How Is Digital Identity Theft Prosecuted in the Philippines?
Introduction
Fake social media profiles are often used to impersonate another person, deceive the public, solicit money, or obtain access to accounts and services. Depending on the facts, these acts may constitute computer-related identity theftunder the Cybercrime Prevention Act, or may support liability for another offense committed through information and communications technology.
The legal analysis does not depend solely on the existence of a fake account. Prosecutors must establish what identifying information was taken or used, whether the accused acted without authority, whether the conduct was intentional, and whether the evidence connects the accused to the account and the resulting deception or loss.
Governing Law on Computer-Related Identity Theft
Section 4(b)(3) of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or juridical entity, without right. If no damage has yet been caused, the penalty imposable is one degree lower.
The provision covers both natural persons and juridical entities. Thus, the identifying information may belong to an individual, a company, an institution, or another organization.
The law is directed at the unauthorized handling of another person’s identifying information. A fake online profile may fall within the provision when the creator intentionally uses another person’s name, photograph, contact details, account information, or comparable identifying data without authority.
Elements Prosecutors Must Establish
In general, the prosecution must prove the following circumstances beyond reasonable doubt:
First, there was identifying information belonging to another person or juridical entity. Identifying information may include a person’s name, residence address, contact number, date and place of birth, occupation, or similar information. The Supreme Court recognized that such information may be used to perpetrate identity theft and that the crime requires an illegitimate purpose (Disini, Jr. v. The Secretary of Justice, G.R. No. 203335, February 11, 2014).
Second, the accused acquired, used, misused, transferred, possessed, altered, or deleted the information. The offense is not limited to the creation of a profile. Liability may arise from using the information to communicate with victims, represent oneself as another person, receive money, or obtain access to an account or service.
Third, the act was intentional. Accidental possession or an innocent mistake is not enough. The prosecution must show that the accused deliberately engaged in the prohibited conduct.
Fourth, the act was without right. A person who has authority to use the information, or who is acting within a lawful mandate, generally cannot be treated as having used it “without right.” Consent, authorization, agency, or another recognized legal basis may be relevant to the defense.
Fifth, damage or its absence must be determined. If damage has already been caused, the ordinary penalty under the statute applies. If no damage has yet been caused, the law provides for a penalty one degree lower. The prosecution should therefore allege and prove the circumstances relating to the resulting harm.
When a Fake Social Media Profile May Qualify
A fake profile may support a charge for computer-related identity theft where the accused intentionally uses another person’s identifying information without authority. Examples include creating an account using another person’s name and photograph, representing the victim as the account owner, and using the account to solicit funds from the victim’s relatives or contacts.
The strength of the charge depends on the evidence. A profile that merely uses a fictional name, without appropriating identifying information belonging to another person, may present a different legal issue. Similarly, parody, satire, or commentary cannot automatically be treated as identity theft without proof of the statutory elements and the absence of lawful justification.
In Disini, Jr. v. The Secretary of Justice, the Supreme Court upheld the constitutionality of the cyber-squatting provision because the law focuses on the bad-faith purpose of acquiring the domain name. The ruling illustrates that the offender’s purpose and the unauthorized nature of the conduct are material, rather than the mere use of a particular name.
Soliciting Funds Through the Fake Profile
Soliciting money may provide evidence of fraudulent intent and resulting damage. It may also support prosecution for another offense if the facts satisfy the elements of that offense. The use of the internet does not automatically convert every fraudulent transaction into computer-related identity theft; the prosecution must still connect the conduct to the statutory definition charged.
Section 6 of the Cybercrime Prevention Act of 2012 provides that crimes under the Revised Penal Code and special laws committed through information and communications technologies are covered by the Act, with a penalty one degree higher than that provided under the applicable law.
The Supreme Court explained that Section 6 treats the use of information and communications technology as a qualifying circumstance because online conduct may evade identification, reach more victims, or cause greater harm (Disini, Jr. v. The Secretary of Justice, G.R. No. 203335, February 11, 2014).
Accordingly, a prosecution involving a fake profile and solicitation of funds may require careful examination of whether the conduct constitutes computer-related identity theft, fraud, estafa, or another offense committed through a computer system. The exact charge should correspond to the facts alleged and proved, rather than merely to the existence of an online account.
Proof Linking the Accused to the Account
The existence of a fake profile does not, by itself, prove who created or controlled it. Investigators and prosecutors should establish the connection between the accused and the account through direct or circumstantial evidence.
Relevant evidence may include account registration records, subscriber information, device data, login records, internet protocol information, recovery email addresses, telephone numbers, payment records, screenshots authenticated by competent testimony, communications with victims, and admissions by the accused.
Other circumstances may also be relevant, including the accused’s control of the device used to access the account, knowledge of private facts about the impersonated person, distinctive language or writing patterns, and possession of money received from the victims. These circumstances must be assessed as a whole and presented in a manner that establishes identity beyond reasonable doubt.
Role of Digital Evidence
Digital evidence should be preserved promptly. Investigators should document the profile’s URL, username, displayed name, photographs, posts, messages, payment instructions, transaction details, and the dates and times when the material was viewed.
Screenshots are useful but may require authentication. The prosecution should be prepared to show who captured the screenshot, how it was obtained, that the account and messages were not materially altered, and how the digital evidence relates to the accused.
Where necessary, investigators may seek the appropriate cybercrime warrants and related orders under the procedural provisions of the Cybercrime Prevention Act. Requests for subscriber or account information should be made through lawful processes and should observe constitutional protections against unreasonable searches and seizures.
The Supreme Court has recognized that the Cybercrime Prevention Act may regulate online conduct, but provisions that are vague, overbroad, or lacking adequate safeguards may violate constitutional rights (Disini, Jr. v. The Secretary of Justice, G.R. No. 203335, February 11, 2014).
Identity Theft and Data Privacy Offenses
The same conduct may also raise data privacy concerns. Names, email addresses, and similar information may constitute personal information. The National Privacy Commission has recognized that such data may be used to enable identity fraud, particularly where the circumstances permit phishing or further access to important accounts (NPC 20-124, September 10, 2020).
However, a data privacy violation and computer-related identity theft are not identical offenses. The Cybercrime Prevention Act focuses on the intentional and unauthorized handling of another’s identifying information. The Data Privacy Act may apply to the unauthorized processing, disclosure, or breach of personal information, subject to its own elements and defenses.
For unauthorized processing under Section 25 of the Data Privacy Act, the evidence must establish that personal or sensitive personal information was processed and that the processing was conducted without the data subject’s consent or without authority under the law or another existing legal basis (NPC 19-1429, March 4, 2024).
Possible Defenses and Issues
A person accused of creating or using a fake profile may contest identity, intent, authorization, the ownership of the information, the occurrence of damage, or the integrity and admissibility of the digital evidence.
A person who merely received or viewed a message is not automatically liable for identity theft. The prosecution must show the accused’s own intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information without right.
The accused may also challenge evidence that does not reliably establish account control. A profile bearing the accused’s name or photograph may be insufficient if another person could have created or accessed the account. The prosecution must prove the connection through competent evidence rather than assumption.
Where the evidence shows that no damage had yet been caused, the statutory consequence regarding the lower penalty must be considered. The absence of damage does not necessarily eliminate the offense, but it affects the penalty provided by Section 4(b)(3).
Practical Steps for Victims
A victim should preserve the original profile and messages before reporting or blocking the account. The victim should record the profile address, account name, user ID, relevant posts, messages, payment instructions, bank or e-wallet details, and the names of persons contacted by the impersonator.
The victim should obtain written statements from persons who received the solicitations and retain transaction records showing whether money was sent. If funds were transferred, the victim should promptly notify the relevant bank, e-wallet provider, or payment intermediary and request preservation of transaction information.
The complaint should clearly identify the impersonated person, the information used, the acts performed through the account, the persons deceived, the money or benefit sought or obtained, and the evidence connecting the suspected offender to the account.
Practical Steps for Investigators and Prosecutors
Investigators should preserve volatile online evidence and obtain records through legally authorized procedures. They should avoid relying exclusively on screenshots when server records, subscriber information, device examinations, payment records, or witness testimony can establish the account’s creation and control.
The complaint or information should identify the specific prohibited acts attributed to the accused. It should also allege the use of information and communications technology when the prosecution seeks the consequence under Section 6 of the Cybercrime Prevention Act.
Prosecutors should distinguish between proof that a fake profile existed, proof that another person’s identifying information was used, proof that the use was intentional and unauthorized, and proof that the accused was the person who controlled the account.
Conclusion
Creating a fake social media profile becomes criminally prosecutable as computer-related identity theft when the prosecution can prove the intentional and unauthorized acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person or juridical entity.
When the profile is used to solicit funds, the conduct may also support liability for another fraud-related offense, subject to the elements of that offense. The decisive issues are the identity of the accused, the nature of the information used, the absence of authority, the accused’s intent, the existence of damage, and the reliability of the digital evidence.
Victims should preserve evidence immediately, document financial transactions, and report the incident through the proper law-enforcement and prosecutorial channels. Investigators and prosecutors should build the case through authenticated digital records and lawful investigative procedures, not through the mere appearance of a name or photograph on an online profile.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
