Quick answer
If someone is using your name, photos, personal details, or business identity through a fake social media account:
- Preserve the evidence before reporting or blocking the account.
- Report the profile and its harmful posts or messages to the platform.
- Secure your real accounts, email, mobile number, and financial accounts.
- Report possible criminal conduct to the PNP Anti-Cybercrime Group or NBI Cybercrime Division.
- If money is moving or a scam is ongoing, contact the bank or e-wallet immediately and call the CICC Cybercrime Complaint Center at 1326.
A fake account is not automatically a criminal case. Criminal liability depends on what information was used, whether it was used without right and for an illegitimate purpose, and whether the account was used to deceive, defraud, threaten, harass, or harm someone. Platform reporting, a criminal complaint, and a privacy complaint are separate remedies; one does not automatically start the others.
What counts as identity theft under Philippine law?
Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, punishes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s or organization’s identifying information, without right.
In Disini v. Secretary of Justice, the Supreme Court upheld this provision and explained that the identity information must be taken or used for an illegitimate purpose. The Court also said that merely acquiring and disseminating information that a user made public is not, by itself, identity theft. The account’s purpose and actual conduct therefore matter. Read the Supreme Court decision.
A duplicate profile is more likely to raise a criminal issue when it is used to:
- Convince relatives, friends, customers, or employers that the impersonator is really you;
- Ask for money, loans, investments, passwords, one-time PINs, or sensitive documents;
- Open accounts, enter transactions, or obtain goods or services in your name;
- Damage your reputation through fabricated statements or conversations;
- Threaten, stalk, blackmail, or sexually harass you;
- Take over your real account or use information obtained through hacking; or
- Impersonate a company, government office, or professional to deceive the public.
A clearly disclosed parody, commentary, or fan account may present a different legal question. A similar name, reused public photograph, or anonymous account does not by itself prove all elements of a crime. Prosecutors and courts evaluate the complete facts and evidence.
Other laws that may apply
The proper charge depends on what the account actually did.
| Conduct | Possible legal issue |
|---|---|
| Intentional use of another’s identifying information without right and for an illegitimate purpose | Computer-related identity theft under Section 4(b)(3), RA 10175 |
| Taking over a real account, email, or device without permission | Illegal access under Section 4(a)(1), RA 10175; other cybercrime provisions may also apply |
| Manipulating computer data or systems with fraudulent intent and causing damage | Computer-related fraud under Section 4(b)(2), RA 10175 |
| Using the fake identity to obtain money or property through deceit | Estafa or another fraud offense, potentially in relation to Section 6 of RA 10175 |
| Publishing a defamatory accusation through the fake account | Online libel may be considered; under Disini, Section 4(c)(4) is valid as to the original author, not people who merely receive or react to the post |
| Gender-based threats, stalking, sexual remarks, nonconsensual sexual content, or identity impersonation used to harm the victim | Gender-based online sexual harassment under Sections 12–14 of the Safe Spaces Act, RA 11313 |
| Posting or distributing qualifying intimate photos or videos without consent | The Anti-Photo and Video Voyeurism Act, RA 9995 may apply |
| Unlawful processing, disclosure, or misuse of personal data | The Data Privacy Act of 2012, RA 10173 may apply if the processing is covered and no statutory exception applies |
For computer-related identity theft, Section 8 of RA 10175 provides prision mayor—generally six years and one day to twelve years—or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both. If no damage has yet been caused, the law provides for a penalty one degree lower. These penalties apply only after conviction, and the exact charge and penalty depend on the proven facts.
Preserve evidence before the account disappears
Do this before blocking the account or asking many people to mass-report it. Takedown is useful, but it can also make evidence harder to collect.
Save:
- The complete profile URL, username, display name, user ID if visible, and QR code;
- Full-page screenshots showing the profile, URL, date, and time;
- A screen recording that starts from the platform or browser and navigates to the profile, posts, and messages;
- Copies of the profile photo, cover photo, bio, posts, stories, comments, and advertisements;
- Messages sent by the impostor, including the complete conversation and account header;
- Transaction records, bank or e-wallet reference numbers, receipts, account names, and destination numbers;
- Emails or text messages about password resets, new logins, or account changes;
- Names and contact details of people who received messages or sent money;
- The URL of your genuine profile and documents showing that the identity, business, or professional role is yours;
- Platform report confirmations, ticket numbers, and responses; and
- A written timeline stating when the account was discovered, what it did, who was affected, and what actions you took.
Keep the original files. Do not crop, annotate, compress, rename repeatedly, or edit your only copy. Back them up in at least two secure locations. Do not factory-reset a relevant phone or delete the conversation.
Screenshots can be documentary or electronic evidence, but their authenticity and integrity may still have to be established. Philippine rules place the burden on the person presenting a private electronic document to show that it is reliable and authentic. Preserving the original device, files, URLs, context, and testimony of people who personally saw the account can help. See the Supreme Court’s Rules on Electronic Evidence.
Secure your real identity and accounts
If your real account was taken over, use the platform’s official account-recovery process first. From a device you trust:
- Change the password of the email account connected to social media;
- Change the social media password and use a unique password;
- Sign out unknown devices and revoke unfamiliar apps or sessions;
- Turn on multi-factor authentication, preferably through an authenticator app or security key;
- Check whether the recovery email, phone number, username, or payment settings were changed;
- Ask your mobile provider to protect or replace a compromised SIM;
- Review bank, e-wallet, shopping, cloud-storage, and government-service accounts for unauthorized activity; and
- Tell contacts through a verified channel that the fake account is not yours.
Never give an OTP, password, recovery code, or remote access to someone claiming that they can “trace” or recover the account. Government agencies and legitimate platform support should not need your password.
Report the account to the platform
Report both the profile and any specific scam, threat, defamatory post, private-information disclosure, or sexual content. A profile report alone may not capture every violation.
Current official reporting pages include:
- Facebook impersonating profile or Page
- Instagram or Threads impersonation form
- TikTok impersonation reporting instructions
- X impersonation reporting instructions
Use only the platform’s app, website, or verified support domain when submitting an identification document. Keep a copy of what you submitted and the acknowledgment. A successful takedown does not automatically identify or prosecute the operator, while a rejected platform report does not establish that the conduct was lawful.
Report possible cybercrime to the PNP or NBI
RA 10175 designates both the Philippine National Police and the National Bureau of Investigation as law-enforcement authorities for cybercrime. You may approach either agency.
PNP Anti-Cybercrime Group
Report to the PNP Anti-Cybercrime Group headquarters or the appropriate Regional Anti-Cybercrime Unit. For immediate safety concerns, you may also go to the nearest police station and ask for coordination with the PNP-ACG.
Official contact numbers can change, so confirm them through the PNP-ACG’s government website or official PNP-ACG page before sending sensitive documents.
NBI Cybercrime Division
The NBI accepts cybercrime complaints from the general public. Its Citizen’s Charter states that a complainant may be interviewed, asked to complete a sworn complaint sheet, submit supporting documents and sworn statements, and allow examination of a relevant device. The listed intake service has no filing fee. Review the NBI cybercrime complaint process.
You may also use the NBI’s official online complaint page, visit the Cybercrime Division or a regional cybercrime center, or confirm current details through the NBI divisions directory, which lists the Cybercrime Division at ccd@nbi.gov.ph.
An online report may be only the initial intake. Investigators may still require personal appearance, identity verification, a sworn statement, original records, or access to the relevant device before a formal investigation can proceed.
CICC Cybercrime Complaint Center
For an active scam or fast-moving cyber incident, call the Cybercrime Investigation and Coordinating Center’s complaint hotline at 1326 or use the CICC reporting page. This can support rapid intake, coordination, and referral, especially where money or accounts may still be at risk.
A CICC report should not be assumed to replace a sworn criminal complaint requested by the PNP, NBI, or prosecutor.
If money was sent
Contact the bank, card issuer, remittance company, or e-wallet through its official fraud channel immediately. Give the transaction reference, amount, date, destination account, and police or CICC reference when available.
Ask the provider to:
- Mark the transaction as unauthorized or fraudulent;
- Preserve the account and transaction records;
- Explain its dispute or recall process;
- Secure your account and connected devices; and
- Give you a written acknowledgment or case number.
Do not promise yourself or other victims that the funds will be recovered. A freeze, recall, or refund depends on timing, the payment method, available funds, contractual rules, and the provider’s investigation.
What to bring when making a formal report
Prepare a clear filing package:
- A government-issued ID and your current contact information;
- A short chronological statement of events;
- The fake account’s full URL, usernames, and identifying details;
- Printed and electronic copies of the preserved evidence;
- A link and screenshot of your genuine account;
- Proof of ownership or association if a business, brand, or professional identity was impersonated;
- Financial records and recipient-account details, if applicable;
- Statements or contact details of witnesses and people who received messages;
- Platform report acknowledgments and correspondence; and
- A description of the harm already caused or the risk that remains.
State only facts you personally know. Clearly label information obtained from a witness. If you suspect a particular person, explain the factual basis instead of presenting the suspicion as proven.
When a National Privacy Commission complaint may help
Consider the National Privacy Commission when the conduct involves unlawful processing, disclosure, failure to secure, or refusal to correct or remove personal data and is covered by the Data Privacy Act. An NPC complaint is different from reporting a cybercrime to the police or NBI.
Under the NPC’s current rules, a complainant generally must first notify the personal information controller, processor, or concerned entity in writing and allow it to act. The complaint may proceed when it fails to take timely or appropriate action or gives no response within 15 calendar days of receiving the notice. The NPC may waive this requirement for proven good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal action. See the amended 2021 NPC Rules of Procedure.
A formal NPC complaint generally requires:
- The current notarized complaint-assisted form or a verified complaint;
- A narration of material facts and requested relief;
- Supporting documents and witness affidavits, if any;
- Correspondence showing prior written notice to the respondent;
- A certification against forum shopping; and
- Payment of the applicable filing fee, unless an exemption or waiver applies.
If the operator is unknown, state the circumstances that may lead to identification. The NPC may dismiss a complaint when the parties cannot be identified or traced despite diligent effort. Download the current form and instructions from the NPC’s File a Complaint page; outdated forms may no longer be accepted.
Do not assume that a platform’s failure to remove an account automatically violates the Data Privacy Act. Coverage, jurisdiction, the platform’s role, the identity of the respondent, and applicable exceptions require a fact-specific assessment.
Important timing rules
Report promptly even if the account has not yet caused financial loss.
Under Section 13 of RA 10175, service providers must preserve traffic data and subscriber information for a minimum of six months from the transaction. Content data must be preserved for six months from receipt of a law-enforcement preservation order, with a possible one-time extension. This is not a six-month filing period for victims, and it does not guarantee that every platform keeps every item for six months. Only authorized law enforcement can issue the statutory preservation order.
Criminal prescriptive periods vary according to the offense, penalty, date of discovery, interruptions, and other facts. Administrative and platform procedures have different time limits. Do not delay while trying to determine the perfect charge.
Common mistakes to avoid
- Reporting or blocking the profile before saving its URL and complete contents;
- Keeping only cropped screenshots with no username, date, context, or link;
- Deleting messages, resetting the device, or editing original files;
- Publicly accusing an unverified suspect;
- Hacking the fake account, attempting to obtain its password, or arranging your own entrapment;
- Sending an ID through an unofficial support page or direct message;
- Paying a “tracer,” “hacker,” or supposed government fixer;
- Giving an OTP or recovery code to anyone;
- Asking contacts to argue with the impostor, which may alert the operator;
- Assuming mass-reporting will preserve evidence or begin a criminal case; or
- Filing long, emotional narratives without a clear timeline, URLs, transaction details, and supporting records.
When help is urgent
Call 911, go to the nearest police station, or contact the PNP-ACG or NBI immediately when there is:
- A credible threat of physical harm;
- Blackmail, extortion, or a demand for sexual material;
- An account targeting a child;
- Publication or threatened publication of intimate content;
- Doxxing that exposes a home, workplace, school, or live location;
- Ongoing unauthorized withdrawals or transfers;
- Continued account takeover despite password changes;
- Impersonation of a public office, regulated professional, or business affecting many people; or
- Evidence that may disappear quickly or require a service-provider preservation order.
Consult a Philippine lawyer promptly if substantial money, employment, custody, reputation, business operations, or personal safety is involved. Counsel can help identify the proper respondent and offenses, prepare affidavits, coordinate evidence preservation, and assess civil remedies or protective orders.
FAQ
Can I report a fake account even if I do not know who created it?
Yes. Give the platform and authorities every available identifier. Law-enforcement access to subscriber or traffic data normally requires the legal processes and warrants provided by RA 10175 and the Supreme Court’s cybercrime rules. A victim should not try to hack or privately purchase account data.
Do I need a lawyer to report it?
Not normally for an initial platform, PNP, NBI, or CICC report. A lawyer is advisable when preparing a prosecutor’s complaint, seeking court relief, facing serious harm, or coordinating criminal, privacy, employment, school, or civil proceedings.
Is using my photograph enough to prove identity theft?
Not necessarily. The prosecution must prove the required intent, use without right, and other elements. A photograph combined with your name, personal details, messages, transactions, or conduct designed to make others believe the account is yours is stronger evidence of impersonation and illegitimate purpose.
What if the fake account has not yet caused damage?
Report it and preserve evidence. Section 4(b)(3) expressly contemplates cases where no damage has yet occurred, although it provides a lower penalty. The absence of completed loss does not make prevention unnecessary.
Can friends report the account for me?
They can usually flag an impersonating profile through the platform, but the person being impersonated or an authorized representative may be required to complete the formal impersonation form. A criminal or NPC complaint may likewise require the victim’s sworn statement or proper written authority.
Will a barangay blotter identify the account owner?
No. A blotter can document that an incident was reported, but it does not itself compel a platform or telecommunications provider to disclose subscriber information. Cybercrime investigators and courts use the processes authorized by law.
Should I post the fake account publicly to warn people?
A limited warning through your verified account may help, but avoid reposting sensitive material, unverified accusations, intimate content, or information that could compromise an investigation. Directly notify likely targets and give them the genuine account or contact channel.
Official references
- Cybercrime Prevention Act of 2012, RA 10175
- Disini v. Secretary of Justice, G.R. No. 203335
- Data Privacy Act of 2012, RA 10173
- NPC amended Rules of Procedure
- NPC complaint guidance
- NBI cybercrime complaint process
- Supreme Court Rules on Electronic Evidence
- Safe Spaces Act, RA 11313
This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Procedures and contact channels can change. Sources and current procedures were checked on 2 August 2026.