Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar credit facility was opened using your identity without your consent, dispute it immediately in writing with the lender or issuer. State clearly that:

You did not apply for, authorize, sign, receive, or benefit from the account.
You dispute the entire account and every charge, interest, fee, and collection demand connected with it.
The provider must flag the account as fraudulent, prevent further use or disbursement, suspend collection and the accrual of disputed interest and charges while investigating, preserve all application and authentication records, and correct any credit information reported under your name.
You want a case number, the investigation timetable, and the final decision in writing.

A person generally cannot be bound by a loan contract to which they never consented. Consent is an essential element of a contract under Article 1318 of the Civil Code. However, the result may depend on evidence—particularly if your phone, email, ID, signature, selfie, one-time password, or account was used, or if the loan proceeds reached an account you controlled.

Do not rely on a phone call alone. Report the matter through the provider’s official consumer-assistance or fraud channel, preserve proof of the report, and escalate to the proper regulator, law-enforcement agency, Credit Information Corporation, or National Privacy Commission as appropriate.

Act immediately

There is no single legal deadline covering every unauthorized loan. Report it as soon as you discover it because funds may still be disbursed, records may be overwritten, collection may continue, and adverse credit information may be submitted.

1. Confirm the account without dealing through the suspicious message

Contact the lender using details from its official website, mobile application, branch directory, or regulator listing—not a number or link supplied by a collector or unexpected text message.

Ask for enough information to identify the account:

Provider’s legal and trade name
Account or application reference number
Date and channel of application
Type and original amount of credit
Date, amount, and destination of any disbursement
Mobile number and email address registered to the account
Current balance and account status
Whether the account has been reported to the Credit Information Corporation or another credit-information service
Name and contact details of any collection agency handling it

Do not send a complete ID image, selfie, signature specimen, OTP, password, PIN, or card details through an unofficial email address, messaging account, or collector’s personal number.

2. Secure the accounts that may have enabled the fraud

After preserving screenshots and other evidence:

Change the passwords of your primary email, financial applications, cloud storage, and social-media accounts.
Enable multi-factor authentication using a method the intruder cannot access.
Sign out unknown devices and review account-recovery details.
Ask your telecommunications provider to investigate unexplained SIM replacement, loss of service, or unauthorized account changes.
Notify banks and e-wallet providers if your credentials or identification documents may have been compromised.
Report a lost or stolen ID to the issuing agency and keep the report or replacement record.
Review recent bank and e-wallet statements for an unfamiliar loan disbursement, cash-out, transfer, or account-opening verification charge.

Do not factory-reset or dispose of a relevant phone until important messages, logs, application details, and files have been preserved. If law enforcement may need the device, ask how it should be handled before altering it further.

Send a written identity-theft dispute

Address the dispute to the provider’s fraud unit or Financial Consumer Protection Assistance Mechanism. The Financial Products and Services Consumer Protection Act requires financial service providers to maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the provider must suspend interest, fees, and charges while its final investigation is pending, or give a similar reasonable accommodation.

Your dispute should include:

Your full name and secure contact details
The account or application reference
When and how you discovered the account
A direct statement that you did not apply, consent, sign, authorize another person, receive the proceeds, or use the credit
Any particular detail showing that the application was not yours
A list of attachments
The exact relief you are requesting

A useful statement is:

I dispute this account in full as an unauthorized account opened through identity misuse. I did not apply for or consent to this loan or credit facility, authorize anyone to apply for me, sign or authenticate the application, receive or use its proceeds, or agree to its terms. Please treat this as a fraud and identity-theft report.

Ask the provider to:

Immediately restrict the account and stop additional withdrawals, purchases, disbursements, limit increases, and changes to its contact details.
Suspend collection activity and disputed interest, penalties, fees, and charges while the investigation is pending.
Tell internal and external collectors that the account is disputed because of alleged identity theft.
Preserve the complete application, approval, authentication, disbursement, servicing, and collection records.
Investigate whether its identity-verification and security controls were bypassed, manipulated, or improperly performed.
Correct or withdraw any inaccurate credit information and notify recipients of the correction.
Provide its written findings, supporting basis, and available appeal or escalation process.
Confirm in writing if the account is closed, cancelled, or removed from your liability.

Request access, subject to lawful restrictions, to relevant records such as:

Application and loan or credit agreement
Submitted identification documents, photograph, selfie, video, and signature
Electronic-signature and consent records
Date, time, IP address, device information, and application audit trail
OTP destination and authentication history
Call recordings, chat transcripts, email records, and branch documents
Identity-verification or know-your-customer results
Disbursement instructions and destination, to the extent legally disclosable
Records showing how the proceeds were used or withdrawn
Information on the source, recipients, access, and modification of your personal data

Electronic documents and signatures may be legally recognized, but their existence does not automatically prove that you created or authorized them. Under the Electronic Commerce Act and the Rules on Electronic Evidence, authenticity may still have to be established through reliable evidence and security procedures.

Preserve evidence

Keep the original electronic files where possible, not only cropped screenshots. Preserve:

Complete texts, emails, chat conversations, call logs, voicemails, and collection letters
Message headers, sender details, dates, times, URLs, and application names
Screenshots showing the full screen and account reference
The credit report or notice through which you discovered the account
Bank and e-wallet statements showing that you did not receive the proceeds—or identifying an unfamiliar receipt and its immediate disposition
Your location, work, travel, or device records relevant to the application date
Proof that the contact number, email, device, signature, selfie, or address used was not yours
Lost-ID, SIM-replacement, hacking, or account-recovery records
Complaint acknowledgments and reference numbers
Names, dates, and summaries of calls with the provider and collectors
Sworn statements from witnesses with direct knowledge
The provider’s decisions, investigation reports, and collection notices

Maintain a simple chronological incident log. Do not edit the original files. Back them up securely and avoid publishing sensitive evidence on social media.

A police blotter or affidavit can support your account, but it does not by itself cancel the loan or correct a credit report. The lender, regulator, credit-information system, and law-enforcement process serve different purposes.

Escalate to the correct regulator

For a bank, digital bank, credit-card issuer, or other BSP-supervised institution

Complain to the institution first. If its response is absent, delayed, or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism.

You may use the BSP Online Buddy, or send the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph. Attach:

Your complaint to the institution
Its reply, if any
Supporting documents
The outcome you are requesting
Your daytime contact details

The BSP lists banks, digital banks, non-bank credit-card issuers, electronic-money issuers, and other covered entities in its directory of supervised institutions’ consumer-assistance channels.

For a lending or financing company supervised by the SEC

Use the SEC iMessage ticketing system and select the service for complaints involving financing or lending companies. The SEC’s published complaint procedure calls for its complaint form, a valid government-issued ID, and supporting documents. The SEC ordinarily furnishes the complaint to the company, which is given ten days from receipt to submit an answer or comment.

If you cannot identify the legal company behind a lending application, include the application name, website, advertised name, phone numbers, payment instructions, screenshots, and any recipient account details. An application’s brand name may differ from the registered lending company.

A regulator’s administrative process does not automatically replace a criminal complaint, privacy complaint, credit-report dispute, or court defense.

Report possible identity theft or fraud to law enforcement

If electronic systems, messages, falsified documents, or stolen credentials were used, report the incident to the NBI Cybercrime Division, an NBI regional or district office, or the appropriate PNP cybercrime unit. The Cybercrime Prevention Act assigns cybercrime enforcement responsibilities to the NBI and PNP.

The NBI provides an online complaint page and an in-person Cybercrime Division complaint process. For an in-person complaint, be prepared to undergo an interview, execute a sworn complaint or affidavit, submit supporting records, and—if relevant—allow examination of a device.

Possible offenses depend on the evidence and may include:

Computer-related identity theft under the Cybercrime Prevention Act
Fraudulent application for or use of an access device under the Access Devices Regulation Act, as amended by Republic Act No. 11449
Opening a covered financial account using another person’s identity or identification documents under the Anti-Financial Account Scamming Act
Falsification, estafa, or Data Privacy Act offenses, where their particular legal elements are established

Do not label a specific person as the offender without evidence. Give investigators the facts and records and let them determine the appropriate charge.

Prompt reporting matters because the Cybercrime Prevention Act prescribes minimum preservation periods for certain traffic and subscriber data, and law enforcement can issue lawful preservation orders. Your own request to a provider to preserve evidence is useful but is not the same as a statutory law-enforcement preservation order.

Check and dispute your CIC credit report

Obtain your own report through the Credit Information Corporation’s official consumer program. If the unauthorized account appears, initiate the CIC Online Dispute Resolution System.

The CIC requires the consumer to obtain a credit report before filing a dispute. Upload evidence showing that the account or related data is erroneous, misleading, incomplete, or outdated, and respond promptly to communications from the CIC and submitting lender.

Under the Credit Information System Act:

A borrower has the right to dispute erroneous, incomplete, outdated, or misleading credit information.
The CIC must investigate and verify disputed information within five working days from receipt of the complaint.
If the information’s accuracy cannot be verified or proven, it must be deleted.
The borrower and entities that received the information must be informed of the correction or removal within five working days.

The CIC cannot simply rewrite a lender’s submitted data without following the dispute process. Keep monitoring your report after the lender says the matter is resolved.

Use your data-privacy rights

The Data Privacy Act gives a data subject rights that may include reasonable access to processed personal information, correction of inaccurate data, and blocking or removal of data that is false, unlawfully obtained, or used for unauthorized purposes. Some access may be restricted by other laws or an ongoing criminal, administrative, or regulatory investigation.

Write to the provider or its Data Protection Officer and ask it to:

Identify the personal information processed and its source
Explain how and why it was processed
Identify recipients or classes of recipients
Correct inaccurate information
Inform prior recipients of the inaccuracy and correction where applicable
Restrict further harmful processing while the dispute is investigated
Preserve evidence notwithstanding any later request for deletion

Do not initially demand destruction of every record needed to prove the fraud. Financial institutions may also have lawful record-retention duties. Evidence preservation, correction, and restriction are usually the immediate priorities; removal can be requested to the extent legally permitted after the matter is resolved.

When to complain to the National Privacy Commission

An NPC complaint may be appropriate if an entity unlawfully processed or disclosed your data, failed to secure it, refused to correct it, or failed to respond properly to your written privacy concern.

Ordinarily, you must first notify the respondent in writing and allow it to act. Under the NPC Rules of Procedure, a complaint generally will not be given due course unless the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving your written notice. The NPC may waive this requirement for good cause or a serious violation presenting risks such as grave and irreparable harm.

Use the NPC’s current Complaint-Affidavit form, which took effect on July 1, 2025. It requires a verified complaint, evidence, the correspondence showing exhaustion of remedies or an explanation for not contacting the respondent, the relief requested, and a certification against forum shopping. Current complaint contact details are published on the NPC website.

An NPC complaint focuses on personal-data processing and privacy violations. It is not a substitute for disputing the debt with the lender or correcting the CIC report.

Important exceptions and fact-dependent issues

The conclusion may be more complicated if:

You knowingly gave another person authority to apply or transact for you.
You shared an OTP, password, unlocked phone, authenticated selfie, or electronic signature.
The proceeds entered an account you controlled, particularly if you kept or used them.
You previously confirmed the account, requested restructuring, promised payment, or made payments.
The account combines an unauthorized transaction with a genuine account or application.
A family member, employee, agent, or business partner claims to have acted with authority.
The alleged account is actually a mistaken identity or data-matching error rather than an application using your documents.

None of these facts automatically decides liability. They affect what must be explained and proven. State exactly what occurred instead of hiding an embarrassing mistake; incomplete information can undermine an otherwise valid claim.

Common mistakes to avoid

Reporting only by phone and keeping no case number or written record
Paying a “small amount” or signing a restructuring agreement merely to stop collection calls
Ignoring a genuine demand letter, subpoena, summons, or court notice
Deleting messages or resetting the relevant device before preserving evidence
Sending additional IDs or selfies to an unverified collector
Assuming that a police report automatically closes the account
Assuming that a lender’s cancellation automatically corrects the CIC record
Disputing only the balance instead of clearly disputing the account’s creation and consent
Mixing a genuine debt with the unauthorized account in one unclear complaint
Posting accusations, account numbers, IDs, or a suspected person’s private information online
Asking for immediate destruction of the very records needed to investigate and prove the fraud
Failing to update the lender, regulator, CIC, or investigator when new evidence appears

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a court summons, subpoena, prosecutor’s notice, or formal demand with a response deadline.
A collection case has been filed or a judgment is claimed against you.
The lender refuses to suspend collection despite a documented identity-theft dispute.
Several accounts were opened, substantial proceeds moved, or your phone and email remain compromised.
The provider claims that its biometric, OTP, signature, or device records conclusively identify you.
You received the proceeds but believe another person controlled the transaction.
A collector threatens arrest, violence, public shaming, workplace disclosure, or contact with unrelated persons.
The incident involves an employee or insider of a financial institution.
The account is affecting employment, housing, a business loan, or another time-sensitive transaction.

Qualified indigent persons may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines also maintains a National Center for Legal Aid.

Frequently asked questions

Do I have to pay an unauthorized loan?

Generally, you should not be liable for a loan you never consented to. Do not simply ignore it, however. Dispute it formally and provide evidence. Whether a provider can establish consent, authority, receipt of proceeds, or another basis for liability depends on the records and circumstances.

Should I pay first and request a refund later?

Not merely to stop calls. Payment or a signed settlement may be used as evidence that you recognized the account, even if that was not your intention. Dispute the account first and obtain legal advice if a deadline, lawsuit, or mixed genuine-and-fraudulent balance is involved. Continue paying unrelated legitimate obligations normally.

Is an OTP enough to prove I borrowed the money?

Not necessarily. An OTP is one item of evidence. The relevant questions include who controlled the registered number and device, how the OTP was delivered and used, whether the identity-verification process was reliable, where the proceeds went, and whether other records support genuine consent.

What if a relative used my identity?

Report the facts accurately. A family relationship does not by itself authorize someone to borrow in your name. But prior authority, shared accounts, receipt or use of the proceeds, and later conduct may affect the legal analysis.

Is a barangay or police blotter enough?

No. It may document when you reported the incident, but it does not automatically invalidate the loan, compel a lender to correct its records, or remove the account from your credit report. Complete the lender, regulator, CIC, and—where applicable—NPC processes as well.

How long should the lender’s investigation take?

The period can depend on the provider, regulator, complexity, and evidence. Ask for the applicable complaint-handling timetable in writing. The law requires clear information on the action taken or to be taken and suspension of disputed interest and charges, or similar accommodation, while the final investigation is pending.

Can I ask the lender to erase all my data immediately?

You may have correction, blocking, or removal rights, but immediate destruction can conflict with fraud investigation, evidence preservation, anti-money-laundering requirements, and other lawful retention duties. Request restriction, correction, and preservation first, then seek lawful removal after resolution.

What if the lender says the account is not in its system?

Ask for that confirmation in writing. Check whether the collector gave the correct legal lender name and whether the account appears in your CIC report. Preserve the demand because it may itself be fraudulent or may identify another provider.

What if collection continues after I disputed the account?

Send the collector and lender the dispute reference, insist that all communications identify the legal creditor and account, and document every contact. Escalate an unresolved complaint to the BSP or SEC as applicable. Threats, public shaming, unauthorized disclosure, or coercion may justify additional regulatory, privacy, police, or legal action.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Rights, liability, jurisdiction, and the best procedure can depend on the provider, documents, technology used, receipt of proceeds, and procedural history. Official sources and procedures were checked as of August 18, 2026.