Quick answer

If a loan, credit card, credit line, or similar account was opened using your identity without your consent, report it immediately and in writing to the institution named as creditor. State clearly that you did not apply for, authorize, receive, use, or benefit from the account. Ask the institution to:

block further use and collection activity while it investigates;
preserve the application, identification documents, signatures, recordings, device and IP logs, authentication records, disbursement details, and transaction history;
give you a complaint reference number;
provide copies of the personal data and records attributed to you, subject to lawful limitations;
correct its internal records and withdraw any erroneous credit reporting; and
confirm the result in writing.

Also secure your compromised accounts and report the identity theft to the appropriate law-enforcement agency. If the false account appears in your Credit Information Corporation (CIC) credit report, file a separate CIC dispute. Escalate unresolved complaints to the regulator responsible for the institution—usually the Bangko Sentral ng Pilipinas (BSP) for BSP-supervised institutions or the Securities and Exchange Commission (SEC) for lending and financing companies. A complaint to the National Privacy Commission (NPC) may also be appropriate when personal data was unlawfully obtained, disclosed, or processed.

Do not acknowledge the debt, make a “good-faith” payment, or sign a restructuring agreement merely to stop collection calls. Those acts may complicate your position. A police or NBI report is valuable evidence, but it does not by itself remove the account; the creditor and credit-information records must also be formally disputed.

Act immediately

Identity theft can lead to additional accounts, unauthorized transactions, collection demands, and damaged credit records. Take these steps as soon as you discover the account.

1. Secure your identity and financial access

Change the passwords for your email, mobile banking, e-wallets, shopping accounts, and government-service accounts. Use unique passwords and enable multi-factor authentication where available.

Ask your mobile network whether an unauthorized SIM replacement or account change occurred. If your phone or SIM was lost, have it blocked. Review email forwarding rules, logged-in devices, password-recovery details, and recent security alerts.

Notify banks and e-wallet providers if any legitimate account may have been used to receive or move the loan proceeds. Report unauthorized transactions through their official fraud channels immediately. Transaction-reporting periods may depend on the institution’s rules and the particular service, so do not wait for a complete investigation before notifying them.

Never send an OTP, PIN, password, or full card security code to someone claiming to “cancel” the fraudulent loan.

2. Contact the actual creditor—not merely the collector or app name

Identify the legal entity that supposedly granted the credit. An online lending app, collection agency, brand name, and creditor may be different entities.

Use contact information from the institution’s official website, statement, or regulator listing. Do not rely only on a phone number or link contained in an unsolicited text message.

Tell the creditor that this is an identity-theft and unauthorized-account dispute, not a request for a payment extension. If a collector contacted you, send the dispute to both the collector and the named creditor, but require the creditor to investigate the account-opening process.

3. Send a written dispute

Your notice should contain:

your complete name and safe contact details;
the account number, application number, or reference number, masking unnecessary digits where appropriate;
the date and manner in which you discovered the account;
a direct statement that you did not apply for or authorize it;
whether you received or benefited from any proceeds;
any obvious discrepancies, such as a different phone number, email address, employer, signature, selfie, address, device, or disbursement account;
a request to suspend collection and adverse reporting while the dispute is investigated;
a request to preserve and review all account-opening and transaction evidence;
a request for access to and correction of personal data attributed to you;
a request for written findings and confirmation of any correction; and
a list of attached evidence.

A concise opening may read:

I formally dispute this account as unauthorized. I did not apply for, consent to, sign, activate, use, or receive the proceeds of this loan or credit account. Please flag the account as disputed, prevent further use, preserve all application and authentication records, investigate the identity theft, and confirm in writing the correction of your records and any credit information you submitted.

Send the notice through a channel that produces proof of delivery. Keep the ticket number, automated acknowledgment, sent email, screenshots, and courier receipt.

What the institution should investigate

Ask the creditor to compare the disputed application with its verified records and examine, where available:

the complete application and attached identification documents;
signature, selfie, facial-verification, liveness, or video records;
recorded calls and electronic consent records;
phone numbers, email addresses, addresses, and employment information used;
OTP and multi-factor-authentication logs;
dates, times, devices, IP addresses, and geolocation records;
changes to contact or recovery information;
the destination bank account, e-wallet, card, merchant, or cash-out channel;
the name of any agent, merchant, intermediary, or collection agency involved;
activation and transaction history; and
information submitted to the CIC or a credit bureau.

Do not demand that the institution send you another person’s unrestricted personal data. Your access request may require redaction or be limited by fraud-prevention, confidentiality, or investigation rules. The important point is to require preservation and a documented review of the records attributed to you.

Under the Data Privacy Act and its implementing rules, a data subject generally has rights of access and rectification. Inaccurate or incomplete personal data must be rectified, supplemented, destroyed, or have further processing restricted as applicable. Erasure or blocking may also be available when the statutory grounds are established. These rights are subject to lawful limitations, including information used for investigations or legal claims. See the Data Privacy Act of 2012 and its implementing rules.

Request protection while the dispute is pending

The Financial Products and Services Consumer Protection Act requires covered financial service providers to maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the provider must, pending its final investigation report, suspend the imposition of interest, fees, and charges or give a similar reasonable accommodation. Cite this rule in your complaint and request written confirmation of the accommodation. See Republic Act No. 11765.

That protection does not mean every identity-theft claim must automatically be accepted. The institution may examine whether the application was authorized, whether credentials were shared, whether proceeds reached an account controlled by the complainant, and whether the complainant later used or ratified the facility. Conclusions therefore depend on the actual documents and transaction trail.

Report the identity theft to law enforcement

Using another person’s identifying information through a computer system may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act. Depending on the method used, other offenses—such as falsification, estafa, or access-device fraud—may also be relevant. The precise charge is for investigators and prosecutors to determine.

You may approach:

the NBI Cybercrime Division or an NBI regional or district office; or
the Philippine National Police Anti-Cybercrime Group or the appropriate local police cybercrime unit.

The NBI also maintains an online complaint page and official guidance for investigative assistance to victims of computer crimes.

Bring or preserve:

government-issued identification;
the creditor’s demand, statement, or account notice;
your written dispute and the creditor’s replies;
screenshots showing full URLs, usernames, numbers, dates, and times;
original emails, including headers where possible;
SMS messages and call logs;
proof that the contact details or disbursement destination were not yours;
security alerts and evidence of account or SIM compromise;
your relevant genuine signatures or account records for comparison;
a chronology of events; and
the device that contains the original evidence, if investigators request it.

Do not edit screenshots or delete the original messages after making copies. Export records where possible and keep backups. A notarized affidavit may be requested during a formal complaint, but follow the receiving agency’s current instructions rather than paying an unofficial intermediary.

The governing statute is Republic Act No. 10175. If a credit card, account number, code, or other means of account access was fraudulently applied for or used, the Access Devices Regulation Act may also be relevant.

Correct your credit record

Obtain your own CIC credit report through a channel identified by the CIC. If the unauthorized account appears, use the CIC Online Dispute Resolution System.

The CIC currently requires the credit report used for an online dispute to be no more than 30 days old. Follow the instructions shown in the dispute portal and remain responsive to CIC communications.

Under Section 4(o) of the Credit Information System Act:

a borrower may dispute erroneous, incomplete, outdated, or misleading credit information;
the CIC must investigate and verify disputed information within five working days from receipt of the complaint;
information that cannot be verified and proven must be deleted; and
the borrower and entities that received the information must be informed of the correction or removal within five working days.

See Republic Act No. 9510 and the CIC’s credit-report guidance.

A CIC dispute addresses the credit information in the CIC system. It does not replace the complaint to the creditor, a regulator, or law enforcement.

After receiving a correction, obtain a fresh report and check whether the account, status, balance, and payment history were properly updated. Keep the old and new reports.

Escalate an unresolved complaint to the correct regulator

For banks and other BSP-supervised institutions

First use the institution’s own Financial Consumer Protection Assistance Mechanism. If the response is missing or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism.

The BSP accepts complaints through the BSP Online Buddy on its official website and through the other channels listed in its current complaint-filing guide. Attach proof that you first raised the matter with the institution, together with its response and your supporting records.

BSP escalation is generally a second-level remedy. Preserve every deadline stated in BSP correspondence if the case proceeds through replies, mediation, or adjudication.

For lending or financing companies

Check whether the company and its online lending platform are properly registered or recorded using the SEC’s official lending and financing company resources.

Complaints may be submitted through the SEC iMessage portal or the current channel stated on the SEC’s complaints page for lending and financing companies. Include identification, the disputed account details, your prior complaint, collection communications, and relevant supporting documents.

Report an apparently unregistered lender to the SEC, but still preserve evidence and file an identity-theft report with law enforcement. Registration status does not determine whether you authorized the particular account.

When to complain to the National Privacy Commission

Consider an NPC complaint if your identity documents or other personal data were unlawfully collected, accessed, disclosed, altered, or used, or if the institution refuses a proper access or correction request.

Start by writing to the institution and its data protection officer. Identify the personal data involved, the disputed processing, the correction or restriction requested, and the harm or risk. Keep proof of delivery and the response.

If the matter remains unresolved, follow the NPC’s current formal complaint instructions. The NPC requires a complaint in the prescribed form or a verified complaint, with supporting evidence; its published process includes notarization requirements. Do not use a personal-data-breach notification form intended for organizations unless you are the party responsible for making that regulatory notification.

An NPC case concerns data-protection rights and compliance. It does not automatically decide criminal liability, cancel a private debt, or substitute for correcting CIC data.

If collectors contact you

Respond once in writing that the account is disputed because of identity theft. Give the creditor’s complaint reference number and ask the collector to record the dispute and return the matter for investigation.

Do not provide additional sensitive information until you verify the collector’s authority and contact channel. Do not agree to pay, restructure, or settle an account you deny opening without obtaining legal advice.

Preserve evidence of:

threats, insults, or deceptive statements;
repeated or unreasonable communications;
disclosure of the alleged debt to relatives, co-workers, employers, or social-media contacts;
public shaming or publication of your information;
altered photographs or fabricated notices; and
calls made after you supplied written notice of the identity dispute.

For lending and financing companies, unfair collection conduct may be reported to the SEC under SEC Memorandum Circular No. 18, Series of 2019. Misuse or disclosure of personal data may also be brought to the NPC.

Evidence checklist

Create one folder containing:

a dated chronology;
the first notice or collection message;
account numbers and the creditor’s full legal name;
copies of all dispute letters and attachments;
delivery confirmations and ticket numbers;
all responses from the creditor, collector, CIC, or regulators;
your CIC reports before and after correction;
the police or NBI report and affidavit, if filed;
relevant bank, e-wallet, mobile, and email security records;
screenshots plus the original electronic messages;
proof of financial loss, denied applications, collection harassment, or other harm; and
notes of calls stating the date, time, number, agent’s name, and substance of the conversation.

Share only what is necessary through verified channels. Mask unrelated account numbers and sensitive information where appropriate, while retaining unredacted originals for investigators or counsel.

Common mistakes to avoid

Ignoring the account because you never applied. Silence may allow collection and incorrect reporting to continue.
Reporting only to the police. You must also dispute the creditor’s and CIC’s records.
Calling without sending a written complaint. A call may not establish what you disputed or when.
Paying a small amount to stop harassment. Payment can create factual and legal complications.
Signing a restructuring or settlement form. Read every document carefully and obtain advice if it describes you as the borrower.
Sending IDs through unverified links or chat accounts. A supposed cancellation process may be another attempt to steal data.
Deleting messages after taking screenshots. Originals and metadata can be important.
Assuming an app’s brand name is the creditor’s legal name. Identify the regulated entity behind the account.
Publishing accusations or a suspect’s personal details online. Give evidence to the institution and authorities; public accusations can create separate legal risks.
Filing an exaggerated or knowingly false report. State only facts you can honestly attest to.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a collection case, subpoena, prosecutor’s notice, or court document has been served;
a vehicle, land title, or other property is claimed as security;
the false account involves a large amount or several institutions;
proceeds entered an account you own or control, even if someone else directed the transaction;
your genuine signature, selfie, OTP, or device appears in the creditor’s evidence;
you previously allowed another person to use your identification, SIM, device, bank account, or e-wallet;
the creditor alleges that you benefited from or later accepted the loan;
collectors are threatening violence, arrest, or immediate seizure;
your employer, family, or contacts are being harassed;
your identity documents are being used repeatedly; or
you need an injunction, damages, formal representation, or a defense in a filed case.

If there is an immediate threat to safety, contact emergency or local police services without waiting for the creditor’s investigation.

Frequently asked questions

Am I required to pay a loan I never authorized?

A person who did not consent to or authorize a loan generally has a basis to deny being the borrower. However, liability cannot be decided from the account name alone. The documents, authentication trail, destination of proceeds, subsequent use, and any conduct suggesting authorization or acceptance must be examined. Formally dispute the account and obtain legal advice if the facts are contested.

Is an affidavit of identity theft enough to cancel the account?

No. It is supporting evidence, not an automatic cancellation order. Submit it to the creditor, pursue correction of any CIC entry, and comply with regulator or law-enforcement procedures.

Should I pay while the creditor investigates?

Do not pay or sign an acknowledgment for a debt you deny without legal advice. For covered disputed amounts or unauthorized transactions, request the accommodation required by Republic Act No. 11765, including suspension of interest, fees, and charges pending the final investigation report.

What if the loan proceeds entered my bank or e-wallet?

Report the transaction immediately and do not move or spend unexplained funds. Preserve the complete trail. Receipt into an account associated with you may materially affect the investigation, even if another person controlled the device or induced the transaction. Obtain legal advice before giving a detailed sworn statement.

What if the creditor refuses to show me the application?

Make a written data-subject access request and ask for the basis of any refusal or redaction. Access may be limited to protect another person’s data, an investigation, or legal claims, but the institution should still investigate the disputed identity and respond. Escalate privacy issues to its data protection officer and, where appropriate, the NPC.

Can I dispute an account that is not yet in my CIC report?

Yes. Dispute it directly with the creditor immediately. The CIC process applies to discrepancies already appearing in a CIC credit report.

Will changing my ID number stop further fraud?

Not necessarily, and replacement procedures depend on the issuing agency. Notify the issuer if an ID was lost or compromised, follow its official replacement or annotation process, and strengthen the email, SIM, and financial accounts used for authentication.

Can a collector have me arrested simply because the account is unpaid?

Ordinary nonpayment of a debt does not, by itself, permit a collector to order an arrest. Identity theft, fraud, falsification, or related conduct can involve criminal investigations, but arrest and criminal process require lawful action by the authorities—not a collector’s threat. Seek counsel immediately if you receive genuine court, prosecutor, police, or NBI documents.

Official references

This article provides general legal information, not individualized legal advice or a prediction of any case’s outcome. Procedures and conclusions may depend on the institution, documents, transaction trail, and later regulatory or judicial developments. Official sources were checked as of 26 August 2026.