Quick answer

If someone creates a social-media account using your photos and pretends to be you, act quickly:

Preserve the account, posts, messages, and links before reporting them.
Report the profile through the platform’s impersonation process.
Warn people who may be contacted, especially if the account is asking for money or personal information.
Secure your real accounts and check whether any were compromised.
Report the incident to the PNP Anti-Cybercrime Group or NBI Cybercrime Division if there are scams, threats, harassment, reputational harm, sexual content, or repeated impersonation.
Consider a complaint with the National Privacy Commission if your personal data is being processed unlawfully and the platform or other responsible organization does not adequately address your request.

A fake account is not automatically proof of a particular crime. Liability depends on what information was used, whether it was used without right, the impersonator’s purpose, and what the account did. But using another person’s identifying information for an illegitimate purpose may amount to computer-related identity theft under the Cybercrime Prevention Act.

Preserve the evidence before the account disappears

Do this before confronting the suspected impersonator or asking friends to mass-report the account. Reporting may cause the profile to be removed, taking useful evidence with it.

Save:

The complete profile URL, username, display name, account ID if visible, and QR code
Screenshots and screen recordings showing the full profile
The profile photo, cover photo, biography, contact details, and links
Every relevant post, story, reel, advertisement, comment, and message
The URL of each post, not merely a screenshot
Dates and times, including when you discovered the account
Messages sent to your family, friends, customers, employer, or other contacts
Requests for money, bank or e-wallet details, payment receipts, and transaction references
Threats, sexual messages, defamatory statements, or attempts to obtain passwords or one-time PINs
The platform’s report confirmation, reference number, and later responses
Proof that the photos and identity are yours, such as your real profile and the original photo files
A list of witnesses and short descriptions of what each person personally received or saw
Evidence of actual harm, including fraudulent payments, lost work, cancelled transactions, counseling expenses, or reputational consequences

Capture enough surrounding context to show that the material came from the reported account. Avoid cropping out the username, URL, date, or conversation sequence. Keep the original files unchanged and make backup copies.

A printed screenshot can be useful, but digital evidence may later require authentication. If legal proceedings are likely, ask a lawyer or investigating officer whether the webpage should be preserved through an affidavit, forensic extraction, or other evidence-preservation method.

Report the account to the platform

Open the fake profile and select the reporting reason closest to impersonation, pretending to be someone else, or fake identity. Report individual scam, threat, harassment, or intimate-image posts separately when the platform permits it.

Official reporting pages include:

For Facebook and other services, use the report option on the fake profile or the service’s official Help Center. Do not submit identification documents through a link sent by the impersonator or an unknown “support agent.” Go directly to the platform’s official app or website.

The platform may ask for a government-issued ID or another way to verify your identity. Disclose only what the official form requires. If possible, note whether the form allows unnecessary ID information to be covered.

If the first report is rejected:

Appeal using the platform’s official process.
Identify your genuine account.
Explain precisely how the fake profile is misleading users.
Point out matching names, photos, workplaces, schools, contact details, or messages claiming to be from you.
Include evidence of scams, threats, or harm.
Ask people who actually received deceptive messages to file truthful reports based on their own experience.

Do not organize false reports or instruct people to select violations they did not witness.

Warn potential victims without spreading the fake account further

Post a brief notice on your genuine account and privately alert people who are likely targets. Say that the named username or profile is not yours and that nobody should send money, passwords, one-time PINs, identification documents, or personal information to it.

If the fake account is contacting customers or coworkers, notify the relevant employer, school, marketplace, bank, or e-wallet provider. Give them the exact username and URL.

Avoid repeatedly reposting sexual, humiliating, or defamatory material. A warning normally needs only enough information to identify the impostor account. Preserve the complete material privately for investigators.

Secure your real accounts

A copied profile does not necessarily mean your real account was hacked. Still, check immediately:

Change passwords if they were reused, exposed, or entered on a suspicious site.
Use a unique password for each important account.
Enable multi-factor authentication, preferably through an authenticator app or security key where available.
Review active sessions and sign out unfamiliar devices.
Check recovery email addresses, phone numbers, connected apps, and forwarding rules.
Secure the email account connected to your social-media profiles.
Check whether unauthorized posts, password-reset messages, or login alerts appeared.
Ask your mobile provider about suspicious SIM activity if your number stopped working unexpectedly.

Never give an OTP, password, recovery code, or remote access to someone claiming that these are needed to remove the fake account.

When the Cybercrime Prevention Act may apply

Section 4(b)(3) of Republic Act No. 10175 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another natural or juridical person.

In Disini v. Secretary of Justice, the Supreme Court upheld this provision and explained that identity theft concerns the acquisition or use of personal identifying data for an illegitimate purpose. The Court also clarified that merely obtaining and disseminating information which the user made public is not, by itself, the essence of identity theft. The purpose and surrounding acts therefore matter. See the Supreme Court’s decision.

An account is more likely to raise identity-theft concerns when, for example, it combines your photos with your name or other identifying details and then pretends to speak, transact, solicit money, form relationships, or obtain information as you.

Computer-related identity theft is punishable under Section 8 of the law by prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, Section 4(b)(3) provides for a penalty one degree lower. Only a court can determine guilt, the applicable offense, and the sentence.

Other offenses may apply when the account is used for fraud, threats, extortion, unlawful access, forgery, or defamatory posts. The correct charge depends on the account’s actual conduct and the available evidence; impersonation should not automatically be labelled as every possible cybercrime.

Privacy rights and the use of your photos

A recognizable photograph and the information attached to it may constitute personal information under the Data Privacy Act of 2012. The Act regulates operations such as collecting, storing, using, altering, disclosing, blocking, or deleting personal information.

Section 16 gives a data subject rights that may include disputing inaccurate personal information and seeking its blocking, removal, or destruction upon substantial proof that it is false, unlawfully obtained, used for an unauthorized purpose, or no longer necessary.

These rights are not absolute. The Act contains lawful-processing grounds and exclusions, including provisions concerning journalistic, artistic, literary, and research purposes and personal, family, or household affairs. A publicly visible photo is also not automatically free of all privacy, impersonation, contractual, or other legal restrictions. The source of the image, the information combined with it, the purpose of the account, and the resulting harm all matter.

Copyright is a separate issue. The person shown in a photograph does not necessarily own its copyright; ownership may belong to the photographer or another rights holder. Use the platform’s copyright process only if you own the copyright or are authorized to act for its owner. An impersonation report is usually the more direct route when the central problem is someone pretending to be you.

When the Safe Spaces Act may apply

A fake identity may fall under the Safe Spaces Act, Republic Act No. 11313, when it forms part of gender-based online sexual harassment.

The law covers specified online conduct targeted at a person that causes or is likely to cause mental, emotional, or psychological distress and fear for personal safety. Section 12 includes, in the relevant context, unauthorized sharing of photos or information, cyberstalking, impersonating a victim online, and posting lies to harm the victim’s reputation.

This does not mean every fake profile is automatically gender-based online sexual harassment. The conduct must fit the law’s elements and context. Where it does, Section 14 provides for prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both. The law identifies the PNP Anti-Cybercrime Group as the primary law-enforcement body for these online complaints.

Sexual images and minors require urgent action

Seek immediate assistance if the account posts, threatens to post, sells, or solicits intimate images, particularly where a child is involved. Additional laws—including the Anti-Photo and Video Voyeurism Act and child sexual abuse or exploitation laws—may apply depending on the material and how it was created, possessed, or distributed.

Do not download, forward, or publicly repost suspected child sexual abuse or exploitation material. Preserve URLs, usernames, dates, report confirmations, and non-explicit contextual screenshots, then contact law enforcement promptly.

If there is an immediate threat to life or physical safety, call 911 or go to the nearest police station.

How to make a law-enforcement report

You may approach the PNP Anti-Cybercrime Group, a local police station that can coordinate with cybercrime officers, or the NBI Cybercrime Division.

Bring:

A government-issued ID
A clear chronological statement
The fake account’s URL and username
Your screenshots, recordings, messages, and original files
Details of suspected persons, stated as facts or clearly identified suspicions
Witness names and contact details
Transaction records and proof of loss, if any
Copies of your platform reports and responses

Ask for the complaint or reference number and the investigator’s official contact information. Do not alter your phone or delete the original messages after making copies unless an investigator advises you otherwise.

The NBI lists its Cybercrime Division at ccd@nbi.gov.ph on its official divisions and services page. Its regional and district office directory can help locate an office outside Metro Manila.

Prompt reporting matters. Under Section 13 of Republic Act No. 10175, service providers must preserve traffic data and subscriber information relating to communication services for at least six months from the transaction. Content data is preserved for six months from receipt of a law-enforcement preservation order, subject to the rules in the statute. Individuals generally cannot compel disclosure of subscriber data themselves; investigators may need the appropriate preservation or disclosure process and, where required, a court warrant.

Filing a privacy complaint

A National Privacy Commission complaint may be appropriate when your personal data is being unlawfully processed and the matter falls within the Commission’s jurisdiction. A privacy complaint is distinct from a criminal complaint to the police, NBI, or prosecutor.

First send the responsible organization or platform a clear privacy request when practicable. Keep proof of submission and its response or failure to respond. Explain:

Which personal information belongs to you
Where it appears
Why the use is inaccurate, unauthorized, or unlawful
The action requested, such as blocking, correction, or removal
The harm or risk created
What you already did to resolve the matter

Use the NPC’s current complaint-affidavit template and instructions. The NPC announced that a new template took effect on July 1, 2025, so download the current version rather than relying on an old saved form. Check the NPC complaint page and NPC homepage notices immediately before filing because forms, fees, and submission methods can change.

A filing does not guarantee immediate takedown or a finding of liability. Jurisdiction, procedural requirements, lawful-processing defenses, and evidence must still be evaluated.

Possible civil remedies

Depending on the facts, Articles 19, 20, 21, and 26 of the Civil Code may support an action for damages or other relief involving unlawful injury, abuse of rights, or interference with dignity, personality, privacy, and peace of mind.

A civil claim is not automatic merely because an account is fake. The claimant must establish the legal basis, the responsible defendant, causation, and the type and amount of recoverable damage. Identifying an anonymous account holder and obtaining platform records may require formal legal process. Consult counsel before sending demands or filing suit, particularly if the account operator is unknown or abroad.

Common mistakes to avoid

Reporting before saving the profile URL and evidence
Keeping only cropped screenshots with no username, date, or context
Publicly accusing a suspected person without reliable proof
Threatening, hacking, doxxing, or creating a retaliatory fake account
Paying an impersonator or an unofficial “takedown service”
Giving passwords, OTPs, or ID documents to unverified contacts
Asking friends to make false or exaggerated reports
Publicly reposting intimate material as “evidence”
Assuming that a police blotter, platform report, or notarized affidavit automatically proves the case
Waiting until the account disappears before contacting investigators
Treating an impersonation complaint, privacy complaint, and copyright complaint as interchangeable

When legal help is urgent

Consult a Philippine lawyer or contact law enforcement promptly when:

The account is collecting money, loans, investments, or donations in your name.
Someone has already transferred funds or disclosed banking credentials.
There are death threats, stalking, extortion, or a credible risk of physical harm.
Intimate images or sexualized altered images are involved.
The victim is a child.
The account is damaging employment, professional licensing, business, or family relationships.
The suspected operator is a coworker, employer, school official, current or former partner, or person with access to confidential records.
The platform rejected reports while the harm continues.
You need subscriber information, a preservation request, a restraining order, or court-ordered relief.
A prosecutor, court, police unit, or agency has issued a deadline or requested a sworn submission.

Frequently asked questions

Is using my profile photo automatically identity theft?

Not necessarily. Computer-related identity theft requires the intentional use or other handling, without right, of another person’s identifying information for an illegitimate purpose. A misleading account that uses your photo together with your name and pretends to transact or communicate as you presents a stronger case than an isolated repost with no impersonation.

Can I report the account even if I do not know who created it?

Yes. Preserve the URL and other evidence and report the account to the platform. You may also approach cybercrime investigators. Identifying the operator may require records held by the platform, telecommunications providers, or financial services and the appropriate legal process.

Should I message the fake account?

Usually, preserve the evidence first. Direct contact may cause the operator to delete the profile, destroy evidence, escalate threats, or block you. If communication is needed, follow the advice of an investigator or lawyer and do not threaten or attempt to entrap the person yourself.

Can my friends report it for me?

They may truthfully report an account that appears to impersonate you, especially if it contacted them. Some platforms, however, give greater weight to a report from the person impersonated or an authorized representative and may require identity verification.

What if the account uses my photos but a different name?

It may still violate platform rules or another law, particularly if it creates a false association, carries out a scam, sexually harasses someone, or uses your personal data unlawfully. Whether it constitutes identity theft depends on the identifying information, purpose, and overall conduct—not the photograph alone.

Can I demand that the platform disclose the creator’s identity?

You can ask, but platforms generally will not give private subscriber information directly to an individual merely upon request. Disclosure may require law-enforcement authority, a court warrant or order, and compliance with applicable privacy and cybercrime procedures.

Is a public warning enough?

A warning can reduce harm but does not remove the account, preserve provider records, recover money, or begin a formal investigation. Use it together with evidence preservation, platform reporting, account security, and—where warranted—an official complaint.

This article provides general legal information, not legal advice or a prediction of any case outcome. The applicable remedy depends on the account’s content, purpose, evidence, parties, and procedural history. Laws and official procedures were checked against available primary and government sources as of July 27, 2026.