Quick answer

Report the fake account through the social media platform and, when it uses your identity without authority, scams people, threatens or harasses you, exposes private information, or causes financial or reputational harm, report it to Philippine cybercrime authorities. Preserve the account, posts, messages, URLs, and transaction records before requesting removal.

If money was transferred or a financial account was compromised, contact the bank or e-wallet immediately, then call the Cybercrime Investigation and Coordinating Center’s 1326 hotline. If anyone is in immediate physical danger, call 911 or go to the nearest police station.

A fake name or anonymous account is not automatically identity theft. The facts must show conduct covered by law, such as intentionally using another person’s identifying information without right. A clearly identified parody, commentary, or fan account may raise different issues from an account designed to deceive people into believing it is the real person.

What Philippine law covers

Computer-related identity theft

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 punishes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another natural or juridical person’s identifying information without right.

This may apply when someone creates or operates an account using another person’s name, photographs, contact details, identification documents, business identity, or other identifying information without authority. Whether a particular account qualifies depends on the account’s content, how the information was obtained and used, the operator’s intent, and any claimed consent, authority, or lawful justification.

The general penalty for computer-related offenses under Sections 4(a) and 4(b) is prision mayor, a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. For computer-related identity theft, the law provides a penalty one degree lower if no damage has yet been caused. The Supreme Court upheld the identity-theft provision in Disini v. Secretary of Justice.

Other offenses may apply

Depending on what the account does, authorities may assess other laws in addition to—or instead of—computer-related identity theft:

Unauthorized collection, disclosure, or use of personal data may raise issues under the Data Privacy Act of 2012.
An account that uses impersonation as part of gender-based threats, sexual harassment, cyberstalking, nonconsensual sharing, or reputation-harming lies may fall within Section 12 of the Safe Spaces Act. The statute expressly includes certain forms of online impersonation, but its gender-based and other elements must still be established.
Defamatory posts may support a cyberlibel complaint if all legal elements are present. A fake account, an insulting statement, or a false statement is not automatically cyberlibel; context, publication, identifiability, malice, privileges, and defenses matter.
Sharing covered sexual images or recordings without the required consent may violate the Anti-Photo and Video Voyeurism Act.
Sexual content involving a child requires immediate, specialized handling under the Anti-OSAEC and Anti-CSAEM Act.
If an impostor obtains financial credentials through deception, takes control of an account, opens a financial account using another person’s identity or identification documents, or uses accounts to receive criminal proceeds, the Anti-Financial Account Scamming Act may apply.

The investigating agency and prosecutor—not the complainant or the platform—determine which charges the evidence can support.

What to do immediately

1. Preserve the evidence before the account disappears

Capture enough information to show both the content and where it came from:

The complete profile URL, exact username or handle, display name, profile photograph, bio, and visible account or user ID.
Your genuine account’s URL for comparison.
Full screenshots of the profile, posts, comments, advertisements, stories, and messages.
A screen recording that starts from the platform or browser, opens the profile, shows the URL or handle, and scrolls through the relevant content.
Dates, times, and the time zone in which you viewed or received each item.
The full conversation—not only the most offensive message.
Email notices, message requests, login alerts, password-reset notices, and, where available, original email headers.
Names and contact details of people who received messages or sent money because they believed the account was yours.
Payment receipts, reference numbers, destination account details, QR codes, telephone numbers, and bank or e-wallet statements.
The acknowledgment, case number, or email generated by every platform and government report.

Keep the original files and device. Store unedited copies in at least one secure backup. You may make marked-up or cropped copies for explanation, but retain the untouched versions. Philippine rules place the burden of authenticating private electronic documents on the party offering them, so integrity, context, and reliability matter. See the Supreme Court’s Rules on Electronic Evidence.

Do not hack the account, secretly access another person’s device, buy unlawfully obtained account data, or impersonate the suspect. Do not conduct your own entrapment operation.

2. Secure your genuine accounts and identity

If your real account may have been taken over:

Secure the email account connected to it first.
Change passwords from a trusted device using unique, strong passwords.
Sign out unknown devices and revoke unfamiliar applications or sessions.
Turn on multi-factor authentication and save new recovery codes securely.
Check whether the recovery email, telephone number, forwarding rules, or security questions were changed.
Contact your telecommunications provider immediately if your SIM suddenly lost service or you suspect a SIM swap.
Notify family, colleagues, customers, or followers through a separate verified channel. State the exact fake handle and tell them not to send money, codes, documents, or personal information.

If identification documents were copied, notify the issuing agency and every institution where the documents may have been used. Ask banks, lenders, e-wallets, or other institutions to flag the identity-theft claim and give you a written reference number.

3. Report the account and its individual content to the platform

Report both the profile and any harmful posts, advertisements, or direct messages. Platform removal is often the quickest way to limit harm, but it does not replace a government complaint.

Official reporting routes include:

Use the category that best describes the violation—such as impersonation, fraud, hacked account, private information, threats, harassment, or nonconsensual intimate imagery. Supply only identification documents that the platform officially requests, and verify that you are on the platform’s real domain before uploading them.

Preserve your evidence first. A successful takedown may make public content harder to retrieve later.

Where to report in the Philippines

CICC hotline and complaint center

Call the Cybercrime Investigation and Coordinating Center at 1326, particularly when the incident is ongoing, involves a scam, or needs referral to the appropriate agency. Current alternative channels and walk-in details are listed on the CICC cybercrime report page. The DICT contact page also lists its complaint contact information.

CICC coordinates and refers cybercrime concerns. A call or online report is useful for prompt assistance, but investigators may still require a sworn complaint and supporting evidence.

PNP Anti-Cybercrime Group

Report to the nearest Philippine National Police Anti-Cybercrime Group regional unit or police station. The PNP Anti-Cybercrime Group is particularly relevant to active threats, harassment, online sexual harassment, scams, and other cyber-enabled crimes.

Ask for:

The name and contact details of the assigned investigator.
The complaint, reference, or docket number.
Written acknowledgment of the evidence you submitted.
Guidance on whether an urgent preservation request or cybercrime warrant should be pursued.

NBI Cybercrime Division

You may submit an initial report through the NBI online complaint page or contact the Cybercrime Division through the current details on the NBI Divisions and Services page. The NBI also lists its regional and district offices online.

The NBI’s published procedure for computer-crime victims includes a complaint sheet, preliminary interview, sworn statements or affidavits, supporting documents, and examination of a relevant device when appropriate. Its stated investigative-assistance service has no agency fee. See the NBI Citizen’s Charter procedure.

Under Section 10 of Republic Act No. 10175, both the NBI and PNP are responsible for cybercrime law enforcement.

How to prepare the complaint

Write a clear chronology using facts you personally know. Include:

When and how you discovered the account.
The exact fake-account URLs, handles, telephone numbers, and email addresses.
The identifying information taken from you or your organization.
Why the account is unauthorized.
What the account posted, represented, requested, or obtained.
Who was contacted or deceived.
Any money, account access, employment, business, emotional, safety, or reputational harm.
Any facts that may lawfully help identify the operator, clearly separating confirmed facts from suspicions.
Previous reports to the platform, bank, employer, school, telecommunications provider, or government agency.
A numbered list of attached evidence.

Bring a valid government-issued ID, your evidence, and the original device when requested. Witnesses may be asked to execute sworn statements. If filing for a minor, bring proof of the parent’s or guardian’s relationship or authority. A representative of a company or organization should bring proof of authority, such as the appropriate board resolution or secretary’s certificate.

Do not name a suspected person as a fact unless the evidence supports that identification. Say “I suspect” and explain the factual basis when the identity is uncertain.

Why prompt reporting matters

There is no single deadline for every incident involving a fake account. The applicable prescriptive period depends on the offense and facts.

Some particularly important periods are:

Under Section 13 of Republic Act No. 10175, traffic data and subscriber information relating to communication services must generally be preserved by service providers for at least six months from the transaction. Content data must be preserved for six months from receipt of a law-enforcement preservation order, subject to a possible one-time six-month extension. Foreign platforms and cross-border evidence may involve additional legal processes and retention policies.
The Supreme Court has confirmed that cyberlibel generally prescribes in one year from discovery by the offended party, authorities, or their agents. The discovery date may require evidence. See the Court’s 2026 resolution in Causing v. People.
Before an ordinary complaint is given due course by the National Privacy Commission, the complainant must generally notify the personal information controller, processor, or concerned entity in writing and allow it to act. If it gives no response within 15 calendar days, the exhaustion requirement may be satisfied. The NPC may waive this requirement for good cause or certain serious violations. See the 2021 NPC Rules of Procedure, as amended.

Do not wait for the account to contact more victims or for the platform to finish its review before preserving evidence and making an urgent government report.

If money or a financial account is involved

Contact the sending and receiving bank or e-wallet through their official fraud channels immediately. Give them:

The transaction date, amount, and reference number.
The destination account or wallet details.
A brief explanation that the transaction resulted from identity theft, impersonation, account takeover, or social engineering.
The police, CICC, or NBI reference number, if already available.

Ask for a written fraud-case number and whether the transaction can be disputed, traced, or temporarily held. Do not assume that filing a report guarantees reversal.

Under the Anti-Financial Account Scamming Act, a covered institution may temporarily hold funds subject to a disputed transaction for the period prescribed by the Bangko Sentral ng Pilipinas, not exceeding 30 calendar days unless extended by a competent court. The law also requires coordinated verification of disputed transactions. Current implementation rules are compiled in the BSP’s AFASA booklet and implementing regulations.

Never give an OTP, PIN, password, card verification value, recovery code, or remote access to someone claiming they need it to “return” the money.

When a National Privacy Commission complaint may help

Consider an NPC complaint when the incident involves unlawful processing, disclosure, inadequate protection, or misuse of your personal data by an identifiable person or organization. The NPC is not a substitute for the police in a pure threat, scam, or reputation dispute, although the same incident may involve both privacy and criminal issues.

For an ordinary NPC complaint:

Notify the platform, organization, or concerned entity in writing and keep proof of delivery.
Keep its response or proof that 15 calendar days passed without a response.
Use the NPC’s current complaint-affidavit form.
Attach the correspondence, documentary evidence, witness affidavits, requested relief, and certification against forum shopping.
Have the complaint notarized and pay the applicable filing fee unless an exemption or waiver applies.

The NPC permits submission in person, by courier, or by scanned email, subject to its current requirements. Check the NPC formal-complaint page for the latest form, address, email, and fee schedule before filing.

What authorities can—and cannot—do

Investigators may document the complaint, interview witnesses, examine devices with consent or lawful authority, request preservation, and apply for appropriate cybercrime warrants. Subscriber information, traffic data, private messages, and other nonpublic data are generally not available merely because a victim asks the platform for them.

A court-issued Warrant to Disclose Computer Data may authorize law enforcement to require a person or service provider to disclose relevant computer data. Other forms of interception, search, seizure, or examination have their own requirements under the Supreme Court’s Rule on Cybercrime Warrants.

Identification is not guaranteed. An account may contain false registration information, use compromised devices or accounts, or involve a foreign platform or operator. Still, a prompt, well-documented complaint gives investigators a better opportunity to preserve and lawfully obtain evidence.

Common mistakes to avoid

Reporting the account before saving its URLs and content.
Keeping only cropped screenshots that omit the username, date, or surrounding conversation.
Deleting the original messages, emails, files, or compromised account.
Publicly accusing an unverified suspect.
Posting your full IDs, address, signatures, or case documents to prove that you are the victim.
Paying the impersonator or a supposed “hacker” who promises to recover or trace the account.
Giving passwords or OTPs to someone claiming to be from the platform, police, bank, or CICC.
Asking friends to confront, threaten, or bait the operator.
Assuming a barangay blotter or platform report automatically starts a cybercrime investigation.
Assuming that account removal proves who operated it or establishes criminal liability.
Reposting defamatory, sexual, or child-related material while asking the public for help.

A barangay or local police report may document threats or local incidents, but it should not replace a report to the PNP Anti-Cybercrime Group or NBI when digital investigation is needed.

When help is urgent

Seek immediate assistance when:

The account makes a credible threat of violence, reveals your location, or encourages others to harm you. Call 911 or the nearest police station.
Money is moving or an account has just been taken over. Contact the financial institution and CICC at 1326 immediately.
The account distributes or threatens to distribute intimate images.
A child is being sexually exploited, groomed, impersonated for sexual purposes, or depicted in sexual material. Do not forward or repeatedly download the material. Preserve the account identifiers and report immediately to law enforcement. OSAEC and CSAEM concerns may also be reported through the government’s MAKABATA Helpline 1383, established under Executive Order No. 79.
Your SIM, email, bank, e-wallet, government-benefit, or workplace account has been compromised.
The impersonator is contacting your employer, customers, school, creditors, or family.
A filing deadline may be approaching, especially where defamatory posts are involved.

A lawyer should be consulted promptly if the operator is known, substantial loss occurred, the account is part of a continuing harassment campaign, the platform rejected repeated reports, or you need help preparing a complaint-affidavit or identifying the correct offenses.

Frequently asked questions

Do I need to know who created the account before reporting it?

No. You may report an unknown operator. Give investigators every reliable identifier and explain any suspicions without presenting them as established facts.

Can police immediately obtain the account owner’s name from the platform?

Not necessarily. Nonpublic account data may require a preservation order, cybercrime warrant, platform legal process, or international cooperation. The data may also be incomplete or false.

Is using my photograph enough to prove identity theft?

Not automatically. It is important evidence, but legal liability depends on the complete circumstances, including the identifying information used, intent, lack of authority, and what the account did.

What if the account says it is a parody or fan account?

A clear parody, commentary, or fan disclosure may reduce the likelihood that reasonable users will believe it is the real person, but the label is not conclusive. Fraud, threats, harassment, unlawful data use, or other prohibited conduct may still be actionable.

Can I report an account impersonating my child?

Yes. A parent or lawful guardian may report it to the platform and authorities. Bring the child’s birth certificate or other proof of relationship or authority when formally filing.

Should I ask friends to mass-report the account?

Friends may make truthful platform reports, but preserve the evidence first. The impersonated person or authorized representative should also file the primary report because platforms may require identity verification.

Will a platform report file a criminal case?

No. Platform enforcement and Philippine criminal proceedings are separate. Report to the PNP, NBI, or CICC when investigation or prosecution is needed.

Can I post the suspect’s name to warn people?

A narrowly worded warning about the fake account’s exact handle may help prevent harm. Publicly identifying an unverified operator can expose an innocent person and create legal risk. State confirmed facts and avoid unsupported accusations.

Should I contact the impersonator?

Usually, preserve the evidence and seek guidance first. Contact may cause the operator to delete evidence, escalate threats, or demand money. Do not arrange a meeting or entrapment without law-enforcement direction.

Official references

This article provides general Philippine legal information, not individualized legal advice or a prediction of any case’s outcome. The correct remedy and charges depend on the account, documents, evidence, timing, and surrounding facts. Official sources and procedures were checked as of 3 August 2026.