Quick answer
If someone creates a fake social media account using your name, photographs, business identity, contact details, or other identifying information without authority, the conduct may amount to computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012. The law covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's identifying information "without right." It applies to identifying information belonging to both individuals and juridical persons such as corporations. (Lawphil)
You can report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division (NBI-CCD). The Cybercrime Investigation and Coordinating Center (CICC) also accepts reports through its cybercrime reporting channels and can help coordinate appropriate action. RA 10175 expressly designates the PNP and NBI as the principal law-enforcement authorities for cybercrime cases. (Lawphil)
Do not wait for someone to lose money before reporting. RA 10175 expressly recognizes computer-related identity theft even when damage has not yet occurred; where no damage has yet been caused, the law provides for a lower penalty. The ordinary statutory penalty for offenses under Section 4(b) is prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. (Lawphil)
The most important practical step is to preserve evidence before the fake account, posts, or messages disappear, while immediately reporting any ongoing threat, extortion, financial loss, or danger.
When does a fake social media account become identity theft?
Section 4(b)(3) of RA 10175 is not limited to stolen credit cards, passwords, or bank credentials. It concerns "identifying information" belonging to another person or entity.
In Disini, Jr. v. Secretary of Justice, the Supreme Court upheld the computer-related identity-theft provision. The Court noted that ordinary identifying information may include a person's name, citizenship, residence address, contact number, place and date of birth, spouse's name, occupation, and similar information. The Court explained that the law targets acquiring or using another person's identifying information without right. (E-Library)
A fake account that copies a real person's name, photographs, personal details, workplace, business identity, or similar identifiers and then represents itself as that person can therefore raise serious identity-theft issues. An official NBI case, for example, involved a fake Facebook account created using another person's name and photograph; the NBI pursued charges under RA 10175 together with another alleged offense arising from the account's use. (National Bureau of Investigation)
But not every account using the same or a similar name automatically proves criminal identity theft. Criminal liability depends on the evidence concerning what information was used, whether its use was intentional, whether the person had authority or another legal justification, what the account represented to other people, and what the account was used to do.
RA 10175 defines "without right" to include conduct undertaken without or beyond authority, as well as conduct not protected by an established legal defense, excuse, court order, justification, or relevant principle of law. (Lawphil)
The Supreme Court has also cautioned that merely obtaining information that a person has made openly available online is not necessarily the identity theft contemplated by the statute. The issue is unauthorized acquisition or use of identifying information in the legally prohibited sense, not the mere fact that information can be seen on the internet. (E-Library)
What if no money has been stolen yet?
You may still report the incident.
Section 4(b)(3) expressly states that if no damage has yet been caused, the penalty is one degree lower. This provision would make little sense if financial or other completed damage were always required before authorities could act. (Lawphil)
This is important when a fake account has just appeared and is already pretending to be you but has not yet successfully scammed anyone. Early reporting may prevent further impersonation and may make electronic evidence easier to preserve.
There is also no statutory peso threshold that must first be reached before computer-related identity theft can be reported.
How to report identity theft or a fake account
Preserve the fake account before requesting its removal. Save the full profile URL, exact username or handle, profile photograph, bio, posts, comments, advertisements, messages, and any other identifying material. Take screenshots showing the whole screen where possible, including dates and times. If the account changes usernames, preserve both the old and new information. Ask people who received messages from the impersonator to retain those original messages in their own accounts rather than merely forwarding screenshots.
Secure your genuine accounts. If there is any possibility that your real account, email, phone number, or cloud account was compromised, change the relevant passwords from a trusted device, enable multi-factor authentication, review active sessions and recovery information, and revoke unfamiliar devices or applications. A takeover of an existing account can raise additional issues, including illegal access under RA 10175. (Lawphil)
Report the impersonating account to the social-media platform. Use the platform's specific impersonation or "pretending to be someone else" reporting mechanism whenever available. Platform removal is useful for stopping further harm, but it is separate from filing a criminal complaint. Preserve your evidence first unless immediate removal is necessary for safety.
File a cybercrime complaint with the PNP-ACG or NBI-CCD. Give investigators a chronological account of what happened and provide the URLs, screenshots, messages, transaction records, account-recovery notices, witness information, and other evidence you have. You do not need to know the offender's real identity before asking law enforcement to investigate. The PNP-ACG maintains national, regional, provincial, and district cybercrime contacts, while the NBI's published Citizen's Charter provides for investigative assistance to victims of computer crimes. (PNP ACG)
Consider reporting the incident to CICC as well. The CICC currently publicizes Hotline 1326, the email report@cicc.gov.ph, and dedicated mobile reporting numbers for online scams and cybercrime concerns. CICC performs a coordinating role; a criminal investigation itself may ultimately be handled by the appropriate law-enforcement agency. (CICC)
If financial accounts are involved, contact the bank, e-wallet, card issuer, or other institution immediately. Request appropriate blocking or security measures and preserve transaction numbers, recipient-account information, SMS or email alerts, dispute records, and communications with the institution. Where deception is used to obtain sensitive identifying information and thereby gain unauthorized access and control over a financial account, the Anti-Financial Account Scamming Act, RA 12010, may also become relevant. (Lawphil)
Keep the complaint and platform reference numbers. Preserve acknowledgment emails, police or NBI records, complaint-sheet numbers, platform ticket numbers, bank dispute references, and subsequent communications. These can help establish the sequence of events and make follow-up easier.
What should you bring to the PNP or NBI?
Bring as much original evidence as reasonably available, but do not delay an urgent report simply because your evidence package is incomplete.
Useful material normally includes a government-issued ID; the URL and username of your legitimate account; the URL and username of the fake account; screenshots and screen recordings; copies of posts, comments, advertisements, and direct messages; dates and approximate times; emails or SMS notices showing account-access attempts; details of people contacted by the impersonator; transaction receipts or bank/e-wallet records if money is involved; and any information explaining why you suspect a particular person.
Distinguish clearly between facts you personally know and suspicions. If you suspect an individual because of a prior dispute, threat, writing style, telephone number, payment account, or other circumstance, state the factual basis rather than presenting the person's identity as established.
The NBI's current published procedure for victims of computer crimes lists no initial documentary checklist as a prerequisite to seeking assistance. Its process contemplates a complaint sheet, preliminary interview, sworn statements or affidavits, collection of supporting documents, and, where relevant, examination of a device connected with the investigation. (National Bureau of Investigation)
Why reporting quickly matters
Electronic evidence can disappear quickly. Accounts can be renamed, deactivated, or deleted; posts can be removed; messages can disappear; and devices can be replaced.
RA 10175 and the Supreme Court's Rule on Cybercrime Warrants provide mechanisms for the preservation, disclosure, search, seizure, and examination of computer data during an authorized investigation. The statute generally requires service providers to preserve traffic data and subscriber information for at least six months from the transaction and provides for preservation of content data after a law-enforcement preservation order. Disclosure of protected computer data generally requires the appropriate legal process, including a court warrant where required. (Lawphil)
That does not mean a victim should attempt to obtain private subscriber records, IP addresses, or account-registration information personally. Give investigators the exact account identifiers and ask whether timely preservation or disclosure measures are warranted.
Reporting the account to Facebook, Instagram, TikTok, or X
A platform report and a criminal complaint serve different purposes.
A platform may suspend or remove an impersonating account under its own rules. Philippine law enforcement, on the other hand, can investigate whether a criminal offense occurred and, when legal requirements are satisfied, seek information or computer data through the proper process.
For Facebook, use Meta's official procedure for reporting a profile or Page pretending to be you or another person: Facebook Help Center — impersonation reports.
For Instagram, use the official Instagram Help Center's impersonation-reporting procedure: Instagram Help Center — impersonation accounts.
TikTok provides both an in-app reporting route and an impersonation-report procedure. Its current instructions direct users to the profile, then to Report → Report account → Pretending to Be Someone, with additional reporting forms available for impersonation cases.
X also maintains an official impersonation reporting form: X Help Center — impersonation report.
Platform menus and forms can change, so use the platform's current official Help Center if the wording differs from what appears above.
What if the fake account is scamming other people using your identity?
Tell the people contacted by the impersonator not to send money, OTPs, identification documents, passwords, or sensitive financial information.
Ask affected recipients to preserve the fake account's messages, profile URL, payment instructions, QR codes, phone numbers, email addresses, account names, bank or e-wallet details, and proof of any transfers.
If people actually sent money because they believed the impersonator was you, the facts may support additional offenses beyond identity theft. Depending on how the scheme operated, investigators may consider offenses involving fraud or estafa and, in appropriate financial-account cases, RA 12010. The correct charge depends on the precise method used and the evidence; merely calling every online scam "computer-related fraud" can be legally inaccurate because that offense has its own statutory elements. (Lawphil)
What if the fake account posts defamatory statements?
Using a fake identity and publishing defamatory material are separate legal questions.
RA 10175 recognizes cyberlibel when the prohibited acts of libel under the Revised Penal Code are committed through a computer system or similar means. In Disini, the Supreme Court upheld the cyberlibel provision as applied to the original author of the offending online statement, while striking down its application to persons who merely receive and react to the post in the manner addressed by the decision. (E-Library)
Not every false statement, criticism, insult, or hostile post automatically constitutes cyberlibel. The actual words, subject, publication, identification of the person concerned, defamatory character, privileged communication rules, malice, and other circumstances must be examined.
Preserve the exact post and its URL rather than copying only selected sentences.
What if the fake account is threatening, blackmailing, or sexually exploiting someone?
Seek law-enforcement help promptly if the impersonator is threatening physical harm, demanding money, threatening to publish intimate material, stalking the victim, targeting a child, or attempting sexual exploitation.
Different laws can apply depending on the facts, including provisions of the Revised Penal Code and special statutes concerning intimate images, violence against women and children, or online sexual abuse or exploitation of children. These offenses should not be reduced to a generic "fake account" complaint when the underlying conduct presents more immediate risks.
Do not arrange a dangerous personal confrontation or attempt your own unauthorized access to the offender's account. Give the communications and account information to investigators.
What if your real account was hacked instead of cloned?
A cloned account is generally a separate fake account pretending to be you.
A compromised account is your actual account being accessed or controlled by someone without authority.
The distinction matters. Unauthorized access to a computer system is itself covered by Section 4(a)(1) of RA 10175. Because the Act's definition of computer systems includes devices such as mobile phones and internet-connected systems, unauthorized account access can fall within the cybercrime framework even where no separate fake profile was created. (Lawphil)
Use the platform's official compromised-account recovery process immediately, secure the associated email account and telephone number, save login notifications and unfamiliar-session information, and report unauthorized transactions separately to any affected financial institution.
Can you complain to the National Privacy Commission?
Possibly, but an NPC complaint serves a different purpose from a criminal cybercrime investigation.
The National Privacy Commission states that a data subject may file a complaint when personal information has been misused, maliciously disclosed, improperly disposed of, or when data-privacy rights have otherwise been violated. A complaint ordinarily requires a verified or notarized complaint with supporting evidence. (National Privacy Commission)
The NPC's current rules also generally require exhaustion of remedies: the complainant should first notify the respondent in writing of the alleged privacy violation and give the respondent an opportunity to address it; the NPC states that proof should ordinarily show no timely or appropriate action or no response within 15 calendar days. The Rules contain exceptions for circumstances warranting immediate Commission action. (National Privacy Commission)
Because notifying an offender could be inappropriate in an urgent criminal investigation, an extortion case, or a situation where evidence may be destroyed, coordinate with counsel or law enforcement before taking steps that might alert the suspect.
An NPC complaint is not a substitute for reporting suspected computer-related identity theft to the PNP or NBI.
Can you seek damages or an order stopping the impersonation?
Potentially.
Apart from criminal liability, Articles 19, 20, 21, and 26 of the Civil Code may provide civil remedies where the required circumstances are established. Article 26 specifically requires respect for another person's dignity, personality, privacy, and peace of mind and recognizes actions for damages, prevention, and other relief for covered abuses even when the conduct does not independently constitute a criminal offense. (E-Library)
Whether a civil damages action, injunction, or other preventive relief is appropriate depends on the identity of the defendant, available evidence, actual or threatened injury, jurisdiction, and the specific conduct involved.
Common mistakes that can weaken an identity-theft complaint
Reporting the profile before saving its URL and contents
Removal is desirable, but once an account disappears it can become harder for the victim to show exactly what was displayed. Preserve what you lawfully can first, unless immediate takedown is necessary for safety.
Saving only cropped screenshots
A cropped image may omit the username, URL, date, surrounding conversation, or other information needed to establish context. Keep the original screenshot or recording and avoid unnecessary editing.
Deleting embarrassing or threatening messages
Do not delete the originals simply because they are upsetting. Preserve them and restrict access to them where privacy requires.
Publicly accusing a suspected offender before the evidence is established
A suspicion is not proof. Public accusations can create additional disputes and may alert the offender, cause evidence to disappear, or expose the complainant to separate legal issues.
Trying to hack or "trace" the fake account yourself
Do not guess passwords, enter another person's account without authority, install spyware, or pay questionable online "hackers" to obtain private records. Unauthorized access can itself create legal problems and may contaminate an investigation.
Assuming platform removal is the same as filing a criminal complaint
A successful Facebook, Instagram, TikTok, or X report does not automatically create a PNP, NBI, or prosecutor's case. If criminal investigation is desired, make a separate report to the proper authorities.
When legal or law-enforcement help is urgent
Treat the matter as urgent when the fake account is currently soliciting money from your contacts, accessing your bank or e-wallet, threatening violence, demanding payment, distributing or threatening to distribute intimate material, impersonating you in transactions or official communications, targeting a child, obtaining identification documents or OTPs, or actively damaging your business or reputation.
The same applies if the account is likely to disappear and subscriber or transaction records may be important. Prompt reporting gives investigators a better opportunity to consider preservation measures before potentially relevant computer data is lost.
FAQ
Can I report a fake account even if I do not know who created it?
Yes. Lack of a known suspect does not prevent you from reporting the incident. Give investigators the exact profile URL, username, communications, telephone numbers, payment details, and other identifiers available to you. Identification of the person behind an account may require lawful investigative measures and cooperation from service providers.
Does the fake account have to steal money before identity theft exists?
No. Section 4(b)(3) expressly provides for cases in which no damage has yet been caused, although the penalty is lower in that situation. (Lawphil)
Is using my photograph enough to file a case?
It can be important evidence, particularly when combined with your name or other information and an account that represents itself as you. But criminal liability depends on the complete circumstances. The NBI has previously pursued an RA 10175 case involving a fake Facebook account using another person's name and photograph, but every case must be evaluated on its own evidence. (National Bureau of Investigation)
Should I go to the PNP or the NBI?
Either may investigate cybercrime. RA 10175 specifically assigns cybercrime law-enforcement responsibility to both the PNP and NBI. The PNP-ACG maintains cybercrime offices and response teams around the country, while the NBI has its Cybercrime Division and regional cybercrime facilities. (Lawphil)
Can CICC investigate the case?
CICC has statutory coordination and cybercrime-prevention functions and operates reporting channels, including Hotline 1326. RA 10175 designates the NBI and PNP as the principal law-enforcement authorities, so a report may need to be coordinated or referred for formal investigation. (Lawphil)
Should I block the fake account?
Usually, preserve the evidence first. After that, blocking may protect you from further contact. Blocking alone does not remove the account or preserve evidence held by the platform.
Can I ask Facebook or another platform for the person's IP address?
Ordinary users generally cannot compel a platform to disclose protected subscriber or computer data. Law enforcement may seek relevant information through the procedures authorized by RA 10175 and the Rule on Cybercrime Warrants. (Lawphil)
Can a company or business be a victim of computer-related identity theft?
Yes. Section 4(b)(3) expressly covers identifying information belonging to another person whether natural or juridical. (Lawphil)
Official sources and reporting pages
Cybercrime Prevention Act of 2012 — Republic Act No. 10175: Official Lawphil text of RA 10175
Supreme Court decision in Disini, Jr. v. Secretary of Justice: Supreme Court E-Library decision
Implementing Rules and Regulations of RA 10175: Supreme Court E-Library — RA 10175 IRR
PNP Anti-Cybercrime Group: The current contact page lists the Cyber Response Unit at 0968-878-3561 and complaint@acg.pnp.gov.ph, together with regional and local cybercrime units nationwide. PNP-ACG official contact page
National Bureau of Investigation: NBI — Investigative Assistance for Victims of Computer Crimes
Cybercrime Investigation and Coordinating Center: Hotline 1326; current CICC materials also list report@cicc.gov.ph and its dedicated mobile reporting channels. CICC official cybercrime-reporting information
National Privacy Commission: NPC — File a Complaint
Anti-Financial Account Scamming Act — Republic Act No. 12010: Official Lawphil text of RA 12010
General-information disclaimer
This article provides general Philippine legal information and is not a substitute for legal advice based on the complete facts, documents, electronic evidence, and procedural posture of a particular case. The appropriate criminal, civil, privacy, or platform remedy can change depending on how the identity was used and what the impersonating account actually did. Laws, government reporting channels, and official procedures cited here were checked against primary and official sources as of August 25, 2026.