Quick answer

If someone is using your name, photos, personal details, or hacked account to pretend to be you, act on several tracks at once:

Preserve the account, posts, messages, links, dates, and transaction records before anything disappears.
Report the impersonating profile and each harmful post or message through the platform’s official reporting tools.
Secure your genuine social media, email, mobile, banking, and e-wallet accounts.
Report suspected crime to the PNP Anti-Cybercrime Group, the NBI Cybercrime Division, or the Cybercrime Investigation and Coordinating Center.
If personal data was misused and the responsible entity does not act, consider a formal complaint with the National Privacy Commission.

You do not need to prove the offender’s identity before making a report. You may report an unknown person using the fake account’s exact username, profile URL, and other identifying details. However, a report is not the same as a criminal conviction: investigators and prosecutors must still establish the elements of an offense through admissible evidence.

Do not wait for a platform response if money is being stolen, threats are being made, intimate material is involved, or someone faces immediate physical danger.

Is a fake social media account automatically illegal?

Not every account using a nickname, fictional identity, fan label, or obvious parody is automatically a crime. The legal question depends on what information was used, whether the person had a right to use it, whether the presentation was deceptive, and what the account did.

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 punishes computer-related identity theft: the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person, whether natural or juridical, without right. The Supreme Court upheld this provision in Disini v. Secretary of Justice.

A profile may therefore raise an identity-theft issue when, for example, it intentionally uses another person’s identifying information without authority and presents itself as that person. The use of the account to solicit money, obtain passwords, deceive customers, threaten the victim, or access financial accounts may support additional charges. The possible offenses depend on the evidence and may include estafa, falsification, unlawful access, threats, cyberlibel, violations of the Data Privacy Act, or offenses involving financial accounts.

Platform rules are separate from criminal law. A platform may remove an impersonating account even when the available evidence is not yet enough to prosecute a crime.

On conviction, computer-related identity theft is punishable under Section 8 of Republic Act No. 10175 by prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. Other offenses may carry different penalties.

What to do immediately

1. Preserve evidence before reporting or confronting anyone

Record the account in its existing condition.

Quick answer

If someone is using your name, photos, personal details, or organization’s identity to deceive others, first preserve the account and its activity as evidence, then report it through the social-media platform’s impersonation channel. If the account is scamming people, accessing your accounts, threatening you, or causing financial or safety risks, report it promptly to the Philippine National Police Anti-Cybercrime Group (PNP-ACG), National Bureau of Investigation Cybercrime Division (NBI-CCD), or Cybercrime Investigation and Coordinating Center (CICC).

You may also file a complaint with the National Privacy Commission (NPC) when personal information has been collected, disclosed, or used unlawfully. These remedies are separate: a platform report seeks restriction or removal, law-enforcement reporting can begin a criminal investigation, and an NPC complaint addresses possible violations of the Data Privacy Act.

Do not delete messages, warn the impersonator, or publicly post sensitive evidence before making secure copies.

When a fake account may be identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right.

A fake social-media account may fall within this provision when, for example, it deliberately uses another person’s name, photographs, contact details, credentials, or other identifying information to pose as that person. Financial loss is not expressly required by the statutory definition, although evidence of deception, solicitations, transactions, or resulting harm can be important.

Not every account using a similar name is automatically criminal identity theft. The facts still matter, including:

What identifying information was copied or used
Whether the user had permission or another lawful basis
Whether the account actually presents itself as the victim
Whether it is clearly identified as parody, commentary, or a fan account
What the account did after adopting the identity
Whether deception, fraud, threats, harassment, or other unlawful conduct occurred

The Supreme Court sustained the validity of the computer-related identity-theft provision in Disini v. Secretary of Justice. Ultimately, criminal liability must be established through evidence and the proper legal process. A platform may remove an account under its own rules even when the available evidence is insufficient for a criminal charge.

Upon conviction, computer-related identity theft is punishable under Section 8 of the Cybercrime Prevention Act by prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. Other offenses may apply depending on what the account did, such as estafa, threats, falsification, unlawful use of financial accounts, or violations of the Data Privacy Act. Charges and penalties should not be assumed without examining the evidence.

Preserve the evidence before reporting

Fake accounts can disappear or change their usernames, photographs, and posts within minutes. Preserve enough information to show both the account’s identity and its conduct.

Save the following when available:

Full screenshots showing the profile name, username or handle, profile photograph, biography, and browser address bar
The complete profile URL—not merely the displayed name
URLs and screenshots of individual posts, stories, advertisements, comments, and messages
The date and time each item was viewed or received
Screen recordings showing how you reached the profile, post, or conversation
Messages in their full conversational context, including sender details
Requests for money, bank or e-wallet details, QR codes, payment instructions, and transaction references
Reports from friends, customers, employers, or relatives who were contacted
Emails or notifications from the platform, including report and case numbers
Proof that the copied name, photograph, business page, or contact information belongs to you
A written timeline of when the account was discovered, what it did, whom it contacted, and what harm followed

Keep original files. Do not crop, annotate, rename, or repeatedly resave your only copy. Make a separate working copy if you need to highlight something. Back up the originals in at least one secure location.

Screenshots are useful but do not preserve the platform’s subscriber information, login records, or technical logs. Law-enforcement authorities may need to seek preservation or disclosure of provider-held data under the Cybercrime Prevention Act and applicable cybercrime-warrant rules. Because provider data may not remain available indefinitely, report serious cases promptly.

Report the account to the platform

Report both the account and any specific posts, messages, advertisements, or payment solicitations that violate platform rules. Use only official help pages or the reporting function inside the app.

Facebook: Use Meta’s impostor-account form or follow its instructions for profiles and Pages pretending to be someone else.
Instagram: Follow Meta’s Instagram impersonation-reporting instructions.
X: Use the impersonation-reporting process. X states that a person or authorized representative may report an account and that an X account is not required for a self-impersonation report.
TikTok: Follow TikTok’s impersonation-account reporting instructions.

The platform may request proof of identity or authority to represent the person, child, company, or organization being impersonated. Submit documents only through the platform’s verified app or official domain. A message asking you to send an ID, password, one-time PIN, or recovery code through chat may itself be phishing.

Save the confirmation page, acknowledgment email, reference number, and a copy of everything submitted. If the platform refuses or does not act, preserve that response for a possible NPC complaint.

Do not organize false or misleading mass reports. People who were actually contacted may submit truthful reports and retain their own evidence.

Report to Philippine authorities

A platform report is not a substitute for a criminal complaint. Contact law enforcement when the account is being used for fraud, account takeover, extortion, threats, stalking, sexual exploitation, unauthorized transactions, or a continuing campaign that causes substantial harm.

Authority	Appropriate use	Current official channel
PNP Anti-Cybercrime Group	Criminal investigation, urgent cyber-enabled threats, fraud, or impersonation	Approach the nearest police station or PNP-ACG office. The BSP’s current government directory also lists acg@pnp.gov.ph in its complaint guide.
NBI Cybercrime Division	Investigation of identity theft, account compromise, online scams, and related computer crimes	Use the NBI Online Complaint page or approach the NBI-CCD. The NBI lists ccd@nbi.gov.ph in its official directory.
CICC	Cybercrime and scam incident reporting and coordination	Call 1326 or email 1326@dict.gov.ph, as listed by the DICT.
National Privacy Commission	Unlawful collection, disclosure, processing, or misuse of personal data	Follow the NPC formal-complaint procedure.

The NBI Citizen’s Charter for computer-crime victims describes an initial complaint sheet and interview, followed as appropriate by sworn statements, supporting documents, and examination of relevant devices. An initial report or tip does not by itself guarantee that a criminal case will be filed. Investigators and prosecutors must determine what offenses and evidence the facts support.

Prepare a concise narrative covering:

Who is being impersonated
When and how the account was discovered
The account’s exact URL and username
What identifying information it used
What it represented, requested, or threatened
Who interacted with it
Any money, account access, or property involved
What reports were already submitted and their reference numbers
What evidence is attached and where the originals are stored

If the suspected operator is unknown, say so. Do not identify a person publicly or in an affidavit based only on suspicion.

If money or financial accounts are involved

Contact the bank, e-wallet provider, card issuer, or other financial institution through its official 24/7 fraud channel immediately. Ask it to secure the account, record the dispute, and provide a complaint reference number. Change compromised credentials using a clean device, but preserve relevant notices and transaction records first.

Under the Financial Products and Services Consumer Protection Act, financial service providers must maintain a consumer-assistance mechanism. If a complaint against a BSP-supervised institution remains unresolved, it may be escalated through the BSP Consumer Assistance Mechanism. BSP-CAM is a second-level consumer remedy; it does not replace reporting possible crimes to law enforcement.

Never send a PIN, password, one-time PIN, recovery code, full card details, or identification document to someone claiming they need it to “recover” stolen funds.

If your real account was also hacked

An impersonation account and a compromised genuine account are different problems and may require separate reports.

For a compromised account:

Use the platform’s official account-recovery process
Secure the connected email account first
Change passwords that were reused elsewhere
Sign out unfamiliar sessions and remove unknown devices or applications
Replace compromised recovery email addresses or phone numbers
Enable multi-factor authentication
Check whether the attacker changed advertisements, payment methods, page administrators, or business settings
Warn affected contacts through a verified channel without publishing sensitive investigative details

Preserve login alerts, password-reset notices, session records, and emails showing unauthorized changes.

Filing a privacy complaint with the NPC

The Data Privacy Act may apply when personal information is unlawfully collected, used, disclosed, or otherwise processed. The precise violation depends on the information involved, how it was obtained, who processed it, and whether a lawful basis existed. The Data Privacy Act of 2012 contains different offenses and penalties; misuse of information should not automatically be labeled as a particular DPA crime without reviewing the evidence.

Before a formal NPC complaint is ordinarily given due course, Rule II, Section 2 of the 2021 NPC Rules of Procedure, as amended, requires proof that:

The complainant informed the personal information controller, processor, or concerned entity in writing about the violation or breach; and
The entity failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving that written notice.

A properly documented platform report or written notice may be relevant to this requirement, depending on whom the complaint names and what the report contained. Keep proof of submission and receipt.

The NPC may waive these requirements for proven good cause or a serious violation or breach, including circumstances involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or patently illegal action. If urgent harm is continuing, explain and document it rather than simply omitting the prior-notice requirement.

The current amended rules do not contain the old six-month/30-day filing limit found in the repealed 2016 NPC rules. Nevertheless, delay can weaken evidence and make effective relief harder to obtain.

Use the NPC’s current Complaint-Affidavit template, which took effect on July 1, 2025. The complaint must be properly completed and notarized and may be submitted in person, by courier, or as a scanned filing through complaints@privacy.gov.ph, following the NPC’s filing instructions. Filing fees may apply under the NPC’s fee schedule, subject to the exemptions and waiver provisions in its rules.

The 15-day NPC prior-notice period does not require you to postpone an urgent platform report, bank notification, police report, or request for emergency assistance.

Common mistakes to avoid

Reporting before saving the profile URL and complete evidence
Keeping only cropped screenshots that omit usernames, dates, or context
Blocking the account before preserving messages and activity
Contacting or threatening the operator and causing evidence to disappear
Posting IDs, private messages, phone numbers, or financial details publicly
Paying the impersonator to delete the account
Sending recovery codes or IDs to unofficial “support agents”
Assuming that a barangay blotter or platform report automatically starts a cybercrime prosecution
Treating every parody, duplicate name, or unauthorized photograph as conclusively proven criminal identity theft
Waiting for the platform’s decision while fraud, threats, or account compromise continues
Failing to retain acknowledgment emails and complaint reference numbers
Naming a suspected offender without reliable evidence

When help is urgent

Call 911, contact the nearest police station, or seek immediate law-enforcement assistance if there is an imminent threat to life or physical safety.

Do not wait for ordinary platform review when the account is:

Threatening violence, stalking, or publishing a person’s live location
Extorting money or threatening to release intimate material
Soliciting money from the public in your name
Taking over financial, email, government, or business accounts
Using a child’s identity for sexual exploitation or grooming
Sending links or files intended to steal credentials
Causing continuing unauthorized transactions
Impersonating a public authority or emergency contact to obtain money or access

A lawyer experienced in cybercrime or data privacy is particularly helpful when substantial money is involved, the operator may be overseas, a company or public official is being impersonated, the platform rejected repeated reports, intimate images or minors are involved, or you need to prepare a complaint-affidavit or preservation-related request.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. Give investigators the exact URL, username, evidence, and all known circumstances. Identifying the operator may require provider records and lawful investigative process. Do not guess or accuse someone merely because of a personal dispute.

Should I report to both the platform and the police?

For serious or potentially criminal conduct, yes. The platform can restrict content or accounts, while police or the NBI can investigate possible offenses. One process does not automatically perform the other’s function.

Is using my photograph enough to prove identity theft?

Not necessarily. It is relevant evidence, but liability depends on the full circumstances, including whether the person intentionally used identifying information without right and whether the account posed as you. The same conduct may also raise separate privacy or platform-policy issues.

Can a family member report for me?

A person may help preserve evidence or submit a platform report, but formal complaints may require the victim’s participation or proof that the representative is authorized. Special rules may apply to minors, persons unable to act, companies, and organizations.

Will the account be removed immediately?

Not necessarily. Platforms apply their own review procedures, and removal is not guaranteed. Report accurately, use the correct impersonation category, attach the requested proof, and retain the result. Escalate urgent criminal, financial, or safety risks separately.

Do I have to wait 15 days before going to the NPC?

Ordinarily, the NPC requires written notice to the concerned entity and either inadequate action or no response within 15 calendar days. The NPC may waive that requirement in qualifying serious or urgent cases. This waiting rule applies to giving due course to an NPC complaint—not to police, bank, emergency, or platform reporting.

Can I ask the platform to reveal who created the account?

A victim’s ordinary report may not establish a right to receive private subscriber or technical records directly. Investigators may need to obtain provider-held information through the legal procedures applicable to computer data. Preserve the account details and report promptly so authorities can assess the proper process.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy and possible offenses depend on the evidence, documents, parties, and continuing harm. Laws, procedures, and official reporting channels were checked against primary and official sources as of August 3, 2026.