Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar facility was opened using your identity without your consent, report it immediately to the lender or issuer in writing. State clearly that you did not apply for, authorize, receive, or benefit from the account; demand that collection and adverse credit reporting be suspended while the case is investigated; and request copies of the application and verification records.

Also secure any compromised phone, email, SIM, e-wallet, or bank account. If the false account appears in your credit report, dispute it through the Credit Information Corporation (CIC). Escalate an unresolved complaint to the regulator supervising the provider—usually the Bangko Sentral ng Pilipinas (BSP) for BSP-supervised institutions or the Securities and Exchange Commission (SEC) for lending and financing companies. Report suspected identity theft or fraud to the Philippine National Police Anti-Cybercrime Group (PNP-ACG) or the National Bureau of Investigation (NBI). A privacy complaint may also be filed with the National Privacy Commission (NPC) when personal data was unlawfully obtained, used, disclosed, or left uncorrected.

An account appearing under your name does not, by itself, prove that you validly agreed to the debt. However, neither a police report nor an affidavit automatically removes the account. The lender, credit-information provider, regulator, or court may need to examine the application, authentication records, disbursement trail, and other evidence.

Act quickly, but preserve the evidence first

Take screenshots or download copies before messages, account pages, or app records disappear. Keep the original electronic files when possible—not only cropped screenshots.

Preserve:

The collection notice, billing statement, email, text message, app notification, or credit report through which you discovered the account
The creditor’s name, account or reference number, amount, opening date, due dates, and collection-agency details
Complete messages, caller numbers, email headers, URLs, social-media profiles, and app names
Dates, times, names, and reference numbers for every call or complaint
Proof showing where you were, which phone number or email you used, or other facts inconsistent with the application
Copies of IDs that may have been exposed, together with any prior loss report or replacement record
Security alerts, password-reset messages, SIM-replacement notices, login histories, device lists, and one-time-password messages
Bank, e-wallet, or remittance records showing where the proceeds went
Any specimen signature or authentic document needed for comparison

Do not alter suspicious files or continue communicating from a compromised account. Keep an incident timeline and store copies in a secure location.

Step 1: Secure the identity and accounts that may still be exposed

Change the passwords of the affected email account first, followed by financial accounts and other services using the same or similar credentials. Use strong, unique passwords, sign out unknown devices, and enable multi-factor authentication.

Contact the relevant provider immediately if:

Your SIM stopped working or may have been replaced
Your phone or identification document was lost
Your email, social-media account, e-wallet, or online-banking account was accessed by someone else
Loan proceeds passed through an account under your control
You disclosed an OTP, PIN, password, selfie, ID image, or account credentials to a suspicious person

Ask the telecommunications or financial provider to block unauthorized access and preserve relevant logs. Do not publish full IDs, account numbers, addresses, or specimen signatures when seeking help online.

Step 2: Send a formal written dispute to the lender or issuer

Use the provider’s official customer-assistance or fraud channel. Verify the contact information through its official website, app, statement, branch, or regulator—not through a link supplied by a collector or unknown caller.

Your dispute should identify the account sufficiently while masking unnecessary sensitive information. Include:

Your full name and reliable contact details
The disputed account or reference number
When and how you discovered it
A direct statement that you did not apply for or authorize the account
Whether you received, controlled, transferred, or benefited from any proceeds
Known circumstances of the identity compromise
The supporting documents attached
The specific action you want the provider to take

Ask the provider to:

Mark the account as disputed because of suspected identity theft
Suspend collection calls, endorsements, and adverse credit reporting while investigating, where legally and operationally appropriate
Prevent further drawdowns, purchases, or disbursements
Preserve the original application and all related records
Investigate the application, authentication, approval, disbursement, and account use
Correct or withdraw inaccurate information sent to the CIC, a credit bureau, collector, or other recipient
Give you a written finding and complaint reference number

Request reasonable access to records needed to understand and challenge the account, including:

The application and purported contract
IDs, photographs, selfies, signatures, and documents submitted
Phone numbers, email addresses, residential or employment details, and bank or e-wallet details used
Date and time records, device or session information, IP information, and authentication logs, if available
OTP, liveness-check, facial-verification, electronic-signature, call-verification, or branch-verification records
The destination and subsequent handling of the loan proceeds
The source from which the provider obtained your personal data
The entities to which the account or personal data was disclosed

Access may be subject to lawful redactions, security controls, confidentiality obligations, and the rights of other people. Ask the provider to preserve any material it cannot immediately release.

Under Section 16 of the Data Privacy Act of 2012, a data subject may request access to specified information, dispute inaccurate personal data, and seek its correction. Upon substantial proof and subject to the law, the data subject may also seek blocking, removal, or destruction of data that is false, unlawfully obtained, or used for unauthorized purposes.

Send the dispute through a channel that produces proof of delivery. Keep the sent email, ticket confirmation, courier receipt, branch-received copy, and all replies.

Do not accidentally acknowledge the debt

You may identify the disputed account without agreeing that it is yours. Avoid signing a restructuring agreement, promising payment, making a “good-faith” payment, or accepting a settlement simply to stop collection pressure before obtaining advice about its effect.

Use precise language such as:

I dispute this account in full. I did not apply for or authorize it, and my request for records or investigation is not an acknowledgment of the alleged debt.

Do not make a false statement if you participated in any part of the transaction, allowed another person to use your identity, received the proceeds, or later ratified an arrangement. Those facts can materially change the legal analysis and should be discussed candidly with a lawyer.

Step 3: Check and dispute your CIC credit report

An unauthorized account may damage your ability to obtain legitimate credit even if collection has not begun. Obtain your CIC credit report through a channel identified by the Credit Information Corporation.

If the account appears, use the CIC’s Online Dispute Resolution System. Filing a CIC dispute is free, but you must first obtain a CIC credit report. Under the published process:

The report used for the dispute must be no more than 30 days old.
The Transaction Reference Number in the report is required.
The email used for the dispute must correspond to the one used to obtain the report.
Supporting documents and a clear explanation should identify exactly which entry is wrong and why.

CIC classifies disputes as simple, complex, or highly technical. Its governing circular assigns resolution periods of three, seven, or twenty working days, respectively, measured from receipt of notice of the dispute, although an actual case may take longer if information is incomplete or further action is required.

CIC does not simply erase an entry on request. It works with the entity that submitted the data, and supporting contracts, receipts, identification records, and other documents may affect the outcome. Continue pursuing the dispute directly with the lender because correcting a credit report and determining responsibility for the alleged debt are related but distinct issues.

If the account appears in a report from another credit bureau, use that bureau’s official dispute process as well and retain proof of the result.

Step 4: Escalate to the correct financial regulator

If the provider is supervised by the BSP

Banks, digital banks, non-bank credit-card issuers, certain electronic-money issuers, pawnshops, money-service businesses, operators of payment systems, and other covered institutions may be BSP-supervised.

First complain through the institution’s own financial-consumer assistance mechanism. If the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism. The BSP identifies these channels:

BSP Online Buddy through the BSP website or its official Facebook channel
A completed Complaint/Inquiry/Reply form emailed to consumeraffairs@bsp.gov.ph

Attach proof that you first raised the complaint with the institution, the institution’s response or failure to respond, and the records supporting the identity-theft claim. The Financial Products and Services Consumer Protection Act requires financial regulators to maintain consumer-redress mechanisms and establishes standards including protection of consumer assets against fraud and misuse, protection of information, fair treatment, and effective recourse.

If it is a lending or financing company supervised by the SEC

Verify whether the company is registered and authorized to operate. Submit the complaint through the SEC’s official iMessage portal or the current channel published for the SEC Financial and Lending Company Division. The BSP’s official inter-agency directory lists flcd_complaints@sec.gov.ph for lending complaints.

Include the company’s legal and trade names, app or website, account details, copies of your prior dispute, and any evidence of unauthorized data use, harassment, threats, or disclosure to contacts.

An app’s presence in an app store does not establish that its operator is licensed. Conversely, an unfamiliar brand may be operated by a registered company under a different corporate name. Identify the actual creditor shown in the contract, disclosure statement, collection notice, or disbursement record.

Step 5: Report the suspected crime

When another person intentionally used identifying information through a computer system without right, the conduct may fall under computer-related identity theft in Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on the evidence, related conduct may also involve computer-related fraud, forgery, falsification, access-device fraud, or other offenses. The final charge is determined by investigators and prosecutors, not by the victim or lender.

A credit card, account number, code, or other means of obtaining money or value may be an “access device.” The Access Devices Regulation Act expressly addresses access devices applied for using falsified documents, false information, fictitious identities or addresses, or other false pretenses.

You may seek investigative assistance from:

The PNP Anti-Cybercrime Group or the appropriate police cybercrime unit
The NBI Cybercrime Division at ccd@nbi.gov.ph
An NBI regional or district office
The NBI online complaint facility, if suitable for the incident

Bring a government-issued ID, your incident timeline, the lender’s notices and replies, technical records, proof of identity compromise, and information tracing the proceeds. Ask for the complaint, blotter, or reference number and inquire what additional affidavit or original evidence is required.

Report promptly when logs, CCTV footage, call recordings, platform records, or transaction trails may be deleted under ordinary retention policies. Do not delay reporting merely because you do not know who committed the offense.

A police blotter, incident report, or affidavit documents your allegation; it does not by itself establish that the contract is forged, decide criminal liability, or compel deletion of a credit entry.

Step 6: Consider a complaint with the National Privacy Commission

An NPC complaint may be appropriate if a lender, collector, platform, employer, agent, or other personal-information controller unlawfully collected, used, disclosed, retained, or refused to correct your personal data.

Ordinarily, the NPC’s exhaustion rule requires you to notify the respondent of the privacy violation in writing and allow it to address the matter. You may proceed when the respondent fails to take timely or appropriate action or gives no response within 15 calendar days after receiving the written notice. The NPC may waive exhaustion in circumstances recognized by its rules, including certain serious violations or situations involving grave and irreparable harm.

The NPC’s complaint instructions call for a notarized Complaints-Assisted Form or a verified complaint, supporting documents, and any witness affidavits. The complaint may be submitted personally, by registered mail, by courier, or through an electronic channel authorized by the Commission. The NPC website currently directs complaint submissions to complaints@privacy.gov.ph.

A formal complaint must satisfy the 2021 NPC Rules of Procedure, including requirements concerning verification, material facts, evidence, relief requested, prior correspondence, and certification against forum shopping. Disclose related cases or complaints accurately; do not conceal a parallel proceeding before another agency or court.

The NPC process addresses data-privacy violations. It is not a substitute for disputing the debt with the lender, correcting the CIC record, or reporting a crime.

If a collector contacts you

Tell the collector in writing that the alleged account is disputed because of identity theft. Ask for:

The creditor’s full legal name
The account and endorsement reference
The collector’s authority and contact information
A statement of the alleged obligation
A secure channel for sending your dispute and supporting records

Send the creditor a copy of the dispute as well. Ask it to notify every collection agency or service provider handling the account.

Do not provide an OTP, password, PIN, card security code, remote access to your device, or unnecessary ID copies. Do not pay through a personal account or unofficial link. Preserve threats, public shaming, contact-list messages, or disclosures to relatives, coworkers, or friends; these may be relevant to regulatory and privacy complaints.

If the message is actually a summons, subpoena, court order, or official agency notice, do not ignore it. Verify it directly with the issuing court or agency and obtain legal help promptly. An earlier customer-service dispute does not automatically extend a court deadline.

Evidence that may help establish the account was unauthorized

No single document is conclusive in every case. Useful evidence may include:

A materially different signature, photograph, address, employer, email, or phone number
Proof that the submitted ID was altered, expired, lost, or previously reported compromised
Device, IP, location, or login information inconsistent with your activity
OTP or authentication records tied to a number or device you did not control
A disbursement to another person’s bank, e-wallet, remittance account, or address
CCTV, delivery, facial-verification, or recorded-call evidence identifying someone else
Your timely written denial before any payment, use, or benefit
Records of an earlier account takeover, phishing incident, SIM swap, data exposure, or lost device
Comparable authentic signatures, selfies, or account-opening records
Evidence that you were elsewhere when an in-person application or delivery occurred

Apparent inconsistencies are not always decisive. Shared devices, recycled phone numbers, authorized representatives, joint arrangements, incomplete records, and later receipt of proceeds can complicate the case.

Common mistakes to avoid

Reporting only by telephone and keeping no written record
Deleting messages, resetting a device, or closing an account before preserving evidence
Sending full IDs and signatures through an unverified email address or messaging account
Assuming that blocking a collector also corrects the lender’s records or CIC report
Filing a CIC dispute without separately notifying the creditor
Making a token payment or signing a restructuring document while denying the debt
Accusing a specific person publicly without adequate evidence
Inventing facts in an affidavit or denying proceeds you actually received
Assuming an affidavit of loss or police blotter automatically cancels the account
Ignoring a demand letter, summons, subpoena, or deadline because a regulator complaint is pending
Treating the NPC, BSP, SEC, CIC, police, and NBI processes as interchangeable

When legal help is urgent

Consult a Philippine lawyer promptly if:

A collection case or other court proceeding has been filed
You received a summons, subpoena, prosecutor’s notice, or formal agency order
Salary, property, a bank account, or collateral is being threatened
The amount is substantial or several accounts were opened
You know or suspect the perpetrator and the dispute involves a relative, employee, business partner, or former partner
You signed or submitted something connected with the application
Loan proceeds entered an account you own or control
A lender claims to have biometric, video, electronic-signature, or OTP proof
Your authentic documents were mixed with forged information
The provider refuses to preserve records or continues adverse reporting after receiving strong evidence
You face threats, stalking, extortion, doxxing, or danger to your family
You need to coordinate civil, criminal, privacy, regulatory, and credit-report remedies without making inconsistent statements

If private representation is unaffordable, inquire with the Public Attorney’s Office about eligibility and available assistance.

FAQ

Am I required to pay while the account is being investigated?

Do not assume either that payment is required or that the dispute automatically suspends every contractual or procedural consequence. State that you dispute the account in full and request a written hold on collection and adverse reporting. Obtain legal advice before paying, restructuring, or signing anything that could be treated as an acknowledgment.

Can the lender demand identity documents before processing my complaint?

The lender may reasonably verify that it is dealing with the affected person. Ask for a secure submission channel, the minimum documents required, the purpose of collection, and the retention or protection measures. Mask information that is unnecessary for verification.

What if the lender says an OTP proves I applied?

An OTP is relevant but may not be conclusive. Ask which number received it, who controlled that number, what device and session were involved, and whether there were account takeover or SIM-replacement indicators. Preserve telecom and device records.

What if the proceeds were sent to my e-wallet or bank account?

Report the matter immediately to that provider and preserve the full transaction trail. Do not move or spend unexplained funds. Because receipt or control of proceeds can materially affect the case, obtain legal advice before giving a detailed sworn statement.

Can CIC remove the account immediately?

CIC generally cannot unilaterally rewrite data merely on the consumer’s assertion. It sends the dispute to the submitting entity and monitors the correction process. A current CIC credit report, Transaction Reference Number, clear explanation, and supporting documents are important.

Should I file with every agency at once?

Use the channels that match the facts. The lender dispute and security response are usually immediate. A CIC dispute is needed if the entry appears in your credit report. BSP or SEC escalation depends on the provider. Police or NBI reporting addresses suspected crime, while the NPC addresses personal-data violations. Tell each agency about related proceedings where its forms or rules require disclosure.

What if I only received a text from an unknown collector?

Do not assume the debt or the message is genuine. Preserve it, verify the creditor through independent official channels, and avoid clicking links or sending IDs. If no legitimate provider can confirm the account, report the suspicious message and continue monitoring your financial and credit records.

Will reporting guarantee that the account is deleted?

No. The result depends on the records and facts. Reporting creates a documented dispute, helps preserve evidence, and activates the appropriate investigation or correction process, but it does not predetermine the outcome.

Official sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may depend on the provider, documents, transaction trail, and other facts. Official sources and filing information were checked as of August 27, 2026.