A cloned social profile, an email address used by others, or an account opened with your data can create a very concrete problem: someone is speaking, asking for money, making commitments, or spreading content while pretending to be you. Digital identity theft does not automatically coincide with a single offence, but may constitute identity substitution and, depending on what was done, also other conduct that should be reported.
I want to help you distinguish what needs to be blocked immediately from what is useful for reconstructing the facts. We will examine when a fake profile may assume criminal relevance, why it is not enough to say that the account is “fake”, how to formulate a complaint usefully, and what elements are needed if you also intend to claim compensation for damages.
When digital identity used by others can become identity substitution
Article 494 of the Italian Criminal Code concerns anyone who induces another person into error by illegitimately substituting themselves for someone or by attributing to themselves or others a false name, state, or legally relevant quality, with the purpose of obtaining an advantage or causing harm. The decisive point is the deception directed at someone: it does not only matter that a page exists with your name, but that this false identity is used to make third parties believe they are dealing with you.
A profile that uses a photograph, name, and contacts can therefore assume different relevance depending on how it is used. If it remains inactive or clearly parodistic, the problem may primarily concern the removal of the content and the unauthorized use of the image. If instead it sends messages to colleagues, friends, or clients, asks for bank transfers, proposes sales, publishes statements attributed to you, or collects data while pretending to be you, more concrete elements for a reportable offence emerge.
The purpose matters as much as the profile. Identity substitution does not necessarily require a profit already obtained: the rule also considers the intention to cause harm. However, when the false identity has been used to receive money, goods, credentials, or other economic advantages, additional offences may also come into play, such as fraud. It is not useful to independently assign a definitive label to the fact: in the complaint, it is more important to precisely describe the conduct, the subjects involved, and the consequences.
Cloned profile and unauthorized access are not the same thing
One thing is the creation of a new account that mimics yours; another is access to your authentic account, with password modification, reading of messages, or publication of content from your profile. In the first case, imitation must be proven; in the second, login warnings, credential recovery emails, unknown devices, and security setting modifications become essential.
The distinction also changes the way of reacting. If your account is still accessible, protect it without delay and preserve the warnings received before deleting them. If you can no longer log in, the platform operator's recovery procedure is useful to limit damage, but it does not replace the collection of evidence or any potential complaint.
Digital evidence to preserve before contents and accounts disappear
The removal of a fake profile is often necessary, but it can make it harder to document what happened. First, preserve the context: not just a screenshot of the photograph, but also the full address of the profile, the username, the date and time you saw it, posts, stories, comments, and messages received from the deceived people.
An isolated screenshot may show little. It is preferable for images to show the page header, the contested content, and, when possible, the URL or account identifier. If a contact forwards you a message received from the fake profile, preserve both the forwarding and the information that allows understanding which user account it came from. Messages, emails, payment receipts, phone numbers used, and details of any advertisement are distinct elements: relate them without modifying them.
Do not alter the original files. Cropping images, rewriting conversations, or copying texts into a document can be useful for orientation, but must not replace the originals. Furthermore, preserve communications sent to the platform and its replies: they demonstrate that you reported the problem and help reconstruct the duration of publication, but they do not prove on their own who created the account.
Information that makes the complaint clearer
A useful reconstruction follows a simple order: when you discovered the fact, which identity was imitated, which account or contact detail was used, which people were contacted, and what result was sought or obtained. Separating facts from assumptions avoids misunderstandings. If you suspect a person, indicate the concrete elements linking that person to the conduct, without presenting as certainty what you cannot prove.
It may also be relevant to explain what you did after the discovery: reporting to the platform, blocking the user account, warning contacts, recovering the account, or contesting unauthorized transactions. There is no need to turn the complaint into a generic narrative of one's digital life. Instead, details that allow identifying the account, the contents, and any damages are required.
Criminal complaint and formal querela: why the difference must be understood
Denuncia and querela are not perfect synonyms. A denuncia communicates the report of an offence; a querela also contains the offended person's will for criminal proceedings to be brought for an offence for which the law requires that condition. The Ministry of Justice clarifies the general distinction between the two acts on the page dedicated to denuncia, esposto and querela.
For the identity substitution provided by Article 494 of the Italian Criminal Code, it is not the offended person's querela that conditions the initiation of proceedings: the reporting of the facts can therefore be gathered as a denuncia. This does not mean that every episode of false digital identity is certainly identity substitution, nor that other hypotheses of crime are excluded. If the facts also reveal conduct prosecutable upon querela, the will to proceed must be expressed explicitly within the foreseen term.
The ordinary term for a querela is three months from the day on which the fact constituting the crime becomes known, unless a provision specifies a different term. Article 124 of the Italian Criminal Code indicates this general rule in the text published in the Official Gazette. The starting date must not be automatically confused with the date the profile was created or removed: the moment of knowledge of the criminally relevant fact matters.
The denuncia or querela can be presented orally or in writing at the Public Prosecutor's Office or a judicial police office. The practical indications of the Public Prosecutor's Office of Modena recall that the act can also be gathered at police forces and that it is important to correctly identify the offended person. If there is a querela deadline to respect, it is not prudent to wait solely for the digital platform's response.
Stopping the damage without losing useful elements
The first concrete action is to stop the use of the identity. Reporting the profile to the platform serves to reduce the circulation of the deception, especially if friends, clients, or family members are contacted. The report does not replace the complaint, and the complaint does not guarantee the immediate removal of the content: they are different tools to be used in parallel when the risk continues.
If an authentic account has been compromised, change the password from a trusted device, revoke unrecognized sessions, verify recovery emails and phone numbers, enable multi-factor authentication, and check any automatic forwarding rules in the email inbox. The email inbox is often the most delicate point, because it can allow whoever controls it to reset credentials for other services.
When the fake profile is asking for money or data from people you know, warn them through a channel other than the compromised one. The message should be clear and circumscribed: explain that the account is not yours, urge not to send money or access codes, and indicate the authentic profile. Avoid public discussions with whoever manages the fake account: they can fuel the spread of content or make traces disappear before you have preserved them.
Assessment of damages: what must be proven
The complaint does not automatically produce compensation. Damages must be alleged and proven, distinguishing what is economically measurable from what concerns reputation, image, privacy, or personal peace of mind. If someone obtained payments while pretending to be you, receipts, conversations, and statements from those who paid the money are important. If the damage concerns reputation, the audience reached, published phrases, duration of spread, and documentable consequences become relevant.
Not every annoyance caused by a copied profile translates into the same compensable amount. The connection between conduct and prejudice matters. The cost incurred to recover an account, an unauthorized payment, a contract concluded by someone acting while pretending to be you, or a demonstrable economic loss require different proofs compared to non-pecuniary damage deriving from the violation of identity or image.
The claim for damages can be evaluated within criminal proceedings, when the prerequisites are met, or in civil proceedings. The choice also depends on the identification of the responsible party, available evidence, type of damage, and the need to obtain specific measures. Before quantifying a claim, it is useful to separate damages already occurred from those merely feared: an undocumented figure risks weakening the reconstruction.
Errors that make reacting more difficult
The first error is deleting everything as soon as the profile is discovered. First document, then request removal. The second is limiting oneself to saying "my identity was stolen" without indicating which data were used, who was deceived, and what advantage or damage followed. Legal qualification belongs to the competent authorities; your reconstruction must make the facts verifiable.
Another error is waiting for the platform's outcome before evaluating criminal protection. The platform operator's response can be useful, but it does not suspend any deadlines foreseen for crimes prosecutable upon querela. Promptness does not mean disorderly haste: it means gathering essential information, securing accounts, and presenting facts with dates, accounts, messages, and recognizable consequences.
If the case involves banking operations, payment requests, or card data, one must also contact the service provider without delay to block tools and contest transactions. This initiative protects the relationship with the bank or provider; the complaint, instead, serves to bring the facts to the attention of the judicial authority. The two paths do not replace each other.
Frequently asked questions
Is a profile with my photo always identity substitution?
No, not automatically. For identity substitution, the use of the false identity to induce someone into error is relevant, with the purpose of obtaining an advantage or causing harm. A profile with a copied photograph can still justify a report to the platform and other forms of protection, but one must verify how it is concretely used.
Do I have to wait for the social network to remove the profile before reporting?
No. The removal of the fake profile and the complaint pursue different purposes. First save URLs, screenshots, and messages, then report the content to the platform. If the profile is contacting people, asking for money, spreading data, or using the identity for other conduct, waiting for the operator's response can cause important elements to be lost.
Can I file a querela for a cloned profile?
It depends on the offenses emerging from the facts. For the identity substitution of Article 494 of the Italian Criminal Code, it is possible to present a detailed complaint, because proceedings do not depend on the victim'querela. If the affair also includes offenses prosecutable upon querela, one must explicitly express the will to proceed and respect any applicable deadline.
What evidence must I bring when filing a complaint?
Bring what identifies the account and conduct. URLs, username, complete screenshots, security emails, messages, dates, phone numbers, receipts, and details of contacted people are useful. It is not necessary to already know the author of the act; however, it is important to distinguish certain data from suspicions and explain why certain elements point to a specific person.
Can I claim damages even if the fake profile is removed?
Yes, removal does not automatically cancel damages already produced. To obtain compensation, however, one must prove the prejudice and its connection with the conduct. Evidence changes according to the damage: payments, costs incurred, messages received from third parties, content spread, and reputational consequences must be documented consistently.
An orderly intervention after discovery
When the false identity continues to circulate or has already produced consequences, the priority is combining technical security, preserved evidence, and legal reconstruction of the facts. There is no need to choose between account protection and complaint: each initiative covers a different risk. If you need to clarify which conduct to indicate, whether a querela is needed for further offenses, or how to set up a claim for damages, you can contact me.