Quick answer

If someone creates a fake social media account using your name, photos, contact details, or other identifying information, preserve the evidence first, report the account to the platform, and report suspected criminal impersonation or identity theft to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI Cybercrime Division. If the incident involves misuse of personal data, a complaint with the National Privacy Commission (NPC) may also be appropriate. If money was transferred or a bank or e-wallet account was compromised, immediately report the transaction through the financial institution's official fraud channel. (Lawphil)

A fake account is not automatically a criminal case merely because it is fake. The important question is what the account creator did. Under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, computer-related identity theft involves the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person's or entity's identifying information without right. Depending on the facts, the same conduct may also involve illegal access, computer-related fraud or forgery, cyber libel, estafa, threats, or other offenses. (Lawphil)

Do not wait for the fake account to disappear before documenting it. Social media accounts can be renamed, deleted, suspended, or altered quickly, while data retained by service providers is subject to legal preservation rules. Under RA 10175, traffic data and subscriber information must generally be preserved by service providers for at least six months from the transaction, while law enforcement can require preservation of content data and obtain relevant data through the procedures and warrants provided by law. (Lawphil)

When does a fake social media account become identity theft?

Philippine law does not criminalize every pseudonymous, parody, fan, anonymous, or alternative social media account. What matters for computer-related identity theft is the unauthorized use or misuse of identifying information belonging to another person or juridical entity. (Lawphil)

The Supreme Court explained in Disini v. Secretary of Justice that identifying information ordinarily includes such data as a person's name, citizenship, address, contact number, birth details, occupation, and similar information. The Court upheld the identity-theft provision and emphasized that the prohibited conduct concerns unauthorized acquisition or use of another person's identifying data for an illegitimate purpose. It also distinguished identity theft from legitimately acquiring or disseminating information that the person himself or herself made public. (Judiciary eLibrary)

The implementing rules of RA 10175 likewise define identifying information broadly to include names or numbers used alone or together with other information to identify a specific individual, including names, dates of birth, government identification numbers, biometric data, electronic identifiers, addresses, routing codes, and telecommunications or access-device information. (Judiciary eLibrary)

Accordingly, an account that merely happens to have the same common name as yours is different from an account that copies your name and photographs, presents itself as you, contacts your relatives or clients as though it were you, asks for money in your name, obtains confidential information, or uses your identity to damage your reputation.

Actual financial loss is not always required before computer-related identity theft may be punishable. RA 10175 expressly provides that where no damage has yet been caused, the penalty is one degree lower. For offenses under Section 4(b), the general statutory penalty is prision mayor or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both; prision mayor runs from six years and one day to twelve years. The precise imposable penalty depends on the proven facts and applicable provisions. (Lawphil)

Other offenses may apply

A fake account can involve more than identity theft.

If someone hacked your real account rather than creating a separate impostor account, unauthorized entry into the account may implicate the illegal-access provision of RA 10175. DOJ guidance specifically recognizes unlawful access to Facebook accounts as a cybercrime concern and directs complainants to the NBI Cybercrime Division or PNP-ACG. (Lawphil)

If the impostor manipulates computer data or uses false electronic data as authentic for a fraudulent or dishonest purpose, computer-related forgery or fraud may be relevant. If the account publishes defamatory statements, cyber libel may become an issue, but only if the legal elements of libel are present. Other crimes under the Revised Penal Code or special laws may also apply depending on threats, deception, financial loss, harassment, or other conduct involved. RA 10175 expressly contemplates liability under other applicable laws. (Lawphil)

The correct charge should therefore be based on what the evidence establishes, not simply on the label “fake account.”

What to do when you discover an impostor account

Preserve the evidence before reporting or blocking the account. Capture the entire profile or page, profile photograph, cover photograph, username, display name, bio, posts, comments, advertisements, messages, and any representation that the account is yours. Record the exact profile or page link, not merely the displayed name. Take screenshots and, where useful, a screen recording showing how you reached the account. Record the date and time you discovered it. Save original message files, emails, attachments, transaction records, and other electronic evidence rather than keeping only cropped screenshots. If friends, customers, relatives, or employees were contacted, ask them to preserve their own copies of the communications. Keep the original device and data intact when the incident is serious; the NBI's published procedure expressly contemplates examination of a device relevant to an investigation. (National Bureau of Investigation)
Secure your genuine accounts. If there is any possibility that the offender obtained your credentials, change the password using the platform's genuine website or app, terminate unfamiliar sessions, verify your recovery email and phone number, enable two-factor authentication, and secure the email account connected to your social media. For a hacked Facebook account, Meta provides a dedicated account-recovery process, and DOJ guidance recommends recovery measures and two-factor authentication. (Facebook)
Report the impostor to the social media platform. Use the platform's impersonation-reporting function rather than merely blocking the account. Facebook expressly prohibits profiles and Pages pretending to be another person and permits impersonation reports even from people without Facebook accounts. Instagram and TikTok also maintain dedicated impersonation-reporting procedures. Preserve your evidence before doing this because a successful platform report may make the account or some of its content unavailable. (Facebook)
File a cybercrime report if your identity is actually being misused. You may approach either the PNP-ACG or the NBI Cybercrime Division. You do not need to know the real name of the offender before asking law enforcement to investigate. Give investigators the account URLs, usernames, dates, screenshots, messages, witness information, transaction records, and any platform-report reference numbers you have. The NBI's current Citizen's Charter lists no documentary checklist as a prerequisite for requesting Cybercrime Division assistance, but its process includes a complaint sheet, preliminary interview, sworn statements or affidavits, collection of supporting documents, and possible examination of relevant devices. (National Bureau of Investigation)
Consider the NPC if personal data was unlawfully processed or disclosed. The Data Privacy Act route is particularly relevant where the dispute concerns misuse, disclosure, or other unlawful processing of personal information. The NPC is not a substitute for a criminal investigation, especially where the perpetrator is anonymous. Its current complaint procedure ordinarily requires the complainant first to notify the respondent in writing and give the respondent an opportunity to address the privacy violation; the NPC's public guidance uses a 15-calendar-day period. Its rules permit waiver of exhaustion requirements for good cause or certain serious violations. (National Privacy Commission)
If money or financial credentials are involved, contact the bank or e-wallet immediately. Do not wait for the cybercrime investigation. BSP rules require BSP-supervised institutions to provide active 24/7 reporting channels for unauthorized or fraudulent transactions. For a subsequent complaint to the BSP involving a regulated financial institution, the BSP currently instructs consumers to report to the institution first and obtain its reference number. (Bureau of the Treasury)
Warn people who are likely to be targeted. A short notice from your genuine account can tell contacts that the identified account is unauthorized and that they should not send money, disclose passwords or OTPs, or follow payment instructions from it. Avoid making accusations against a named suspect unless you have a proper factual basis; the identity behind an account may still be under investigation.
Keep a chronological case file. Record when the account first appeared, when you discovered it, every person contacted, each platform report, every financial transaction, and every report made to government authorities. Keep acknowledgment emails, complaint numbers, affidavits, and copies of what you submitted. This can become important when dates of discovery, preservation of electronic evidence, damages, or prescription are disputed.

Where can you report the case?

PNP Anti-Cybercrime Group

The PNP-ACG is one of the law-enforcement agencies specifically responsible for cybercrime investigations under RA 10175 and its implementing rules. Its current contact directory identifies the Cyber Response Unit and regional cybercrime units throughout the country. The Cyber Response Unit currently lists complaint@acg.pnp.gov.ph as its complaint email. (PNP ACG)

Use the current official directory rather than relying on an old phone number or social-media post because unit contact information can change.

NBI Cybercrime Division

The NBI is the other principal law-enforcement authority designated under RA 10175. Its current Cybercrime Division Citizen's Charter states that members of the general public may proceed to the division to file a complaint or request an investigation, with the same procedure applicable to cases intended for NBI Cybercrime Regional Centers. The NBI also presently maintains an official Online Complaint page. (National Bureau of Investigation)

The NBI's official site currently lists ccd@nbi.gov.ph for its Cybercrime Division. (National Bureau of Investigation)

National Privacy Commission

The NPC is appropriate when the facts independently involve a privacy violation or personal-data breach within its jurisdiction. Its current site states that a complainant may use the prescribed complaint form or verified complaint, accompanied by supporting evidence and witness affidavits, and file through the methods authorized by the Commission. (National Privacy Commission)

The NPC implemented a new Complaint-Affidavit template effective July 1, 2025, so use the current form from the NPC website instead of an old downloaded copy. (National Privacy Commission)

An important limitation is that the NPC may dismiss a complaint when the parties cannot be identified or traced despite diligent efforts. For a wholly anonymous impostor, a PNP or NBI investigation may therefore be important because law enforcement has statutory mechanisms for seeking preservation and disclosure of relevant service-provider data. (National Privacy Commission)

Can the police obtain the identity behind an anonymous account?

Potentially, but an ordinary complainant usually cannot compel a social media company to hand over another user's private subscriber information.

RA 10175 provides investigative mechanisms for law enforcement. Data beyond the categories obtainable under the statute generally requires the appropriate court warrant. Once the statutory requirements are satisfied, law enforcement may obtain a warrant and require a service provider to disclose relevant subscriber information, traffic data, or other data. Section 14 requires disclosure within 72 hours from receipt of the lawful order when it relates to a valid complaint officially docketed and assigned for investigation and the information is necessary and relevant to that investigation. (Lawphil)

This is one reason to provide investigators with the actual account URL, usernames, dates, message records, and other technical identifiers rather than only a screenshot bearing a display name.

Important deadlines and preservation periods

There is no single filing period that applies to every case involving a fake account. Prescription depends on the particular offense charged.

One especially important current rule concerns cyber libel. In its April 8, 2026 En Banc Resolution in Causing v. People, the Supreme Court affirmed that cyber libel prescribes in one year from discovery of the crime by the offended party, the authorities, or their agents. Whether prescription has actually occurred may involve factual questions about when discovery happened. (Judiciary eLibrary)

Do not assume that the same one-year period automatically governs computer-related identity theft. RA 10175 is a special law, and prescription of special-law offenses is generally governed, absent a different statutory rule, by Act No. 3326 according to the applicable penalty. The correct period can therefore depend on the precise offense and circumstances, including the statutory effect of no damage having yet occurred. (Lawphil)

Separately, the six-month data-preservation provisions of RA 10175 are not a six-month deadline for filing a criminal complaint. They regulate preservation of particular service-provider data. They are nevertheless a practical reason to report serious cases promptly instead of assuming online records will remain available indefinitely. (Lawphil)

For an NPC complaint, its published procedure ordinarily requires prior written notice to the respondent and either inadequate action or no response within 15 calendar days, subject to the Commission's authority to waive exhaustion requirements in appropriate circumstances. (National Privacy Commission)

Evidence that can make a report stronger

The most useful evidence normally shows both what the account did and why it was falsely representing itself as you.

A screenshot containing only the fake account's display name may be much less useful than a record showing the profile URL, username, copied photograph, statements claiming to be you, conversations with victims, payment instructions, transaction receipts, and the date and time each item was obtained.

If another person actually sent money or disclosed information to the impostor, preserve that person's messages and transaction records and, if possible, identify that person as a potential witness. If the impersonation affected a business, save customer inquiries, invoices, fake payment instructions, advertisements, and communications showing confusion between the impostor and the genuine business.

Keep original files whenever possible. Avoid editing the only copy of a screenshot, deleting the original conversation, resetting a relevant device, or forwarding evidence through applications that may remove metadata. You can create redacted or annotated copies for explanation while keeping the originals intact.

Common mistakes to avoid

Reporting only to Facebook, Instagram, TikTok, or another platform. A platform report may result in removal, but it is not the same thing as filing a criminal complaint with Philippine law enforcement. Meta itself states that reporting content does not guarantee removal. (Facebook)

Blocking the account before preserving its URL and content. Once you lose access—or the platform removes the account—you may have difficulty reconstructing what was displayed.

Assuming that the profile name identifies the offender. Account names, photographs, phone numbers, email addresses, and even payment accounts can themselves be stolen or controlled by intermediaries. Treat the identity of the perpetrator as something to be proved.

Confronting the suspected offender and announcing that police are coming. This may cause the person to delete accounts, messages, or other evidence. Where identification of an anonymous offender is important, discuss investigative steps with the PNP-ACG or NBI instead of attempting your own entrapment operation.

Sending additional money to “trace” the scammer. Do not make further payments merely to obtain evidence unless you are acting under lawful instructions from investigators.

Paying someone who promises to obtain private Facebook or TikTok subscriber records. Legitimate access to protected platform information may require lawful process. Be especially cautious of supposed “hackers” who demand money to identify the account owner.

Waiting because no one has lost money yet. RA 10175 itself recognizes computer-related identity theft even where damage has not yet occurred, although it provides a lower penalty in that situation. (Lawphil)

When legal or law-enforcement help is urgent

Act immediately if the impostor is currently soliciting money, obtaining OTPs or banking credentials, threatening physical harm, blackmailing you, extorting money, publishing private information that creates a safety risk, compromising your genuine accounts, or impersonating you to enter contracts or obtain financial services.

If unauthorized financial transactions are occurring, contact the affected bank, e-money issuer, or other financial institution through its official fraud channel immediately, in addition to reporting the cybercrime. BSP rules require regulated institutions to maintain 24/7 channels for these concerns. (Bureau of the Treasury)

Cases involving children, sexual exploitation, intimate material, serious threats, or immediate physical danger should likewise be escalated promptly to the appropriate authorities. Do not unnecessarily download, duplicate, or circulate illegal sexual material merely for evidentiary purposes.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. An unknown offender does not prevent you from asking the PNP-ACG or NBI to investigate. Give investigators everything that can identify the online account and the relevant transactions. RA 10175 provides procedures through which law enforcement, subject to the required legal process, can seek preservation and disclosure of service-provider data. (Lawphil)

Is using my photograph and name automatically computer-related identity theft?

Not automatically. The prosecution would still have to establish the statutory elements, including intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. Context and purpose matter. The Supreme Court has specifically distinguished unlawful identity theft from legitimate acquisition and dissemination of information that a person made public. (Judiciary eLibrary)

An account that actually presents itself as you and uses your identity to deceive others is materially different from commentary, parody, a fan page, or another account that does not falsely claim to be you.

Are screenshots enough to file a complaint?

They can be useful evidence and are far better than having no record at all, but they should not be the only thing preserved when more evidence is available. Save URLs, usernames, original communications, dates and times, witness information, transaction records, platform acknowledgments, and relevant devices. Investigators may seek additional electronic or service-provider evidence where legally available. (National Bureau of Investigation)

Should I report the account to the platform first or to the police first?

Preserve the evidence first. After that, there is no rule requiring you to wait for the platform to decide your report before approaching the NBI or PNP-ACG. If the conduct involves fraud, extortion, threats, account compromise, or continuing harm, parallel reporting may be appropriate.

What if someone hacked my real Facebook account instead of making a duplicate?

Use Meta's account-recovery process immediately, secure the email and phone number associated with the account, change compromised passwords, and enable two-factor authentication. If someone intentionally accessed the account without authority or used it for fraud or identity theft, report the incident to the NBI Cybercrime Division or PNP-ACG as well. (Facebook)

Can the NPC order Facebook or another platform to reveal who owns the account?

Do not assume that an NPC complaint is a substitute for a criminal investigation or cybercrime warrant. The NPC's jurisdiction concerns violations of the Data Privacy Act and related privacy rules. Its own complaint guidance recognizes that a case may be dismissed where parties cannot be identified or traced despite diligent efforts. Law-enforcement requests for protected service-provider data are governed separately by RA 10175 and the applicable cybercrime-warrant procedures. (National Privacy Commission)

Can I recover money lost because of the fake account?

Possibly, but recovery is fact-dependent and should never be promised. Immediately notify the financial institution from which the money was sent, preserve the transaction reference and recipient details, and ask what fraud-control measures remain available. For BSP-supervised institutions, the BSP instructs consumers to report the incident to the institution first before escalating through BSP channels. A criminal or civil remedy may also be available depending on the facts and identification of the responsible parties. (Bureau of the Treasury)

Official sources and reporting pages

For the governing cybercrime law, see Republic Act No. 10175 — Cybercrime Prevention Act of 2012 and the DOJ Office of Cybercrime implementing rules. The Supreme Court's treatment of computer-related identity theft is in Disini v. Secretary of Justice, G.R. No. 203335, while the current ruling on cyber-libel prescription is in Causing v. People, G.R. No. 258524, April 8, 2026.

Cybercrime victims may consult the PNP Anti-Cybercrime Group contact directory, the NBI Cybercrime Division Citizen's Charter, and the NBI Online Complaint page.

For privacy complaints, use the NPC's current Mechanics for Complaints and formal complaint page. For financial fraud involving a BSP-regulated institution, see the BSP's current scam-reporting and institution-verification guidance.

For platform-level impersonation reports, see the official Facebook impersonation-reporting page, Instagram impersonation guidance, and TikTok impersonation-reporting guidance.

General-information disclaimer

This article provides general legal information about Philippine law and is not a substitute for legal advice based on the complete facts, evidence, and documents of a particular case. The proper offense, forum, remedy, evidentiary requirements, and prescriptive period may change depending on exactly what the impostor did and when the acts were discovered. Government and platform reporting procedures can also change, so verify the current official channel when filing.

Law and official procedures checked as of August 23, 2026.