Quick answer

If someone creates a social media account using your name, photographs, business identity, or other identifying information to impersonate you, deceive other people, solicit money, damage your reputation, or carry out another illegitimate purpose, report the account to the platform and preserve the evidence before it disappears. You may also report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI CyberCrime Division, especially when the impersonation involves fraud, threats, harassment, account hacking, financial loss, or deliberate misuse of your identity.

Philippine law specifically punishes computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012. It covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or entity's identifying information without right. The law provides a lower penalty when no damage has yet been caused, which means actual financial loss is not necessarily required before the offense may become actionable. (Lawphil)

However, not every account using another person's name or photograph automatically constitutes criminal identity theft. The Supreme Court explained in Disini v. Secretary of Justice that the identity information must be taken or used for an illegitimate purpose; merely obtaining and disseminating information that the person himself or herself made public is not, by itself, the identity theft contemplated by the law. The surrounding facts—especially deception, unauthorized use, fraudulent intent, and what the fake account actually does—are therefore important. (Judiciary eLibrary)

What to do as soon as you discover the fake account

Preserve the evidence before reporting or confronting the account. Take clear screenshots showing the fake profile's name, username or handle, profile photograph, biography, posts, messages, comments, follower information when relevant, and the date and time. Save the full profile URL and URLs of important posts or conversations. Screen-recording the profile can help document material that may later be changed or deleted. The PNP's own cybercrime investigation guidance identifies screenshots, electronic communications, logs, affidavits, and other digital records as important evidentiary material. (PNP ACG)
Document exactly how the account is impersonating you. Save your genuine account URL and examples showing that the photographs, identity details, business name, logo, signature, credentials, or other information belong to you. If friends, clients, relatives, or customers received messages from the fake account, ask them to preserve the entire conversation rather than sending only cropped screenshots.
Preserve proof of harm or attempted harm. Keep bank or e-wallet transaction records, payment requests, account numbers, QR codes, phone numbers, email addresses, phishing links, demands for money, threats, defamatory posts, fake contracts, advertisements, receipts, or messages sent to third parties. If someone transferred money because of the impersonation, that person's evidence and statement may be particularly important.
Report the fake account through the social media platform. Facebook expressly allows reports against profiles or Pages pretending to be another person and permits impersonation reports even from people who do not have a Facebook account. Instagram, TikTok, X, and YouTube likewise maintain impersonation-reporting mechanisms. (Facebook)
Secure your real accounts. If there is any possibility that your genuine account, email, or phone was compromised, immediately change passwords, terminate unknown login sessions, activate multi-factor authentication, secure your recovery email and mobile number, and review recent account activity. If your actual Facebook account was hacked rather than merely copied, Meta provides a separate compromised-account recovery process. (Facebook)
Report the incident to law enforcement when criminal conduct is involved or reasonably suspected. Republic Act No. 10175 expressly assigns enforcement of the Cybercrime Prevention Act to the NBI and PNP. (Lawphil) The PNP-ACG currently lists its Cyber Response Unit at complaint@acg.pnp.gov.ph and publishes contact information for its regional and district anti-cybercrime units. (PNP ACG) The NBI also maintains an official online complaint page and its CyberCrime Division provides investigative assistance to members of the public. (National Bureau of Investigation)
Consider reporting through the Cybercrime Investigation and Coordinating Center. The CICC currently identifies 1326 as its cybercrime hotline and also publishes report@cicc.gov.ph for reports. The CICC's statutory role includes coordinating cybercrime prevention, investigation, suppression, and assistance among government agencies. (CICC)
Consider a National Privacy Commission complaint when personal data is being unlawfully processed or misused. The Data Privacy Act gives data subjects rights concerning unlawful or unauthorized processing of their personal information and authorizes complaints before the NPC. The NPC's current complaint process uses its prescribed complaint form or complaint-affidavit, supporting evidence, and applicable filing requirements. (Lawphil)

What evidence should you preserve?

The most useful evidence normally shows both the identity of the fake account and what it actually did.

Preserve the complete profile URL, username or handle, screenshots with visible dates and times where possible, profile and cover photographs, biography, posts, stories, reels or videos, comments, advertisements, private messages, payment instructions, phone numbers, email addresses, bank or e-wallet details, links sent by the impersonator, and communications from people who were contacted.

Keep original electronic files whenever possible. Avoid repeatedly editing, annotating, cropping, or converting the only copy of a screenshot or recording. You may make annotated copies for explanation while retaining the originals.

If witnesses received fraudulent messages, ask them to retain the messages on their own devices. Their direct evidence can help establish what the impersonator represented to third parties.

For businesses, professionals, and organizations, preserve documents showing ownership or legitimate use of the business name, branding, domain, official social media pages, contact information, and other identifying material being copied.

When does a fake account become computer-related identity theft?

Section 4(b)(3) of the Cybercrime Prevention Act covers intentional dealings with another person's or entity's identifying information without right. The statute is broad enough to cover natural persons as well as juridical persons such as corporations. (Lawphil)

But the criminal analysis does not end with the fact that two accounts use the same photograph or name. In Disini, the Supreme Court upheld the identity-theft provision and emphasized that the prohibited taking or use of identity information involves an illegitimate purpose. Information openly published by a person does not become criminally "stolen" merely because another person reads or republishes it. (Judiciary eLibrary)

For example, the legal position becomes materially stronger when an account deliberately represents itself as being you and then asks your relatives for money, approaches your clients pretending to act for you, uses your credentials to obtain goods or services, sends fraudulent payment instructions, publishes fabricated statements as though you made them, or combines your identity information with other deceptive conduct.

A parody, fan, commentary, or similarly styled account may present a different issue if reasonable users would not be deceived into believing that it is genuinely yours. Platform rules may nevertheless prohibit certain forms of impersonation even when the evidence is insufficient to establish a Philippine criminal offense.

What if your real account was hacked?

A hacked account and a newly created fake account are related problems but legally distinct.

Unauthorized access to a computer system is separately punishable under Section 4(a)(1) of Republic Act No. 10175. If an offender gained control of your genuine Facebook, Instagram, email, or another account without authority and then changed passwords, sent messages, extracted information, or used it to impersonate you, tell investigators that this was an account takeover, not merely a duplicate profile. (Lawphil)

Preserve notices of password resets, login alerts, recovery-email changes, unfamiliar devices, IP or location notifications, and messages sent while the offender controlled the account. Secure the email account connected to the social media profile because control of the email account may allow the attacker to retake the social media account even after you change its password.

Why reporting quickly matters

Online evidence can disappear quickly. The offender may delete the account, change usernames, erase messages, or remove content once challenged.

Republic Act No. 10175 also contains specific rules on preservation of computer data. It requires preservation of traffic data and subscriber information for at least six months from the relevant transaction and provides a separate six-month preservation period for content data after a law-enforcement preservation order, subject to a permitted extension. Disclosure of protected computer data for an investigation is governed by legal process and court-warrant requirements. (Lawphil)

This does not mean every deleted message will always be recoverable for six months. The practical availability of data depends on what the service provider possesses and retains. The important point for a victim is to report promptly so investigators can evaluate whether a formal preservation request or cybercrime warrant should be pursued before relevant records disappear.

A private complainant ordinarily cannot compel Meta, TikTok, X, Google, or another provider to disclose another user's subscriber information merely by asking customer support. Law-enforcement authorities use the legal processes provided by the Cybercrime Prevention Act and the Rule on Cybercrime Warrants when protected account data is needed for an investigation.

Reporting to the PNP Anti-Cybercrime Group

For a criminal investigation, you may approach the PNP-ACG Cyber Response Unit or an appropriate Regional Anti-Cybercrime Unit. The PNP publishes current national, regional, provincial, and district contact details on its official ACG website. (PNP ACG)

Expect investigators to ask what happened, when and where you discovered it, what account or device was involved, what identifying information was used, what the offender communicated, whether anyone suffered damage, and what evidence you possess. The PNP's cybercrime investigation primer identifies complaint and witness affidavits, screenshots, communications, digital files, transaction records, and related materials among the evidence that may be collected depending on the offense. (PNP ACG)

Be precise about which statements are personally known to you and which came from another witness. If another person received the scam message, identify that person instead of presenting the conversation as though you personally received it.

Reporting to the NBI CyberCrime Division

The NBI's current Citizen's Charter states that its CyberCrime Division provides investigative assistance to victims of computer crimes and that the service is available to the general public. The published process includes a preliminary interview, complaint documentation, sworn statements, collection of supporting documents, and examination of relevant devices when necessary. (National Bureau of Investigation)

The NBI also maintains an official Online Complaint page. Depending on the circumstances, further personal appearance, sworn statements, supporting evidence, or device examination may still be required during the investigation. (National Bureau of Investigation)

When a National Privacy Commission complaint may also be appropriate

Identity theft can overlap with data-privacy violations, but the jurisdictions are not identical.

The Data Privacy Act regulates the processing of personal information and recognizes the data subject's right to complain about unlawful processing. It also contains offenses involving unauthorized processing and processing for unauthorized purposes. Whether those provisions apply to a particular fake account depends on the information involved, how it was obtained and processed, the purpose for which it was used, and whether a lawful basis existed. (Lawphil)

The NPC currently uses a Complaint-Affidavit template that took effect on July 1, 2025. Its published complaint procedures require the prescribed form or verified complaint, supporting evidence, and compliance with the applicable filing and fee requirements. Complaints may be submitted through the filing methods authorized by the Commission, including the channels identified on its official complaint pages. (National Privacy Commission)

A privacy complaint before the NPC does not necessarily replace a criminal complaint with the PNP or NBI. Where the same conduct may constitute computer-related identity theft or another crime, the appropriate remedies can operate under different laws.

What if the fake account is scamming other people?

Preserve evidence showing the representations made to each victim. If money was transferred, obtain transaction confirmations, recipient account details, reference numbers, dates, amounts, and communications preceding the payment.

Victims who sent money should promptly contact their bank, e-wallet provider, or other financial institution through its official fraud channel. Speed can matter when a transaction has only recently occurred.

Do not assume that merely obtaining a profile takedown will preserve the evidence necessary to identify the offender or trace payments. Capture the evidence first, then report the profile and seek law-enforcement assistance.

If the offender is still actively communicating with you, avoid arranging your own entrapment or pretending to make payments unless investigators specifically direct the operation. Improvised confrontations can expose the victim to additional loss and may complicate evidence collection.

Common mistakes that can weaken a complaint

A frequent mistake is reporting the profile immediately without first saving its URL, username, screenshots, messages, and other evidence. Another is keeping only a cropped photograph of the profile, which may not show where the material came from.

Victims should also avoid publicly accusing a specific person of being the offender without reliable evidence. The apparent name, photograph, telephone number, bank account, or social media profile may itself have been stolen or controlled by another person.

Do not delete suspicious messages merely because they are upsetting or embarrassing. Do not alter screenshots to emphasize your version of events. Do not pay an impersonator merely because the person promises to delete the account. And do not send copies of IDs, passwords, OTPs, recovery codes, or other sensitive credentials to unofficial "agents" claiming that they can remove the fake profile.

Another mistake is treating a social-media takedown report as equivalent to a criminal complaint. Platform enforcement may remove an account for violating private platform rules, while a Philippine criminal investigation requires evidence sufficient to establish an offense and, eventually, identify the responsible person.

When legal or law-enforcement help is urgent

Seek prompt assistance when the fake account is presently collecting money, accessing your genuine accounts, threatening physical harm, blackmailing or extorting you, distributing intimate material, targeting a child, obtaining financial credentials, publishing sensitive personal data that creates a safety risk, or using your identity for continuing transactions.

Urgency is also warranted when significant money has already been transferred, because banking and platform records may need to be preserved quickly.

If the impersonator is threatening immediate physical violence or there is an immediate danger to a person, prioritize personal safety and contact the police rather than attempting to identify or confront the account holder yourself.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. Not knowing the offender's real name is common in cybercrime complaints. Preserve the account URL, username, messages, payment information, email addresses, telephone numbers, and other identifiers and give them to investigators. Identification may depend on records held by platforms, telecommunications companies, financial institutions, or other service providers and may require formal legal process.

Do I need to suffer financial loss before reporting identity theft?

No. Section 4(b)(3) expressly provides for a lower penalty where no damage has yet been caused, rather than requiring damage as an indispensable condition in every case. The precise criminal liability still depends on whether the other elements of computer-related identity theft are established. (Lawphil)

Is using my photograph automatically identity theft?

Not necessarily. The Supreme Court has distinguished criminal identity theft from merely acquiring or disseminating information that a person has made public. The decisive issue is the unauthorized conduct and illegitimate purpose shown by the evidence. Deceptively presenting the fake account as genuinely yours, particularly for fraud or another unlawful objective, presents a materially different situation. (Judiciary eLibrary)

Should I message the fake account and demand that it be removed?

Usually, preserve the evidence first. A warning may cause the offender to delete the account, erase conversations, change usernames, or destroy evidence. If there is an active criminal investigation, ask the investigator before engaging further with the suspect.

Can Facebook or another platform tell me who owns the fake account?

A platform may investigate and remove an impersonating account under its own rules, but protected subscriber and computer data are subject to privacy rules and legal process. When identifying information is required for a criminal investigation, Philippine law provides mechanisms for law enforcement to seek preservation and court-authorized disclosure of relevant computer data. (Lawphil)

Can I report the account to both the platform and the police?

Yes. The two processes serve different purposes. Reporting to the platform seeks enforcement of the platform's rules and possible takedown. Reporting to the PNP or NBI seeks investigation of possible criminal conduct.

Can a business or company be a victim of computer-related identity theft?

Yes. Section 4(b)(3) expressly protects identifying information belonging to another person whether natural or juridical. A company whose identity or credentials are deliberately misused online may therefore have remedies depending on the facts. (Lawphil)

Official sources and reporting links

The controlling Philippine statute is the Cybercrime Prevention Act of 2012 — Republic Act No. 10175. The Supreme Court's controlling constitutional discussion of computer-related identity theft is in Disini v. Secretary of Justice, G.R. No. 203335, February 18, 2014.

For law-enforcement reporting and guidance, see the PNP Anti-Cybercrime Group contact directory, the NBI CyberCrime Division Citizen's Charter, the NBI Online Complaint page, and the Cybercrime Investigation and Coordinating Center.

For privacy-related complaints, consult the National Privacy Commission complaint page and the Data Privacy Act of 2012.

For platform impersonation reports, use the official procedures published by Facebook, Instagram, TikTok, X, or YouTube, depending on where the fake account appears.

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for advice on a specific case. Whether a fake account constitutes computer-related identity theft, fraud, illegal access, a Data Privacy Act violation, or another offense depends on the actual content, purpose, evidence, identity of the actors, and surrounding circumstances. Procedures and online reporting channels can also change.

Sources and procedures checked as of August 23, 2026.