Unauthorized Account Access Philippines: What to Do After Hacking or Illegal Login

Last materially reviewed: September 3, 2026

Direct Answer

Accessing the whole or any part of a computer system without right is an offense under Republic Act No. 10175. If an email, social-media, cloud, banking or business account has been accessed without authorization, the victim should secure the account immediately, preserve login and security records, document any changes or transactions, and report the incident when criminal investigation is appropriate.

Primary authority: RA 10175, Section 4(a)(1) — Illegal Access.

Key Takeaways

• Illegal access is expressly punishable under RA 10175.
• Mobile phones and online accounts can fall within the law’s computer-system framework.
• Secure the account first, but preserve evidence before logs or messages disappear.
• Login alerts, IP/device information, reset emails and session records can be important evidence.
• Do not wipe a relevant device before deciding whether it may need examination.
• Financial accounts require immediate contact with the provider to reduce further losses.

Decision Snapshot

What Is Illegal Access Under RA 10175?

Section 4(a)(1) defines illegal access as access to the whole or any part of a computer system without right. The Act defines computer systems broadly enough to include devices such as computers and mobile phones and systems that process or store computer data. See Sections 3 and 4 of RA 10175.

What Should You Do Immediately?

1. Recover and secure the primary email account.
2. Change passwords from a trusted device.
3. Enable MFA.
4. Sign out unknown sessions and revoke suspicious apps.
5. Save security alerts, login history and reset messages.
6. Contact banks or e-wallets if financial access is involved.
7. Preserve the affected device and relevant logs.

For technical recovery steps, see How to Know If Your Phone or Account Was Hacked.

What Evidence Helps Prove Unauthorized Access?

• login alerts and timestamps;
• IP addresses or device/session information shown by the platform;
• password-reset emails and SMS;
• changes to recovery email or phone number;
• unauthorized messages, posts, transfers or purchases;
• security logs or audit logs;
• screenshots of account settings before and after recovery; and
• support tickets with the provider.

Should You Delete Unknown Sessions?

Yes, for account security, but first capture the session information if doing so does not create additional risk. A screenshot or exported security log can preserve useful attribution clues before the session is revoked.

When Should You Report to Law Enforcement?

Consider filing when the intrusion caused financial loss, identity misuse, extortion, data theft, business disruption, repeated harassment, or another serious criminal impact. Use Cybercode’s NBI Cybercrime Complaint Process or PNP Anti-Cybercrime Group Complaint Process.

What If Personal Data Was Exposed?

If the compromised account belongs to a business and personal data may have been accessed, the incident can also trigger Data Privacy Act obligations. See What Should a Company Do After a Personal Data Breach?.

Frequently Asked Questions

Is guessing someone’s password illegal?

If it results in access to a computer system without right, the conduct may fall within RA 10175’s illegal-access offense.

What if the hacker used my saved device?

The key issue is authorization. Preserve evidence showing when access occurred and whether the person had permission.

Can I report an attempted hack even if access failed?

Yes, especially if threats, repeated attempts or related criminal conduct are involved. Whether a specific offense is established depends on the facts.

Should I reset my phone?

Not immediately if the device may contain evidence. Secure accounts and seek technical or investigative guidance before wiping a potentially relevant device.

Related Cybercrime Guides

• Cybercrime Philippines Hub
• Where and How to Report Cybercrime
• Computer-Related Identity Theft Philippines
• Electronic Evidence Preservation

Official Sources

• RA 10175 — Cybercrime Prevention Act
• DOJ Office of Cybercrime — IRR

General educational information only.