Direct answer: No Philippine statute uses the word “catfishing,” and there is no offence by that name. The conduct is still frequently criminal. Depending on what the fake persona was used for, it can fall under computer-related identity theft or computer-related fraud in the Cybercrime Prevention Act, estafa under the Revised Penal Code as amended, gender-based online sexual harassment under the Safe Spaces Act, or the child-protection statutes. Deception on its own, with nothing more, is usually not an offence.
For reporting routes, offense maps and evidence guidance, see Cybercode’s Cybercrime Philippines hub.
Key Takeaways
- There is no crime called catfishing in Philippine law. Asking “is catfishing illegal” is the wrong question. The right question is what the fake persona was used to do.
- Using a real person’s name or photos is the sharpest hook. Republic Act No. 10175, Section 4(b)(3) punishes computer-related identity theft — the use of identifying information belonging to another, without right.
- A wholly invented persona is different. If nobody real was impersonated, the identity-theft route may not apply at all, and the case has to be built on what the deception achieved instead.
- If money changed hands, this is an estafa case. Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951, punishes false pretences using a fictitious name or falsely pretended qualifications, and Section 6 of RA 10175 raises the penalty by one degree when the offence is committed through information and communications technology.
- The Safe Spaces Act names impersonation directly. Section 12 of Republic Act No. 11313 lists “impersonating identities of victims online” as gender-based online sexual harassment.
- Those offences never expire. Section 36(d) of RA 11313 provides that offences committed under Section 12 are imprescriptible.
- There are often two different victims. The person whose photos were stolen and the person who was deceived are usually not the same person, and they have different remedies.
- Lying about your height is not a crime. Exaggeration, an old profile photo, a pen name or an anonymous account, standing alone, do not engage any of these provisions.
Jump to a Section
- Why no Philippine law says “catfishing”
- Decision snapshot: is your situation a crime?
- The two-victim problem
- Route 1: computer-related identity theft
- Route 2: estafa and computer-related fraud
- Route 3: the Safe Spaces Act
- Route 4: when the target is a child
- Adjacent offences that often ride along
- What is not a crime
- Mapping table: conduct to provision
- Penalties at a glance
- Seven worked scenarios
- Evidence to preserve, and how
- Where to report it
- Common mistakes
- Frequently asked questions
- Verification note
- Official sources
Decision Snapshot: Is Your Situation a Crime?
Work down this table before reading anything else. Each row reflects a different provision, and more than one can apply to the same set of facts.
| What happened | Likely criminal? | Provision that bites |
|---|---|---|
| Someone used a real person’s photos and name to build a fake profile | Yes, in most cases | RA 10175 Sec. 4(b)(3), computer-related identity theft |
| A fake persona was used to get money out of you | Yes | Art. 315 RPC as amended by RA 10951, with RA 10175 Sec. 6 |
| A fake persona was used to send sexual or misogynistic messages, or to impersonate you | Yes | RA 11313 Sec. 12, gender-based online sexual harassment |
| A fake persona was used to approach someone under 18 for sexual purposes | Yes, and far more seriously | The OSAEC and CSAEM Act, luring and grooming |
| A fake account posted defamatory statements about a real person | Possibly | Cyber libel under RA 10175, read with Sec. 6 |
| Intimate images were obtained or shared through the deception | Yes | RA 9995, and RA 11313 Sec. 12 |
| Someone used a fully invented identity and did nothing else | Usually no | No provision is clearly engaged on those facts alone |
| Someone exaggerated their age, job or appearance on a dating profile | No | Not an offence by itself |
Why No Philippine Law Says “Catfishing”
Catfishing is a description of a behaviour, not a legal category. It describes building a false online persona and using it to form a relationship with someone who believes the persona is real. Philippine criminal statutes are not written around behaviours of that shape. They are written around defined acts — acquiring identifying information without right, obtaining money by false pretences, harassing a person through information and communications technology, luring a child.
That has a practical consequence for anyone trying to work out whether they have a case. Searching for a law against catfishing produces nothing, and it is easy to conclude from that silence that nothing can be done. The conclusion is wrong. What is actually required is to separate the deception from its purpose, and then to ask which statute covers the purpose.
Three questions do most of the work:
- Whose identity was used? A real person’s, or an invention? This decides whether the identity-theft provision is available.
- What did the deception achieve? Money, sexual content, access to an account, reputational damage, or nothing?
- Who was on the receiving end? An adult or a child? This changes the applicable statute entirely, not just the penalty.
The rest of this guide follows those three questions. For the broader statutory framework behind most of what follows, see our guide to the cybercrime offences and higher penalties under RA 10175 Sections 4 and 6.
The Two-Victim Problem
This is the part that most explanations of catfishing miss, and it changes how a complaint should be framed.
In a typical catfishing case there are two distinct injured parties, and they are not the same person:
- The impersonated person — whoever the stolen photographs and name actually belong to. They may not know the fake account exists. Their injury is the unauthorised use of their identifying information, and possibly damage to their reputation.
- The deceived person — the one who formed the relationship, sent the money, or sent the images. Their injury is the fraud, harassment or exploitation that the deception enabled.
Each can complain, and each complains about something different. The impersonated person’s strongest route is the identity-theft provision and, where the account is defamatory, cyber libel. The deceived person’s strongest route is estafa, or the Safe Spaces Act, or the child-protection statutes, depending on what was extracted from them.
Where the same conduct injures both, a single investigation can cover both — but the complaints should be drafted to say so rather than leaving the investigator to infer it. Our page on fake accounts and impersonation sets out the platform-takedown side of this for the impersonated person; this page covers the criminal classification.
Route 1: Computer-Related Identity Theft
Short answer: if the fake profile used a real person’s name, photographs or other identifying details, Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act of 2012, is the provision that applies.
Section 4(b)(3) defines computer-related identity theft as:
“the intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical, without right.”
Three features of that wording matter more than they look.
“Acquisition, use, misuse, transfer, possession”
The list is deliberately wide. A person who downloads someone else’s photographs and uploads them to a dating profile has acquired and used identifying information. A person who merely holds a folder of scraped photos has possessed it. The provision does not require that the information be sold, or that the impersonated person suffer a measurable financial loss.
“Belonging to another, whether natural or juridical”
This is the phrase that decides most cases. The identifying information has to belong to somebody. Where a catfisher constructs a persona entirely from invention — a name nobody carries, a face generated by software, a biography with no real referent — there is no “another” whose information was used, and the identity-theft route becomes difficult or unavailable on those facts alone.
The inclusion of juridical persons matters too: a fake profile impersonating a company, a bank or an agency is squarely within the provision. That is the overlap with our guide to a fake Facebook page using a business name.
“Without right”
Consent defeats the element. A person operating a joint or fan account with the subject’s permission, an agency running a client’s profile, or a parent managing a page for a family business is acting with right. The absence of permission is what has to be established, and it is usually established by the impersonated person’s own statement.
What the penalty is
Section 8 of RA 10175 provides that offences under Section 4(a) and Section 4(b) are punished by prisión mayor, or a fine of at least Two hundred thousand pesos (₱200,000.00) up to an amount commensurate to the damage incurred, or both.
For the victim’s side of this offence in detail, see our guide to computer-related identity theft and what victims should do. Where the stolen material is a face or a voice reused synthetically rather than simply copied, see digital likeness rights in the Philippines and deepfakes and your likeness.
Route 2: Estafa and Computer-Related Fraud
Short answer: if the persona was used to obtain money or property, the case is an estafa case, and the fact that it happened online raises the penalty rather than creating a separate offence.
Estafa by false pretences
Article 315 of the Revised Penal Code, as amended by Republic Act No. 10951, punishes swindling committed by several distinct means. The one that fits catfishing is the second group — false pretences or fraudulent acts “executed prior to or simultaneously with the commission of the fraud.” The first item in that group covers a person who uses:
a fictitious name, or falsely pretends to possess power, influence, qualifications, property, credit, agency, business or imaginary transactions.
A fabricated persona is a fictitious name. A claimed profession, an invented overseas posting, a non-existent business, a promised inheritance or an imaginary investment are falsely pretended qualifications, business or imaginary transactions. The timing requirement is also satisfied in the ordinary catfishing pattern, because the persona is built before the request for money, not afterwards.
The amount decides the penalty
Republic Act No. 10951, approved 29 August 2017, adjusted every peso threshold in the Revised Penal Code. Under the amended Article 315 the general scale runs:
| Amount defrauded | Penalty range under the amended Art. 315 |
|---|---|
| Over ₱4,400,000 | Base penalty plus one year for each additional ₱2,000,000, total not to exceed 20 years |
| Over ₱2,400,000 up to ₱4,400,000 | Prisión correccional maximum to prisión mayor minimum |
| Over ₱1,200,000 up to ₱2,400,000 | Prisión correccional minimum and medium |
| Over ₱40,000 up to ₱1,200,000 | Arresto mayor maximum to prisión correccional minimum |
| ₱40,000 or less | Arresto mayor medium and maximum |
Section 100 of RA 10951 makes the adjusted amounts retroactive to the extent favourable to the accused.
Section 6 raises it by one degree
Section 6 of RA 10175 provides that all crimes defined and penalised by the Revised Penal Code and special laws, if committed by, through and with the use of information and communications technology, are covered by the Act, “Provided, That the penalty to be imposed shall be one (1) degree higher.”
A catfishing estafa carried out entirely over a messaging app or a dating platform is committed through information and communications technology on any ordinary reading. What Cybercode will not do is state the resulting penalty range as a finished figure, because applying one degree to each band above is a sentencing exercise for a court, not a table a website should publish as settled. Our guide to online estafa in the Philippines explains the elements and the complaint route in full.
Computer-related fraud is a different provision
Section 4(b)(2) of RA 10175 separately punishes computer-related fraud, defined as “the unauthorized input, alteration, or deletion of computer data or program or interference in the functioning of a computer system, causing damage thereby with fraudulent intent.”
That provision is about manipulating data or systems, not about lying to a person. A catfisher who simply persuades someone to send money has not altered anybody’s computer data. A catfisher who takes over the victim’s account, changes the recovery details and moves funds has. The distinction is set out in our guide to computer-related fraud, and the account-takeover variant in what to do about a hacked Facebook account.
Route 3: The Safe Spaces Act Names Impersonation Directly
Short answer: Republic Act No. 11313, the Safe Spaces Act, is the one Philippine statute that expressly mentions online impersonation, and it is badly under-used in catfishing complaints.
RA 11313 was approved on 10 April 2019. Its full title is “An Act Defining Gender-Based Sexual Harassment in Streets, Public Spaces, Online, Workplaces, and Educational or Training Institutions, Providing Protective Measures and Prescribing Penalties Therefor.”
Section 12 defines gender-based online sexual harassment as follows:
“Gender-based online sexual harassment includes acts that use information and communications technology in terrorizing and intimidating victims through physical, psychological, and emotional threats, unwanted sexual misogynistic, transphobic, homophobic and sexist remarks and comments online whether publicly or through direct and private messages, invasion of victim’s privacy through cyberstalking and incessant messaging, uploading and sharing without the consent of the victim, any form of media that contains photos, voice, or video with sexual content, any unauthorized recording and sharing of any of the victim’s photos, videos, or any information online, impersonating identities of victims online or posting lies about victims to harm their reputation, or filing false abuse reports to online platforms to silence victims.”
Why this matters for catfishing
Two clauses near the end of that definition do the work. “Impersonating identities of victims online” describes the core of a catfishing account built on a real person. “Posting lies about victims to harm their reputation” describes what such an account usually does next. Neither clause requires that money changed hands, and neither requires that the impersonated person ever spoke to the catfisher.
The provision is not unlimited. It sits inside a statute about gender-based sexual harassment, and the definition is framed around conduct directed at a victim in that register — sexual, misogynistic, transphobic, homophobic or sexist. An impersonation with no gendered or sexual dimension at all is better routed to Section 4(b)(3) of RA 10175. Where the impersonation is used to send sexual content, to harass, or to attach a person’s face to sexual material, Section 12 is the better fit and carries advantages the Cybercrime Prevention Act does not.
The penalty
Section 14 of RA 11313 provides:
“The penalty of prision correccional in its medium period or a fine of not less than One hundred thousand pesos (P100,000.00) but not more than Five hundred thousand pesos (P500,000.00), or both, at the discretion of the court shall be imposed upon any person found guilty of any gender-based online sexual harassment.”
The provision that almost nobody quotes
Section 36(d) of RA 11313 provides that offences committed under Section 12 of the Act shall be imprescriptible.
This is the single most valuable fact on this page for anyone whose case is old. Most of the alternatives are time-limited. Cyber libel in particular runs on a short clock — see cyber libel prescription in the Philippines. A gender-based online sexual harassment complaint under Section 12 does not expire at all. A person who was impersonated in 2019 and did nothing about it because they did not know it was actionable is not out of time under this provision.
Where the complaint goes
Section 13 of RA 11313 designates the PNP Anti-Cybercrime Group to receive complaints of gender-based online sexual harassment and to develop an online mechanism for reporting such acts in real time and apprehending perpetrators. That is a statutory assignment, not merely a practice. Our full treatment of the Act is at Safe Spaces Act: gender-based sexual harassment under RA 11313.
Route 4: When the Target Is a Child
Short answer: if the person on the other side of the fake persona is under 18, this stops being a catfishing question. It becomes a child-protection case under a far heavier statute, and it should be reported immediately rather than investigated privately.
The Anti-Online Sexual Abuse or Exploitation of Children (OSAEC) and Anti-Child Sexual Abuse or Exploitation Materials (CSAEM) Act, approved 30 July 2022, punishes luring and grooming as distinct prohibited acts. Its Section 4(m) prohibits a person:
“To engage in the luring or grooming of a child: Provided, That grooming taking place offline as a prelude to violations under this Act shall also be penalized”
The Act’s definitions section defines luring as:
“The act of communicating, by means of a computer system, with a child or someone the offender believes to be a child for the purpose of facilitating the commission of sexual activity”
Two details worth noticing
- “Or someone the offender believes to be a child.” The offence does not fail because the account on the other side turned out to belong to an adult, a parent or an investigator. The offender’s belief is enough.
- Offline grooming counts. The proviso in Section 4(m) reaches conduct that begins away from a computer system and leads into a violation of the Act.
A fake persona is the standard vehicle for both. The deception is not an aggravating detail here — it is the mechanism the provision was written to catch. Our full guide is at the OSAEC and CSAEM Act, and the practical reporting side at the Expanded Anti-Trafficking in Persons Act where recruitment or exploitation is involved. Please see the verification note below regarding the Act’s number as printed in the Senate’s published text.
Adjacent Offences That Often Ride Along
Catfishing rarely produces a single clean charge. These provisions commonly attach to the same facts.
| If the catfisher also… | Then consider | Note |
|---|---|---|
| Posted defamatory statements through the fake account | Cyber libel under RA 10175, read with Sec. 6 | Short prescriptive period — act quickly |
| Obtained or shared intimate images | RA 9995, the Anti-Photo and Video Voyeurism Act, and RA 11313 Sec. 12 | See the verification note on RA 9995 below |
| Threatened to publish images unless paid | Sextortion — estafa or extortion, plus RA 11313 Sec. 12 | See our sextortion guide |
| Took over the victim’s own account | RA 10175 Sec. 4(a)(1) illegal access, and Sec. 4(b)(2) | Different offence, different evidence |
| Used a SIM registered under false details | The SIM Registration Act framework | See our SIM Registration Act guide |
| Moved the proceeds through a borrowed or rented bank or e-wallet account | The Anti-Financial Account Scamming Act | See our RA 12010 guide |
| Scraped a real person’s photos and personal details in bulk | Data Privacy Act considerations | Application to a purely personal actor is unsettled — see below |
A word of caution on the Data Privacy Act
It is tempting to add a Data Privacy Act complaint to every impersonation case. Be careful. Republic Act No. 10173 regulates personal information controllers and processors, and Section 4 of the Act excludes a set of categories from its scope. Whether a private individual who copies another person’s photographs for a fake dating profile is acting as a personal information controller, or is engaged in something closer to a purely personal activity, is not a question the National Privacy Commission’s published issuances settle on these facts.
Where an organisation is involved — a scam operation processing victim data at scale, an employer, a platform — the analysis is different and the Act is more clearly engaged. Our guide to the National Privacy Commission sets out what the regulator actually handles, and the Data Privacy Act guide covers scope in detail. Cybercode does not assert that every catfishing case is also a privacy violation, because the published material does not support that.
What Is Not a Crime
Short answer: online deception, standing alone, is not an offence in the Philippines. Something has to be done with it.
This section exists because the opposite impression is widespread, and because people occasionally file complaints that cannot succeed. None of the following, by itself, engages any of the provisions above:
- Using a pseudonym, handle or screen name. Anonymity is the default condition of most of the internet. No Philippine statute requires a social media account to carry a legal name.
- Using an old, flattering or edited photograph of yourself. The photograph belongs to you. No identifying information belonging to another has been used.
- Exaggerating age, height, income, job title or relationship status on a dating profile. Unattractive, but not an offence, and not estafa unless it was the false pretence that obtained money or property.
- Running a parody, fan or commentary account that is recognisable as such and does not pass itself off as the subject.
- Ending a relationship, ghosting, or being dishonest about feelings. Emotional harm is not, on its own, any of the offences described here.
- A profile built from a face generated by software, with no real person behind it. There is no “another” whose identifying information was used. The case, if any, has to rest on what the persona was used to do.
The dividing line is consistent across every route on this page: the law reaches the use to which the false persona was put, not the falseness itself. A fabricated identity that asks for money is estafa. A fabricated identity that harasses is gender-based online sexual harassment. A fabricated identity that approaches a child is a child-protection offence. A fabricated identity that does nothing is, in most cases, nothing.
Mapping Table: Conduct to Provision
This is the table to bring to a complaint. Identify the row that matches what actually happened, and cite that provision rather than describing the conduct as catfishing.
| Conduct | Statute and provision | What has to be shown |
|---|---|---|
| Built a profile using a real person’s name or photographs | RA 10175, Sec. 4(b)(3) | Identifying information belonging to another, used without right, intentionally |
| Obtained money or property through the persona | Art. 315 RPC as amended by RA 10951, second group of means | False pretence executed before or at the time of the fraud, reliance, damage |
| Committed that estafa online | RA 10175, Sec. 6 | The offence was committed by, through and with the use of ICT |
| Manipulated data or a system to cause loss | RA 10175, Sec. 4(b)(2) | Unauthorised input, alteration or deletion of data, damage, fraudulent intent |
| Accessed the victim’s own account | RA 10175, Sec. 4(a)(1) | Access to the whole or part of a computer system without right |
| Impersonated a person online, or posted lies to harm their reputation, in a gendered or sexual register | RA 11313, Sec. 12 | Use of ICT, and conduct within the Section 12 definition |
| Sent unwanted sexual, misogynistic, transphobic, homophobic or sexist messages through the persona | RA 11313, Sec. 12 | Same |
| Shared sexual media of the victim without consent | RA 11313 Sec. 12, and RA 9995 | Absence of consent; see verification note on RA 9995 |
| Communicated with a child, or someone believed to be a child, to facilitate sexual activity | OSAEC and CSAEM Act, luring and grooming | Communication by computer system; purpose of facilitating sexual activity |
| Published defamatory imputations through the fake account | Cyber libel under RA 10175, read with Sec. 6 | The libel elements, plus publication through ICT, within the prescriptive period |
Penalties at a Glance
These are the penalties as the statutes state them. They are not sentencing predictions, and a court applies mitigating and aggravating circumstances that no table can anticipate.
| Offence | Penalty as stated in the statute |
|---|---|
| Computer-related identity theft, RA 10175 Sec. 4(b)(3) | Prisión mayor, or a fine of at least ₱200,000 up to an amount commensurate to the damage incurred, or both (Sec. 8) |
| Computer-related fraud, RA 10175 Sec. 4(b)(2) | Same range under Sec. 8 |
| Illegal access, RA 10175 Sec. 4(a)(1) | Same range under Sec. 8 |
| Estafa, Art. 315 RPC as amended by RA 10951 | Graduated by amount — see the scale above; one degree higher where Sec. 6 of RA 10175 applies |
| Gender-based online sexual harassment, RA 11313 Sec. 12 | Prisión correccional in its medium period, or a fine of ₱100,000 to ₱500,000, or both, at the discretion of the court (Sec. 14) |
One further point on timing. Section 36(d) of RA 11313 makes Section 12 offences imprescriptible. The other offences on this page are not. If a case is old, the Safe Spaces Act route may be the only one still open, which is a reason to assess it first rather than last.
Seven Worked Scenarios
1. The stolen face
A woman in Cebu discovers that her graduation photographs are being used on three dating profiles under a different name. She has never spoken to whoever runs them.
Analysis: she is the impersonated person, not the deceived one. Her route is RA 10175 Sec. 4(b)(3) — her identifying information is being used without right. If the accounts are being used to send sexual messages in her apparent voice, RA 11313 Sec. 12 also applies, and does not expire. She should preserve the profiles before requesting takedown, because a successful takedown destroys the evidence.
2. The overseas engineer
A man forms a months-long relationship with a persona claiming to be an engineer working abroad, and sends ₱380,000 across eleven transfers for a fabricated customs problem.
Analysis: estafa by false pretences. The persona is a fictitious name and the posting is a falsely pretended qualification and business. The amount falls in the band above ₱40,000 and up to ₱1,200,000. Because it was carried out through ICT, Section 6 of RA 10175 is engaged. The eleven transfers matter: receipts, reference numbers and the receiving account details are the case.
3. The invented person
A persona with a software-generated face and an invented name chats with someone for a year, asks for nothing, and disappears.
Analysis: uncomfortable, but probably not an offence. No real person’s identifying information was used, no money or property was obtained, and no conduct within RA 11313 Sec. 12 occurred. This is the scenario that shows why “is catfishing illegal” has no single answer.
4. The escalation
The same invented persona in scenario 3 later persuades the person to send intimate images, then threatens to publish them unless paid.
Analysis: everything changes at the moment of the demand. This is now sextortion — extortion or estafa depending on how it is charged — together with RA 11313 Sec. 12, and RA 9995 if the images are published or threatened with publication. The invented identity is no longer the issue; the demand is.
5. The impersonated ex
A man creates an account in his former partner’s name and posts sexual comments and fabricated claims about her to her colleagues.
Analysis: this is the paradigm case for RA 11313 Sec. 12, which covers both “impersonating identities of victims online” and “posting lies about victims to harm their reputation.” Cyber libel may also apply to specific defamatory posts, but it runs on a short clock while the Section 12 route does not.
6. The minor on the other side
An adult uses a persona presenting as a 17-year-old to build a relationship with someone who says she is 16, and steers the conversation towards sexual content.
Analysis: stop analysing this as catfishing. Communicating by computer system with a child, or someone the offender believes to be a child, for the purpose of facilitating sexual activity is luring under the OSAEC and CSAEM Act. The adult’s own false persona is the mechanism, not a defence. This should be reported to law enforcement immediately.
7. The fake supplier
A fake company page using a real supplier’s trade name takes deposits from six buyers and disappears.
Analysis: two tracks. The buyers have an estafa case. The real supplier has an identity-theft case, because Sec. 4(b)(3) covers identifying information belonging to another “whether natural or juridical,” and a trademark or trade-name enforcement route besides. See someone is using my business name online.
Evidence to Preserve, and How
Short answer: preserve before you report, and preserve before you request a takedown. A successful platform takedown removes the account and, with it, most of your evidence.
This is the most common irreversible mistake in these cases. The instinct on discovering a fake profile is to report it to the platform. The platform removes it. The profile, its post history, its follower list and its message thread all disappear, and the complaint that follows has nothing to attach.
Capture first
- Full-page captures of the profile, showing the account name, the profile URL, the numeric or handle identifier, the creation or “joined” date if visible, and the photographs used.
- The complete message thread, not excerpts. Capture continuously so that the sequence is unbroken and the timestamps are visible. Partial screenshots invite the argument that context was removed.
- The original photographs as they appear on the fake account, and separately the originals on the impersonated person’s own account, with their URLs, to show provenance.
- Every financial record where money moved: transfer receipts, reference numbers, the receiving account name and number, the bank or e-wallet used, dates and amounts. Request the transaction history from your provider in writing.
- Phone numbers, email addresses, usernames and any other handle the persona used, including ones it used earlier and changed.
- Any voice notes, calls or video calls and their metadata.
- The URLs themselves, written out in text. A screenshot of a page does not preserve its address in a searchable form.
Do not alter the originals
Do not crop, annotate, retouch, re-save through an editor, or delete the original messages after capturing them. Work from copies. Keep the original files with their original filenames and timestamps on a device you are not going to reset. Our electronic evidence checklist sets out what to preserve and in what form before filing anything.
Then request the takedown
Once the capture is complete, the platform report is the right next step, and it is independent of the criminal complaint. The practical steps for impersonation reports are in our guide to fake accounts and impersonation.
Where to Report It
Short answer: the PNP Anti-Cybercrime Group and the NBI Cybercrime Division both receive cybercrime complaints. For gender-based online sexual harassment under Section 12 of RA 11313, the PNP Anti-Cybercrime Group has a specific statutory assignment.
| Body | Handles | Useful when |
|---|---|---|
| PNP Anti-Cybercrime Group | Cybercrime complaints generally; statutory assignment under RA 11313 Sec. 13 for gender-based online sexual harassment | Impersonation, harassment, fraud, account takeover |
| NBI Cybercrime Division | Cybercrime investigation | Larger or cross-jurisdictional matters |
| DOJ Office of Cybercrime | Prosecution and international cooperation on cybercrime | After investigation, and for preservation and disclosure requests |
| National Privacy Commission | Complaints under the Data Privacy Act against personal information controllers and processors | Where an organisation, not a lone individual, processed the data — see the caution above |
What to bring: the preserved evidence described above, a written narrative in date order, your own identification, and the specific provision you are invoking. Naming the provision matters. A complaint that says “I was catfished” gives the investigator nothing to work with. A complaint that says “my identifying information was used without right, contrary to Section 4(b)(3) of RA 10175” does.
For what follows a complaint — preservation orders, disclosure, warrants — see what happens after you report cybercrime in the Philippines. If money was lost, the parallel recovery track is in the online scam complaint procedure, and it should be started the same day: contacting the bank or e-wallet provider quickly is the only step with any chance of stopping funds in transit.
Common Mistakes
- Reporting to the platform before capturing the evidence. The single most damaging error, and it cannot be undone.
- Confronting the account. It warns the operator, who deletes, blocks and moves on, taking the thread with them.
- Framing the complaint as “catfishing.” There is no such offence to charge. Name the provision instead.
- Assuming an old case is dead. Section 36(d) of RA 11313 makes Section 12 offences imprescriptible.
- Assuming a recent case can wait. Cyber libel in particular runs on a short clock, and traffic data is only preserved for a limited period — Section 13 of RA 10175 sets a minimum of six months for traffic data and subscriber information.
- Sending more money to “recover” the first payment. A second scam is often run on the victims of the first.
- Treating emotional harm as the legal injury. It is real, but none of these provisions are built on it. Identify the concrete act.
- Adding a Data Privacy Act complaint reflexively. Where the actor is a private individual, the analysis is genuinely unsettled, and a weak add-on can distract from a strong core charge.
Frequently Asked Questions
Is catfishing illegal in the Philippines?
There is no offence called catfishing. The conduct becomes criminal when it involves using a real person’s identifying information without right, obtaining money or property by false pretences, gender-based online sexual harassment, or approaching a child for sexual purposes. Deception alone is generally not an offence.
Can I file a case if I did not lose any money?
Yes, on the right facts. Computer-related identity theft under Section 4(b)(3) of RA 10175 does not require financial loss, and neither does gender-based online sexual harassment under Section 12 of RA 11313. Financial loss matters for estafa, not for those provisions.
Someone is using my photos on a fake profile. What is the offence?
Computer-related identity theft under Section 4(b)(3) of RA 10175 — the use of identifying information belonging to another, without right. If the account is also being used in a sexual or gendered way, Section 12 of RA 11313 applies as well, and does not prescribe.
What if the catfisher invented the person entirely?
Then the identity-theft route is difficult, because no identifying information belonging to another was used. The case then depends on what the persona was used to do: obtaining money is estafa, harassment falls under RA 11313 Section 12, and approaching a child falls under the child-protection statutes.
Is there a deadline for filing?
It depends on the offence. Section 36(d) of RA 11313 provides that offences under Section 12 are imprescriptible. The other offences on this page are subject to prescriptive periods, and cyber libel in particular runs on a short clock. Cybercode does not publish a single deadline, because no single deadline exists.
Can I find out who is behind the account myself?
You should not try. Identifying a subscriber behind an account requires legal process, and attempting to obtain it another way risks committing an offence. Preserve the evidence, name the provision and let the investigating body use the disclosure and preservation mechanisms in Chapter IV of RA 10175.
Does it matter that the catfisher is overseas?
Not necessarily. Section 21 of RA 10175 gives the Regional Trial Court jurisdiction including over violations committed by a Filipino national regardless of where the offence was committed, and the Act contains further jurisdictional hooks. Practical enforcement across borders is a separate and harder question from jurisdiction.
Is lying about my age on a dating app a crime?
No, not by itself. It can become part of an offence if the false statement is the pretence used to obtain money or property, or if the person on the other side is a minor, which raises an entirely different set of statutes.
The account has been deleted. Is it too late?
Not necessarily, but act quickly. Section 13 of RA 10175 requires service providers to preserve the integrity of traffic data and subscriber information for a minimum of six months, and content data for six months from receipt of a law enforcement order, with a one-time six-month extension. Your own preserved captures remain usable regardless.
Do I need a lawyer to file?
You can report to the PNP Anti-Cybercrime Group or the NBI without one. Counsel becomes valuable when the complaint has to be drafted to a specific provision, when several provisions overlap, or when a parallel civil claim for damages is being considered alongside the criminal case.
Verification Note
Cybercode states the limits of what was checked rather than leaving them implied.
- No case citations appear on this page. The Supreme Court’s published decisions could not be retrieved from this environment at the time of review, and Cybercode does not cite jurisprudence from memory. Where a provision has been judicially construed, that construction is not reflected here.
- The OSAEC and CSAEM Act number. The Senate’s published PDF served at the path for Republic Act No. 11930 carries the OSAEC and CSAEM short title and an approval date of 30 July 2022, but its extracted text renders the Act number with a differing final digit. Because the two do not agree, this page cites the statute by its short title and quotes its definitions verbatim, rather than asserting a number the source text does not state consistently.
- RA 9995 is referred to but not quoted. The full text of the Anti-Photo and Video Voyeurism Act could not be retrieved at the time of review, so this page names the statute as a route to consider without stating its elements or penalties.
- The Data Privacy Act point is flagged as unsettled, not resolved. No National Privacy Commission issuance located in this review addresses whether a private individual running a fake profile is a personal information controller.
- No penalty figure has been computed. Where Section 6 of RA 10175 raises a penalty by one degree, this page says so and stops, rather than publishing a derived range.
Official Sources
- Republic Act No. 11313, the Safe Spaces Act — full text (Senate of the Philippines) — Sections 12, 13, 14 and 36(d)
- Republic Act No. 10175, the Cybercrime Prevention Act of 2012 (Senate Legislative Digital Resource) — Sections 4, 6, 8, 13 and 21
- Republic Act No. 10951 — full text (Senate of the Philippines) — Section 85, amending Article 315 of the Revised Penal Code
- The OSAEC and CSAEM Act — full text as published by the Senate of the Philippines — luring and grooming
- Republic Act No. 10173, the Data Privacy Act of 2012 (National Privacy Commission)
- Filing a complaint with the National Privacy Commission
- PNP Anti-Cybercrime Group
- National Bureau of Investigation
- Department of Justice
Related Cybercode Guides
- Online libel in the Philippines
- Social media law in the Philippines
- Can someone post your photo without permission?
- Romance scam: how to report it and try to get your money back
About This Guide
Author: Cybercode.ph Editorial Team.
Reviewer: this page has not been reviewed by a named external legal reviewer. Cybercode does not attribute review to a person who has not carried it out.
Last materially reviewed: 19 September 2026. Every statutory provision quoted above was read against the official source listed in the Official Sources section on that date.
Disclaimer: Cybercode.ph provides general educational information about technology, cybersecurity, privacy, and related legal issues. It is not a substitute for legal, cybersecurity, or professional advice for a specific situation.