Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar facility was opened using your identity without your knowledge or consent, dispute it immediately in writing with the lender or account issuer. State clearly that you did not apply for, authorize, receive, use, or benefit from the account. Ask the company to:

mark the account as disputed because of suspected identity theft;
stop collection and adverse credit reporting while it investigates, if its rules and the applicable law allow;
preserve all application, verification, device, transaction, and disbursement records;
give you copies of the documents and personal data used to open the account;
correct or remove inaccurate records; and
send you its written findings and final resolution.

Do not pay, promise to pay, sign a settlement, or describe the account as “my loan” merely to stop collection calls. Those actions may complicate your position. At the same time, do not ignore a demand letter, subpoena, prosecutor’s notice, or court summons.

Report the matter through the regulator appropriate to the provider: the Bangko Sentral ng Pilipinas (BSP) for a BSP-supervised institution, the Securities and Exchange Commission (SEC) for a lending or financing company, and the National Privacy Commission (NPC) for unlawful use or mishandling of personal data. Consider reporting the suspected identity theft or fraud to the NBI or PNP, particularly if money was disbursed, documents were forged, or several accounts are involved.

An account displaying your name or identification details does not by itself prove that you consented to the debt. However, neither a police report nor a simple denial automatically cancels an account. The outcome depends on evidence such as the application, signature or electronic consent, identity-verification process, device and login records, destination of the proceeds, and whether you received or used any benefit.

Act immediately

1. Secure the accounts and contact details that may have been compromised

Change the passwords of your email, mobile banking, e-wallet, government-service, and social-media accounts. Use unique passwords and enable multi-factor authentication where available.

Contact your mobile network if your SIM suddenly lost service or you suspect an unauthorized SIM replacement. Review your email for unfamiliar forwarding rules, recovery addresses, devices, or deleted security notices. Inform your bank or e-wallet provider immediately if an account was accessed or used without permission.

Do not send an OTP, password, PIN, selfie, or full identity document to a collector or an unverified contact. Use only contact details independently confirmed through the institution’s official website, app, statement, or SEC registration record.

2. Send the lender a formal written dispute

Address the complaint to the provider’s consumer-assistance unit, fraud team, data protection officer, or official complaints channel. Include:

your full name and safe contact details;
the account or reference number, if known;
when and how you discovered the account;
a direct denial of applying for or authorizing it;
whether you received, controlled, withdrew, transferred, or used any proceeds;
the identity documents, phone numbers, email addresses, signatures, employers, addresses, or bank accounts that appear incorrect;
any known loss, compromise, phishing incident, stolen device, lost ID, SIM replacement, or impersonation; and
the specific action you want the provider to take.

Use precise language. For example:

I dispute this account as unauthorized. I did not apply for or consent to this credit facility, sign or electronically approve its documents, receive or control its proceeds, or authorize another person to act for me. Please preserve and investigate all records, mark the account as disputed, correct any inaccurate personal or credit information, and provide your written findings.

Send the complaint through a channel that produces proof of delivery. Save the ticket number, automated acknowledgment, sent email, courier receipt, screenshots, and every response.

3. Request the underlying records

Ask the provider to preserve and, subject to lawful limitations, provide the records used to establish the alleged obligation, including:

the application and loan or credit agreement;
disclosure statement, promissory note, and repayment schedule;
copies of identification documents, selfies, video verification, signatures, and electronic consents;
the phone number, email address, residential address, employer, and references supplied;
timestamps and available IP address, device, session, and authentication records;
OTP or verification logs and recorded calls;
the bank, e-wallet, merchant, or other destination to which funds or credit were released;
withdrawal, transfer, purchase, and repayment records;
collection notes and communications; and
information submitted to the Credit Information Corporation (CIC) or another credit bureau.

A provider may redact information belonging to another person or withhold material protected by law. Ask it to identify the basis for any refusal rather than accepting a bare denial.

Under the Data Privacy Act of 2012, a data subject has rights that include access to personal data and correction of inaccurate or erroneous information. Rights to object, erase, or block data are subject to legal grounds and exceptions; they do not require deletion of records that an institution must lawfully retain or needs for a fraud investigation or legal claim.

4. Preserve evidence before it disappears

Keep original electronic files whenever possible. Screenshots are useful, but also preserve complete emails, message exports, call logs, URLs, app names, usernames, transaction references, dates, and timestamps.

Create a chronological incident log covering:

when you first learned of the account;
every call, message, visit, and demand;
each report you filed and its reference number;
the institution’s responses;
any SIM, email, or account-security event; and
any credit denial, collection activity, or other harm linked to the false account.

Retain the envelope and contents of collection letters. Save voicemails and messages in their original form. Do not edit suspected forged documents. If you surrender a device for examination, ask how it will be documented and returned.

A police blotter entry, notarized affidavit of denial, report of a lost ID, or telecom certification may support your account, but none is conclusive by itself. Make every statement truthful and based on personal knowledge.

Where to escalate the complaint

The provider should ordinarily receive the first written complaint. The correct regulator depends on who issued the account.

If the provider is a bank, e-wallet issuer, or other BSP-supervised institution

A BSP-supervised institution’s Financial Consumer Protection Assistance Mechanism is the first-level recourse. If the institution does not act within a reasonable period or you are dissatisfied with its handling, escalate through the BSP Consumer Assistance Mechanism.

The BSP currently accepts complaints through its BSP Online Buddy and the channels listed on its consumer-assistance page. Its official guidance also permits submission of a completed Complaint, Inquiry and Request form to consumeraffairs@bsp.gov.ph, with proof that you first used the institution’s own complaints mechanism and any supporting documents.

The BSP process is governed by BSP Circular No. 1169. BSP consumer adjudication has defined jurisdiction and procedural requirements; it is not a substitute for a criminal investigation or every form of court relief.

If the provider is a lending or financing company

Verify the company and its claimed online lending platform through official SEC records. A company’s corporate registration alone does not necessarily establish that it has authority to operate as a lending or financing company.

Use the SEC’s official complaint instructions for lending and financing companies. The SEC requires a completed complaint form, supporting evidence, a valid government-issued ID, and one complaint form for each respondent company. Follow the filing channel and subject-line format stated on the SEC page because these may change.

The SEC can investigate regulatory violations and may refer matters to another agency. Its own guidance cautions that it cannot, through that complaint process, declare a loan contract void or cancel or settle the alleged obligation. A disputed debt may therefore require separate legal action or a defense in court.

If your personal data was unlawfully obtained, used, disclosed, or left uncorrected

First notify the company, its data protection officer, or other responsible entity in writing. Under the NPC’s amended rules, an NPC complaint ordinarily must show that the respondent did not take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice. The NPC may waive this requirement for good cause or specified serious violations.

The formal complaint must comply with the NPC’s rules, include the relevant correspondence and supporting evidence, and be verified. The NPC’s current filing page instructs complainants to complete the prescribed form, have it notarized, and submit it personally, by courier, or through the listed email channel. Review the NPC complaint mechanics, formal filing instructions, and 2021 Rules of Procedure, as amended before filing.

Do not assume that an NPC complaint automatically erases a legitimate record or decides whether a contract is enforceable. The NPC’s role concerns personal-data protection and violations of the Data Privacy Act and related issuances.

If the false account appears on your credit report

Obtain your CIC credit report through a channel identified by the CIC. If it contains erroneous, misleading, incomplete, or outdated credit data, use the CIC Online Dispute Resolution System.

The CIC explains that you must first obtain a credit report before lodging a dispute. The disputed information is referred to the submitting entity; the CIC cannot simply change the lender’s submission unilaterally. Upload the lender dispute, identity-theft report, relevant correspondence, and other records requested by the system.

A corrected record with one provider may not automatically update every database. Ask each institution where it reported the account and verify the result through a later credit report.

If a crime may have been committed

Using another person’s identifying information without right may fall under computer-related identity theft when the statutory elements of the Cybercrime Prevention Act of 2012 are present. Depending on the conduct and evidence, access-device fraud, computer-related fraud, falsification, estafa, or other offenses may also be considered by investigators and prosecutors. The precise offense should not be assumed before investigation.

You may seek investigative assistance from the NBI Cybercrime Division or use the NBI’s online complaint page. You may also approach the PNP Anti-Cybercrime Group or the appropriate police unit. Bring identification, your incident chronology, the disputed account details, provider correspondence, transaction records, and the original electronic evidence available to you.

Under the amended Access Devices Regulation Act, issuers covered by that law must conduct an initial investigation of reported access-device fraud and furnish reports to the NBI and PNP Anti-Cybercrime Group. Whether a particular loan account or instrument qualifies as an “access device” depends on its features and the statutory definitions.

A criminal report does not replace your direct dispute with the provider, regulatory complaint, or credit-report correction request.

If collectors contact you

Tell the collector, in writing, that the account is disputed as identity theft. Ask for:

the creditor’s complete legal name and official contact details;
the account and contract on which collection is based;
the collector’s authority to act; and
a channel for sending the fraud dispute without exposing more personal data.

Do not argue at length by telephone. Keep the conversation factual and do not guess at information you do not know. Save all messages and call details.

If collectors contact relatives, co-workers, or other third parties, publish your personal information, threaten violence or arrest, impersonate government personnel, or use humiliating or deceptive tactics, preserve the evidence and include it in the appropriate SEC, BSP, NPC, or law-enforcement report. An unpaid private debt does not by itself authorize harassment, unlawful disclosure, or immediate arrest.

If a collection lawsuit is filed, respond within the period stated in the summons and consult a lawyer promptly. A complaint to a regulator generally does not suspend a court deadline.

What not to do

Avoid these common mistakes:

Making a small “good-faith” payment before obtaining advice.
Signing a restructuring, waiver, acknowledgment, or settlement merely to stop calls.
Disputing only by phone and keeping no proof.
Sending more identity documents through an unverified link or personal messaging account.
Deleting suspicious messages, resetting a compromised device before preserving evidence, or editing files.
Naming a suspected offender as a proven criminal in public posts.
Assuming the SEC, BSP, NPC, CIC, police, and courts perform the same function.
Filing a vague complaint without account details, dates, correspondence, or supporting records.
Ignoring a summons because a police or regulatory complaint is pending.
Paying someone who promises guaranteed deletion from a credit database.

When legal help is urgent

Seek advice from a Philippine lawyer without delay if:

you received a court summons, subpoena, prosecutor’s notice, or formal demand with a deadline;
the provider claims you electronically signed the agreement or received the proceeds;
funds passed through an account, SIM, device, or e-wallet under your control;
a family member, employee, agent, or business associate may have used your details;
several fraudulent accounts exist or the amount is substantial;
forged notarized documents, real property, a vehicle, or collateral are involved;
the incident is affecting employment, housing, business financing, or an imminent transaction;
collectors are threatening violence, public exposure, or contact with your workplace;
the institution refuses to preserve records or warns that logs will soon be deleted; or
you need an injunction, damages, a judicial declaration, or representation in a criminal investigation.

People who cannot afford private counsel may ask the Public Attorney’s Office whether they meet its legal-assistance requirements. Law-school legal aid clinics and the Integrated Bar of the Philippines may also have suitable referral or assistance programs.

Frequently asked questions

Am I required to pay because the account uses my name and ID?

Not automatically. The creditor must rely on a valid legal basis for holding you liable, and the documents and circumstances matter. If you did not consent, authorize an agent, receive the proceeds, or later adopt the transaction, dispute the account and demand the evidence. A court—not a collector—ultimately resolves a contested civil obligation when the parties cannot settle it through the available processes.

Should I pay first and request a refund later?

Usually, do not pay an account you genuinely deny without first obtaining legal advice. A payment or payment arrangement may be used as evidence concerning acknowledgment or acceptance, although its legal effect depends on the circumstances.

Is an affidavit of denial enough to cancel the loan?

No. It is supporting evidence, not an automatic cancellation. The provider should compare it with the application, verification records, consent trail, device data, and destination and use of the proceeds.

Can I demand immediate deletion of every record?

You may demand correction of inaccurate data and invoke applicable data-subject rights. But an institution may have lawful reasons to retain records for investigation, regulatory compliance, legal claims, or other purposes allowed by law. A more precise request is to correct the account’s attribution or status, restrict improper use, stop unsupported reporting, and preserve evidence of the fraud.

What if the lender says an OTP proves I applied?

An OTP record is relevant but may not be conclusive. Ask which number received it, when it was sent, what transaction it approved, how the number was linked to you, and what device and identity checks accompanied it. Report any SIM loss, takeover, forwarding, malware, or social-engineering incident truthfully.

What if the money entered my bank or e-wallet account?

That fact requires urgent investigation. Explain whether you controlled the account at the time, whether the money was withdrawn or transferred, who initiated each transaction, and whether you benefited. Preserve statements and device records and consult counsel before giving a detailed sworn statement if criminal exposure is possible.

Can I file with every agency at once?

You may use remedies that address different issues, but follow each agency’s prerequisites. The lender’s internal complaint is normally the starting point for BSP and NPC escalation. Disclose related proceedings when a form or rule requires it, and keep your statements consistent.

How quickly should I report the account?

Immediately. Delay can allow further borrowing, collection, adverse reporting, or loss of electronic logs. Even when a particular complaint route does not specify a short filing deadline, civil, criminal, administrative, evidentiary, and procedural time limits may apply.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and rights can depend on the provider, documents, transactions, and pending proceedings. Official sources and procedures were checked as of 1 August 2026.