What Computer-Related Identity Theft Is, and the First Three Calls to Make
Computer-related identity theft is a crime in its own right under Section 4(b)(3) of Republic Act No. 10175, punished under Section 8 by prision mayor or a fine of at least ₱200,000 up to an amount commensurate to the damage, or both. If money has already moved, call your bank’s or e-wallet’s 24/7 fraud channel first and get a case reference number, because the holding period runs from your complaint. Then report to the government’s 24/7 hotline 1326 and preserve your evidence. Go to the National Privacy Commission only after writing to the company that mishandled your data.
Primary authority: Republic Act No. 10175, Sections 4(b)(3) and 8, Senate Legislative Documents and Research copy. Identity theft rarely travels alone: where a financial account was involved, Republic Act No. 12010 and the Bangko Sentral’s rules give you a separate and faster route, and Section 19 of that Act confirms that the two laws stack rather than compete.
Key Takeaways
- Identity theft is expressly defined as a cybercrime under RA 10175.
- The law covers identifying information belonging to a natural or juridical person.
- Actual financial loss is not always required before the offense can exist, although the penalty may differ where no damage has yet been caused.
- Victims should preserve account, transaction and impersonation evidence before deleting anything.
- Compromised passwords, email accounts and financial accounts should be secured immediately.
- A complaint is stronger when it shows both the unauthorized use and the identity information involved.
- Where money moved, your own bank or e-wallet is the only body that can freeze it, and only a complaint to its 24/7 fraud channel starts the clock.
- The initial hold is five calendar days and the whole mechanism is capped at thirty, so the first hour matters more than a complete file.
- An institution that failed to hold the funds, or to use adequate controls, can be liable for restitution under RA 12010 without anyone being convicted.
- The Data Privacy Act does not apply during coordinated verification of a disputed transaction, so privacy is not a reason to refuse to trace the money.
- Opening an account in your name is a separate offence under RA 12010, and RA 10175, RA 12010 and RA 8484 can be charged together.
- The National Privacy Commission will not take a complaint until you have written to the organisation and waited fifteen calendar days.
- Service providers must keep traffic and subscriber data for at least six months, and only law enforcement can order it preserved or extended.
Decision Snapshot
| Incident | Immediate response |
|---|---|
| Fake account using your name/photos | Capture the profile, URL, username, messages and platform report. |
| Account takeover | Recover the account, change credentials and preserve login/security notices. |
| Fraud using your identity | Contact the bank/platform, dispute transactions and preserve records. |
| SIM or email used to reset accounts | Contact the provider immediately and document the compromise. |
What RA 10175 Defines as Computer-Related Identity Theft
Section 4(b)(3) is one sentence long, and every word of it matters. Read from the Senate’s copy of the Act on 19 October 2026, it provides:
Computer-related Identity Theft. – The intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another, whether natural or juridical, without right: Provided, That if no damage has yet been caused, the penalty imposable shall be one (1) degree lower.
Three things follow that readers are often told wrongly. First, the list of verbs is wide: mere possession of another person’s identifying information without right is inside the definition, so the offence can be complete before anything is used. Second, the information must belong to “another, whether natural or juridical”, which is why a business name and corporate details are covered as squarely as a person’s. Third, the words “without right” do the real work, which is why consent, authority and the terms on which you handed information over are the first things an investigator will test.
Section 8 sets the penalty. Any person found guilty of the acts in Sections 4(a) and 4(b), which includes identity theft, “shall be punished with imprisonment of prision mayor or a fine of at least Two hundred thousand pesos (PhP200,000.00) up to a maximum amount commensurate to the damage incurred or both.” There is no fixed ceiling on the fine: it tracks the damage you can prove, which is a practical reason to document loss carefully rather than describe it loosely. Jurisdiction sits with the Regional Trial Court under Section 21, and specially designated cybercrime courts handle these cases.
The Evidence to Preserve, and the Six-Month Clock Behind It
- screenshots of fake profiles or messages;
- profile URLs, usernames and account IDs;
- password-reset and login alerts;
- emails or SMS showing unauthorized changes;
- bank, card or e-wallet records;
- copies of identification misused by the offender;
- platform complaint or takedown reference numbers; and
- a timeline showing when the misuse started and what harm followed.
Why speed matters more than completeness. Section 13 of RA 10175 requires service providers to keep traffic data and subscriber information for a “minimum period of six (6) months from the date of the transaction”, and content data for six months from receipt of a preservation order. Law enforcement “may order a one-time extension for another six (6) months”. Two consequences follow for you as a victim. The six-month minimum is the floor on what a provider must still hold, so the records that prove who was behind an account have a shelf life. And the power to order preservation and to extend it belongs to law enforcement, not to a private complainant: you cannot freeze a platform’s logs yourself, which is the single strongest argument for making a law-enforcement report early rather than waiting until your own file feels complete. Under Section 14, disclosure of that data requires a court warrant, and the provider is then given 72 hours to produce it.
Preserve originals rather than tidied copies, and keep the device or account the material came from where you can. Electronic Evidence Preservation in the Philippines sets out how to hold each kind of record so that it stays usable, and the online scam evidence checklist is the shorter version to work through today.
What to Do First, in Order
- Secure the email account connected to other accounts.
- Change passwords and enable MFA.
- Revoke unknown sessions and devices.
- Call financial institutions if money or credit is involved.
- Preserve the evidence before removing or blocking the offender.
- Report the incident to the relevant platform and cybercrime authority.
For where to file, use Where and How to Report Cybercrime in the Philippines.
Identity Theft Against a Company or a Business Name
Yes, a company can be the victim. The statutory wording covers identifying information belonging to “another, whether natural or juridical”, so business identities and corporate information are covered on the face of the provision. In practice this is how fake seller pages, cloned business accounts and invoice-redirection fraud are charged, and it means the complainant can be the company itself rather than an individual officer. Where the impersonation was used to redirect a payment, read it alongside business email compromise, because the evidence trail there is the mailbox rather than the public profile.
Where No Damage Has Yet Been Caused
RA 10175 provides expressly that “if no damage has yet been caused, the penalty imposable shall be one (1) degree lower”. Read that the right way round: the proviso lowers the penalty, it does not remove the offence. The absence of financial loss does not make the conduct lawful, and it does not make the report pointless, because a report filed before money moves is the one with the best chance of stopping the next step. Note also that Section 5 makes aiding, abetting and attempting an offence in its own right, punished one degree lower than the main offence or by a fine of ₱100,000 to ₱500,000, or both, under Section 8.
Related access-device authority: When stolen identifying information is used as an account number, PIN, credential or other access device, examine RA 8484 as amended by RA 11449 alongside RA 10175.
The Top Resources for Victims of Online Scams and Identity Theft in the Philippines, and What Each One Can Actually Do
Most lists of resources are lists of phone numbers. That is not much use when you do not yet know which body has power over your particular problem, because the wrong first call costs you the only deadline that was ever running in your favour. The table below maps the question a victim actually has to the provision that answers it and to the government source where it can be read. Every source in it was retrieved on 19 October 2026.
| What you need to know | The rule that answers it | Where to read it |
|---|---|---|
| Is this a crime at all | RA 10175 Sec. 4(b)(3) covers acquisition, use, misuse, transfer, possession, alteration or deletion of another’s identifying information, without right | Senate Legislative Documents and Research, RA 10175 |
| What the penalty is | RA 10175 Sec. 8: prision mayor, or a fine of at least ₱200,000 up to an amount commensurate to the damage, or both | Senate copy, RA 10175 Sec. 8 |
| Which agency investigates | RA 10175 Sec. 10 gives enforcement to the NBI and the PNP, each required to run its own cybercrime unit; Sec. 23 makes the DOJ Office of Cybercrime the central authority for international assistance | Senate copy, RA 10175 Secs. 10 and 23 |
| Whether one hotline covers it | I-ARC Hotline 1326 is described as the government’s 24/7 central number for online selling scams, deceitful messages, romance, impersonation, investment fraud, cybercrimes and phishing | Philippine Information Agency, 31 December 2025 |
| Money has left an account | RA 12010 Sec. 7 lets your institution hold disputed funds for up to 30 calendar days; BSP Circular No. 1215 splits that into 5 days initial and 25 days extended | BSP Circular No. 1215, s. 2025 |
| Your bank or wallet did nothing | RA 12010 Sec. 6 makes an institution liable for restitution where it failed to use adequate controls, and Sec. 9 where it failed to hold the funds; conviction is not a prerequisite | BSP, RA 12010 with its IRRs |
| The complaint is going nowhere | RA 11765 Sec. 8(f) requires a free single assistance mechanism; Sec. 6(f) lets the BSP adjudicate money claims not exceeding ₱10,000,000 | BSP, RA 11765 and MORB Appendix 115 |
| An account was opened in your name | RA 12010 Secs. 4(a)(2) and 5(c) make this an offence on its own; on conviction under Sec. 5(c) the court must also order the account closed | BSP, RA 12010 Secs. 4, 5 and 16 |
| Your personal data was exposed | Rule II, Sec. 2 of the NPC 2021 Rules of Procedure: no complaint is given due course unless you first told the company in writing and it failed to answer within 15 calendar days | NPC 2021 Rules of Procedure, as amended |
Two gaps in that list are worth stating plainly rather than papering over. The PNP Anti-Cybercrime Group’s own website, checked again on 19 October 2026, publishes no hotline, email address or complaint intake route. The numbers that circulate for it are published by the Bureau of Customs on its own scam advisory page, which gives a PNP-ACG hotline of 09985988116, a landline of +63 (02) 414-1560 and the addresses pnp.anticybercrimegroup@gmail.com and infoacg@pnp.gov.ph, together with the DOJ Office of Cybercrime on 526-2747 and 521-8345 and cybercrime@doj.gov.ph. They are reproduced here with that attribution because they come from a government host, but they are published by a different agency from the one they belong to, so confirm them before you rely on one to meet a deadline.
Which Cybercode Guide to Open Next, by Situation
This page owns the offence and the routing. Each of the guides below goes deeper on one lane of it.
| Your situation | The guide that goes deepest | What it adds |
|---|---|---|
| Money moved out of a bank or wallet | RA 12010, the Anti-Financial Account Scamming Act | The prohibited acts, the penalty tiers and how the institution’s own liability is decided |
| You want the money back | Online scam complaint procedure | The recovery route step by step, and what each body can and cannot do about the money |
| Deciding what to save, and how | Electronic evidence preservation | The preservation order, the six-month clock and how to keep a record usable |
| Working out which agency to approach | Cybercrime reporting directory | An agency-by-agency map of which body handles which harm |
| You need a bank, wallet, telco or platform contact | Hacked or scammed help directory | The escalation contacts provider by provider, in one place |
| The account itself was taken over | Hacked in the Philippines, first steps | The first fifteen minutes and the account recovery sequence |
| A stolen card or account number was used | RA 8484 as amended by RA 11449 | The access-device offences, which can be charged alongside RA 10175 |
Where the impersonation has spilled into published lies about you, online libel and doxxing are the neighbouring remedies, and the evidence you preserve here serves all of them.
The Money Lane: What Your Bank or E-Wallet Must Do Once You Report
If stolen identifying information was used to move money, the fastest remedy is not the criminal case. It is the holding mechanism under Section 7 of RA 12010, implemented by BSP Circular No. 1215, Series of 2025, adopted under Monetary Board Resolution No. 523 dated 22 May 2025. It matters that you understand how it starts, because it starts with you.
The Circular lists three triggers for holding disputed funds, and the first is “a complaint filed by the source account owner, through the 24/7 fraud reporting channel” of your own institution’s assistance mechanism. That channel has to exist and it has to be available around the clock. Once you use it, your institution must verify the transaction, prepare a disputed transaction report, take steps to preserve the integrity of your account such as disabling transfers, hold the funds if they are still with it, and transmit holding requests to every other institution in the chain the money travelled through. It must also give you a case reference number and tell you what other remedies exist, including filing with law enforcement.
The periods are short and they are counted a particular way. The initial hold is “not more than five (5) calendar days”. An extended hold is “not more than twenty-five (25) calendar days after the lapse of the initial holding period”. The total is capped at thirty calendar days and may be lengthened only by a court of competent jurisdiction. The Circular defines a day as twenty-four hours and provides that “in computing a period, the first day shall be excluded, and the last day included”. This is why the first call, made the same hour, is worth more than a better-documented complaint made next week.
Two limits on the mechanism are easy to miss. It does not apply to erroneous transactions, meaning the ones where you typed the wrong account number or amount yourself; those fall under the ordinary consumer protection standards instead. And it does not apply to credit card transactions except where a card is used to make an electronic fund transfer through an Automated Clearing House. The mechanism also reaches only transactions occurring after the Act took effect, which Circular No. 1215 states in its own footnote as 13 August 2024.
The finding that most often surprises victims. Section 8 of RA 12010 provides that during the coordinated verification of a disputed transaction, the bank secrecy law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act and the Data Privacy Act “shall not apply”. So “data privacy prevents us from discussing the recipient” is not a correct answer during coordinated verification. Section 12 goes further for the regulator: the BSP may inquire into financial accounts possibly involved, and bank secrecy does not apply to that inquiry either.
Where the institution falls short, the Act names the consequence rather than leaving it to argument. Under Section 6, an institution judged compliant with adequate risk management controls is not liable for loss from these offences, but one that failed to employ them, or failed “to exercise the highest degree of diligence”, is “liable for restitution of funds to the Account Owners”, and “conviction shall not be a prerequisite to the restitution of funds”. Section 9 adds a separate liability: an institution that fails to hold disputed funds when required “shall be liable for loss or damage arising from such failure, including the restitution of the disputed funds to the Account Owner”. Those two provisions are the strongest leverage an ordinary victim has, and neither requires anyone to be convicted first.
One caution belongs here because the Circular itself requires that you be given it. Section 11 of RA 12010, read with Section 16(e), makes it an offence to report false or completely unwarranted information in bad faith so as to cause funds to be held, punishable by one to five years or a fine of ₱50,000 to ₱200,000, or both. Report what happened, accurately; do not overstate it to force a hold.
If the institution’s own handling stalls, the complaint clocks in Appendix 115 of the Manual of Regulations for Banks apply: acknowledgement within 2 days, a simple complaint resolved within 7 days and communicated within 9, a complex one resolved within 45 days and communicated within 47. The Appendix states only that “all periods are reckoned from receipt of complaint” and does not say whether these are banking days or calendar days, so this page does not either. Only after internal remedies are exhausted does the Appendix direct that consumers “dissatisfied with BSFI’s response or action may seek assistance with Bangko Sentral -FCPD”.
The Privacy Lane, and the Step That Gets Complaints Dismissed
Where the identifying information reached the thief because an organisation that held it was careless, you also have a data privacy complaint. There is one procedural trap, and it ends more complaints than any substantive defence does. Rule II, Section 2 of the National Privacy Commission’s 2021 Rules of Procedure, as amended, is headed Exhaustion of remedies and provides that “no complaint shall be given due course unless it has been sufficiently established and proven that” the complainant first “informed, in writing, the personal information controller (PIC), personal information processor (PIP), or concerned entity of the privacy violation or personal data breach”, and that the entity then failed to act in time or did not respond within fifteen calendar days. The Commission may waive the requirement for good cause or in serious cases, but the safe assumption is that it will not.
So write to the company first, in writing, keep proof that you sent it, and diarise fifteen calendar days. The complaint itself must then be a notarised complaint-assisted form or a verified complaint, filed with copies of your evidence and any witness affidavits, and the Commission states that “complaints with insufficient evidence may be dismissed outright”. A representative needs a special power of attorney. On timing, Rule I, Section 6 says only that the Commission adopts the prescriptive periods for violations penalised by special acts under Act No. 3326; it states no number of years, so treat the question as one to raise early rather than one with a published answer. Reporting a data breach in the Philippines covers the organisation’s side of the same incident.
What to Do Next
Three situations, three different first actions. Pick the row that matches what has actually happened, not the one that matches how serious it feels.
| Your situation | First action today | Why it has to come first |
|---|---|---|
| Money has already left an account | Call your bank’s or wallet’s 24/7 fraud channel, report the disputed transaction and write down the case reference number | The hold under Circular No. 1215 is triggered by your complaint, and the initial hold is only five calendar days |
| No money moved, but your identity is in use | Capture the profile, its URL, the username and the messages, then report to hotline 1326 and to the platform | A platform takedown destroys the evidence, and only law enforcement can order a provider to preserve data |
| A company mishandled your data | Write to that company, keep proof of sending, and diarise fifteen calendar days before approaching the NPC | Rule II, Sec. 2 means the NPC will not give your complaint due course without that step |
After the first action, the sequence is the same in every lane: preserve before you delete, report to law enforcement so the preservation power can be used, and keep every reference number you are given. If a criminal case is what you want, the complaint is built and filed through the two-stage route set out in how to report cybercrime in the Philippines, and where the loss was money obtained by deceit, online estafa explains when the conduct is charged as a property crime as well.
Frequently Asked Questions
What are the top resources for victims of online scams and identity theft in the Philippines?
Four government routes cover almost every case, and each does something the others cannot. Your own bank’s or e-wallet’s 24/7 fraud channel is the only one that can freeze money, under Section 7 of RA 12010 and BSP Circular No. 1215, for up to 30 calendar days. Hotline 1326, the I-ARC line run with the CICC, DICT, NPC and NTC, is the government’s 24/7 central reporting number and covers impersonation, phishing, romance and investment fraud. The NBI and the PNP Anti-Cybercrime Group investigate under Section 10 of RA 10175 and are the only ones who can order a service provider to preserve data. The National Privacy Commission handles the mishandling of your personal data, but only after you have written to the organisation and waited fifteen calendar days. If a bank or wallet complaint stalls, the Bangko Sentral can adjudicate money claims up to ₱10,000,000 under Section 6(f) of RA 11765.
Who should I call first if money has already left my account?
Your own bank or e-wallet, through its 24/7 fraud reporting channel, before anyone else. Under BSP Circular No. 1215 a complaint through that channel is what triggers the temporary holding of the funds, and the initial hold lasts not more than five calendar days. Ask for your case reference number and keep it. Reporting to the police first does not start that clock.
Can I go straight to the National Privacy Commission?
Usually not. Rule II, Section 2 of the NPC 2021 Rules of Procedure, as amended, says no complaint is given due course unless you first informed the organisation in writing and it failed to act or did not respond within fifteen calendar days. The Commission may waive this for good cause or in serious cases, but you should assume the written notice is required and keep proof that you sent it.
Does the Data Privacy Act stop my bank from telling me where the money went?
Not during coordinated verification. Section 8 of RA 12010 provides that the bank secrecy law, the Foreign Currency Deposit Act, the Revised Non-Stock Savings and Loan Association Act and the Data Privacy Act do not apply during the coordinated verification of a disputed transaction. That does not entitle you to the recipient’s personal details, but privacy is not a valid reason for an institution to refuse to take part in tracing the funds.
Is opening a bank account in someone else’s name a separate offence?
Yes. Opening a financial account under a fictitious name or using another person’s identity or identification documents is a money muling act under Section 4(a)(2) of RA 12010 and an offence in its own right under Section 5(c). Section 16(d) punishes it with four to six years, or a fine of ₱100,000 to ₱200,000, or both, and the court must also order the account closed. Section 19 confirms that prosecution under RA 12010 does not bar prosecution under RA 10175 or RA 8484 for the same conduct.
Is a fake Facebook account automatically identity theft?
Not every fake account automatically satisfies every element of the offense. The facts must show unauthorized acquisition or use of identifying information within the statutory definition.
Should I report the fake account to the platform first?
Yes, but preserve evidence before the account is removed. Platform reporting and law-enforcement reporting serve different purposes.
Can stolen identity information be personal data under the Data Privacy Act too?
Yes, depending on the information and circumstances. Cybercrime and privacy issues can overlap.
What if the offender is overseas?
Philippine courts can still have jurisdiction. Section 21 of RA 10175 gives the Regional Trial Court jurisdiction where any element was committed in the Philippines, where a computer system wholly or partly here was used, or where damage was caused to a person who was in the Philippines at the time. Section 23 makes the DOJ Office of Cybercrime the central authority for mutual legal assistance and extradition requests, which is the channel through which evidence held abroad is sought. Section 21 of RA 12010 is drafted the same way and adds a further hook: jurisdiction also lies where the financial account is maintained with an institution operating in the Philippines. The practical constraint is time rather than jurisdiction, so report early.
Related Cybercode Guides
- Cybercrime Philippines hub
- Where and how to report cybercrime in the Philippines
- The Cybercrime Prevention Act, RA 10175, in full
- RA 12010, the Anti-Financial Account Scamming Act
- Unauthorized account access in the Philippines
- Electronic evidence preservation
- How to know if an account has been hacked
- Online scam evidence checklist
- Online scam complaint procedure
Checks Made on 19 October 2026
Every provision, period and figure on this page was read from the government source named beside it on the date given. Nothing is restated from an earlier review.
| What was checked | Source read on 19 October 2026 | Result |
|---|---|---|
| RA 10175 Secs. 4(b)(3), 5, 8, 10, 13, 14, 21 and 23 | Senate Legislative Documents and Research copy of RA 10175 | Read; Secs. 4(b)(3) and 8 quoted verbatim on this page |
| RA 10175 approval and publication | Same Senate page | Approved 12 September 2012; Sec. 31 sets effectivity 15 days after Official Gazette publication, recorded there as vol. 108, no. 44, 29 October 2012 |
| RA 12010 Secs. 4 to 9, 11, 16, 19 and 21 | BSP booklet of RA 12010 with its implementing rules | Read in full; Secs. 5(c), 8 and 9 appear on this page for the first time |
| Holding periods for disputed funds | BSP Circular No. 1215, Series of 2025 | Confirmed: 5 calendar days initial, 25 extended, 30 maximum, extendable only by a court |
| Date RA 12010 took effect | Same Circular, footnote 1 | Printed there as 13 August 2024 |
| RA 11765 Secs. 6(f) and 8(f) | BSP copy of RA 11765 | Confirmed: ₱10,000,000 adjudication ceiling, free single assistance mechanism; approved 6 May 2022 |
| Bank and wallet complaint clocks | MORB Appendix 115 | Confirmed at 2, 7, 9, 45 and 47 days; the Appendix does not say whether these are banking or calendar days |
| NPC complaint requirements | NPC 2021 Rules of Procedure, as amended | Rule II, Sec. 2 exhaustion and the 15 calendar days confirmed; Rule I, Sec. 6 adopts Act No. 3326 without stating a period |
| Hotline 1326 | Philippine Information Agency, 31 December 2025 | Confirmed as the government’s 24/7 I-ARC central number, expressly covering impersonation and phishing |
| PNP-ACG contact details | The PNP-ACG website and the Bureau of Customs advisory page | The ACG site publishes none; the numbers on this page are the ones the Bureau of Customs publishes, and are attributed to it |
Three sources could not be reached from this review and nothing on this page rests on them: the Official Gazette’s copy of RA 10175, the Implementing Rules of RA 10175 on the DOJ Office of Cybercrime website, and the Cybercrime Investigation and Coordinating Center’s own site. The hotline and the Center’s role are therefore stated from the Philippine Information Agency and from Sections 24 to 26 of the Act itself rather than from the Center. No figure has been invented and none has been carried over unverified.
Official Sources
- Republic Act No. 10175, the Cybercrime Prevention Act of 2012 — Senate Legislative Documents and Research
- Republic Act No. 12010, the Anti-Financial Account Scamming Act, with its implementing rules — Bangko Sentral ng Pilipinas
- BSP Circular No. 1215, Series of 2025, on the temporary holding of funds subject of disputed transactions
- Republic Act No. 11765, the Financial Products and Services Consumer Protection Act — Bangko Sentral ng Pilipinas
- Appendix 115, Consumer Assistance Management System — Manual of Regulations for Banks
- 2021 Rules of Procedure of the National Privacy Commission, as amended
- Mechanics for complaints — National Privacy Commission
- Hotline 1326 and the I-ARC — Philippine Information Agency, 31 December 2025
- Online and love scam advisory, with PNP-ACG and DOJ Office of Cybercrime contact details — Bureau of Customs
Sources rechecked as of: October 19, 2026
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.