office. Under Rule 112 of the Rules of Criminal Procedure, offenses carrying the required level of penalty undergo preliminary investigation. A complaint for preliminary investigation is supported by the complainant's and witnesses' affidavits and other documents establishing probable cause, with the affidavits sworn as prescribed by the Rules. (Lawphil)

For an anonymous fake account, however, a law-enforcement investigation may be needed first to establish who actually controlled the account. A profile name, photograph, phone number, or apparent location should not automatically be treated as proof of the operator's identity; those details can themselves be fabricated or stolen.

A barangay conciliation proceeding is generally not a prerequisite to a computer-related identity-theft complaint because the penalty prescribed for the offense exceeds the one-year imprisonment threshold excluded from the lupon's authority under Section 408 of the Local Government Code. Different rules may apply to a separate, lesser offense arising from the same dispute, so the precise charges still matter. (Lawphil)

When the National Privacy Commission may also be relevant

Misuse of personal information can sometimes raise issues under Republic Act No. 10173, the Data Privacy Act of 2012. The National Privacy Commission receives complaints from data subjects involving privacy violations and personal-data breaches. This can be an additional remedy where the facts genuinely fall within the DPA; it is not a substitute for a police or NBI investigation when the main problem is an anonymous criminal impersonator. (Lawphil)

Under the NPC's 2021 Rules of Procedure, a complainant ordinarily must first inform the personal information controller, processor, or concerned entity in writing of the alleged privacy violation and give it an opportunity to act. If it does not take timely or appropriate action, or does not respond within 15 calendar days from receipt, the exhaustion requirement may be satisfied. The NPC may waive these requirements for good cause or in serious cases involving sufficient risk of harm. Complaints must also satisfy the NPC's requirements on verification, evidence, identification of the respondent where possible, correspondence, relief sought, and certification against forum shopping.

Because the NPC remedy has its own jurisdictional and procedural requirements, do not assume that every copied profile photograph or fake social media account automatically establishes a Data Privacy Act violation.

If money or an e-wallet is involved

Treat financial identity theft as urgent. Immediately notify the bank, credit-card issuer, e-wallet provider, or other financial institution using its official fraud channel. Preserve transaction numbers, account numbers, timestamps, recipient information, confirmation messages, statements, and all communications with the institution.

The Anti-Financial Account Scamming Act provides mechanisms concerning disputed financial transactions and coordinated verification by covered financial institutions. It also specifically recognizes electronic communications, including social-media messages, in financial-account scamming schemes. (eLibrary)

Do not wait for the fake social media profile to be removed before reporting unauthorized transactions. Platform takedown and financial recovery are separate issues.

Common mistakes that can weaken a complaint

Deleting the conversation immediately: Blocking an account may be sensible for safety, but preserve the evidence first whenever doing so does not expose you to additional harm.

Keeping only a screenshot of the profile picture: A photograph alone may not show the URL, username, date, associated messages, or conduct proving impersonation.

Editing screenshots: Cropping, annotating, filtering, or combining images may make them easier to read but can create authenticity questions. Keep untouched originals.

Assuming the displayed name identifies the offender: Fake accounts can contain fake telephone numbers, stolen IDs, altered names, VPN-related location information, or financial accounts belonging to third parties.

Paying an impersonator to delete the account: Payment does not guarantee deletion and can encourage further demands. Extortion or threats should instead be documented and reported.

Confronting the suspected operator before evidence is secured: A confrontation can lead to account deletion, username changes, destruction of messages, or migration to another account.

Waiting until someone loses money: Computer-related identity theft can still be legally relevant even where no damage has yet occurred; the statute expressly addresses the situation in which damage has not yet been caused. (eLibrary)

When legal or law-enforcement help is urgent

Seek prompt assistance if the impersonator is currently collecting money, obtaining OTPs or passwords, opening or taking over financial accounts, threatening physical harm, demanding payment, stalking you, impersonating you in business transactions, communicating with your employer or customers, using government IDs, or repeatedly creating new accounts after takedowns.

Urgent intervention is also appropriate where intimate material is being distributed or threatened, a child is involved, the fake account is inducing victims to meet someone in person, or the activity appears coordinated across several accounts or victims. Different criminal statutes may apply in these situations, so the complaint should describe the conduct rather than attempting to force every incident into the label "identity theft."

Frequently asked questions

Is using my photo on a fake account enough for an identity-theft case?

It can be important evidence, but liability depends on the complete facts. Computer-related identity theft requires intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another's identifying information without right. A copied photograph combined with your name, occupation, personal details, and representations that the account is really yours is much stronger evidence of impersonation than an isolated use of a photograph without context. (eLibrary)

Can I report the account even if I do not know who created it?

Yes. In fact, anonymity is one reason to report serious impersonation to a specialized cybercrime unit. Preserve the profile URL and evidence and explain that the operator is unknown. Investigators can determine whether further investigative measures or cybercrime warrants are justified.

Can I demand that Facebook, Instagram, TikTok, or X tell me who owns the fake account?

Ordinarily, a private complainant cannot simply require a platform to disclose protected subscriber or technical records. Under the Cybercrime Prevention Act, law-enforcement disclosure of specified computer data is subject to legal procedures, including the warrant requirement applicable under Section 14 and the Rule on Cybercrime Warrants. (Lawphil)

Should I report the account to the platform or police first?

Usually both can be done promptly. Preserve evidence first. Platform reporting is aimed primarily at restriction or removal, while PNP or NBI reporting is directed toward investigation and possible prosecution. If there is immediate financial fraud, threats, extortion, or danger, prioritize law enforcement and the relevant bank or financial institution as well.

Is a screenshot enough to prove the case?

It can be valuable evidence, but it may not be sufficient by itself. Save original messages, URLs, account details, devices, transaction records, witnesses' copies, and other evidence. Platform-held information may later become important in proving who controlled an account.

What if the fake account has already been deleted?

Report the incident if the conduct was serious. Preserve whatever remains: screenshots, URLs, emails, messages received by third parties, notification emails, transaction records, and witnesses. Deletion of the public-facing account does not necessarily mean that every service-provider record has already disappeared, which is another reason to report promptly.

Official sources and reporting pages

For the Cybercrime Prevention Act and its legal framework, see the Supreme Court E-Library copy of Republic Act No. 10175 and the Supreme Court's decision in Disini v. Secretary of Justice.

For law-enforcement reporting, see the PNP Anti-Cybercrime Group contact directory and the NBI procedure for investigative assistance to victims of computer crimes.

For privacy complaints, see the National Privacy Commission complaint guide.

For platform reporting, see TikTok's official impersonation-account reporting guide and X's official impersonation reporting guide. Facebook users whose genuine account has been taken over can use Meta's official hacked-account recovery guidance.

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice about a particular incident. The proper offense, agency, venue, evidence, remedies, and deadlines can depend on exactly how the identity was used, what the fake account did, whether the operator is identifiable, and whether financial loss or other harm occurred. Laws, procedural rules, agency contacts, and platform reporting systems should be rechecked when action is taken.

Sources and procedures checked: 25 August 2026.