Quick answer

If a loan, credit card, credit line, or similar account was opened using your identity without your knowledge or consent, dispute it immediately in writing with the lender. State clearly that you did not apply for, authorize, sign, receive, use, or benefit from the account. Ask the lender to freeze collection activity while investigating, preserve its records, stop reporting the account as yours, and provide the application and identity-verification records.

You are generally not responsible for a contract you never consented to. Under Article 1318 of the Civil Code, consent is an essential requirement of a contract. However, an identity-theft report does not automatically cancel an account: the lender, credit-information provider, regulator, or court may still need to examine the application, disbursement records, authentication data, and other evidence.

Report through the correct channels:

The lender’s fraud or consumer-assistance unit;
The Credit Information Corporation (CIC), if the account appears in your CIC credit report;
The BSP for a BSP-supervised institution, or the SEC for a lending or financing company;
The National Privacy Commission (NPC), if your personal data was unlawfully used or the company fails to honor your data-subject rights; and
The NBI or police when identity theft, falsification, fraud, hacking, or another crime may have occurred.

Do not pay a “small amount,” sign a restructuring agreement, or promise to pay merely to stop collection calls. That conduct may complicate your position. At the same time, do not ignore a subpoena, summons, demand from a court, or formal regulatory notice.

Act immediately

Contact the lender using a number, email address, app, or website independently verified as official. Do not rely only on contact details in a suspicious text message or collection call.

Tell the lender that:

The account is disputed as identity theft or unauthorized account opening.
You did not consent to the application or contract.
You want the account flagged and investigated by its fraud and consumer-protection teams.
Collection calls, automated debits, endorsement to collectors, and adverse credit reporting should be suspended while the dispute is investigated.
Relevant records must be preserved.
All further communications should be in writing.

Ask for a complaint or case number, the name of the office handling the matter, the lender’s stated turnaround time, and written confirmation that it received your dispute.

If money is being taken from your deposit account, payroll account, e-wallet, or card, report the unauthorized debit separately to the institution maintaining that account. Ask whether it can block future debits, replace compromised credentials, or trace the destination of transferred funds.

Send a detailed written dispute

A phone call is useful for immediate containment, but create a written record on the same day if possible. Your letter or email should include:

Your full name and reliable contact details;
Only the identification information reasonably needed to locate the disputed account;
The account or reference number, with unnecessary digits masked when appropriate;
When and how you discovered the account;
A direct statement that you did not apply for or authorize it;
Whether you received any proceeds, card, goods, OTP, email, or account credentials;
Whether an ID, phone, SIM, email account, or device was previously lost or compromised;
The specific action requested; and
A list of attached evidence.

Request written confirmation of the following:

The account is tagged as disputed due to suspected identity theft.
The lender will investigate rather than treat your report as an ordinary payment complaint.
It will not represent the alleged debt as admitted or undisputed.
It will correct information already furnished to the CIC or another credit bureau if the account is found unauthorized.
It will notify any collection agency or third party that received the disputed data.
It will give you its written findings and the factual basis for them.

Do not send passwords, PINs, OTPs, card security codes, or the credentials to your email, banking, or government accounts.

Request the records needed to identify what happened

Ask the lender to preserve and, subject to lawful security restrictions, provide or explain the records used to open and approve the account, including:

The complete application and alleged contract;
Submitted IDs, photographs, selfies, signatures, and supporting documents;
Electronic-signature, OTP, biometric, or liveness-verification records;
The phone number, email address, device, IP address, timestamp, and location data associated with the application;
Call recordings or video-verification records;
The identity of any agent, branch, merchant, dealer, or third-party service provider involved;
The approval and know-your-customer records;
The bank account, e-wallet, card, merchant, or person to whom proceeds were released;
Delivery records for any card, goods, or documents;
Statements, payment history, and collection notes; and
The entities to which the account information was disclosed or reported.

Under the Data Privacy Act of 2012, a data subject may, subject to applicable limitations, request access to personal data being processed, dispute inaccurate information, demand correction, and seek blocking or removal when there is substantial proof that data is false, unlawfully obtained, or used for an unauthorized purpose. A lender may withhold particular security information when another lawful ground applies, but it should not use “data privacy” as a blanket reason to refuse to address your own identity-theft dispute.

Preserve evidence before accounts or messages disappear

Keep original electronic files whenever possible. Screenshots are helpful, but they may omit metadata or context.

Preserve:

Collection texts, emails, app notifications, letters, and envelopes;
Full email headers and message details;
Call logs, voicemails, caller numbers, dates, and summaries of conversations;
The lender’s acknowledgment and complaint reference number;
Copies of your dispute and every attachment;
Your CIC credit report and its transaction reference number;
Evidence showing where you lived or worked when the application was made, if relevant;
Proof that the disbursement account, phone number, email, signature, device, or address is not yours;
Notices concerning a lost ID, SIM, phone, or compromised account;
Relevant bank and e-wallet statements; and
Police, NBI, regulator, and privacy-complaint records.

Keep an incident timeline. Record dates, the names or positions of people contacted, what they said, and promised response dates.

If you give a copy of an ID to a legitimate investigator or lender, consider marking the copy with the recipient, purpose, and date—for example, “For identity-theft dispute with [institution] only, 2 August 2026”—provided the marking does not cover information needed for verification.

Check whether other accounts were opened

One unauthorized account may not be the only one. Obtain your CIC credit report and review:

Names, addresses, phone numbers, and identification details;
Lenders you do not recognize;
Accounts you did not open;
Incorrect balances or payment status; and
Recent credit activity inconsistent with your records.

The CIC explains how consumers can obtain a report through its direct-to-consumer program.

Also secure the accounts that could be used to impersonate you:

Change compromised email and financial-account passwords from a trusted device.
Use unique passwords and multi-factor authentication.
Ask your mobile provider to secure or replace a compromised SIM.
Sign out unknown devices and revoke suspicious app access.
Check whether email forwarding rules, recovery addresses, or phone numbers were changed.
Notify the issuing agency if a government ID was lost or stolen and follow that agency’s replacement or reporting process.

Dispute an incorrect CIC credit record

If the unauthorized account appears in your CIC credit report, use the CIC Online Dispute Resolution System. This is separate from—and should not replace—your direct dispute with the lender.

The current CIC process requires a credit report issued no more than 30 days before the dispute and its 14-digit Transaction Reference Number. A single valid TRN may be used once to dispute records involving multiple lenders. CIC’s step-by-step instructions also explain the identity-verification and alternative process when PhilSys verification cannot be completed.

Under Section 4(o) of the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading information. The law directs CIC to investigate and verify disputed information within five working days from receipt of the complaint. If accuracy cannot be verified and proven, the disputed information must be deleted, with affected recipients informed of the correction or removal. Operational resolution can nevertheless involve additional steps and response periods depending on the dispute category and the submitting lender.

Monitor the dispute email thread and answer requests on time. CIC’s process may require you to accept or reject the lender’s recommendation within five days. Keep the acknowledgment and final resolution.

A correction in the CIC database does not by itself decide every contractual, criminal, privacy, or damages issue. Conversely, a police report alone does not automatically change CIC data; use the CIC dispute process as well.

Escalate to the institution’s regulator

For banks, credit-card issuers, e-money issuers, and other BSP-supervised institutions

The institution’s Financial Consumer Protection Assistance Mechanism is the required first-level remedy. If its response is unsatisfactory or it does not act within a reasonable period, escalate through the BSP Consumer Assistance Mechanism.

BSP accepts concerns through its Online Buddy, or through a completed Complaint, Inquiry and Request form sent to consumeraffairs@bsp.gov.ph. Attach proof that you first raised the matter with the institution.

Under BSP Circular No. 1169, BSP-CAM is the second-level process. It must generally be completed before BSP mediation or adjudication. BSP adjudication covers qualifying financial-consumer claims that are purely civil and seek payment or reimbursement not exceeding ₱10 million, exclusive of legal interest. It is not the forum for prosecuting the identity thief.

For lending or financing companies

Submit the complaint to the Securities and Exchange Commission through the SEC iMessage system, selecting the service for complaints involving financing or lending companies. Include the company’s legal name, app or brand name, account details, your direct dispute, its response, and supporting evidence.

An app’s brand may differ from the licensed company operating it. Identify both if possible. SEC registration alone also does not necessarily prove that a company holds the authority required to operate as a lending or financing company.

For cooperatives

If the alleged lender is a cooperative, raise the complaint with the cooperative and the Cooperative Development Authority. A cooperative bank, however, is BSP-supervised. Confirm the entity’s legal identity before choosing the regulator.

Filing with a regulator does not replace a criminal complaint when someone forged documents, hacked an account, or impersonated you.

Consider a National Privacy Commission complaint

An unauthorized application may involve unlawful collection, use, disclosure, or retention of your personal data. First write to the lender or other entity responsible for processing the data, preferably addressing its Data Protection Officer. Exercise your rights to access, correction, objection, and blocking where applicable.

Under the NPC’s 2021 Rules of Procedure, as amended, a complainant generally must first inform the entity in writing and allow it to act. Ordinarily, an NPC complaint may proceed if the entity takes no timely or appropriate action or gives no response within 15 calendar days from receiving the written notice. The NPC may excuse this requirement in specified circumstances, including when the respondent cannot provide a plain, speedy, or adequate remedy or its action is patently illegal.

A formal NPC complaint must satisfy procedural requirements. The NPC’s filing guide provides the complaint form and current submission options. The complaint is generally written, verified, supported by the correspondence with the respondent, and accompanied by the required certification and evidence. Follow the current form and fee instructions rather than sending only an informal email.

An NPC case addresses data-privacy violations. It is not automatically a proceeding to declare a loan contract nonexistent, remove a CIC entry, or prosecute an identity thief.

Report possible crime

Using another person’s identifying information through a computer system may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on the evidence, other laws on fraud, falsification, unauthorized access, or access devices may also apply. The correct charge is determined by investigators and prosecutors; do not assume that every disputed account proves a particular crime.

You may seek investigative assistance from:

The NBI Cybercrime Division, which lists its current contact information;
An NBI regional or district office;
The PNP Anti-Cybercrime Group or an appropriate police station; or
The prosecutor’s office, usually with legal assistance where needed.

The NBI’s published service procedure for victims of computer crimes indicates that complainants may be interviewed, execute sworn statements, submit affidavits and supporting documents, and present relevant devices for examination.

Bring government identification, the lender’s account information, your chronology, communications, credit report, proof that the disbursement destination or application credentials were not yours, and any available device or account-security evidence. Do not alter suspected electronic evidence before asking investigators whether forensic examination is needed.

A barangay blotter or police incident record can help document when you reported the matter, but it does not conclusively establish identity theft or cancel the alleged debt.

If a collector contacts you

Tell the collector, in writing, that the account is disputed as identity theft. Give the lender’s complaint reference number without disclosing unnecessary personal information. Ask for:

The collector’s full legal name and authority;
The lender it represents;
The alleged account number and balance;
A copy or description of the basis for linking the account to you; and
Written confirmation that the identity-theft dispute was relayed to the lender.

Do not be pressured into paying solely to stop calls. Do not sign an acknowledgment, settlement, promissory note, or restructuring agreement without understanding its legal effect.

Save evidence of threats, public shaming, disclosure to unrelated contacts, impersonation of officials, or other abusive conduct. Report the collector’s conduct to the lender and the proper financial regulator. If personal data is misused, consider an NPC complaint. If there is a credible threat of physical harm, contact law enforcement immediately.

Common mistakes to avoid

Reporting only by phone and keeping no proof;
Saying merely “I do not recognize this” instead of expressly denying consent and receipt of proceeds;
Sending complete IDs through an unverified number or social-media account;
Paying, restructuring, or promising payment before obtaining advice;
Assuming a police report automatically removes the account;
Disputing with CIC but not with the lender, or vice versa;
Missing emails or response periods in the CIC or regulator process;
Deleting messages, resetting a device, or closing an email account before preserving evidence;
Posting full account numbers, IDs, signatures, or suspects’ personal information publicly;
Accusing a particular person without supporting evidence;
Ignoring a court summons because the debt is fraudulent; and
Filing with the wrong regulator because the app’s brand was mistaken for the licensed entity.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A collection case, small-claims case, or other court action has been filed;
You received a subpoena, summons, demand from a prosecutor, or formal regulatory order;
Salary, benefits, collateral, or property are being threatened;
A lender claims you authenticated the application or received the proceeds;
The fraud involves an employee, relative, business partner, or someone who had authorized access to your information;
Several accounts or substantial amounts are involved;
Your signature, notarized document, biometrics, or government ID appears to have been forged or misused;
The lender refuses to provide a reasoned decision or continues adverse reporting after receiving strong contrary evidence;
You are considering signing a settlement, waiver, affidavit, or acknowledgment;
A collector threatens arrest, violence, exposure, or contact with unrelated persons; or
You need provisional court relief, damages, or a definitive ruling on contractual liability.

The Public Attorney’s Office may be an option for people who meet its current eligibility and case requirements. A private lawyer can also help prepare affidavits, preserve electronic evidence, respond to a lawsuit, and coordinate complaints without making inconsistent statements.

Frequently asked questions

Am I automatically liable because the account uses my name and ID?

No. A name or ID copy does not by itself prove valid consent. The lender should examine how the application was authenticated and where the proceeds went. Liability ultimately depends on the evidence and applicable law.

Should I pay while the account is being investigated?

Do not make a payment merely to silence collectors without legal advice. Payment, restructuring, or a promise to pay may create arguments you did not intend. If the account includes both authorized and unauthorized amounts, obtain advice on how to protect your position without defaulting on an undisputed obligation.

Will a police or NBI report erase the debt?

Not automatically. Give the report to the lender and use the relevant CIC and regulator processes. A report documents the complaint; it is not by itself a final ruling on the contract or credit record.

Can I demand a copy of the loan application?

You may request access to personal data processed about you and ask for the factual basis of the account. Access can be subject to lawful limitations protecting security, privileged information, investigations, or other people’s data. Ask for a reasoned written response if anything is withheld.

What if the lender says an OTP was used?

An OTP record is relevant but may not conclusively establish that you personally consented. Ask which number received it, who controlled that number at the time, what device and IP address were used, and whether the application passed other identity checks.

What if the proceeds entered an account in my name?

That fact requires prompt investigation but does not always end the inquiry. Determine who opened or controlled the receiving account, whether funds were immediately transferred, and whether the account itself was compromised. Preserve statements and report unauthorized transfers separately.

What if the unauthorized account is not yet on my CIC report?

Continue the direct dispute and ask the lender not to furnish the account as yours. Retain proof and check a later report. CIC can address data appearing in its system; it does not replace the lender’s fraud investigation.

Can I ask the lender to delete all my data?

Not necessarily. The right to erasure or blocking is not absolute, and a lender may need to retain some records to comply with law, investigate fraud, preserve evidence, or defend legal claims. Request blocking or correction of false or unauthorized data and ask the lender to explain any continuing retention.

Should I name the person I suspect?

Give investigators the facts and evidence, including why you suspect someone, but distinguish suspicion from confirmed fact. Avoid public accusations that could expose you to a separate legal dispute.

Is there one government office that handles everything?

No. The lender addresses the account; CIC handles disputed CIC credit information; BSP, SEC, or CDA supervises the relevant provider; NPC addresses privacy violations; and law-enforcement agencies investigate possible crimes. More than one report may be necessary.

Official resources

This article provides general legal information, not legal advice or a prediction of the outcome of any particular dispute. Liability and the proper remedy depend on the application records, authentication evidence, disbursement trail, communications, and procedural history. Official sources and procedures were checked as of 2 August 2026.