Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar facility was opened in your name without your knowledge or consent, report it immediately to the lender or account issuer as identity theft and formally dispute the account in writing. Ask the institution to freeze further use, stop collection activity while the account is investigated, preserve its records, correct its internal files, and remove any inaccurate credit information it submitted.

Also secure the email, mobile number, e-wallet, bank account, and IDs that may have been compromised. If the account appears in your Credit Information Corporation (CIC) credit report, file a separate CIC dispute. Escalate unresolved complaints to the regulator that supervises the provider—usually the Bangko Sentral ng Pilipinas (BSP) for banks and other BSP-supervised institutions, or the Securities and Exchange Commission (SEC) for lending and financing companies. Report suspected identity theft or online fraud promptly to the National Bureau of Investigation (NBI), Philippine National Police (PNP), or Department of Justice Office of Cybercrime.

An account being recorded under your name does not, by itself, establish that you validly consented to the loan. Whether an enforceable obligation exists depends on the evidence, including the application, authentication records, contract, signatures or electronic consent, and where the proceeds went.

Act immediately

Take these steps as soon as you discover the account:

Contact the lender through an independently verified channel. Use the institution’s official website, app, branch, or published hotline—not a number or link contained only in a suspicious message.
State clearly that the account is unauthorized. Do not describe it merely as an “incorrect balance” or “billing concern.” Say that you did not apply for, authorize, receive, or benefit from the loan or credit account, as applicable.
Request an immediate protective hold. Ask the institution to:
- block further drawdowns, purchases, cash advances, or changes to the account;
- flag the account as disputed for suspected identity theft;
- suspend collection calls, endorsements, and adverse reporting while it investigates;
- preserve the application, verification, transaction, device, and communication records;
- prevent changes to the registered phone number, email address, or mailing address; and
- give you a case or reference number.
Send a written dispute the same day. A phone call is useful for urgent containment, but a dated written complaint is easier to prove.
Secure other accounts. Change passwords from a trusted device, sign out other sessions, enable multifactor authentication, and contact your mobile provider if your SIM may have been replaced, ported, or taken over.
Preserve evidence before deleting or blocking anything. Save messages, emails, call logs, URLs, app pages, collection notices, credit reports, and account alerts.
Report the crime promptly. Early reporting can help investigators seek preservation of electronic records before they are deleted under ordinary retention practices.

What to put in your written dispute

Address the complaint to the provider’s fraud, consumer-assistance, customer-service, or data-protection office. Include:

your full name and safe contact details;
the account or reference number, showing only what is necessary;
when and how you discovered the account;
a direct statement that you did not apply for or authorize it;
whether you received any proceeds, goods, card, or benefit;
any information that is plainly wrong, such as the phone number, email address, employer, address, selfie, signature, or disbursement account;
the police, NBI, or other report number, if already available;
a chronological summary of relevant events; and
the specific corrective action you want.

Request written confirmation of the investigation and copies of records needed to understand and dispute the account, subject to lawful limitations. Relevant records may include:

the application and submitted identity documents;
the alleged contract, promissory note, disclosure statement, or electronic-consent record;
date-and-time stamps;
registered phone numbers and email addresses;
authentication, one-time-password, and account-recovery records;
device, IP-address, geolocation, selfie, liveness-check, and identity-verification records, if collected;
delivery records for any physical card;
the account to which loan proceeds were released;
purchase, transfer, withdrawal, and repayment history;
recordings or transcripts of verification calls; and
the identities of credit bureaus, collectors, or other recipients to which the account was reported or disclosed.

Do not ask the institution to send unredacted passwords, security codes, or another person’s protected data. It may need to redact information while still providing enough material to address your dispute.

A useful statement is:

I dispute this account as unauthorized identity theft. I did not apply for, consent to, or authorize this credit facility. Please block further use, preserve all application and authentication records, investigate the account, mark it as disputed, stop collection and adverse reporting while the investigation is pending, and correct all inaccurate records and disclosures. Please acknowledge this complaint and provide a case reference number in writing.

Modify that statement if, for example, you applied for a different product, started an application but did not complete it, or received funds without knowing their source. Accuracy matters.

Do not accidentally weaken your dispute

Until you understand the records and have obtained legal advice where necessary:

Do not sign a restructuring agreement, promissory note, settlement, or acknowledgment of debt merely to stop collection calls.
Do not make statements such as “my loan” if you deny opening the account.
Do not guess how the fraud happened. Separate what you know from what you suspect.
Do not send complete ID numbers, card details, passwords, PINs, or one-time passwords through insecure channels.
Do not alter screenshots or crop out dates, sender details, URLs, or other context.
Do not delete the original messages after taking screenshots.
Do not pay a supposed “verification,” “cancellation,” or “account-closing” fee demanded by an unknown caller.
Do not rely solely on a police blotter. You must still dispute the account with the lender and, when necessary, the credit-information system and regulator.

If money unexpectedly entered your bank or e-wallet account, do not spend it or return it to instructions supplied by an unknown caller. Notify both the alleged lender and the receiving institution through official channels and ask for documented handling instructions.

Evidence to preserve

Create a folder containing the original or best available copies of:

SMS, chat, and email messages, including headers where available;
collection letters, statements of account, demand letters, and envelopes;
screenshots showing the full page, date, time, URL, sender, and account reference;
your call logs and notes identifying the caller, number, date, time, and statements made;
recordings you lawfully possess;
credit reports showing the disputed account;
proof that your ID, phone, email, or online account was lost or compromised;
SIM-replacement or account-recovery notices;
bank or e-wallet statements showing whether proceeds were received;
examples of your genuine signature, if a signature is disputed;
proof of your actual address, employer, phone number, or email address at the relevant time;
every complaint, acknowledgment, reference number, and response; and
a dated timeline of events.

Keep original electronic files. Forwarding, editing, compressing, or repeatedly screenshotting a screenshot can remove useful metadata. Back up the evidence to a second secure location.

Your rights concerning the account and your personal data

A valid contract generally requires consent, an object, and consideration under the Civil Code. In an identity-theft case, the central factual question is often whether the institution can connect the application and authentication to you and show genuine consent. Electronic transactions are not invalid merely because they were completed online, but electronic records and signatures still must be properly attributable and proved.

The Data Privacy Act of 2012 gives data subjects rights that include access to personal data and correction of inaccurate or erroneous information. It also requires personal data to be processed fairly and lawfully and to be accurate and kept up to date. Depending on the facts, unauthorized use of identifying information may also involve unlawful personal-data processing.

Computer-related identity theft is an offense under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. The provision covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person. Other offenses may apply depending on how the account was created and used, but the proper charges are determined by investigators and prosecutors from the evidence.

These laws do not mean that every data error is automatically a crime or that the lender is automatically liable for the fraud. The identity of the offender, the lender’s security and verification measures, the source of the data, and the institution’s response all require evidence.

Report first to the lender or account issuer

Identify the provider before choosing a regulator. The name of a mobile app may differ from the legal name of the company that extended the credit.

If it is a bank, credit-card issuer, e-money issuer, or other BSP-supervised institution

First use the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. BSP rules treat the provider as the first-level recourse.

If the provider does not resolve the complaint satisfactorily, escalate it through the BSP Consumer Assistance Mechanism. The BSP identifies the BSP Online Buddy, or BOB, on its website and official Facebook page as the primary channel. If you cannot use BOB, the BSP’s current instructions allow submission of its complaint form and supporting documents to consumeraffairs@bsp.gov.ph.

Attach proof that you first raised the issue with the institution and include its response, if any. The BSP warns complainants not to disclose passwords, PINs, complete card or account numbers, passbooks, passports, or identification cards unnecessarily in a BSP complaint.

The BSP Consumer Assistance Mechanism facilitates resolution; it is not itself a criminal complaint. The Financial Products and Services Consumer Protection Act also gives financial regulators consumer-redress and adjudicatory authority within the limits set by law.

If it is a lending or financing company supervised by the SEC

Use the SEC’s official complaint procedure for lending and financing companies. The SEC currently requires a completed complaint form, supporting evidence, and a copy of a valid government-issued ID, with one complaint form for each respondent company.

Follow the filing channels and addresses shown on the SEC page at the time you submit. The SEC explains that its complaint process does not itself authorize the Commission to rewrite a contract, declare it void, or cancel an obligation. In an identity-theft case, therefore, describe the issue precisely: you dispute that you entered into the alleged loan at all, rather than merely requesting more favorable payment terms.

You can also check the SEC’s official records to determine whether the lender is registered and has authority to operate as a lending or financing company. An unregistered or falsely identified operator should still be reported to law enforcement.

If you cannot identify the real provider

Ask the collector, in writing, for the legal name of the creditor, account reference, date of origination, original amount, and documentary basis of the claim. Do not give additional identity information beyond what is reasonably necessary.

Search the institution’s name through official BSP or SEC resources. If a demand letter identifies a law office or collection agency, contact it using independently verified details and state that the account is disputed for identity theft. Ask it to preserve the referral records and return the dispute to its client for investigation.

Correct your CIC credit report

Obtain your CIC credit report through a channel listed by the Credit Information Corporation. Review names, addresses, contracts, balances, payment history, and the identity of each submitting entity.

If the unauthorized account appears, use the CIC’s Online Dispute Resolution System. This is separate from disputing the account with the lender.

Under Section 6 of the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. The law directs CIC to investigate and verify disputed information within five working days from receipt of the complaint; information that cannot be verified and proved must be deleted. Actual completion may also depend on the submitting entity’s response and the applicable CIC process, so keep the dispute number and monitor the result.

Correcting a CIC report does not automatically erase the lender’s internal record or resolve a criminal investigation. Likewise, a lender’s correction may not immediately update every report. Pursue both tracks and obtain written confirmation of each correction.

If inaccurate information appears in a report from a private credit bureau or special accessing entity, use that organization’s own dispute process as well and ask which source supplied the entry.

File a privacy complaint when appropriate

Write first to the lender, app operator, collector, or other organization that processed your data. Address the data-protection officer if one is identified. Explain the suspected misuse and request access, correction, preservation, restriction where legally available, and disclosure of relevant data recipients.

Under the National Privacy Commission’s 2021 Rules of Procedure, an NPC complaint ordinarily will not be given due course unless you show that:

you informed the personal information controller, processor, or concerned entity of the violation in writing; and
it failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your written notice.

Exceptions may apply under the Rules, including situations involving serious harm or circumstances in which prior resort to the respondent is not practicable. Do not assume an exception applies without checking the facts.

If the matter remains unresolved, follow the NPC’s current formal complaint instructions and use its prescribed complaint-affidavit or Complaints-Assisted Form. Attach the written notice, proof of receipt, response or proof of nonresponse, and supporting evidence. The NPC warns that failure to attach supporting evidence can result in dismissal.

An NPC proceeding addresses data-privacy violations. It is not a substitute for disputing the debt, correcting the credit report, or reporting a crime.

Report suspected identity theft or fraud

You may report to the NBI Cybercrime Division, the PNP’s cybercrime unit, or another police office capable of receiving the complaint. Bring:

a valid ID;
a printed chronology;
the disputed account information;
the lender’s responses;
screenshots and original electronic files;
relevant bank or e-wallet statements;
details of suspected recipients of the proceeds; and
the device containing the original messages, if requested.

The NBI provides an online complaint page and publishes current Cybercrime Division details in its directory. The Department of Justice also publishes guidance for reporting cybercrime incidents.

Ask for a receiving copy, reference number, or other proof of your report. A barangay or police blotter may help establish when you reported the incident, but investigators may require a complaint-affidavit and supporting evidence before a criminal case can proceed.

Do not publicly accuse a specific person unless you have reliable evidence and legal advice. Give suspicions and supporting facts to investigators.

If collectors are already contacting you

Tell each collector, in writing, that:

the account is disputed as identity theft;
you did not authorize the account;
the creditor has been asked to investigate;
all collection and communication records must be preserved; and
future communications should be in writing through a specified safe channel.

Keep records of threats, repeated calls, impersonation, disclosure to relatives or employers, publication of your information, or demands sent to people who are not borrowers or guarantors. Such conduct may raise separate consumer-protection, privacy, or criminal issues depending on the facts.

Do not ignore a summons, subpoena, court pleading, or formal regulatory notice. A demand text is not the same as a court case, but official legal documents carry deadlines.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a complaint, summons, subpoena, or court order has been served;
the lender has sued or threatened foreclosure, repossession, garnishment, or seizure;
the unauthorized balance is substantial or several institutions are involved;
the lender claims you authenticated the account using biometrics, a one-time password, or an electronic signature;
proceeds entered an account you own and were moved by someone else;
a family member, employee, or business associate may have used your identity;
your signature or government ID appears to have been forged;
you are being threatened, extorted, doxxed, or harassed;
an employer, housing provider, insurer, or legitimate lender has acted on the false credit information;
the institution refuses to provide a meaningful investigation result or continues adverse reporting despite strong contrary evidence; or
you are asked to execute an affidavit and are uncertain about its legal effect.

The Public Attorney’s Office may provide assistance to qualified applicants. Law-school legal-aid clinics and the Integrated Bar of the Philippines may also have referral or assistance programs, subject to their current requirements and availability.

Common mistakes

Reporting only by phone

Calls may stop immediate transactions, but a written record is necessary for escalation and proof of exhaustion before an NPC complaint.

Disputing only with the credit bureau

The bureau records information supplied by institutions. You should also dispute the underlying account with the lender.

Assuming a police report automatically cancels the account

Law enforcement investigates possible crimes. The creditor, CIC, regulator, or a court may still need to address the account and its records.

Paying simply to protect your credit score

Payment, settlement, or restructuring can complicate the factual and legal record. Obtain advice before taking an action inconsistent with your position that the account is unauthorized.

Sending excessive personal information

A complaint requires enough information to identify you and the account, but sending passwords, PINs, complete card credentials, or unnecessary ID copies can create further risk. Redact irrelevant details unless an authorized recipient specifically requires them through a secure process.

Waiting for the lender before securing other accounts

Containment should happen in parallel. Secure your email, phone, financial accounts, and government-service accounts immediately.

Treating every collection contact as proof that the caller is the lender

Fraudsters sometimes impersonate lenders or collectors. Verify the legal entity and its contact details independently before sending documents or money.

Frequently asked questions

Am I required to pay an account I never opened?

Not merely because an account bears your name. The existence and enforceability of any obligation depend on whether a valid agreement can be established and what the evidence shows. Do not ignore the claim; dispute it promptly and require the creditor to investigate.

Should I pay a small amount while the investigation is pending?

Seek legal advice before doing so. A payment may complicate your position or be characterized as conduct recognizing the account, depending on the circumstances.

Can I demand that the lender delete every record immediately?

You can demand correction of inaccurate information and appropriate restriction of disputed processing, but an institution may lawfully retain certain records for investigation, regulatory compliance, fraud prevention, or legal claims. Ask it to correct adverse account information while preserving evidence of the fraud.

What if I once sent my ID or selfie to the same app?

That does not necessarily prove that you authorized the disputed account. Explain exactly what you submitted, for what purpose, and whether the disputed loan was different from the transaction you intended. The complete application and authentication trail will matter.

What if an OTP was sent to my phone?

An OTP record is relevant but may not conclusively resolve who controlled the phone or entered the code. Preserve evidence of SIM replacement, device compromise, phishing, account recovery, unusual login alerts, or loss of service.

What if the proceeds were released to somebody else’s account?

Tell the lender and investigators immediately. Request preservation of the beneficiary-account, transfer, withdrawal, device, and authentication records. Do not contact or threaten the recipient yourself.

What if the account is not yet in my CIC report?

Continue the lender dispute and ask it not to submit the account as yours. Keep monitoring your credit report. A missing CIC entry does not prove that no internal or privately reported account exists.

Can the NPC cancel the debt?

The NPC decides data-privacy matters. It is not the ordinary forum for declaring whether a loan contract is valid or cancelling a debt. Use the lender’s dispute process, CIC correction process, relevant financial regulator, law enforcement, and—when necessary—legal counsel or the courts.

Is there one deadline for all reports?

No. Different criminal, civil, privacy, regulatory, contractual, and procedural periods may apply. The NPC’s ordinary exhaustion rule includes a 15-calendar-day response period after written notice, while the Credit Information System Act specifies five working days for CIC’s investigation and verification of a credit-information dispute. These are not universal filing deadlines. Report immediately and obtain legal advice if significant time has passed.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. The correct response may depend on the provider’s identity, the alleged contract, authentication and disbursement records, and other specific facts. Official sources and procedures were checked as of August 26, 2026.