Quick answer

Report the takeover through the platform’s official hacked-account recovery process. Secure the email address and mobile number linked to the account, save evidence, and warn your contacts through another channel. If money moved or your card or e-wallet is at risk, call your bank or e-wallet provider immediately. Do this while account recovery is underway. about.fb.com

In the Philippines, you can call 1326 for cybercrime reporting assistance or report suspected unauthorized access, fraud, threats, or identity misuse directly to the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. Ask for a reference number and what the agency needs to open a formal complaint. You can report even if you have no financial loss, do not know who took over the account, or have already recovered it. Philippine News Agency

1. Recover the account and stop further access

Start from the official app or type the recovery address yourself. Use Facebook’s hacked-account recovery page, Instagram’s hacked-account recovery page, or Google’s compromised-account guide. For another service, open its official help center and look for its compromised-account process. Use a device you trust, preferably one you previously used to sign in. about.fb.com
Secure your recovery email. Change its password to a new, unique one, review active sessions, and remove unfamiliar recovery addresses, forwarding rules, and connected apps. If your mobile number suddenly loses service or you receive an unexpected SIM replacement notice, contact your telco through its official channel and tell your bank or e-wallet provider if the number is linked to financial accounts. Google Account Help
Once you regain access, close the other ways back in. Change the account password, sign out unfamiliar sessions, restore your recovery details, and enable two-factor authentication. Review linked apps, payment methods, and any business page or ad account roles. Change the password anywhere else you reused it. about.fb.com
Warn people who may receive messages from the account. Use a separate channel and tell them to ignore recent requests for money, codes, or links. Ask anyone who received a suspicious message to keep the original conversation. If someone sent money, they should contact their own bank or e-wallet provider immediately. Google Account Help

If your real account is still under your control and someone created a separate profile using your name or photos, use the platform’s impersonation reporting option. Save the link to the fake profile and any messages it sent. If someone took over your real account, use the hacked-account recovery process. about.fb.com

2. Report the incident in the Philippines

Where to report	What to do
Cybercrime hotline	Call 1326 for reporting assistance and referral. Ask where to submit your evidence and whether you need to take a separate step to file a formal complaint.
PNP Anti-Cybercrime Group	Email acg@pnp.gov.ph for reporting instructions or contact a PNP Anti-Cybercrime Group office.
NBI Cybercrime Division	Email ccd@nbi.gov.ph for reporting instructions or contact the NBI Cybercrime Division.
Bank, card issuer, or e-wallet provider	Use the official fraud channel. For a disputed transfer, start with the financial institution that sent the money. Ask it to secure your account, record the dispute, and check whether the funds can be held or recovered.

Verify contact details before sending documents. BSP’s official complaint guide and cybercrime contact directory. Philippine News Agency

Give the agency a short timeline, the account handle and profile link, a safe way to reach you, and copies of the most relevant evidence. Say what you observed directly and what someone else told you. If the agency asks for a sworn complaint-affidavit, identification, witness statements, or original files, confirm how to submit them securely. Keep a copy of everything you submit. A hotline call, an in-app report, and a formally docketed complaint serve different purposes. Ask the receiving office which stage your report has reached. Supreme Court E-Library

If money was transferred or charged

Ask the provider for a dispute reference number and its submission requirements and deadlines. If you sent the transfer yourself because a message from the hacked account fooled you, say so. If someone else initiated it, say that instead. Include the transaction reference, amount, date and time, and recipient details. The Anti-Financial Account Scamming Act and BSP rules allow supervised institutions to temporarily hold disputed funds in qualifying cases. The ordinary maximum under the BSP rule is 30 calendar days for the initial and extended holds combined. That period concerns the hold itself. A report does not guarantee that funds will be located or returned. bsp.gov.ph

If the provider’s response is unsatisfactory or the complaint remains unresolved, you can escalate a complaint involving a BSP-supervised institution through the BSP Consumer Assistance Mechanism. Keep the complaint you filed with the provider, its reference number, and any response. BSP complaint filing guide. bsp.gov.ph

3. Preserve evidence before it disappears

Save what you can safely capture without delaying an urgent bank call or account security step.

Account identifiers and ownership records. Keep the profile URL, current and previous usernames, and original account emails or other records showing your connection to the account.
Security notices. Keep original emails or texts about new logins, password resets, and changes to your recovery details. Save email headers if available.
Messages and posts. Capture the sender, recipient, timestamps, and surrounding conversation. Save post links, fake profile links, and demands for money. Ask recipients to preserve their copies.
Payment records. Save receipts, transaction references, recipient details, and relevant statement entries. Record when you contacted the provider and what it told you.
A timeline. Note when you last had normal access, when you noticed the takeover, and when you took each recovery or reporting step. Include the time zone if the records display different times.

Keep original files and unedited screenshots in a secure place. Use redacted copies when you need to share information more widely. If platform records may be needed, tell investigators early. Sections 13 and 14 of the Cybercrime Prevention Act distinguish preservation from compelled disclosure. Investigators can order preservation under the law, and compelled disclosure under Section 14 requires a court warrant. A report to the platform does not itself trigger those legal procedures. Supreme Court E-Library

What Philippine law covers

Under Republic Act No. 10175, access to all or part of a computer system without right can constitute illegal access under Section 4(a)(1). Unauthorized acquisition or use of another person’s identifying information may also fall under computer-related identity theft under Section 4(b)(3). Financial loss is not an element of illegal access. A lockout by itself, however, does not establish that someone accessed the account without right. The facts matter, especially when the account was shared or a former employee, contractor, or page administrator had permission to use it. Preserve records showing who had access and when that authority changed. Supreme Court E-Library

If the takeover exposed customer, employee, or other personal data your organization handles, alert your data protection officer or incident response team immediately. Under the Data Privacy Act’s implementing rules, the personal information controller must notify the National Privacy Commission (NPC) and affected people within 72 hours of knowledge or reasonable belief that a breach requiring notification occurred. The requirement applies when sensitive personal information or information that could enable identity fraud is reasonably believed to have been acquired without authorization and the acquisition is likely to create a real risk of serious harm. That clock applies to the controller’s breach notification duty. For a complaint about an organization’s handling of your personal data, use the NPC’s formal complaint instructions. privacy.gov.ph

When to get help urgently

Money is moving, new charges appear, or your SIM unexpectedly stops working. Contact your bank, card issuer, or e-wallet provider immediately. Contact your telco if you suspect a SIM takeover. bsp.gov.ph
Someone threatens physical harm or knows where to find you. If there is immediate danger, contact emergency services or the nearest police station. Move to a safe place before collecting more evidence.
Someone is demanding money or threatening to release intimate images, or a child is at risk. Report promptly to police and through the platform’s safety tools. Preserve the demands, account details, and links. Avoid forwarding intimate images. If material may depict sexual abuse of a child, avoid downloading or redistributing it and ask police how to provide the location safely.
A work or business account was compromised. Notify the account owner and the organization’s security or privacy lead immediately. Flag any customer data, ad spending, payment access, or other administrator accounts that may be affected. Google Account Help

Common mistakes

Paying a supposed recovery agent or sharing a one-time code. Start recovery yourself through the official app or website. Keep passwords, PINs, one-time codes, and backup codes private.
Deleting the conversation or wiping the device before saving records. Preserve evidence you can safely access, then remove harmful content or follow your organization’s incident response instructions.
Using the compromised account to coordinate your response. Use a separate, secure account or phone number for your reports and warnings.
Publicly naming a suspected hacker or trying to break into their account. Give investigators the facts you can verify and keep your own actions within authorized access. Google Account Help

Frequently asked questions

Can I report if I do not know who hacked me?

Yes. Give the reporting office the account identifiers, timeline, and records you have. Investigators can assess what additional records may be available and whether legal process is needed to obtain them. Supreme Court E-Library

Can the police get my account back?

Start recovery with the platform, which controls the account’s login and verification process. Police and the NBI can investigate suspected offenses and pursue relevant evidence through the applicable legal procedures. You can pursue both tracks at the same time. Office of Cybercrime

Do I have only 72 hours to report a hacked account?

There is no general 72-hour victim reporting deadline under the Cybercrime Prevention Act. Its 72-hour disclosure period runs from receipt of an order issued after law enforcement secures a warrant. The separate data breach notification rule applies to personal information controllers in qualifying cases. Report promptly because records can disappear and financial providers may have their own dispute requirements and deadlines. Supreme Court E-Library

This article provides general legal information for the Philippines. Advice for a particular case depends on the facts and records. Official sources checked on November 9, 2026.