Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or online lending account was opened using your identity without your knowledge or consent, immediately dispute it in writing with the lender. State clearly that you did not apply for, authorize, receive, or benefit from the account; ask the lender to freeze collection and investigate; request the records used to open the account; and obtain a case or reference number.

Also secure your accounts, preserve the evidence, report suspected identity theft to the NBI or PNP, and check whether the false account appears in your Credit Information Corporation (CIC) credit report. Escalate unresolved complaints to the regulator that supervises the lender:

BSP for banks, digital banks, e-wallet issuers, and other BSP-supervised financial institutions;
SEC for lending and financing companies and their online lending platforms;
CDA for credit cooperatives, subject to the statutory exceptions for cooperative banks and insurance cooperatives; or
NPC if personal data was unlawfully collected, used, disclosed, or inadequately protected.

An account created by an impostor is not automatically your valid debt merely because it bears your name or personal details. Liability, however, can depend on the evidence—including authentication records, signatures, device and transaction data, where the proceeds went, and whether you later confirmed or benefited from the transaction. Do not ignore demands or court papers while the dispute is being investigated.

Act immediately

1. Contact the lender through a verified channel

Do not rely on a telephone conversation alone. Use the lender’s official app, website, published email address, branch, or consumer-assistance channel—not a link or number supplied in a suspicious text message.

Your written notice should include:

your full name and safe contact details;
the account or application number, if known;
when and how you discovered the account;
a direct statement that you did not apply for or authorize it;
whether you received any proceeds, card, goods, OTP, or account access;
a request to mark the account as disputed and suspend collection while it is investigated;
a request not to report the account as yours, or to correct any report already made;
a request to preserve all application, authentication, disbursement, communication, and access records; and
a request for a written finding and reference number.

If a collector contacted you, ask for the creditor’s legal name, account number, amount claimed, and the collector’s authority. Do not send identity documents until you have independently confirmed the recipient and the minimum documents genuinely required.

2. Ask for the account-opening and disbursement records

Request copies or a clear description of the records relevant to the disputed transaction, such as:

application form and purported contract;
signatures, selfie or liveness-check results, and IDs submitted;
mobile number, email address, delivery address, and declared employer;
consent and OTP records;
dates, times, IP addresses, device identifiers, and access logs;
call recordings and chat or email history;
bank, e-wallet, merchant, or delivery destination of the proceeds;
proof that the proceeds, card, or purchased goods were delivered; and
information furnished to the CIC or another credit bureau.

Under Section 16 of the Data Privacy Act of 2012, a data subject generally has rights to information, reasonable access, correction, and—where the legal requirements are met—blocking or removal of personal data. These rights are not unlimited; disclosure may be restricted by another law, the rights of other people, or a legitimate investigation. The lender should nevertheless investigate and explain the basis of its conclusion.

3. Secure the identity and accounts that may have been compromised

Change passwords for your email, banking, e-wallet, shopping, and government-service accounts. Use unique passwords and enable multifactor authentication. Review recovery email addresses, trusted devices, forwarding rules, linked accounts, and SIM activity.

Notify the relevant bank or e-wallet immediately if money was sent through an account connected to you. If your SIM stopped working unexpectedly or OTPs were diverted, contact the telecommunications provider and ask it to investigate possible SIM replacement or account takeover.

If an ID was lost or compromised, report it to the issuing agency and follow that agency’s replacement or security procedure. Avoid posting complete IDs or an unredacted police report on social media.

Preserve evidence before it disappears

Keep original electronic files whenever possible. Preserve:

texts, emails, app notifications, collection messages, and call logs;
screenshots showing the full screen, sender, date, time, and URL;
account statements and the disputed credit-report entry;
envelopes, cards, contracts, or delivery documents;
proof showing where you were and which number, email, device, or account you actually controlled;
correspondence with the lender and proof of delivery;
reference numbers, names of representatives, and dates of calls;
reports concerning a lost ID, SIM replacement, compromised email, or hacked account; and
any admission, demand, threat, or identifying detail sent by the suspected impostor.

Do not edit the original files. Make backup copies, export conversations where possible, and write a chronological account while events are fresh. Do not secretly access another person’s account or device to obtain evidence.

Report suspected identity theft to law enforcement

Opening an online loan or credit account using another person’s identifying information may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on what occurred, other offenses—such as computer-related fraud, forgery, falsification, estafa, or access-device fraud—may also be investigated. The appropriate charge depends on the evidence; a consumer complaint does not itself establish criminal guilt.

You may seek investigative assistance from:

the NBI Cybercrime Division or an NBI regional or district office;
the NBI’s online complaint facility; or
the Philippine National Police, including its Anti-Cybercrime Group or the appropriate local police unit.

The Cybercrime Prevention Act assigns cybercrime law-enforcement responsibility to both the NBI and PNP. A sworn complaint may be necessary for a formal investigation. Bring a government ID, a concise chronology, the lender’s details, copies of the disputed records and communications, and information showing how the fraud affected you.

A police or NBI report is important evidence, but it does not automatically erase the account. Continue the lender, regulator, and credit-report dispute processes separately.

Correct the credit record

Obtain and review your CIC credit report

An unauthorized account may not appear in every private report, and its absence from one report does not prove that no application was made. Obtain your CIC credit report through the CIC’s current direct-to-consumer channels, then check:

lender and account name;
opening date;
original and outstanding amounts;
payment status;
addresses and personal identifiers; and
other unfamiliar accounts or inquiries.

File a CIC dispute

The CIC Online Dispute Resolution System is for erroneous, incomplete, outdated, or misleading information found in a CIC credit report. You generally must first obtain the report and identify the specific disputed entry. Follow the CIC’s online dispute instructions and attach supporting documents.

Section 4(o) of the Credit Information System Act provides that CIC must investigate and verify disputed information within five working days from receipt of the complaint. If the information cannot be verified or proven accurate, it must be deleted. The borrower and entities that received the information must be informed of the correction or removal within another five working days.

These statutory periods concern CIC’s verification and notification duties. A dispute involving fraud, incomplete lender records, identity authentication, or additional evidence may still require follow-up with the lender or another authority.

If the entry also appears in a report issued by a private credit bureau or special accessing entity, dispute it directly with that entity as well.

Escalate the lender complaint to the correct regulator

For a bank, digital bank, e-wallet issuer, or other BSP-supervised institution

First use the institution’s own financial consumer assistance mechanism and keep its response or proof that it failed to respond. If the matter remains unresolved, escalate it through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy or the current complaint form and channels published there.

Attach:

your original complaint to the institution;
its final response, if any;
account and transaction details;
proof of identity requested by the channel;
police or NBI report, if available; and
the remedy sought, such as account closure, correction of records, cessation of collection, or reimbursement.

The Financial Products and Services Consumer Protection Act requires financial regulators to maintain consumer-redress mechanisms and authorizes the BSP and SEC to adjudicate qualifying civil financial claims for payment or reimbursement not exceeding ₱10 million. Filing a basic consumer-assistance complaint is not necessarily the same as commencing formal adjudication, which has separate procedural requirements.

For a lending or financing company or online lending platform

Verify the company and platform through the SEC’s official records. A mobile app’s name may differ from the corporation operating it.

Submit the complaint through the SEC iMessage portal or the SEC’s current formal complaint channel for lending and financing companies. Identify both the app and its corporate operator, if known. Attach the disputed application details, demands, screenshots, and your prior written complaint to the company.

SEC supervision can address regulatory violations by a registered lending or financing company. If the operator is unregistered, falsely identified, or cannot be located, report that fact to the SEC and law enforcement. An SEC complaint does not replace a criminal complaint or a CIC dispute.

For a cooperative

Complaints involving a credit cooperative generally fall under the Cooperative Development Authority. Cooperative banks remain under BSP supervision, while insurance cooperatives fall under the Insurance Commission for the financial service concerned. Confirm the entity’s registration and regulator before filing.

Consider an NPC complaint for misuse of personal data

A false loan application may involve unlawful acquisition, use, disclosure, or inadequate protection of personal data. Before filing with the National Privacy Commission, ordinarily notify the lender or other responsible entity in writing of the privacy violation and allow it to act.

Under the NPC’s complaint mechanics, exhaustion is generally shown when the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving the written notice. The NPC may waive requirements in circumstances allowed by its rules, but a complainant should not assume that an exception applies.

Use the NPC’s current Complaint-Affidavit or Complaints-Assisted Form, comply with its verification, notarization, certification, and evidence requirements, and submit it through the channel stated on the form or the NPC website. The NPC currently directs complaints to complaints@privacy.gov.ph, but verify the address and form version before sending.

An NPC case concerns data-privacy compliance. It is not a substitute for disputing the alleged debt, correcting a credit report, or reporting the impostor to law enforcement.

What to say in the written dispute

A concise notice may read:

I dispute the loan or credit account identified as [account/reference number]. I did not apply for, authorize, sign, receive, or benefit from this account or its proceeds. Please mark the account as disputed, suspend collection while you investigate, preserve all application and transaction records, and provide your written findings. Please also provide the records used to authenticate the applicant, the destination of any proceeds or goods, and details of any credit information reported in my name. Nothing in this notice is an acknowledgment or ratification of the alleged debt.

Change the statement if you did receive a card, proceeds, goods, or account access, even inadvertently. Accuracy is more important than using a standard form.

Do not accidentally weaken the dispute

Avoid these common mistakes:

paying a “small amount” merely to stop collection before obtaining advice;
signing a restructuring, settlement, acknowledgment, or promissory note for the disputed account;
saying “my loan” when you mean “the disputed account opened in my name”;
sending full IDs to an unverified caller or messaging account;
deleting texts, resetting a compromised device, or discarding a SIM before preserving evidence;
disputing only by telephone;
assuming a police blotter automatically corrects the lender’s records;
filing only with a regulator while ignoring the lender and CIC;
exaggerating facts or denying a transaction from which you actually received a benefit; or
ignoring a demand letter, barangay notice, subpoena, prosecutor’s notice, or court summons.

A payment or signature does not always settle every legal issue, but it can complicate the evidence concerning acknowledgment, ratification, or benefit. Obtain individualized legal advice before agreeing to anything.

If collectors contact family, employers, or friends

Tell the lender in writing that the account is disputed and identify each collection contact. Preserve messages and record the date, time, number, recipient, and substance of calls.

Even where a genuine debt exists, collection practices remain subject to applicable BSP or SEC rules, financial-consumer protections, and the Data Privacy Act. Threats, public shaming, disclosure to unrelated people, impersonation of authorities, or continued misuse of contact-list data may support separate complaints. Do not retaliate or publish collectors’ unredacted personal information online.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a summons, subpoena, prosecutor’s notice, or formal pleading has arrived;
a court deadline or hearing date is approaching;
the lender claims to have your signature, selfie, OTP, or biometric verification;
proceeds entered an account controlled by you or a family member;
you know or suspect the impostor is a relative, employee, or business associate;
property, salary, or another account is threatened with attachment or enforcement;
several accounts were opened or the loss is substantial;
the lender refuses to preserve records or continues adverse reporting after receiving strong evidence;
you are being pressured to sign a settlement or acknowledgment; or
the incident involves an insider, organized fraud, threats, or continuing account takeover.

Court papers require a response through the proper procedure. A complaint pending before the lender, BSP, SEC, CIC, NPC, NBI, or PNP does not automatically suspend a judicial deadline.

Frequently asked questions

Must I pay while the investigation is pending?

Do not assume that an impostor’s account is your debt. Dispute it immediately and ask the lender to suspend collection. Whether any payment is legally due depends on proof of consent, authentication, receipt of benefits, and other facts. If litigation has begun or the lender asserts strong contrary evidence, obtain legal advice before paying or signing anything.

Is a notarized affidavit of denial enough?

It can help, but it is not conclusive by itself. Pair it with objective evidence and request the lender’s application, authentication, disbursement, delivery, and device records.

Can the lender rely only on an OTP or selfie?

An OTP, selfie, or digital record may be relevant evidence, but its weight depends on reliability and context. Ask which number or device received the OTP, how the identity check was performed, whether the records were altered, and where the proceeds went. No single item should be treated as automatically resolving every fraud claim.

Should I report the incident if no money was collected from me?

Yes. Computer-related identity theft may be investigated even when the victim has not yet suffered financial loss, and an unused or newly discovered account can still affect privacy, credit records, and future applications.

Can CIC cancel the loan?

CIC can investigate and correct or delete unverified credit information in its database. It does not replace the lender’s internal fraud determination, cancel a contract by itself, award criminal penalties, or prosecute the impostor.

Should I file with both the regulator and the NPC?

Possibly. They address different issues. The BSP, SEC, CDA, or Insurance Commission deals with the supervised financial provider; CIC handles disputed credit-report data; the NPC handles personal-data violations; and the NBI or PNP investigates possible crime. File only where the facts and agency jurisdiction fit.

What if I do not know which company opened the account?

Ask the collector for written validation details, inspect the text or email domain without following suspicious links, obtain your CIC credit report, and search the relevant regulator’s official registry. Do not send identity documents until the recipient has been independently verified.

What if a relative used my identity?

Report the facts truthfully. Family relationship does not by itself create authority to borrow in your name. However, prior permission, shared devices, receipt of proceeds, later confirmation, or misleading statements can materially affect the case. Seek legal advice before signing an affidavit or settlement.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may change according to the lender, regulator, evidence, governing documents, and later official issuances. Official sources and reporting channels were checked as of 2 September 2026.