Quick answer

If you discover a loan, credit card, credit line, financing account, or online lending account that you never applied for or authorized, report it immediately in writing to the financial institution that supposedly opened the account. State clearly that you dispute the account as identity fraud, ask the institution to investigate, place the account under dispute, stop collection activity based on the disputed obligation, correct any inaccurate records, and give you a complaint or case reference number.

For financial service providers covered by the Financial Products and Services Consumer Protection Act (FCPA), Republic Act No. 11765, each provider must maintain a free Financial Consumer Protection Assistance Mechanism. For an alleged disputed amount or unauthorized transaction, the provider must, while its final investigation is pending, suspend interest, fees, and charges or provide a similar reasonable accommodation. If you are dissatisfied with the provider's handling of the complaint, you may escalate it to the regulator with jurisdiction over that provider. (eLibrary)

Do not stop with a telephone call. Preserve written proof of the dispute and consider the other reporting routes that apply to your situation:

Problem	Where to report
Unauthorized account with a bank or other BSP-supervised financial institution	Institution first, then BSP Consumer Assistance Mechanism
Account opened by an SEC-regulated lending or financing company	Company's complaint mechanism, then SEC
False loan appearing in your CIC Credit Report	Credit Information Corporation's Online Dispute Resolution System
Misuse, inaccurate processing, or unlawful disclosure of your personal data	Company's Data Protection Officer or privacy channel, then the National Privacy Commission when its complaint requirements are met
Identity theft committed through a computer, mobile phone, app, email, or other ICT system	PNP Anti-Cybercrime Group and/or other cybercrime authorities

These processes serve different purposes. A police or cybercrime report does not automatically erase a loan. A CIC dispute does not replace a complaint against the lender. An NPC privacy complaint does not by itself determine whether a debt is legally enforceable. In many serious identity-theft cases, several routes should be pursued in parallel.

An account in your name does not by itself prove that you agreed to the loan

Under Article 1318 of the Civil Code, a contract does not exist unless there is, among other essential requisites, consent of the contracting parties. Article 1319 provides that consent is manifested by the meeting of an offer and an acceptance. (Lawphil)

Accordingly, if another person used your name, identification documents, photograph, mobile number, email address, or other information to obtain credit without your authority, the appearance of your identity in the lender's records does not by itself establish that you consented to the transaction.

That does not mean every disputed account is automatically cancelled as soon as fraud is alleged. The institution may investigate how the application was authenticated, where the proceeds went, what device or contact details were used, and whether other evidence connects you to the transaction. The legal conclusion therefore depends on the actual documents and electronic records.

Your first objective is to create a clear, documented record that you deny applying for or authorizing the account.

Step 1: Report the account directly to the lender or credit provider

Use an official customer-assistance, fraud, dispute, or complaints channel published by the institution itself. Avoid telephone numbers or links supplied only through collection texts or unsolicited messages.

Your written complaint should identify the account sufficiently for the institution to locate it, while avoiding unnecessary disclosure of sensitive information. State the date you discovered the account and explain plainly that you did not apply for, authorize, or knowingly enter into the transaction.

Ask the institution to:

record the account and amount as formally disputed because of suspected identity theft;
investigate the account-opening and authentication process;
provide a complaint reference number and written status updates;
preserve the application, identity-verification records, electronic logs, disbursement records, and other evidence relevant to the investigation;
provide you, subject to lawful limitations, with records showing how the account was opened, what information was used, where the alleged loan proceeds were sent, and what contact details were associated with the application;
correct inaccurate information and notify relevant recipients of corrected data where the law requires it; and
confirm the final investigation result in writing.

Under the FCPA, financial consumers have rights that include protection of their assets against fraud and misuse, privacy and protection of client data, and timely handling and redress of complaints. Financial service providers must also maintain a consumer-assistance mechanism free of charge. (Senate Legislative Data Repository)

For BSP-supervised institutions, current BSP rules also require assistance for unauthorized or fraudulent transaction concerns, including an active 24/7 reporting channel, clear information about the action being taken, and priority treatment of fraud-related concerns proportionate to their complexity. (Bangko Sentral ng Pilipinas)

Ask specifically about interest, fees, and collection activity

Republic Act No. 11765 expressly provides that, in a case involving an alleged disputed amount or unauthorized transaction, the financial service provider must, pending its final investigation, suspend the imposition of interest, fees, and charges or provide a similar reasonable accommodation. (eLibrary)

Cite the dispute reference number whenever a collector contacts you. Do not simply ignore collection notices, because you want a record showing that you consistently disputed the alleged obligation rather than merely refusing to communicate.

The statutory rule does not mean that filing a complaint automatically establishes identity theft or permanently cancels the account. The lender still investigates the claim.

Step 2: If it is a bank or another BSP-supervised institution, escalate an unresolved complaint to the BSP

The Bangko Sentral ng Pilipinas treats the institution's own Financial Consumer Protection Assistance Mechanism as the first-level recourse. A consumer should first formally complain to the BSP-supervised financial institution. If the matter remains unresolved or the consumer is dissatisfied with the institution's handling of it, the complaint may be escalated through the BSP Consumer Assistance Mechanism. (Bangko Sentral ng Pilipinas)

The BSP currently identifies the BSP Online Buddy (BOB) as a principal channel for escalation. If BOB is unavailable or the consumer prefers another permitted channel, the BSP also accepts its prescribed complaints/inquiries form through its published email, postal, walk-in, and other Consumer Assistance channels. For email or postal complaints, the BSP says a Consumer Specialist will evaluate the concern and, if necessary, respond or refer it to the institution within seven banking days from receipt; postal submissions are likewise acknowledged through the published process. (Bangko Sentral ng Pilipinas)

Attach the complaint you previously sent to the institution, its response if any, your complaint reference number, and the documents supporting your identity-theft claim.

Do not send unnecessary PINs, passwords, full card credentials, or identification documents merely because someone claiming to be from a regulator asks for them. The BSP's own current guidance warns consumers not to disclose PINs, passwords, account or card numbers, passports, or other identification cards unnecessarily in BSP-CAM submissions. (Bangko Sentral ng Pilipinas)

Step 3: If the creditor is a lending or financing company, use the SEC complaint route

Lending and financing companies fall under SEC supervision rather than BSP supervision when they are entities regulated by the SEC under the applicable lending and financing laws. The SEC maintains a dedicated regulatory area for lending and financing companies and continues to publish complaint procedures and notices for the sector. (Securities and Exchange Commission)

As a practical first step, complain to the company's official complaints mechanism and obtain proof that it received your identity-theft dispute. If the matter is not properly resolved—or if the circumstances themselves warrant reporting regulatory violations—use the SEC's current complaint system.

The SEC's current iMessage system is its web-based ticketing platform. Its public user guide lists a service specifically for “Complaints on Financing and Lending Companies.” The system allows a user to create a ticket, upload supporting material, receive a ticket number, and follow the ticket's status. (Securities and Exchange Commission)

With online lending apps, identify the actual corporate lender rather than relying only on the app's trade name. Useful identifiers include the company name appearing in the loan documents, privacy notice, terms of service, collection notice, app-store listing, or disbursement records. The SEC continues to maintain official materials on recorded online lending platforms and actions against lending companies. (Securities and Exchange Commission)

Step 4: Check whether the fake account has reached your CIC credit record

An identity-theft loan can cause continuing problems even after you discover it if inaccurate credit information remains associated with your identity.

Republic Act No. 9510, the Credit Information System Act, requires participating submitting entities to provide credit data and updates to the Credit Information Corporation and contemplates correction of a borrower's credit information. The law gives borrowers access to their credit information and establishes a mechanism for disputing erroneous, incomplete, or misleading information. (CIC)

If the unauthorized account appears in your CIC Credit Report, use the CIC's Online Dispute Resolution System (ODRS).

Under CIC Circular No. 2019-01, the dispute must be based on a CIC Credit Report and requires the report's Transaction Reference Number (TRN). If the credit report was obtained more than 30 calendar days earlier, the CIC rules require the consumer to obtain a new report before proceeding with the dispute. (Credit Information Corporation)

The CIC dispute process does not mean that CIC simply deletes an entry upon request. The underlying submitting entity is involved in verifying and correcting the information. For that reason, keep your lender dispute and your CIC dispute consistent and provide the relevant lender complaint reference numbers.

After the matter is corrected, obtain an updated credit report when appropriate and check whether the disputed account has actually been corrected.

Step 5: Use your rights under the Data Privacy Act when your personal information was misused

Identity theft commonly involves the use of a person's name, date of birth, identification details, photograph, address, mobile number, email address, or other personal information.

The Data Privacy Act gives a data subject important rights concerning information held about them. Among other things, a person may obtain reasonable access to personal information being processed, including its source, recipients, manner of processing, and certain other details. A data subject may dispute inaccurate information and seek its correction. Subject to the law's conditions, a data subject may also seek blocking, removal, or destruction of information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)

These rights can be particularly useful when trying to establish how an unauthorized account was created. You may ask the lender or other personal information controller, subject to applicable legal exceptions, to explain the information associated with the application and the sources and recipients of that information.

Do not assume, however, that every use of your information after discovering the fraudulent account is automatically an unlawful privacy violation. The Data Privacy Act recognizes legal bases for processing other than consent, including circumstances involving legal obligations or the establishment, exercise, or defense of legal claims. Access rights also have statutory exceptions, including certain processing for investigations concerning criminal, administrative, or tax liabilities. (National Privacy Commission)

Before filing a complaint with the National Privacy Commission

The NPC's current complaint mechanics generally require exhaustion of remedies. The complainant must first inform the respondent in writing of the alleged privacy violation or personal-data breach and give the respondent an opportunity to address it. A complaint may proceed when the respondent fails to take timely or appropriate action or gives no response within 15 calendar days from receipt of the written notice. Proof of that prior notice must accompany the NPC complaint. (National Privacy Commission)

The NPC also warns that complaints deficient in form, substance, or supporting evidence may be dismissed. Follow the Commission's current rules and complaint forms rather than simply sending an informal accusation.

Step 6: Report possible cybercrime when another person used your identity online

When another person intentionally obtains or uses identifying information belonging to you without right through a computer system, the facts may fall within computer-related identity theft under Section 4(b)(3) of Republic Act No. 10175, the Cybercrime Prevention Act. Depending on what occurred, computer-related forgery, computer-related fraud, or offenses under other laws may also be relevant. The appropriate offense depends on the evidence and should ultimately be determined by investigators and prosecutors. (Lawphil)

Republic Act No. 10175 assigns cybercrime law-enforcement responsibilities to the PNP and NBI. For reports to the PNP, the PNP Anti-Cybercrime Group currently publishes contact information for its Cyber Response Unit, Cyber Financial Crime Unit, and regional cybercrime units. (Lawphil)

The Cybercrime Investigation and Coordinating Center also publishes its 1326 reporting hotline and other official channels for online scams. (CICC)

Report promptly when the fraud is ongoing. Electronic records can disappear, accounts can be deleted, phone numbers can change, and application or access logs may be subject to retention rules.

A criminal complaint is separate from the lender dispute. Give the lender the police or cybercrime report reference when useful, but continue pursuing correction of the account directly with the lender, regulator, and CIC as applicable.

Evidence to preserve before anything disappears

Keep the original evidence whenever possible, not merely a cropped screenshot. Preserve the message, email, statement, collection notice, or credit report through which you first learned of the account; the lender's legal and trade names; account or application reference numbers; dates and amounts; collection texts, emails, call logs, and voicemails; screenshots showing the unauthorized account; the relevant CIC Credit Report and TRN; your written disputes and proof of delivery; every complaint reference number and response; evidence concerning a lost or stolen ID, compromised email, SIM replacement, account takeover, or suspicious login if relevant; and documents showing where the alleged loan proceeds actually went if that information becomes available.

When preserving emails and electronic files, retain originals and metadata where practicable. Do not edit screenshots in a way that removes dates, sender information, URLs, account identifiers, or other contextual details.

Ask the lender to preserve its own evidence, including the original application, uploaded identification documents, KYC or identity-verification material, registered phone number and email address, disbursement destination, electronic-signature or authentication records, and relevant device or transaction logs. Whether all such records must be disclosed directly to you is a separate question governed by privacy, banking, security, evidentiary, and investigative rules; the immediate goal is to prevent relevant evidence from being lost.

Secure your accounts while the investigation is ongoing

Identity theft affecting one loan application may indicate that other credentials have also been compromised. Change passwords for the email account and financial accounts connected to your identity, use strong unique passwords, activate multi-factor authentication where available, review active sessions and connected devices, and immediately report a lost or compromised SIM to your telecommunications provider.

Never give an OTP, password, PIN, or authentication code to someone who says it is needed to “cancel” the fraudulent loan. Verify any supposed bank, lender, collector, investigator, or regulator through independently obtained official contact information.

Continue checking your financial accounts and credit information for additional unfamiliar activity. A single fraudulent account may not necessarily be the only one.

Important timing rules

Report the fraud immediately. Even where a particular complaint mechanism gives a longer legal period, delay can make investigation and evidence preservation more difficult.

For an NPC privacy complaint, remember the Commission's general requirement that the respondent first receive written notice and either fail to take timely or appropriate action or fail to respond within 15 calendar days. (National Privacy Commission)

For a CIC ODRS dispute, the credit report used for the dispute cannot be more than 30 calendar days old under CIC Circular No. 2019-01. (Credit Information Corporation)

For BSP complaints sent through email or postal mail, current BSP guidance says a Consumer Specialist will evaluate the concern and, if necessary, respond or refer it to the supervised institution within seven banking days from receipt. That is a BSP processing step, not a guarantee that the underlying identity-theft investigation will be completed within seven banking days. (Bangko Sentral ng Pilipinas)

For claims specifically accruing under the FCPA and its implementing rules, Section 14 provides a five-year prescriptive period from consummation of the financial consumer transaction or five years from discovery of deceit or nondisclosure of material facts, subject to an overall ten-year limit from the violation, with a separate rule for insurance contracts. Do not treat that outer statutory period as a reason to postpone an identity-theft report. (Lawphil)

Other civil, criminal, procedural, or contractual periods may apply depending on the particular claim.

Common mistakes that can make the problem harder

Reporting only by telephone. A call may be useful for immediate fraud blocking, but follow it with a traceable written dispute.

Saying merely that you “cannot pay.” If the account is not yours, say so expressly. An inability-to-pay complaint communicates something very different from an identity-theft dispute.

Paying or signing a restructuring agreement just to stop collection calls. Before making a payment, acknowledging the account, or signing a settlement concerning a debt you deny, understand the possible legal and evidentiary consequences and obtain advice when necessary.

Sending IDs and personal information to an unverified collector. Confirm the institution and channel independently.

Deleting the lending app, messages, or emails before preserving evidence. Capture the relevant information first.

Filing only a police report. A criminal report does not automatically correct the lender's records or the CIC Credit Report.

Filing only with the lender. If incorrect credit data has already been reported, separately check and dispute the CIC entry. If personal-data misuse or cybercrime is involved, the NPC or law-enforcement route may also be appropriate.

Accusing a company of a “data breach” without evidence. Identity theft can result from many sources. State the facts you know and request an investigation rather than asserting an unproven source of the compromise.

Ignoring a summons or formal legal notice because the debt is fraudulent. Identity theft is a defense that must be properly raised and supported. It does not make court papers disappear.

When legal help becomes urgent

Consult a Philippine lawyer promptly if the lender or collector has filed a court case; you receive summons, a subpoena, or another document carrying a response deadline; the disputed account is secured by real property or other significant collateral; the lender continues to attribute a substantial debt to you despite strong evidence of identity fraud; several financial accounts have been opened in your name; a fraudulent transaction involves a business, estate, property title, corporate authority, or forged notarized document; or you need urgent court relief or assistance preserving electronic evidence.

Immediate reporting is also important if the impersonator still controls your email, mobile number, financial account, or other authentication channel, because the fraud may still be continuing.

Frequently asked questions

Do I have to pay a loan that I never applied for?

A genuine lack of consent is legally important because consent is an essential requisite of a contract under the Civil Code. But whether a specific lender can establish a legally enforceable obligation depends on the evidence. Dispute the account immediately and require the institution to investigate rather than assuming either that the account is automatically valid or that it has already been legally cancelled. (Lawphil)

Can the lender continue adding interest while investigating?

For financial service providers covered by the FCPA, when there is an alleged disputed amount or unauthorized transaction, Section 8(f) requires the provider, pending its final investigation report, to suspend interest, fees, and charges or provide a similar reasonable accommodation. (eLibrary)

Do I need a police report before I can complain to the lender?

The lender's FCPA consumer-assistance mechanism is itself a formal first avenue for reporting the financial dispute. A cybercrime or police report can nevertheless provide important supporting evidence and should be considered promptly when the facts indicate identity theft, forgery, or fraud. Do not delay the lender complaint merely because a criminal report is still being prepared.

What if the lender says its system shows that I applied?

Ask what evidence connects the application to you and formally dispute any inaccurate information. Depending on applicable legal limitations, relevant records may include the identity documents used, registered contact details, authentication method, application information, and disbursement destination. The Data Privacy Act also gives data subjects rights of access and correction, subject to statutory exceptions. (National Privacy Commission)

What if the account is already on my CIC Credit Report?

File a separate CIC ODRS dispute. You will need the report's TRN, and if the report is more than 30 calendar days old, obtain a new report before filing the dispute. Continue the dispute against the lender at the same time. (Credit Information Corporation)

Can I immediately complain to the NPC because somebody used my ID?

You may have a privacy issue, but the NPC's published complaint mechanics generally require you first to inform the respondent in writing and allow it to address the alleged violation. Proof of this step is required, and a lack of response for 15 calendar days is one of the circumstances identified by the NPC for satisfying the exhaustion requirement. (National Privacy Commission)

Is using another person's identity online a cybercrime?

The Cybercrime Prevention Act defines computer-related identity theft to include the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another. Whether the evidence establishes that offense—or another offense—is for law-enforcement authorities, prosecutors, and ultimately the courts to determine. (Lawphil)

Official sources

General-information disclaimer

This article provides general Philippine legal information, not individualized legal advice. Identity-theft and unauthorized-credit cases can involve different regulators, contracts, electronic records, privacy issues, criminal offenses, and procedural deadlines, so the proper remedy depends on the actual documents and facts. Official laws, regulations, and agency procedures cited here were checked against government and primary legal sources on 26 August 2026.