Quick answer

If someone is using your name, photographs, personal information, or online identity to impersonate you, deceive other people, obtain money, access accounts, or otherwise cause harm, preserve the evidence first, report the account to the platform, secure your genuine accounts, and promptly report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division. You may also report cybercrime or scam incidents through the Cybercrime Investigation and Coordinating Center (CICC), including its 1326 hotline. (Lawphil)

Under Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information, without right. The law expressly covers identifying information belonging to either a natural person or a juridical person such as a corporation. The Supreme Court upheld the constitutionality of this offense in Disini v. Secretary of Justice. (Lawphil)

Not every fake-looking social media account automatically constitutes criminal identity theft. A fan page, parody account, duplicate name, or anonymous account must still be assessed against the elements of the applicable offense. The facts become much more serious when the account copies your identity, communicates as though it were you, solicits money, obtains confidential information, damages your reputation, threatens people, or gains unauthorized access to your genuine accounts.

If money has already been transferred through a bank or e-wallet, contact the financial institution immediately rather than waiting for the police investigation. Philippine financial institutions now operate under the Anti-Financial Account Scamming Act and its implementing rules, which include procedures for temporarily holding disputed funds under specified conditions. (Lawphil)

When a fake account may constitute computer-related identity theft

Section 4(b)(3) of RA 10175 covers computer-related identity theft. It applies to identifying information belonging to another person that is intentionally acquired, used, misused, transferred, possessed, altered, or deleted without right. (Lawphil)

Identifying information can go beyond a person's name. In discussing the provision, the Supreme Court referred to information ordinarily associated with a person's identity, such as a name, citizenship, residential address, contact information, place and date of birth, occupation, and similar data. Depending on the circumstances, photographs, usernames, account details, business identities, and other information may also become relevant evidence of impersonation or identity misuse. (Lawphil)

A common example is an account that copies your name and photograph and then messages your relatives pretending to be you while asking for money. Other examples may include an impersonator who uses your identity to approach customers, falsely represents that the account belongs to your business, or uses information taken from your genuine account to convince victims that the impersonation is authentic.

Importantly, the statute contemplates liability even when damage has not yet occurred: Section 4(b)(3) provides for a penalty one degree lower if no damage has yet been caused. You therefore do not necessarily have to wait until someone loses money before reporting suspected identity theft. (Lawphil)

If the offender actually entered your real account without authority—for example, by using a stolen password or compromising your login credentials—the facts may also implicate the separate cybercrime offense of illegal access under Section 4(a)(1) of RA 10175. Other criminal laws may become relevant if the impersonation is used for fraud, threats, defamatory publications, financial-account scams, or other unlawful conduct. The exact offense depends on what the perpetrator actually did and what the evidence can establish. (Lawphil)

Preserve the evidence before reporting or confronting the account

Preserving evidence is often the most important first step because fake accounts can be renamed, deleted, suspended, or stripped of their posts within minutes.

Before blocking or confronting the impersonator, save as much of the following as reasonably possible:

The exact profile URL or account link. A screenshot showing only the display name may not uniquely identify the account because usernames and display names can change.
The username or handle and displayed name. Capture both if they are different.
Screenshots of the entire profile. Include the profile photograph, biography, follower information, posts, and any visible dates or timestamps.
Messages sent by the impersonator. Preserve the conversation in sequence rather than saving only isolated statements.
Posts, stories, advertisements, comments, or solicitations. Where possible, capture the surrounding context.
Transaction evidence. If money was requested or transferred, preserve receipts, transaction or reference numbers, account names, bank or e-wallet details, QR codes, and the amount and time of each transaction.
Emails, SMS messages, security alerts, and login notifications. These may help establish an account takeover or attempted access.
Proof of your genuine identity or genuine account. This may include the history of your legitimate account and documents establishing your connection to a business or organization being impersonated.
Witness information. Preserve the names and contact details of people who received messages or were deceived by the fake account.
Platform-report confirmations. Save any case number, acknowledgment email, or status notice generated when you report the account.

Keep the original electronic files whenever possible. Avoid relying solely on cropped, annotated, or edited screenshots. A screen recording showing how you navigated to the profile, post, or message may provide useful context, but it should supplement—not replace—the original links, screenshots, messages, and device data.

Do not attempt to hack the impersonator, obtain passwords, break into an account, or use unlawful methods to discover the person's identity. Law-enforcement authorities can seek subscriber information and computer data through the legal processes provided by RA 10175 and the Supreme Court's Rule on Cybercrime Warrants. (E-Library)

Report the impersonating account to the social media platform

Report the account through the platform's official impersonation, fake-account, or account-security procedure. Doing this can stop ongoing victimization more quickly than waiting for a criminal case to progress.

If possible, preserve the evidence before the account is removed. A successful platform takedown is useful, but it is not the same thing as filing a criminal complaint.

TikTok maintains an official procedure for reporting an account that is pretending to be someone else. X likewise prohibits deceptive impersonation, while recognizing that clearly identified parody, commentary, or fan accounts may be treated differently under its authenticity rules.

If your genuine Facebook account has been taken over rather than merely copied, Meta also maintains an account-recovery process for hacked accounts. (Facebook)

Official platform resources include:

Be cautious with links sent by people claiming to be platform support personnel. Do not send identification documents, passwords, recovery codes, or one-time passwords to an unofficial account simply because it promises to remove the impersonator.

File a report with the PNP Anti-Cybercrime Group

The Philippine National Police is one of the law-enforcement authorities specifically designated under RA 10175 to enforce the Cybercrime Prevention Act, and the PNP maintains the Anti-Cybercrime Group for this purpose. (Lawphil)

You may approach the PNP-ACG or the appropriate regional cybercrime unit. The PNP-ACG's current official contact directory identifies its Cyber Response Unit and regional offices. Its published central contact information includes complaint@acg.pnp.gov.ph and 0968-878-3561, together with telephone and regional contact details. Because agency contact details can change, confirm the current information through the official directory before sending sensitive documents. (PNP ACG)

Bring or make available the evidence you preserved. Explain clearly:

which account is genuine;
which account is allegedly impersonating you;
when you first discovered the impersonation;
what identifying information was copied or misused;
what the fake account said or did;
who received communications from it;
whether anyone paid money or disclosed confidential information; and
whether your real account, email, bank account, or device was also compromised.

You do not need to know the real name of the person behind the account before reporting. Identifying an unknown perpetrator may itself be part of the investigation.

PNP Anti-Cybercrime Group contact directory

File a complaint with the NBI Cybercrime Division

You may also seek investigative assistance from the National Bureau of Investigation Cybercrime Division or an appropriate NBI regional office.

The NBI's current Citizen's Charter for victims of computer crimes describes a process that includes filing a complaint or request for investigation, completing a complaint sheet, undergoing a preliminary interview, and executing sworn statements or submitting prepared affidavits when appropriate. Supporting documents and relevant devices may be examined as part of the investigation. The published service carries no fee. (National Bureau of Investigation)

Although the Citizen's Charter does not list a mandatory documentary prerequisite before a person can ask for assistance, bringing organized evidence can make the initial evaluation much more useful. Keep a separate copy of everything you submit.

NBI: Investigative Assistance for Victims of Computer Crimes

You can also report through the CICC

The Cybercrime Investigation and Coordinating Center (CICC) operates government cybercrime-reporting channels, including the 1326 hotline. Its official materials also publish report@cicc.gov.ph and current mobile contact numbers. (CICC)

CICC reporting can be useful for cybercrime and scam complaints, coordination, and referrals. It should not be treated as a reason to postpone a formal complaint with the PNP or NBI where investigation, affidavits, warrants, or other law-enforcement action may be required.

The government's eGovPH system has also been used as a reporting channel for suspicious online activity and scams. (Philippine News Agency)

CICC official anti-scam reporting information

If money was sent, contact the bank or e-wallet immediately

If the fake account persuaded you or another victim to transfer money, the first financial step should usually be to contact the sending bank, e-wallet, or other financial institution immediately, using its official fraud or dispute channel.

Republic Act No. 12010, the Anti-Financial Account Scamming Act (AFASA), specifically addresses financial-account scams and social-engineering schemes. Its definition of electronic communications encompasses communications through channels such as social media, while social engineering includes deceptive methods used to obtain sensitive identifying information and gain unauthorized access or control over financial accounts. (Lawphil)

Under the Bangko Sentral ng Pilipinas' implementing framework, a disputed transaction may, when the legal and regulatory requirements are met, be subjected to an initial temporary holding period of up to five calendar days, with a possible extension of up to 25 additional calendar days. The total temporary holding period generally may not exceed 30 calendar days, absent the applicable legal basis for further restraint. (Bureau of the Treasury)

These rules do not guarantee recovery. Funds may already have been withdrawn, dispersed, transferred through multiple accounts, or otherwise become unavailable. Early reporting can materially affect the chances of tracing or preserving disputed funds.

BSP: AFASA and implementing regulations

When to consider a complaint with the National Privacy Commission

Identity impersonation can also involve violations of the Data Privacy Act of 2012, particularly where personal information has been unlawfully processed, obtained, or used. However, the National Privacy Commission is not a substitute for the PNP or NBI in investigating every fake social media account.

An NPC complaint is most relevant when the facts involve a violation of rights or obligations under the Data Privacy Act. The Act separately penalizes specified forms of unauthorized processing and other unlawful handling of personal or sensitive personal information. Whether a particular impersonator's conduct falls within those provisions depends on the evidence and the exact processing involved. (Lawphil)

For an ordinary NPC complaint, the Commission's current complaint mechanics generally require the complainant first to notify the concerned personal information controller, personal information processor, or other respondent in writing and allow an opportunity to address the matter. The NPC states that a complaint generally will not be given due course when the respondent has not first been afforded this opportunity, including where 15 calendar days from receipt have not yet elapsed without an appropriate response, subject to the Commission's applicable rules. A notarized complaint-assisted form or verified complaint and supporting evidence are also generally required. (National Privacy Commission)

That NPC procedure does not mean you should wait 15 days before reporting possible cybercrime to the PNP, NBI, your bank, or the social media platform. These are separate remedies serving different purposes.

National Privacy Commission: Mechanics for Complaints

What investigators may do after you report

A victim ordinarily cannot force a social media company to disclose the identity, IP address, subscriber records, or other private data of an account holder simply by demanding it.

RA 10175 and the Supreme Court's Rule on Cybercrime Warrants provide legal mechanisms through which authorized law-enforcement officers may seek preservation or disclosure of specified computer data and, when the requirements are satisfied, obtain appropriate court warrants. A Warrant to Disclose Computer Data, for example, is a judicial process used to compel disclosure of relevant subscriber information, traffic data, or other computer data within its lawful scope. (E-Library)

RA 10175 also imposes preservation obligations on service providers. Subscriber information and traffic data are generally required to be preserved for a minimum of six months from the date of the transaction, while content data subject to a lawful preservation order is preserved for six months from receipt of the order, with the statute allowing a one-time extension for another six months. Disclosure itself is subject to the legal requirements of the Act, including appropriate judicial authority. (Lawphil)

These periods are not a reason to delay. A victim cannot assume that every useful piece of evidence will remain available for six months, that the platform possesses every requested record, or that the evidence will ultimately identify the perpetrator. Early preservation and reporting remain important.

Possible penalties for computer-related identity theft

For cybercrimes under Section 4(a) and Section 4(b) of RA 10175, Section 8 generally provides a penalty of prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both, subject to the statute's specific provisions. For computer-related identity theft, Section 4(b)(3) separately states that when no damage has yet been caused, the penalty imposable is one degree lower. (Lawphil)

The ultimate charge and penalty cannot be determined merely from the existence of a fake profile. Investigators and prosecutors must consider the actual conduct, evidence, intent, resulting harm, and any other offenses implicated by the incident.

Do not assume there is a simple reporting deadline

RA 10175 does not establish a simple rule requiring a victim to report computer-related identity theft to the police within a particular number of days after discovering the fake account.

Criminal offenses under special laws are nevertheless subject to rules on prescription, including Act No. 3326, and the applicable period and its reckoning can depend on the offense, penalty, discovery of the violation, and institution of proceedings. (Lawphil)

For practical purposes, report as soon as reasonably possible. Delay can create evidence problems even when the criminal action has not legally prescribed.

Common mistakes that can weaken a complaint

Avoid deleting the conversation or blocking the account before saving its URL and evidence. Blocking may still be appropriate for safety, but preserve what you can first if doing so does not expose you to further risk.

Do not repeatedly threaten the impersonator with prosecution before the evidence is preserved. Warning the person may cause the account, messages, and related profiles to disappear.

Do not publicly accuse a specific person unless you have a sound factual basis. A suspicion based on writing style, a familiar photograph, or an account's followers is not necessarily proof of who controls it.

Do not alter screenshots to make them easier to read and then discard the originals. Keep an untouched copy.

Do not send your passport, driver's license, national ID, passwords, OTPs, or account-recovery codes to an unofficial “support” account.

Finally, do not assume that obtaining a platform takedown ends the matter. If the fake account stole money, threatened someone, obtained confidential data, or committed another offense, preserve the takedown confirmation and consider pursuing the appropriate criminal, financial, or privacy remedy.

When the situation requires urgent action

Treat the matter as particularly urgent if the impersonator has gained control of your genuine email or social media account; is changing passwords or recovery details; is communicating with your bank or e-wallet; is soliciting or receiving money; is impersonating you to clients, employers, relatives, or government agencies; is publishing your private information; is threatening violence; or is targeting children or other vulnerable persons.

Where there is an immediate threat to someone's physical safety, contact the appropriate local police or emergency authorities without waiting for the platform to complete an online review.

If your email account is compromised, secure it first where possible because email access can allow an attacker to reset passwords for multiple connected services. Change compromised passwords, terminate unknown login sessions, enable multi-factor authentication, and review recovery email addresses, telephone numbers, and linked devices.

FAQ

Can I report a fake account even if I do not know who created it?

Yes. You can provide the account URL, username, screenshots, messages, transaction records, and other available evidence even if the perpetrator's real identity is unknown. Determining the person behind an account may require investigative work and lawful requests for computer data.

Must someone actually lose money before computer-related identity theft can be reported?

No. RA 10175 expressly addresses the situation in which computer-related identity theft has occurred but no damage has yet been caused, although the statute provides for a lower penalty in that circumstance. (Lawphil)

Can I personally demand the fake account's IP address from Facebook, TikTok, or another platform?

You may ask a platform for assistance, but you generally cannot compel disclosure of another user's protected account data merely because you filed a private request. Philippine investigators can use the procedures under RA 10175 and the Rule on Cybercrime Warrants when the legal requirements for preservation or disclosure are satisfied. (E-Library)

Should I report to the PNP, NBI, CICC, or NPC?

For suspected criminal identity theft, account hacking, or related cybercrime, the PNP-ACG and NBI are primary law-enforcement options. CICC provides an additional government reporting and coordination channel. The NPC becomes relevant when the facts also amount to a violation of the Data Privacy Act. More than one remedy may apply to the same incident. (PNP ACG)

Is every account using my name illegal?

No. Names may be shared by multiple people, and platforms may permit some parody, fan, or commentary accounts when their nature is made clear. Criminal liability depends on the statutory elements and the actual use of another person's identifying information, not merely on the existence of a similar username or profile. (Lawphil)

What if the impersonator deleted the account?

Still report it if the conduct was serious. Preserve whatever remains: screenshots, URLs, messages sent to other people, emails, transaction records, platform notices, and witness accounts. Deletion of the public profile does not necessarily mean every underlying record has disappeared.

Should I wait for the platform's response before going to the police?

Not where criminal activity appears to be occurring. Platform reporting and law-enforcement reporting can proceed separately. If money is moving, accounts are being compromised, threats are being made, or evidence is disappearing, prompt action is preferable.

Official sources

General information disclaimer

This article provides general legal information for the Philippines and is not a substitute for legal advice on a particular incident. The proper complaint, respondent, offense, evidence, jurisdiction, and available remedies can change depending on how the account was created and used, whether money or confidential information was obtained, and what records remain available from the platform or financial institutions. Sources and procedures checked as of August 25, 2026.