Quick answer
If someone creates a fake social media account using your name, photos, personal details, business identity, or other identifying information, preserve the evidence first, report the account to the platform, secure any compromised accounts, and report the incident promptly to Philippine cybercrime authorities if the impersonation is being used to deceive, defraud, threaten, harass, damage your reputation, or otherwise misuse your identity.
Under Section 4(b)(3) of the Cybercrime Prevention Act of 2012 (Republic Act No. 10175), computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or juridical entity without right. The Supreme Court has upheld this provision and explained that the prohibited conduct concerns the unauthorized use of another person's identifying information for an illegitimate purpose. (Judiciary eLibrary)
A fake account is not automatically a criminal case merely because it uses a similar name or resembles another person's profile. The surrounding facts matter. A parody, fan account, mistaken identity, or use of information that a person voluntarily made public may present different legal issues. The case becomes much stronger when the account deliberately passes itself off as the victim, communicates as if it were the victim, asks other people for money, obtains confidential information, damages the victim's reputation, threatens people, or otherwise uses the victim's identity for an illegitimate purpose. (Judiciary eLibrary)
Reporting the profile to Facebook, Instagram, TikTok, X, or another platform is useful for getting it disabled, but a platform report is not the same as filing a criminal complaint with Philippine authorities.
What Philippine law considers computer-related identity theft
Section 4(b)(3) of RA 10175 covers the intentional:
- acquisition;
- use or misuse;
- transfer;
- possession;
- alteration; or
- deletion
of another person's or juridical entity's identifying information, when done without right. (Lawphil)
The Supreme Court in Disini v. Secretary of Justice explained that identifying information commonly includes matters such as a person's name, address, contact number, date and place of birth, occupation, and similar information. The Court also stressed that the offense is directed at illegitimate acquisition or use of another person's identifying data and that simply acquiring or disseminating information the user himself or herself made public is not, by itself, the essence of identity theft. (Judiciary eLibrary)
For computer-related offenses under Section 4(b), RA 10175 provides a penalty of prision mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage incurred, or both. For computer-related identity theft, the statute provides that when no damage has yet been caused, the imposable penalty is one degree lower. The precise charge and penalty remain matters for prosecutors and courts based on the evidence and circumstances of the case. (Lawphil)
When a fake social media account may become a criminal matter
The strongest cases usually involve more than merely copying a profile picture.
For example, authorities may have reason to investigate when someone creates an account in your name and then:
- messages your relatives or friends while pretending to be you;
- asks for loans, investments, donations, payments, OTPs, passwords, or banking details;
- pretends to represent your company or profession;
- uses copies of your IDs or other personal information;
- posts statements as though they came from you;
- uses your photographs together with fabricated personal information;
- threatens or blackmails you;
- accesses your real social media account without permission;
- uses the fake identity to enter transactions or obtain property;
- publishes defamatory material; or
- repeatedly creates replacement accounts after earlier accounts are removed.
Other offenses may also be relevant depending on what the impersonator actually does. RA 10175 separately penalizes computer-related fraud and forgery, while crimes under the Revised Penal Code or other special penal laws committed through information and communications technology may fall under Section 6 of RA 10175. (Lawphil)
Thus, an account used to obtain money may raise fraud or estafa issues; defamatory posts may raise cyberlibel issues; unauthorized access to your real account may constitute illegal access; and threats, coercion, sexual exploitation, or other conduct may trigger separate laws. The proper charges should be determined from the actual messages, transactions, account activity, and other evidence rather than from the label "fake account" alone.
Step 1: Preserve the evidence before trying to have the account removed
Do this before repeatedly reporting, blocking, confronting, or warning the person operating the account.
A platform may suspend or delete an account quickly. That is helpful for stopping the harm, but it can also make publicly accessible evidence harder to retrieve.
Preserve, when available:
- screenshots of the fake profile;
- the complete profile URL, not only the displayed username;
- the account's username or handle;
- profile photographs, cover photographs, biography, and other identifying details;
- individual post URLs;
- screenshots of posts, comments, stories, or advertisements;
- direct messages and complete conversation histories;
- dates and approximate times when you discovered each item;
- names of people contacted by the fake account;
- screenshots from those recipients;
- email addresses and telephone numbers used by the impersonator;
- payment instructions, QR codes, bank accounts, e-wallet accounts, cryptocurrency addresses, or transaction references;
- proof that the identity being copied actually belongs to you, such as your legitimate account or business records; and
- any prior communications with the suspect.
Whenever possible, keep the original electronic files. Avoid editing, annotating, filtering, or cropping your only copy. You can make separate annotated copies later.
Screenshots can constitute electronic evidence, but electronic evidence still has to be authenticated when formally offered in a legal proceeding. The Supreme Court has emphasized that screenshots and other electronic documents are not exempt from authentication requirements. (Judiciary eLibrary)
For that reason, screenshots should show as much context as reasonably possible. A screenshot displaying only a person's name and one sentence, with no account details, URL, date, or surrounding conversation, is generally less useful than a complete and properly preserved record.
Step 2: Secure your real accounts immediately
If there is any possibility that the impersonator obtained access to your actual account, email, mobile number, or financial account, treat the incident as a security compromise.
Change the password of the affected account and of any other account using the same or a similar password. Secure the email account connected to your social media profile, because control of the email address can allow an attacker to reset other passwords.
Also:
- enable multi-factor or two-factor authentication;
- review logged-in devices and terminate unfamiliar sessions;
- check recovery email addresses and telephone numbers;
- review recent password-reset emails;
- remove unknown applications connected to the account;
- inform your bank or e-wallet provider immediately if financial information was exposed; and
- warn close contacts if the fake account has been asking them for money or information.
Do not send the impersonator passwords, OTPs, identification documents, or additional personal information simply because the person claims these are needed to "verify" or return your account.
Step 3: Report the fake profile to the social media platform
Use the platform's official impersonation, fake account, hacked account, scam, harassment, or privacy-reporting function, whichever most accurately describes the problem.
If the account is impersonating you, state that clearly. If the platform permits supporting documents, provide only what is reasonably necessary and submit them through the platform's official reporting system rather than through messages sent to the fake account.
Ask family members, employees, or friends who actually received fraudulent messages to preserve those messages before reporting them.
A platform takedown can stop further harm, but it does not identify the perpetrator by itself and does not replace a complaint to law enforcement.
Step 4: Report the incident to the PNP Anti-Cybercrime Group
RA 10175 designates the Philippine National Police and National Bureau of Investigation as law-enforcement authorities responsible for cybercrime enforcement. (Cybercrime Division)
The PNP Anti-Cybercrime Group maintains a Cyber Response Unit and regional, provincial, and district cybercrime offices. Its current official contact page lists the Cyber Response Unit at complaint@acg.pnp.gov.ph, telephone (02) 8723-0401 local 7490, and mobile 0968-878-3561, together with contact details for regional and district units nationwide. Because government contact details can change, verify them on the official PNP ACG page before filing. (PNP ACG)
When making the report, organize your evidence chronologically. Explain:
- who you are;
- what legitimate account, name, photograph, business, or identity belongs to you;
- when you discovered the fake account;
- the fake account's URL and username;
- exactly what identifying information was copied or used;
- what the impersonator did with it;
- who received messages or was deceived;
- whether money or information was obtained;
- whether threats or harassment occurred; and
- whether the account remains active.
You do not have to know the real identity of the operator before seeking law-enforcement assistance. Subscriber information and other computer data may require investigative processes and, depending on the data sought, judicial authorization.
Why early reporting matters
Cybercrime evidence is unusually vulnerable to disappearance. Accounts can be deleted, usernames changed, messages removed, devices replaced, and service-provider records eventually lost.
RA 10175 provides mechanisms for preserving computer data. Among other things, subscriber information and traffic data are subject to statutory preservation requirements, and law-enforcement authorities can require preservation of relevant content data and seek appropriate cybercrime warrants for disclosure, search, seizure, or examination of computer data. (PNP ACG)
This is one reason not to wait until months after an account disappears before going to investigators. If identifying the operator will require records held by a social-media company, telecommunications provider, email provider, or another intermediary, timely preservation can be important.
Do not attempt to obtain private subscriber information yourself by hacking, deceptive access, or unauthorized entry into another person's account.
Step 5: Consider a National Privacy Commission complaint when personal data is involved
Identity theft and a privacy violation overlap in some cases, but they are not identical legal proceedings.
The Data Privacy Act of 2012, RA 10173, regulates the processing of personal information and penalizes specified forms of unauthorized processing, unauthorized access, disclosure, and other unlawful conduct, subject to the Act's scope, lawful-processing provisions, and exceptions. (Lawphil)
A complaint before the National Privacy Commission (NPC) may therefore be appropriate when the incident involves a violation of your rights as a data subject or unlawful processing of your personal data. An NPC proceeding is different from reporting a cybercrime to the police.
Under the current 2021 NPC Rules of Procedure, a complainant generally must first inform the personal information controller, personal information processor, or concerned entity in writing about the alleged privacy violation or personal data breach. Ordinarily, the complaint will not be given due course unless the entity failed to take timely or appropriate action or failed to respond within 15 calendar days after receiving the written notice. The NPC may waive this requirement for good cause or in serious cases, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or conduct that is patently illegal.
The NPC currently instructs complainants to use a notarized Complaints-Assisted Form or verified complaint, together with supporting evidence and, where applicable, witness affidavits. Its official website should be consulted for the latest form; the NPC announced a new Complaint-Affidavit template effective July 1, 2025. (National Privacy Commission)
The NPC Rules also require, among other things, a narration of material facts, supporting evidence, relevant correspondence, the relief sought, and a certification against forum shopping.
Do not assume that every fake-account case should be filed with the NPC. If the core problem is criminal impersonation, fraud, threats, hacking, or another cybercrime, law-enforcement reporting remains important.
What happens after you report the case
A report to law enforcement does not automatically mean that someone will immediately be arrested or prosecuted.
Investigators first have to determine what offense may have been committed, identify the relevant accounts and records, evaluate the evidence, and determine what further investigative steps are legally available. Some subscriber or content information cannot simply be demanded informally and may require preservation orders or cybercrime warrants.
The Rule on Cybercrime Warrants, A.M. No. 17-11-03-SC, provides specialized procedures governing warrants for disclosure, interception, and search, seizure, and examination of computer data. (Judiciary eLibrary)
Where prosecution requires a preliminary investigation, the current DOJ-National Prosecution Service rules govern that executive proceeding. The Supreme Court upheld the validity of the DOJ's 2024 rules in Meking v. Remulla in 2025. (Judiciary eLibrary)
For this reason, a well-organized complaint supported by complete electronic evidence is generally more useful than a bare allegation that "someone made a fake Facebook account."
If the fake account was used to scam other people
If friends, customers, employees, or relatives sent money because they believed the fake account was yours, ask them to preserve their own evidence.
Useful records may include:
- their complete conversation with the fake account;
- proof showing why they believed they were dealing with you;
- bank or e-wallet transaction records;
- recipient account details;
- transaction reference numbers;
- receipts;
- telephone numbers and email addresses used by the scammer; and
- statements describing when and how they discovered the deception.
The person whose identity was copied and the person who actually lost money may have different evidence and may be victims of different aspects of the same scheme. Investigators should be told about everyone affected.
If a transfer has just occurred, the sender should contact the bank, e-wallet, or other financial institution immediately rather than waiting for the criminal investigation to progress.
If the fake account is posting defamatory statements
Preserve each allegedly defamatory post individually, including its URL, date, account identity, accompanying photographs, comments, and other relevant context.
The fact that a defamatory statement appears under a fake name does not by itself prevent investigation. But liability for cyberlibel requires the elements of the applicable offense to be established; not every insult, criticism, accusation, or unpleasant statement is automatically libelous.
Where the same account is simultaneously impersonating you and posting statements falsely presented as your own, preserve evidence of both the impersonation and the content.
If your actual account was hacked
A hacked account is different from a newly created imitation account.
Unauthorized access to the whole or any part of a computer system is itself an offense under Section 4(a)(1) of RA 10175. Smartphones and similar devices fall within the Cybercrime Prevention Act's concept of computer systems for relevant purposes. (Lawphil)
If someone entered your actual account and changed the password, recovery email, mobile number, posts, messages, or other data, tell investigators specifically that unauthorized access occurred. Preserve password-reset notifications, unfamiliar login alerts, IP or device information supplied by the platform, and account-recovery communications.
Can you demand that the account be removed?
You can report impersonation directly to the platform and request action under its policies. If the conduct also violates Philippine law, law-enforcement, privacy, prosecutorial, or judicial remedies may be available depending on the case.
Civil remedies may also exist when unlawful conduct causes injury to a person's dignity, personality, privacy, peace of mind, property, or other protected interests. Articles 19 to 21 and Article 26 of the Civil Code recognize causes of action for certain wrongful acts and permit damages or other appropriate relief when their legal requirements are satisfied. (Lawphil)
Whether an injunction, damages claim, or other civil remedy is appropriate depends heavily on the identity of the defendant, evidence of the acts committed, actual injury, jurisdiction, and the relief sought.
Common mistakes that can weaken a complaint
Deleting the evidence after the account is reported. Preserve the profile, URLs, conversations, and transaction information before the account disappears.
Saving only cropped screenshots. Keep the originals and capture enough context to identify the account, conversation, date, and source.
Warning the suspect before preserving evidence. This may cause the account, messages, or devices to disappear.
Assuming a platform takedown is already a criminal complaint. It is not.
Filing under every law you can think of. Describe the facts accurately and let investigators and prosecutors determine the charges supported by the evidence.
Exaggerating what happened. Distinguish what you personally observed from what another person told you.
Pretending to be someone else to investigate the suspect. Do not create additional legal or evidentiary problems through unauthorized access, hacking, threats, or entrapment conducted on your own.
Publishing the suspect's personal information online. Public accusations can create separate privacy, defamation, safety, and evidentiary issues.
Waiting because no money has been lost yet. RA 10175 expressly contemplates computer-related identity theft even when damage has not yet occurred, although the prescribed penalty is lower in that situation. (Lawphil)
How long do you have to report identity theft?
There is no sensible reason to wait for a prescriptive deadline. Cyber evidence can disappear long before a criminal case technically prescribes.
RA 10175 is a special penal law. Under Act No. 3326, violations of special laws punishable by imprisonment of six years or more generally prescribe after 12 years, unless the applicable statute provides otherwise. Act No. 3326 also contains rules governing when prescription begins and when it is interrupted. (Judiciary eLibrary)
That general rule should not be treated as a universal 12-year deadline for every incident involving a fake account. Different charges can carry different penalties and prescription rules; multiple acts may have different dates of commission; and the point at which an offense was discovered can matter. Seek advice promptly if substantial time has already passed.
For NPC proceedings, separate procedural requirements apply, including the usual written-notice and 15-calendar-day exhaustion requirement discussed above.
When help is urgent
Contact law enforcement promptly when the fake account is:
- actively asking people for money;
- using your bank, e-wallet, or financial information;
- obtaining passwords or OTPs;
- distributing copies of your identification documents;
- threatening physical harm;
- extorting money or demanding sexual acts;
- distributing intimate photographs or videos;
- targeting a child;
- accessing your actual accounts;
- impersonating a company officer to order payments or transfers;
- repeatedly contacting your clients, employer, employees, or relatives; or
- deleting accounts and creating replacements as soon as they are reported.
If someone's physical safety is in immediate danger, prioritize emergency police assistance rather than waiting for a platform's internal review.
Practical evidence checklist
Before meeting investigators, prepare one folder containing:
- a short chronological summary of what happened;
- screenshots of the fake profile;
- the exact account and post URLs;
- copies of all relevant messages;
- the original electronic files where available;
- proof of your legitimate identity or account;
- transaction records if money was involved;
- names and contact information of witnesses or recipients;
- copies of platform reports and responses;
- security alerts showing unauthorized access, if any; and
- a list of accounts, phone numbers, email addresses, payment accounts, and other identifiers linked to the impersonator.
Do not alter the originals merely to make the presentation look cleaner. Prepare a separate chronological index if necessary.
Frequently asked questions
Is using my photograph on another account automatically identity theft?
Not necessarily. The entire context matters. The Supreme Court has distinguished legitimate acquisition or dissemination of information made public by a user from identity theft and has emphasized unauthorized use for an illegitimate purpose. An account deliberately pretending to be you and using your information to deceive others presents a materially different situation. (Judiciary eLibrary)
Can I report a fake account even if I do not know who created it?
Yes. Lack of knowledge of the operator's real name is not a reason to ignore the incident. Give investigators the account URLs, handles, communications, payment information, telephone numbers, email addresses, and other available leads.
Should I block the fake account immediately?
Preserve the evidence first unless immediate blocking is necessary for safety. After preservation, use the platform's reporting and blocking tools as appropriate.
Should I message the fake account and demand that it identify itself?
Usually this is unnecessary and can alert the operator to delete evidence. If the conduct is serious, preserve what exists and report it.
Can the police obtain information from Facebook or another platform?
Potentially, but private computer data is subject to legal procedures. RA 10175 and the Rule on Cybercrime Warrants provide mechanisms for preservation and judicially authorized disclosure or examination of computer data. (PNP ACG)
Can I file both a police complaint and an NPC complaint?
Potentially, yes, because criminal cybercrime enforcement and data-privacy proceedings serve different functions. Whether both are appropriate depends on the facts. Comply with the NPC's separate procedural requirements if filing there.
What if the fake account has already disappeared?
Still preserve everything you have and report serious conduct. Screenshots, messages received by other people, transaction records, emails, telephone numbers, and other records may remain useful even after the public profile disappears. Whether service-provider records remain available will depend on timing and the applicable preservation process.
Official sources
- Republic Act No. 10175 — Cybercrime Prevention Act of 2012
- DOJ Office of Cybercrime — RA 10175 Implementing Rules and Regulations
- Supreme Court — Disini v. Secretary of Justice
- Supreme Court — Rule on Cybercrime Warrants
- PNP Anti-Cybercrime Group — Contact information and regional units
- Republic Act No. 10173 — Data Privacy Act of 2012
- National Privacy Commission — File a Complaint
- National Privacy Commission — Forms
- Act No. 3326 — Prescription of violations of special laws
General-information disclaimer
This article provides general Philippine legal information, not legal advice for a particular case. Identity-theft and fake-account incidents can involve different offenses depending on how the account was created, what information was used, whether unauthorized access occurred, what was communicated, whether anyone suffered damage, and what evidence remains available. A lawyer or investigating authority should review the actual account, messages, records, and surrounding circumstances before conclusions are made about criminal, civil, or data-privacy liability.
Sources and procedures checked as of August 23, 2026.