Quick answer

If someone creates a fake social media account using your name, photos, contact details, business identity, or other identifying information, preserve the evidence first, report the account to the social media platform, and report the incident promptly to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI CyberCrime Division if the account is being used to impersonate you, scam others, obtain money or information, damage your reputation, threaten people, or commit another unlawful act.

Philippine law expressly punishes computer-related identity theft. Section 4(b)(3) of Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another natural or juridical person. The Supreme Court upheld this provision in Disini, Jr. v. Secretary of Justice. (Lawphil)

A fake account is not automatically a criminal case, however. An anonymous, parody, commentary, or fan account that does not unlawfully appropriate another person's identity may present a different issue. Criminal liability depends on what identifying information was used, whether its use was without right, what the account holder intended and did, and what evidence can establish those facts.

The practical rule is simple: do not wait for the fake account to successfully scam someone before reporting it. Under RA 10175, the absence of actual damage does not necessarily eliminate computer-related identity theft; the statute instead provides a lower penalty when no damage has yet been caused. (Lawphil)

When a fake account may amount to computer-related identity theft

The Cybercrime Prevention Act protects identifying information belonging both to individuals and to juridical persons such as corporations. The Supreme Court has explained that identifying information commonly includes such details as a person's name, address, contact information, date of birth, occupation, and similar information capable of identifying the person. (eLibrary)

Depending on the evidence, computer-related identity theft may be implicated when someone:

creates an account using your name and photograph and represents the account as genuinely yours;
copies your business name, corporate identity, employee identity, or official position and communicates as though authorized to act for you;
sends messages to your friends, relatives, customers, employees, or business contacts while pretending to be you;
uses your identity to ask for loans, investments, emergency money, donations, payments, passwords, OTPs, or financial information;
obtains or uses your personal details to create accounts or conduct transactions without authority;
takes over your genuine social media account and then communicates with other people as you; or
combines your identity with altered or fabricated information to make the impersonation appear authentic.

A real Philippine case illustrates the distinction. In 2022, the Supreme Court reported the arrest of a person accused of posing on Facebook as a Supreme Court official and allegedly using that false identity while soliciting money. The charges included computer-related identity theft, computer-related forgery, and estafa. (Supreme Court of the Philippines)

Account takeover can also involve illegal access under Section 4(a)(1) of RA 10175 if somebody accesses your account or computer system without right. The PNP has likewise identified compromised social-media profiles used to solicit money from the victim's contacts as conduct potentially involving illegal access, computer-related fraud, and identity theft. (Lawphil)

A fake profile is not necessarily the same as a crime

Avoid assuming that every account using somebody else's name or photograph automatically satisfies every element of criminal identity theft.

Context matters. For example, a clearly disclosed satire, commentary, or fan account may be distinguishable from an account deliberately designed to convince people that it is the genuine person. Some platforms themselves expressly permit properly disclosed parody or fan accounts while prohibiting deceptive impersonation. X, for example, distinguishes compliant parody, commentary, and fan accounts from confusing or deceptive impersonation. (Help Center)

Philippine criminal liability must still be determined under Philippine law, based on the actual acts, intent, authorization, identifying information used, and surrounding circumstances.

Also, social-media username impersonation should not automatically be called “cybersquatting.” Section 4(a)(6) of RA 10175 specifically deals with the bad-faith acquisition of an internet domain name under the circumstances stated in the law. A fake Facebook, Instagram, TikTok, or X username is not necessarily cybersquatting simply because the username resembles your name. (Lawphil)

What to do immediately

1. Preserve the evidence before asking for takedown

Do this before the fake profile disappears, changes its username, blocks you, or is removed by the platform.

Save, whenever available:

the complete profile URL;
the exact username or handle;
the displayed account name;
profile and cover photographs;
the account's bio and contact information;
screenshots showing the entire screen rather than only cropped portions;
a screen recording showing how you navigated to the profile, posts, messages, or listings;
URLs of individual posts, videos, reels, stories, listings, or other content;
the date and approximate time when each item was observed;
direct-message conversations;
messages received by your relatives, customers, employees, or friends from the impostor;
email notifications, login alerts, password-reset notices, and security warnings;
telephone numbers, email addresses, QR codes, payment links, bank accounts, e-wallet numbers, or cryptocurrency addresses supplied by the fake account;
receipts and transaction records if money was sent;
the platform's acknowledgement or reference number after you report the account; and
the names and contact details of witnesses who personally received communications from the impostor.

Keep the original electronic copies. Do not preserve only edited, annotated, compressed, or reposted screenshots.

Electronic evidence can be used in Philippine proceedings, but authenticity and reliability matter. Under the Rules on Electronic Evidence, a party seeking to introduce a private electronic document generally bears the burden of authenticating it. Preserving original files, contextual information, URLs, devices, and unaltered copies can therefore become important later. (Lawphil)

2. Report the fake account to the platform

Use the platform's impersonation or pretending to be someone reporting category where available.

Do not merely report individual posts if the problem is that the entire account is impersonating you. Report the profile itself and, when appropriate, separately report scam messages, threatening posts, private information, or other prohibited content.

Platforms may ask you for proof of identity. TikTok, for example, provides a specific impersonation reporting process, while X allows a person or authorized representative to report an impersonating account.

If your real Facebook account was hacked, rather than somebody merely creating a separate fake account, Facebook provides a dedicated hacked-account recovery process. (Facebook)

Preserve the evidence before completing a takedown request whenever it is safe to do so. Successful takedown can make publicly accessible evidence harder to retrieve.

3. Secure your real accounts

If there is any possibility that your genuine account, email, or phone number was compromised:

change the affected password;
use a new, unique password rather than one reused elsewhere;
change the password of the associated email account;
review logged-in devices and terminate unfamiliar sessions;
review recovery email addresses and phone numbers;
activate two-factor authentication;
remove unfamiliar applications or connected services;
check whether messages, posts, payment settings, or advertisements were created without your permission; and
contact your bank, e-wallet provider, telecommunications company, or other relevant institution immediately if financial accounts, SIM credentials, or OTPs may have been compromised.

Do not send an OTP, password, PIN, recovery code, or identification document to someone merely because that person claims to be investigating the fake account.

4. Warn people who may be targeted

If the fake profile is contacting your friends, relatives, employees, customers, or business partners, issue a short warning through channels you actually control.

State which account is genuine and tell recipients not to send money, OTPs, passwords, identification documents, or other sensitive information to the impersonating account.

Avoid publicly naming a suspected perpetrator unless you have reliable evidence. A guess about who operates a fake account is not the same as proof.

How to report the incident to the PNP Anti-Cybercrime Group

RA 10175 identifies the Philippine National Police and National Bureau of Investigation as the principal law-enforcement authorities responsible for cybercrime enforcement. (Lawphil)

The PNP-ACG maintains a Cyber Response Unit and regional and district anti-cybercrime offices. Its current official contact page lists the Cyber Response Unit at:

PNP-ACG Cyber Response Unit
Telephone: (02) 8723-0401, local 7490
Mobile: 0968-878-3561
Email: complaint@acg.pnp.gov.ph

It also publishes contact details for its Regional Anti-Cybercrime Units and local cyber response teams throughout the Philippines. (PNP ACG)

When reporting, explain the facts chronologically rather than merely saying, “Someone committed identity theft.” Include:

who you are;
what your genuine account or identity is;
the URL and username of the impersonating account;
when you discovered it;
what personal or business information was copied;
what the fake account has actually done;
whether anyone sent money or disclosed information;
whether your real account was accessed;
whether threats, defamatory statements, fraud, or other conduct occurred; and
what electronic evidence you preserved.

You do not need to independently discover the perpetrator's true identity before asking cybercrime investigators for assistance. Subscriber information and other evidence held by service providers may require investigative and court processes that ordinary users cannot obtain themselves.

How to report to the NBI CyberCrime Division

The NBI's current Citizen's Charter provides an Investigative Assistance for Victims of Computer Crimes service through its CyberCrime Division.

According to the NBI procedure, a complainant may proceed to the CyberCrime Division to file a complaint or request an investigation. The NBI assists with a complaint sheet and preliminary interview. Complainants and witnesses may thereafter execute sworn statements or submit prepared affidavits, and relevant devices may be examined as part of the investigation. The service is listed as having no fee. (National Bureau of Investigation)

Even though the Citizen's Charter lists no initial documentary checklist, bringing well-organized electronic evidence will normally make it easier to explain and document the case.

If you are outside Metro Manila, the NBI Citizen's Charter also recognizes Cybercrime Regional Centers handling cases under the same general process. (National Bureau of Investigation)

When to report through the CICC

If the fake account is being used for an online scam, the Cybercrime Investigation and Coordinating Center encourages immediate reporting through its cybercrime reporting channels.

Its official anti-scam materials list:

Hotline: 1326
Email: report@cicc.gov.ph

The CICC also publishes mobile reporting numbers and encourages victims of online scams to report promptly. (CICC)

CICC reporting is useful for rapid reporting and coordination, particularly for scams, but it should not be assumed to replace whatever sworn complaint, investigation, or prosecutorial filing may ultimately be necessary.

If money, an e-wallet, or a bank account is involved

Act faster when the impostor has obtained money or financial credentials.

Immediately notify the relevant bank, e-wallet, card issuer, or financial institution and provide the fraudulent transaction details. Ask for the institution's fraud procedure and preserve the case or reference number.

Republic Act No. 12010, the Anti-Financial Account Scamming Act, separately punishes specified financial-account schemes. Among its provisions are social-engineering schemes involving the use of another person's identifying information through deception or fraud resulting in unauthorized access and control over a financial account. (Lawphil)

Depending on what happened, investigators may consider RA 12010 together with RA 10175 or other applicable laws. The victim does not need to correctly name every offense when making the initial report. What matters is accurately describing the acts and producing the available evidence.

Ask investigators about preservation of platform data

This is one reason prompt reporting matters.

Under Section 13 of RA 10175, service providers must preserve the integrity of traffic data and subscriber information relating to communication services for a minimum of six months from the date of the transaction. Content data must similarly be preserved for six months from receipt of a law-enforcement preservation order. Law-enforcement authorities may order a one-time extension for another six months under the conditions stated in the statute. (Lawphil)

Obtaining subscriber information, content, or other nonpublic platform records is not simply a matter of the complainant asking Facebook, TikTok, X, or another service to disclose them. Philippine cybercrime investigations provide mechanisms involving law enforcement and, where required, judicial warrants. Section 14 of RA 10175, for example, provides for court-authorized disclosure orders in relation to a valid complaint officially docketed and assigned for investigation. (Lawphil)

Accordingly, if identifying the account operator will depend on records held by the social-media service, raise the matter with investigators as early as possible.

Can you file a complaint with the National Privacy Commission?

Possibly, but the NPC route serves a different purpose and does not automatically apply to every fake-account case.

The Data Privacy Act protects personal information and authorizes the National Privacy Commission to receive and investigate complaints concerning personal data. (Lawphil)

The DPA's scope and its definition of a personal information controller contain important qualifications. Among other things, the statutory definition excludes an individual processing personal information in connection with that individual's personal, family, or household affairs. Whether a particular impersonator, organization, platform, business, or other entity falls within the DPA therefore depends on the circumstances. (Lawphil)

An NPC complaint may be particularly relevant where the problem involves unlawful processing, disclosure, retention, security, or use of your personal data by an organization or another entity subject to the DPA.

The NPC currently requires use of its updated Complaint-Affidavit, implemented beginning July 1, 2025. Its complaint guidance states that supporting evidence should accompany the complaint. (Privacy Commission)

The NPC also generally requires exhaustion of remedies: its public complaint guidance instructs the complainant to notify the respondent in writing of the privacy violation or personal-data breach and allow the respondent an opportunity to address it. The NPC guidance refers to the respondent's failure to take timely or appropriate action or failure to respond within 15 calendar days from receipt of that written notice. (Privacy Commission)

Do not delay an urgent police, NBI, bank, or platform report merely because an NPC process may also be available.

What happens after a cybercrime complaint is filed?

Reporting a fake account is not the same as automatically filing a criminal case in court.

The usual sequence may involve:

intake of the complaint by investigators;
interviews and sworn statements;
preservation and forensic examination of electronic evidence;
attempts to identify the account operator;
lawful requests or warrant applications for relevant service-provider information;
gathering financial or telecommunications records where relevant;
preparation of an investigative referral or complaint; and
prosecutorial evaluation before any Information is filed in court.

Because computer-related identity theft is punished under RA 10175 by prision mayor, a criminal prosecution implicates the current DOJ-National Prosecution Service rules governing preliminary investigation. The DOJ's 2024 rules govern crimes carrying the applicable higher prescribed penalties, and the Supreme Court upheld those rules in 2025 as a valid exercise of DOJ authority over prosecutorial preliminary investigations. (Department of Justice)

A police report, platform report, affidavit, prosecutor's complaint, and Information filed in court are therefore different stages or documents.

What is the penalty for computer-related identity theft?

Computer-related identity theft is one of the computer-related offenses under Section 4(b) of RA 10175.

Section 8 provides that offenses under Sections 4(a) and 4(b) are generally punishable by prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. (Lawphil)

Under the Revised Penal Code, prision mayor has a duration of six years and one day to twelve years. (Lawphil)

Section 4(b)(3), however, specifically provides that if no damage has yet been caused, the penalty imposable shall be one degree lower. This is why the absence of completed financial loss does not mean a victim should simply wait for damage to occur. (Lawphil)

The actual penalty in a particular criminal case depends on the charge proved, applicable penalty rules, the evidence, and the court's judgment.

Other offenses may apply

Do not focus so narrowly on the label “identity theft” that other conduct is overlooked.

Depending on the facts, the same incident may involve allegations relating to:

illegal access to a genuine account;
computer-related fraud;
computer-related forgery;
estafa;
falsification;
cyber libel;
threats or coercive conduct;
unlawful use of financial accounts;
unauthorized processing or disclosure of personal data; or
other offenses under special laws.

RA 10175 also contains rules concerning crimes under the Revised Penal Code or special laws committed through information and communications technologies. The correct combination of charges must be evaluated from the actual facts and cannot safely be determined merely from the existence of a fake profile. (Lawphil)

Common mistakes to avoid

Reporting before saving the account

If the platform immediately removes the account, important posts, messages, URLs, usernames, and other details may become inaccessible. Preserve evidence first when it is safe.

Saving only one cropped screenshot

A cropped image may omit the URL, username, timestamp, surrounding messages, or other context needed to establish where it came from. Keep complete originals and supporting screen recordings where possible.

Deleting the conversation

Block the perpetrator if necessary for safety, but first preserve relevant communications. Deleted chats can make reconstruction more difficult.

Negotiating with or threatening the impersonator

Confronting the suspect may cause the account to disappear, evidence to be destroyed, or the scheme to move elsewhere. It can also unnecessarily expose the victim to retaliation.

Sending more personal information to “prove” your identity

Use only legitimate platform and government channels. Fake “support” accounts sometimes exploit victims who are already trying to recover stolen identities.

Paying someone who promises to “hack back” the fake account

Unauthorized access to another account or system can itself create legal problems. Let the platform and authorized investigators handle account access and subscriber evidence.

Publicly accusing a suspected person without adequate proof

Knowing who dislikes you is not evidence that the person operates the fake account. Let technical and documentary evidence support attribution.

Waiting until somebody loses money

Identity-theft provisions contemplate situations where damage has not yet occurred. Delay can also affect evidence preservation.

Calling a fake username “cybersquatting”

Cyber-squatting under RA 10175 concerns domain names and has specific statutory elements. Use the facts rather than forcing the wrong legal label.

When legal or law-enforcement help is urgent

Seek immediate assistance if the fake account is:

actively soliciting money from your contacts;
impersonating you in financial transactions;
using your government IDs or financial-account information;
sending phishing links or seeking OTPs and passwords;
threatening physical harm;
blackmailing or extorting you;
contacting your employer, customers, family members, or business partners while pretending to be you;
publishing sensitive personal information;
using a compromised genuine account rather than merely a copied profile;
disappearing and reappearing under different usernames;
operating from multiple coordinated accounts; or
causing significant financial, employment, business, safety, or reputational consequences.

Where funds have already moved, notify the financial institution immediately in addition to contacting cybercrime authorities. Speed can matter, although no authority can guarantee that transferred funds will be recovered.

Frequently asked questions

Can I report a fake account even if I do not know who created it?

Yes. You can provide PNP-ACG or NBI investigators with the account URL, username, communications, transaction information, and other available evidence. Identification of the person behind an account may require records obtainable only through lawful investigative processes.

Do I need to wait until someone is actually scammed?

No. RA 10175 expressly contemplates computer-related identity theft even when damage has not yet been caused, although the statutory penalty treatment differs. (Lawphil)

Is using my photograph enough to establish identity theft?

Not necessarily by itself. A photograph can contribute to identifying and impersonating a person, but criminal liability depends on the entire factual situation, including what information was taken, how it was used, authorization, intent, and the surrounding conduct.

What if the account says “parody” or “fan account”?

A clear disclaimer may be relevant in assessing whether the account is genuinely impersonating somebody, but a label is not an automatic legal defense if the actual conduct involves fraud, unlawful acquisition or misuse of identifying information, threats, or another offense.

Can I ask Facebook or another platform to tell me who created the account?

You can report the account, but platforms generally do not simply disclose another user's nonpublic subscriber information to an ordinary complainant. Investigators may pursue legally authorized preservation and disclosure procedures when the requirements are met.

Should I get screenshots notarized?

Notarization by itself does not automatically establish that an electronic document is authentic. More important is preserving the electronic evidence and being able to establish its source, integrity, and reliability under the applicable evidence rules. (Lawphil)

Can a company be a victim of computer-related identity theft?

Yes. Section 4(b)(3) expressly refers to identifying information belonging to another natural or juridical person. A business or corporation may therefore be the subject of the offense when its identifying information is unlawfully appropriated under the statutory elements. (Lawphil)

Does reporting the account to Facebook, TikTok, or X automatically start a criminal case?

No. A platform's enforcement process is separate from a Philippine criminal investigation. If prosecution is sought, report the incident to the appropriate law-enforcement agency and cooperate with the investigation and subsequent prosecutorial process.

How long should I wait before reporting?

There is usually no practical reason to delay. Digital evidence can disappear, accounts can be renamed, and RA 10175 contains specific preservation periods for service-provider data. Preserve what you can and report promptly. (Lawphil)

Official sources and reporting channels

General-information disclaimer

This article provides general legal information about Philippine law and is not a substitute for legal advice regarding a particular incident. Whether a fake or impersonating account constitutes computer-related identity theft, fraud, illegal access, a Data Privacy Act violation, or another offense depends on the specific evidence and circumstances. Platform procedures and government contact details can also change, so confirm the current instructions on the official websites before filing.

Sources and procedures checked as of August 25, 2026.