Quick answer

If someone has taken over your social media or online account, report it to the platform through its official recovery process immediately. Secure the email address and phone number linked to the account, save evidence of what happened, and warn contacts if the intruder is sending messages in your name. If money, threats, identity misuse, or unauthorized access is involved, you can also report the incident to the PNP Anti-Cybercrime Group (PNP-ACG) or the NBI. A platform report helps you regain or disable the account; a law-enforcement report asks authorities to investigate. You may need both.

Unauthorized access to a computer system can fall under Section 4(a)(1) of Republic Act No. 10175, the Cybercrime Prevention Act. Other acts, such as altering data, fraud, or misuse of identifying information, may raise different offenses. The applicable charge depends on the evidence and what the person actually did. :chatgpt-content-reference{index="0"}

Act first to limit the damage

Use the platform’s official recovery page. For Facebook, start at facebook.com/hacked, preferably on a device you have used to log in before. For a Google Account or Gmail, follow Google’s account recovery guidance. For another service, open its help centre from its app or a web address you type yourself. :chatgpt-content-reference{index="1"}
Secure your linked email first. Change its password, check its recovery details and signed-in devices, and turn on two-factor authentication. If an intruder controls your email, they may be able to undo your account recovery. Change any other account passwords that you reused.
If you can still sign in, remove the intruder’s access. Change the password; review active sessions, connected apps, recovery email addresses and phone numbers; sign out unfamiliar sessions; and enable two-factor authentication. Save evidence before removing suspicious content where practical, but do not delay securing an active account.
Warn people who may be targeted. Use a separate, trusted channel to tell contacts or customers that messages requesting money, codes, or personal information from the compromised account may be fraudulent. If a business page or shared account is affected, alert its other administrators.
Contact your bank, e-wallet, or card issuer immediately if payment details or funds may be at risk. Use the institution’s official app, website, or number on your card. Keep its case reference and transaction records.

Do not give a password, one-time PIN, or recovery code to someone offering to “retrieve” the account. Use links you have checked yourself, particularly when an apparent support agent contacts you first. Google says it does not work with services claiming to provide account or password support. :chatgpt-content-reference{index="2"}

Where to report the incident

The account provider

Report the takeover even if you have already regained access. Follow the provider’s hacked-account flow and report any impersonating profile, fraudulent posts, or messages separately where its tools allow. Keep confirmation emails, ticket numbers, and screenshots of the report. Reporting to the platform does not automatically file a criminal complaint in the Philippines.

PNP-ACG or NBI

For a suspected crime, approach the PNP Anti-Cybercrime Group or an NBI office or cybercrime unit. The Cybercrime Prevention Act assigns cybercrime law-enforcement responsibilities to the PNP and NBI. The DOJ Office of Cybercrime also provides information on cybercrime matters. Check an agency’s current official contact page before sending sensitive documents or visiting; contact details and intake arrangements can change. :chatgpt-content-reference{index="3"}

Tell the receiving officer plainly what you know and what you only suspect. You need not identify the hacker or choose the legal charge yourself. Ask what complaint, affidavit, identification, and electronic evidence that office requires, and keep your report or reference number. Report promptly: messages, account logs, and other records may become harder to obtain over time. Do not assume that a screenshot by itself proves who operated an account.

National Privacy Commission, when there is a privacy issue

The National Privacy Commission (NPC) handles complaints concerning violations of data privacy rights or personal-data breaches. A hacked personal account does not, by itself, establish that the platform or another organization violated the Data Privacy Act. An NPC complaint may be relevant if, for example, an organization mishandled personal information or failed to address a privacy concern for which it is responsible. :chatgpt-content-reference{index="4"}

The NPC’s complaint guidance says a complainant generally must first inform the respondent in writing of the alleged privacy violation or breach and give it a chance to act. The guidance describes a lack of timely or appropriate action, or no response within 15 calendar days after receipt, as part of this requirement. A formal complaint calls for a notarized complaint-assisted form or verified complaint and supporting evidence; check the NPC’s current instructions for the permitted filing method. This NPC process is distinct from reporting a crime to police or recovering an account through a platform. :chatgpt-content-reference{index="5"}

What to preserve for a report

Make a short timeline while events are fresh. Save copies of:

The account’s profile URL, username, account ID if visible, and proof that it is yours or that you administer it.
Login alerts, password-reset notices, emails about changed contact details, and relevant email headers if available.
Screenshots or exports of unauthorized posts, messages, threats, requests for money, changed settings, and unfamiliar sessions, with dates and times visible where possible.
Links to suspect profiles or posts, transaction references, receipts, and communications with people who received fraudulent messages.
Your platform reports and replies, plus any bank or e-wallet case numbers.

Keep original files and messages where possible. Record who supplied a screenshot and when. Share sensitive records only through the official reporting channel; redact unrelated personal information from copies when appropriate. Avoid confronting a suspected person by trying to enter their account or device.

Common mistakes that delay recovery or a complaint

Changing only the social media password. An intruder with access to the linked email, phone number, or another active session may regain control.
Deleting everything immediately. Preserve a copy of relevant posts, messages, and alerts before removing them, when it is safe to do so.
Treating a platform ticket as a police report. File separately with law enforcement if you want a possible crime investigated.
Naming a suspect as a fact without evidence. A familiar name, profile photo, or phone number may have been impersonated or misused.
Paying a recovery intermediary or clicking “support” links sent in messages. Start from the service’s own app or verified website.

When to seek help urgently

Contact your bank or e-wallet at once if funds moved or financial credentials were exposed. Report promptly to law enforcement if the account is being used for extortion, threats, scams, or disclosure of intimate material. If a child is at risk or someone faces immediate physical danger, seek immediate police assistance. Tell the platform about the harmful content as well, and preserve the relevant messages without forwarding sensitive material unnecessarily.

A lawyer can help where substantial loss, a business account, disputed ownership, multiple affected people, or a possible privacy complaint makes the facts and documents more complex.

FAQ

Can I report a hacked account if I have recovered it?

Yes. Recovery stops or limits access; it does not erase what happened. Keep the evidence and report suspected criminal conduct if investigation is warranted.

Do I need a police report before asking Facebook, Google, or another provider to restore access?

Generally, start with the provider’s own recovery process right away. Its identity checks and requirements vary. A police report is a separate step and does not guarantee that the provider will restore an account.

What if someone made a fake account using my name, but never entered my real account?

Report the fake profile through the platform’s impersonation process. Do not describe it as a takeover unless there is evidence your actual account was accessed. Preserve both profile links and examples of misleading messages.

Is there a fixed deadline for reporting the hack?

There is no single reporting deadline that applies to every platform report, police complaint, and NPC complaint. Act as soon as possible to protect the account and preserve evidence. The NPC’s 15-calendar-day point above concerns its prior written notice and opportunity-to-respond requirement; it is not a waiting period before you secure an account or report suspected crime to law enforcement. :chatgpt-content-reference{index="6"}

This is general Philippine legal information, not advice on a particular case. Procedures and the appropriate remedy depend on the service, conduct, and available evidence. Official sources checked on 29 September 2026.