Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar credit facility was opened in your name without your consent, immediately dispute it in writing with the lender or financial service provider. State clearly that you did not apply for, authorize, receive, or benefit from the account. Ask the provider to:

block further transactions and collection activity;
preserve the application, identity-verification, device, IP-address, call, and disbursement records;
investigate the fraud;
suspend interest, fees, penalties, and adverse credit reporting while the account is disputed;
give you copies of the documents and information used to open the account; and
confirm in writing whether the account will be closed and removed from your records.

Also secure any compromised phone number, email, banking account, e-wallet, and government-issued ID. Report the identity misuse to the appropriate regulator and, where criminal conduct is suspected, to the NBI or PNP. If the fraudulent account appears in your credit report, file a separate dispute with the Credit Information Corporation (CIC).

A demand for payment does not by itself prove that you owe the debt. Consent is an essential element of a contract under Article 1318 of the Civil Code. However, the result of a dispute depends on the application records, authentication evidence, disbursement trail, and other facts. Do not ignore the account simply because it is fraudulent; challenge it promptly and create a written record.

What counts as an unauthorized credit account?

An account is potentially unauthorized when another person used your name or identifying information to obtain credit without your knowledge or permission. Examples include:

a loan-app account opened using a photograph of your ID;
a credit card or credit line you never applied for;
a loan applied for through a stolen phone, SIM, email, or online account;
an application containing a forged signature, false selfie, or substituted contact details;
credit obtained by a relative, employee, agent, or acquaintance who exceeded or never had your authority; or
an account discovered only through collection messages or a credit report.

Do not assume every unfamiliar name is fraud. A lender may use a corporate name different from its app or trade name, or an account may have been transferred to a collection agency. Ask for the original lender, application date, contract number, amount and destination of disbursement before reaching a conclusion.

An unwanted loan that you actually applied for is different from an account opened without your consent. Cancellation, cooling-off, repayment, and fraud rules may differ.

Act immediately

1. Secure the accounts and devices that may have been compromised

Change the passwords for your primary email, mobile-banking accounts, e-wallets, social-media accounts, and any cloud account containing ID images. Use unique passwords and enable multi-factor authentication.

Check for:

unfamiliar devices or active sessions;
email-forwarding rules you did not create;
password-reset messages;
changes to recovery numbers or email addresses;
unknown eSIM or SIM-replacement activity;
newly linked bank accounts, cards, or e-wallets; and
unauthorized transfers or cash-outs.

If your SIM stopped working unexpectedly or may have been duplicated, contact your telecommunications provider immediately. If an ID was lost or stolen, ask the issuing agency what replacement or incident-reporting procedure applies to that particular ID.

2. Contact the lender through a verified channel

Use contact details shown on the provider’s official website, regulated app, statement, or regulator listing—not a number supplied only in a suspicious text message.

Send a written notice with a subject such as “Identity-theft dispute: unauthorized account [reference number]”. Include:

your full name and reliable contact details;
the account or reference number, if known;
when and how you discovered it;
a direct statement that you did not apply for or authorize it;
whether you received any proceeds or recognized the destination account;
any compromised ID, phone, email, or device;
the relief you are requesting; and
a list of attachments.

Ask for a complaint or ticket number and the expected investigation period. Keep proof of delivery.

Under the Financial Products and Services Consumer Protection Act, regulated financial service providers must maintain a consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the provider must, pending its final investigation report, suspend the imposition of interest, fees, and charges or give a similar reasonable accommodation.

3. Ask the provider to preserve and disclose the application evidence

Request copies or a sufficiently detailed account of:

the application and purported contract;
the ID images, selfie, video, signature, and liveness-check results used;
the phone number and email registered;
one-time-password and authentication records;
device identifiers, IP addresses, timestamps, and relevant access logs;
recorded verification calls or chat transcripts;
the account into which the loan was released;
subsequent transfers or withdrawals, where lawfully disclosable;
delivery records for a physical card;
the provider’s investigation findings; and
any credit information already submitted about the account.

Some information may be withheld or redacted because it concerns another person, security controls, bank secrecy, or an active investigation. Even so, the provider should have enough information to explain the basis of its decision and respond meaningfully to your dispute.

4. Do not alter or destroy evidence

Preserve original messages and files. Screenshots are useful, but also retain the underlying email, text, call log, app notification, envelope, statement, or credit report when possible.

Do not delete the suspicious app or reset the affected device until important evidence has been copied, unless leaving it in place creates an immediate security risk. Do not confront a suspected offender through an account that may still be compromised.

Evidence to preserve

Create a simple chronological file containing:

the first collection message, statement, or credit-report entry;
the lender’s name, app name, website, phone numbers, and account reference;
screenshots showing dates, times, URLs, sender details, and complete message threads;
proof that an ID, phone, SIM, email, or device was lost or compromised;
notices from your telecom provider, bank, e-wallet, or email service;
bank and e-wallet statements showing that you did not receive the proceeds—or showing where suspicious funds went;
specimens of your genuine signature, if a signature is disputed;
your written complaint, attachments, delivery receipt, and ticket number;
every response from the lender and collection agency;
your CIC credit report and dispute records;
police, NBI, or PNP reports and affidavits; and
a log of calls identifying the date, time, number, representative, and substance of the conversation.

Share only what is necessary. Redact unrelated balances, transactions, account numbers, and ID numbers when full details are not required. Send sensitive documents only through verified channels.

Where to report the account

Several reports may be necessary because each body has a different role. A regulator’s complaint process does not automatically replace a criminal report or correct a CIC credit entry.

The lender or financial service provider

Start with the provider’s consumer-assistance unit. This is the fastest route to stopping collection, obtaining records, and securing an internal correction.

Ask for written confirmation that:

the account is formally marked as disputed;
collection calls and automated demands have been suspended or appropriately limited;
interest, fees, and penalties are suspended or otherwise accommodated during investigation;
adverse reporting will be withheld or corrected as warranted; and
the provider has instructed its collection agency and credit-data recipients about the dispute.

If a collector contacts you, give the collector the lender’s ticket number and send the same written dispute to the collector. Do not send money or identity documents to an unverified collector.

Bangko Sentral ng Pilipinas

If the provider is supervised by the BSP—such as a bank, many non-bank financial institutions, or an e-wallet provider—first raise the complaint with the provider. If it remains unresolved or its response is unsatisfactory, escalate it through the BSP Consumer Assistance Mechanism.

The BSP identifies its Online Buddy, or BOB, as a complaint channel. It also accepts the prescribed Complaints, Inquiries and Requests form through the official email address shown on that page. Attach your provider complaint, ticket number, response, chronology, and supporting evidence.

Securities and Exchange Commission

For a lending company, financing company, or its online lending platform, complain first through the company’s official complaints mechanism. If unresolved, use the SEC’s official iMessage portal and select the service appropriate to lending or financing-company complaints.

Identify both the app or platform name and the corporation operating it. They may be different. The SEC maintains official information concerning lending and financing companies, including recorded platforms and entities whose authority has been suspended or revoked.

If the supposed lender cannot be identified or appears unlicensed, report that fact to the SEC and law enforcement. Do not install another app or follow a private “verification” link merely to investigate it.

Credit Information Corporation

A complaint to the lender does not necessarily correct your credit report automatically.

Obtain your CIC credit report through a channel listed by the Credit Information Corporation. If it contains the unauthorized account, use the CIC’s Online Dispute Resolution System.

You must first obtain the credit report containing the disputed data. Identify the specific contract and submitting entity, explain that the account resulted from identity misuse, and attach the strongest available records. CIC explains that it cannot unilaterally rewrite submitted data; it relays the dispute to the submitting entity and relies on the dispute process and supporting documents.

Review a fresh report after the dispute is resolved. One correction may not reach every private credit bureau or internal lender database, so ask the provider which recipients received the inaccurate information and whether corrections were sent to each of them.

National Privacy Commission

Opening or maintaining an account using misappropriated personal data may raise issues under the Data Privacy Act of 2012, including the rights to access and correct personal information and the obligation to protect it.

Before filing with the NPC, the general rule is to notify the lender, personal information controller, processor, or other concerned entity in writing and give it an opportunity to act. The NPC’s complaint mechanics state that exhaustion is ordinarily shown when the entity fails to take timely or appropriate action, or gives no response within 15 calendar days after receiving the written notice. Exceptions may apply under the NPC’s rules, but they should not be assumed without examining the circumstances.

The NPC requires a notarized complaint-assisted form or verified complaint, with supporting evidence and witness affidavits where applicable. Its current filing instructions and forms should be checked before submission.

A privacy complaint is particularly relevant when:

the provider cannot explain how it obtained or verified your data;
it refuses a proper request for access or correction;
your information was disclosed to collectors or contacts without lawful basis;
the provider failed to secure information reasonably; or
collection continues using inaccurate identity or account data after notice.

NBI, PNP, or other law enforcement

Report promptly if someone appears to have forged documents, taken loan proceeds, compromised an online account, used your identifying information, threatened you, or is continuing to open accounts.

You may seek help from the NBI Cybercrime Division, use the NBI’s online complaint page, or approach an NBI regional or district office. You may also report to the PNP, including its cybercrime or anti-cybercrime units where appropriate.

Bring government-issued identification, a concise affidavit or chronology, lender details, proof of the disputed account, electronic evidence, and evidence of the destination of proceeds if available. Ask for a copy or reference number for the report.

Possible offenses depend on the evidence. Computer-related identity theft is defined in Section 4(b)(3) of the Cybercrime Prevention Act. Fraudulently applying for an access device may fall under the Access Devices Regulation Act. The Anti-Financial Account Scamming Act also penalizes specified conduct involving financial accounts, including opening certain accounts using another person’s identity or identification documents. Law enforcement and prosecutors—not the complainant—determine the appropriate charge based on the facts.

What to say in your written dispute

Your notice can be short and factual:

I dispute account [number] as unauthorized. I did not apply for, consent to, sign, activate, use, or receive the proceeds of this account. Please immediately mark it as disputed, prevent further use, preserve all application and authentication evidence, suspend interest, fees, penalties, collection escalation, and adverse credit reporting while you investigate, and give me the records and final written findings supporting your decision. Please also identify the destination of the loan proceeds and every credit-information recipient to which this account was reported, to the extent lawfully disclosable.

Modify this statement if any part is not true. For example, disclose if money entered your account but was transferred out without authority, or if you initially mistook the deposit for something else. Accuracy strengthens your complaint and avoids a misleading report.

Are you legally required to pay?

A person is not ordinarily bound by a credit contract that the person never made or authorized, because contractual consent is essential. But identity-fraud cases are evidence-sensitive. A provider may claim that its records show your device, one-time password, signature, selfie, bank account, or receipt of proceeds.

The key questions commonly include:

Who completed the application?
What authentication was used?
Where were the proceeds sent?
Who controlled the receiving account?
Did you authorize another person to act?
Did you later knowingly accept, use, affirm, or settle the account?
Were your credentials compromised through deception, theft, or negligence?
Did the provider follow its identity-verification and security controls?

Do not falsely deny a transaction or omit material facts. Do not sign a restructuring agreement, settlement, acknowledgment of debt, or payment promise merely to stop calls without first understanding its effect. If you decide to make any payment to protect an urgent interest, obtain individual legal advice and state your position in writing.

If collection or harassment continues

Tell the collector in writing that the debt is disputed because of identity theft and provide the original complaint reference. Ask for the collector’s full name, company, authority from the creditor, and contact details.

Preserve threats, public posts, messages to relatives or coworkers, deceptive statements, and disclosure of the alleged debt to third parties. The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices by covered providers. Separate SEC, BSP, NPC, criminal, or civil remedies may apply depending on who collected, what was said, and how personal data was used.

A legitimate dispute does not permit you to threaten, harass, impersonate, or publish private information about employees or a suspected offender. Keep communications factual.

Common mistakes to avoid

Ignoring the first notice. Delay allows additional charges, collection referrals, and credit reporting.
Relying only on phone calls. A written complaint with proof of delivery is much easier to establish.
Sending IDs to an unverified number. The “investigator” may be the identity thief.
Paying a small amount just to stop the calls. Payment or a settlement document may complicate your factual and legal position.
Disputing only with the collector. Notify the original provider and the appropriate regulator.
Assuming a police report fixes the credit record. File the CIC dispute and demand corrections from the data submitter.
Deleting messages or resetting the device too soon. Preserve evidence first when safely possible.
Using identical passwords after the incident. Secure the email and mobile number that can reset other accounts.
Making an exaggerated or false report. State only what you know and label reasonable suspicions as suspicions.
Posting complete IDs and account records online. Public exposure can enable further fraud.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, without delay when:

a court summons, subpoena, prosecutor’s notice, or formal demand has arrived;
the lender has filed a collection case;
several accounts or a substantial amount is involved;
loan proceeds passed through one of your accounts;
a spouse, relative, employee, or business associate had some authority to act for you;
you signed any document connected with the transaction;
the provider rejects the dispute despite strong contrary evidence;
your wages, property, business, or essential banking access may be affected;
the incident involves threats, extortion, stalking, or physical danger; or
you are being treated as a suspect, account mule, or participant rather than a victim.

Court and agency deadlines may continue even while an internal investigation is pending. Never ignore an official summons or order.

Frequently asked questions

Do I need a police or NBI report before contacting the lender?

No general rule requires you to wait for a criminal report before disputing the account with the lender. Contact the lender immediately. A law-enforcement report may nevertheless support the dispute and is important when criminal conduct or continuing identity misuse is suspected.

Can the lender demand a notarized affidavit?

The provider may reasonably request an affidavit and identity verification as part of its investigation. Verify the request and channel before sending sensitive documents. Read the affidavit carefully and keep a copy.

Should I pay while the investigation is pending?

Promptly request suspension of interest, fees, charges, and collection escalation under the provider’s complaint process. Do not sign an acknowledgment or settlement without understanding the consequences. The safest course depends on the evidence and any pending legal proceeding.

What if the money was released to my bank or e-wallet?

Disclose that fact. Explain whether you authorized, noticed, used, transferred, or lost control of the funds. Immediately notify the receiving institution and ask it to preserve transaction records. Receipt into an account bearing your name is important evidence but may not, by itself, answer who controlled the transaction.

What if the lender says the one-time password proves I applied?

An OTP record is relevant, but it may not resolve whether the phone, SIM, email, or device was compromised. Request the complete authentication and disbursement trail and submit evidence of any SIM replacement, account takeover, phishing incident, or unauthorized device access.

Can I demand deletion of every record?

You can demand correction of inaccurate data and closure of an unauthorized account. Complete deletion is not always available because providers may have legal duties to retain transaction, complaint, anti-fraud, accounting, or regulatory records. Ask that retained records clearly state that the account was disputed and, if established, resulted from fraud and was not your obligation.

Will filing with the NPC automatically cancel the loan?

No. The NPC addresses personal-data processing and privacy rights. Cancellation of the account, correction of credit data, criminal investigation, and financial redress may require separate action before the provider, CIC, financial regulator, or law enforcement.

What if I do not know which company owns the loan app?

Preserve the app name, download-page URL, developer name, privacy policy, payment instructions, text messages, phone numbers, and collection details. Check official SEC information for lending and financing companies, then report the unidentified or apparently unauthorized operation to the SEC and law enforcement. Do not pay an unverified recipient.

Official resources

This article provides general Philippine legal information, not advice for a particular case. Procedures and legal consequences depend on the provider, documents, transaction trail, and pending proceedings. Official sources and filing information were checked on 27 August 2026.