Quick answer

If a loan, credit card, credit line, or similar account was opened in your name without your permission, immediately dispute it in writing with the lender. State clearly that you did not apply for, consent to, receive, activate, or use the account; demand that collection and credit reporting be suspended while the case is investigated; and request copies of the application and verification records.

Do not pay, promise to pay, restructure, or sign an acknowledgment merely to stop collection calls. Those actions may complicate your denial. Under Article 1318 of the Civil Code, consent is an essential requirement for a contract. If someone impersonated you and you gave no consent, the alleged credit agreement is generally not your contract—although the lender may investigate whether you authorized another person, received the proceeds, used the account, or later adopted the transaction. See the Civil Code of the Philippines.

Reporting the crime to the police or NBI is important, but it does not automatically remove the account. You must separately dispute the account with the lender and, if it appears in your credit report, with the Credit Information Corporation (CIC).

Act immediately

Take these steps as soon as you discover the account:

Contact the lender through a verified channel. Use the telephone number, email address, branch, or complaint portal shown on the lender’s official website—not contact details supplied in a suspicious text or collection message.
Ask the lender to secure the account. Request an immediate block on further releases, withdrawals, purchases, cash advances, limit increases, profile changes, and replacement cards. If funds have not yet been released, expressly demand that disbursement be stopped.
Submit a written identity-theft dispute. Keep the complaint factual. Identify the account, explain how and when you discovered it, deny authorization, and list the relief you want.
Obtain a complaint reference number. Record the date, time, channel, and name or identifier of every representative. Save acknowledgments and automated replies.
Secure your genuine accounts. Change compromised passwords, enable multi-factor authentication, contact your mobile provider if a SIM takeover is possible, and review your email and financial accounts for unfamiliar devices, recovery addresses, beneficiaries, or transactions.
Preserve evidence before deleting or blocking anything. Screenshots should show the sender, date, time, number or account name, URL, and complete message whenever possible.

There is no single statutory reporting period that applies to every unauthorized loan. Delay can nevertheless allow further disbursements, collection activity, or adverse credit reporting. For a credit-card billing error or discrepancy, Republic Act No. 10870 requires issuers to allow the cardholder up to 30 calendar days from the statement date to report it, and the issuer must act within 10 business days after receiving notice. Report sooner rather than waiting for the deadline. See Sections 17 and 18 of the Philippine Credit Card Industry Regulation Law.

What to tell the lender

Your complaint should include:

Your full name and safe contact information
The account or reference number, if known
The date and manner in which you learned of the account
A direct statement that you did not apply for, authorize, sign, activate, use, or benefit from it
Any specific false information used, such as an unfamiliar phone number, email address, employer, address, bank account, device, or selfie
A request to stop further use and disbursement
A request to suspend collection and adverse credit reporting during the investigation
A request to preserve all application, verification, disbursement, access, and communication records
A request for written findings and correction of all internal and external records
A request for the lender’s data-protection officer or privacy contact details
Copies—not your only originals—of supporting evidence

You may write:

I dispute this account as identity fraud. I did not apply for, authorize, sign, activate, use, or receive the proceeds of this account. Please immediately secure the account, suspend collection and adverse credit reporting while it is investigated, preserve all relevant records, provide the application and verification records lawfully available to me, and confirm your findings and corrective action in writing.

Do not send passwords, PINs, one-time passwords, card security codes, or access to your phone. If identification is reasonably required, ask for a secure submission method and obscure information that is not needed.

Request the records needed to identify what happened

Ask the lender to preserve and, subject to lawful restrictions, provide:

The application form and alleged contract
The identification documents, photograph, selfie, video, signature, or biometric verification used
The phone numbers, email addresses, residential address, employment details, and references supplied
The date, time, and channel of application
Available device, IP-address, login, and authentication records
Recordings or transcripts of verification calls
OTP delivery and validation records
The destination bank account, e-wallet, card, merchant, or remittance outlet
Disbursement and withdrawal records
Delivery, activation, and transaction records for a credit card
Collection endorsements and reports submitted to the CIC or other credit bureaus

The Data Privacy Act generally gives a data subject rights to be informed, obtain reasonable access to personal data being processed, dispute inaccuracies, and seek correction or blocking in appropriate cases. These rights are subject to lawful limitations, including information that cannot be disclosed because it would expose another person’s protected data or compromise an investigation. See Sections 16 and 18 of the Data Privacy Act of 2012.

Preserve a clean evidence file

Keep both digital and printed copies of:

Collection texts, emails, letters, call logs, and voicemail
Screenshots of the account or credit-report entry
The lender’s complaint acknowledgment and reference number
Your written dispute and proof that it was delivered
Statements showing that you did not receive the proceeds, where relevant
Notices of unfamiliar SIM, email, password, or device changes
Suspicious links, app names, website addresses, social-media profiles, and phone numbers
Copies of IDs reported lost or compromised
A police or NBI complaint and supporting affidavit
A dated chronology of events
Proof of your location or activity when the application or verification allegedly occurred, if relevant
Letters from the lender, regulator, CIC, collector, or lawyer

Preserve original files and messages. Avoid cropping out timestamps or account identifiers. Do not publicly post complete IDs, account numbers, signatures, or the suspect’s unverified identity.

Report suspected identity theft to law enforcement

Using another person’s identifying information without right may constitute computer-related identity theft when committed through a computer system. Section 4(b)(3) of Republic Act No. 10175 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right. Depending on the evidence, other offenses may also be investigated; the proper charges are for law-enforcement authorities and prosecutors to determine. See the Cybercrime Prevention Act of 2012.

You may seek investigative assistance from:

The NBI Cybercrime Division
The NBI’s online complaint page
The nearest NBI regional or district office
The Philippine National Police, including its cybercrime unit or your local police station

Bring a valid ID, your chronology, the lender’s account details, proof of your written dispute, and the evidence you preserved. Ask what form of complaint-affidavit and supporting documents the investigating office requires.

A police blotter or incident report can document when you reported the matter, but it does not by itself decide contractual liability or compel correction of a credit record.

Escalate according to the type of lender

Banks and other BSP-supervised institutions

First complain to the institution itself and retain its reference number. If its response is unsatisfactory or the matter remains unresolved, escalate through the BSP Consumer Assistance Mechanism.

The BSP states that its Online Buddy requires the complaint to have been filed with the concerned financial institution first. Current channels include the BSP Online Buddy and consumer-assistance page and consumeraffairs@bsp.gov.ph.

Attach:

Your complaint to the institution
Its acknowledgment and reference number
Its response, if any
The disputed account records
Your identity-theft report and other evidence

The Financial Products and Services Consumer Protection Act requires financial regulators to maintain consumer-redress mechanisms and authorizes adjudication within their respective jurisdiction. See Republic Act No. 11765.

Lending or financing companies regulated by the SEC

For a lending or financing company that is not under BSP supervision, first use the company’s complaint channel. Unresolved lending complaints may be referred to the SEC’s Financial and Lending Company Division. The BSP’s official inter-agency directory lists flcd_complaints@sec.gov.ph for lending complaints; verify current details on the SEC website before filing.

Regulatory complaints and criminal complaints serve different purposes. An SEC complaint may address the company’s conduct, while an NBI or police complaint concerns the suspected offender.

Unknown, fake, or unlicensed lender

Do not send money merely because a caller threatens you. Ask for the entity’s complete corporate name, registration details, physical address, account number, alleged contract, and proof of disbursement. Independently check whether the entity is regulated.

If the supposed lender cannot be identified, report the impersonation, app, website, phone numbers, payment instructions, and receiving accounts to law enforcement. Also notify the bank or e-wallet provider receiving demanded payments.

Correct your credit record

Obtain your CIC credit report and check whether the unauthorized account was reported. If it appears, use the CIC’s Online Dispute Resolution Process.

Under Section 4(o) of the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. The CIC must investigate and verify disputed information within five working days after receiving the complaint. If accuracy cannot be verified and proven, the disputed information must be deleted; the borrower and entities that received the information must be informed of the correction or removal within five working days. See Republic Act No. 9510.

The CIC explains that it cannot simply rewrite a lender’s submission on its own. Its dispute process communicates with the submitting entity, so upload clear evidence and respond promptly to requests. Keep the dispute number and obtain a fresh report after the case is resolved.

A dispute with the CIC should normally accompany—not replace—your direct dispute with the lender.

When to complain to the National Privacy Commission

Consider an NPC complaint when your personal data appears to have been unlawfully obtained, disclosed, used, retained, or refused correction, or when the lender fails to address a substantiated privacy concern.

Ordinarily, the NPC’s rules require you first to inform the respondent in writing of the alleged privacy violation or personal-data breach and allow an opportunity for appropriate action. The NPC may waive exhaustion in circumstances recognized by its rules, including grave and irreparable harm, lack of an adequate remedy, or patently illegal action. Review the current NPC Rules of Procedure and any amendments before filing.

A formal NPC complaint must comply with the prescribed form and documentary requirements. The NPC’s current guidance directs complainants to complete the complaint form, have it notarized, and submit it through an accepted channel. Evidence must be attached; failure to attach supporting evidence may result in outright dismissal. Use the latest instructions on the NPC’s formal-complaint page.

Not every case of identity theft proves that the lender violated the Data Privacy Act. Liability may depend on how the data was acquired or processed, the lender’s safeguards and response, and the evidence connecting a person or entity to the unlawful processing.

If collectors contact you

Tell the collector in writing that:

You dispute the account as identity fraud
You did not incur or authorize the debt
The lender is investigating, if applicable
All collection communications should be documented
You require the name of the creditor, account number, alleged contract, disbursement details, and the collector’s authority

Do not insult or threaten the caller. Do not confirm information beyond what is necessary to identify the disputed account. Keep recordings only when lawfully obtained; otherwise, preserve call logs and write a contemporaneous note of what was said.

If the collector contacts relatives, employers, or unrelated persons, publishes your information, threatens violence or arrest, impersonates a court or government officer, or uses humiliating tactics, preserve the evidence and report the conduct promptly to the lender and appropriate regulator. Threats to your physical safety should be reported immediately to the police.

A collection demand is not a court judgment. However, do not ignore an actual summons, subpoena, prosecutor’s notice, or court order.

Important distinctions and exceptions

You applied, but did not authorize later transactions

That is usually an unauthorized-transaction dispute, not an unauthorized-account case. Use the issuer’s fraud procedure and report each transaction promptly. Different contract terms and statutory deadlines may apply.

You shared an OTP or credentials because of deception

Report the incident truthfully. Sharing an OTP does not necessarily answer every question about liability, but it may affect the institution’s factual and legal assessment. Do not describe an OTP as “never received” if you received and disclosed it.

A family member or employee opened the account

The relationship alone does not establish authority. But the outcome may depend on whether you gave actual authority, allowed use of your credentials, received the proceeds, knew of the account, or later ratified it. Obtain legal advice before signing or paying anything.

Your ID was lost or photographed earlier

State when and how it was lost or exposed, and attach any earlier loss report. The fact that a genuine ID was used does not by itself prove that you consented to the credit agreement.

The account is not yet on your CIC report

Continue the direct dispute. Some lenders may not have reported the account yet, and the absence of an entry does not prove that no application or obligation is being asserted.

Common mistakes to avoid

Reporting only by telephone and keeping no written record
Paying a “small amount” or accepting restructuring without legal advice
Missing the 30-calendar-day credit-card billing-dispute period
Sending additional IDs through an unverified link or messaging account
Deleting messages, resetting a device, or discarding a SIM before preserving evidence
Assuming a police blotter automatically cancels the account
Disputing only with the CIC and not with the lender
Filing an NPC complaint without first writing to the respondent, unless an exception applies
Submitting conclusions without the documents that support them
Ignoring genuine court or prosecutor documents
Naming a suspected offender publicly without reliable evidence

When legal help is urgent

Consult a Philippine lawyer promptly if:

A complaint, summons, subpoena, demand from counsel, or court paper has been served
The lender has filed a collection case or criminal complaint
Salary, property, benefits, or legitimate accounts are being threatened or affected
The amount is substantial or several institutions are involved
The lender claims that you received or used the proceeds
A family member, employee, or authorized representative may be implicated
You previously paid, negotiated, or signed documents concerning the account
The institution refuses to provide a reasoned response or continues adverse reporting after receiving strong evidence
There are threats, doxxing, extortion, or immediate risk of further financial loss

If cost is a concern, ask the Public Attorney’s Office whether you qualify for assistance, or inquire with your local Integrated Bar of the Philippines chapter or a law-school legal-aid clinic.

FAQ

Am I required to pay a loan opened by an identity thief?

Generally, a person who never consented to a credit agreement is not bound merely because the offender used that person’s name or ID. The conclusion can change if evidence shows authorization, receipt or use of proceeds, or later ratification. Dispute the account immediately and avoid acknowledging the debt.

Should I close my legitimate account with the same lender?

Not automatically. Ask the lender whether it can isolate the fraudulent account while protecting the legitimate one. If credentials or account access were compromised, replacement or closure may be appropriate.

Is an affidavit of denial enough?

It is useful but not automatically conclusive. Combine it with objective records such as account statements, device or SIM alerts, loss reports, proof of your communications, and discrepancies in the fraudulent application.

Can I demand that collection stop?

You can demand that the lender suspend collection while it investigates and inform collectors that the debt is disputed. Whether a regulator or court will compel particular relief depends on the governing rules and evidence. Continue preserving every collection communication.

Can the CIC delete the entry immediately?

The CIC follows a dispute and verification process and coordinates with the entity that submitted the data. It does not ordinarily make an immediate unilateral change merely upon request.

Should I report to both the NBI and the regulator?

They perform different functions. Law enforcement investigates suspected crimes; the lender and financial regulator address the account and the institution’s conduct; the CIC addresses disputed credit information; and the NPC addresses personal-data violations. More than one report may therefore be appropriate.

What if the lender says its verification was successful?

Ask for the basis of that conclusion and the records supporting it. Point out concrete mismatches and request reconsideration. Escalate to the proper regulator and obtain legal advice if the lender continues to hold you responsible.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and contact details may change, and specific rights may depend on the documents and facts. Official sources were last checked on 26 August 2026.