Quick answer

If you did not apply for, authorize, or knowingly accept the loan or credit account, you generally should not be treated as the borrower merely because your name, ID, phone number, or other personal data appears in the lender’s records. A valid contract requires consent. However, the account will not disappear automatically: you must dispute it promptly and preserve proof.

Take these actions without delay:

Contact the lender through a verified official channel and submit a written identity-theft dispute.
Demand that it block further use or disbursement, mark the account as disputed, investigate the application, suspend collection and disputed charges, and correct any credit reporting if the account is unauthorized.
Secure your email, mobile number, financial accounts, and identification documents.
Report the identity misuse to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or another appropriate law-enforcement office.
Escalate an unresolved complaint to the regulator—usually the BSP for BSP-supervised institutions, the SEC for lending or financing companies, or the CDA for cooperatives.
Obtain your CIC credit report and dispute any inaccurate entry through the CIC Online Dispute Resolution System.
If your personal data was mishandled, exercise your data-subject rights with the lender and, when the procedural requirements are met, consider a complaint with the National Privacy Commission.

A police report alone does not cancel the account, and a complaint to the lender alone does not start a criminal investigation. These remedies serve different purposes and may need to proceed in parallel.

Why an unauthorized account is not automatically your debt

Under Article 1318 of the Civil Code, a contract requires the consent of the contracting parties, a certain object, and a lawful cause. If an impostor used your identity without authority, the use of your name or identification documents does not by itself establish your consent.

The outcome can nevertheless depend on evidence. Relevant questions include whether you:

Signed or electronically accepted any document;
Shared an OTP, password, selfie, or device with another person;
Authorized an agent or family member to apply;
Received, retained, transferred, or used the loan proceeds;
Made payments or otherwise adopted the account after learning of it; or
Previously opened a legitimate account that was later taken over.

None of these facts should be assessed in isolation. For example, possession of an OTP may be evidence relied on by a lender, but it does not necessarily prove who entered it or whether it was obtained through deception. If the facts are disputed, a regulator, prosecutor, or court may ultimately need to evaluate the complete audit trail.

Several laws may apply depending on how the account was created:

The Cybercrime Prevention Act of 2012 covers computer-related identity theft—the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of identifying information belonging to another.
The Access Devices Regulation Act of 1998 defines an access device fraudulently applied for as one obtained through falsified documents, false information, fictitious identities or addresses, or another false pretense or misrepresentation. Its application depends on whether an access device, such as a credit card, account number, code, or other means of account access, was involved.
The Philippine Credit Card Industry Regulation Law requires credit-card issuers to conduct know-your-client procedures and exercise proper diligence before issuance.
Other offenses, including falsification or fraud under other laws, may be relevant. The investigator and prosecutor—not the complainant—should determine the appropriate charge from the evidence.

Report the account to the lender first

Use the lender’s official website, application, published hotline, branch, or verified customer-assistance channel. Do not rely on a telephone number or link supplied only in a collection text, social-media message, or unsolicited email.

Submit a dated written complaint to the lender’s Financial Consumer Protection Assistance Mechanism, fraud unit, and data protection officer if their contact details are available. State clearly:

I deny applying for, authorizing, signing, accepting, receiving, or using this loan or credit account. I am reporting identity theft and disputing the account, all transactions, the alleged obligation, and any related credit reporting. Nothing in this notice is an acknowledgment of the debt.

Include only accurate facts and request:

Immediate blocking of additional drawdowns, purchases, cash advances, limit increases, or changes to the account;
A fraud or identity-theft case reference number;
Written confirmation that the account and amount are disputed;
Suspension of collection activity, interest, fees, penalties, and adverse reporting while the investigation is pending;
Preservation of the application, contract, KYC records, identification documents, photographs, selfie or liveness records, signatures, OTP records, call recordings, IP addresses, device identifiers, timestamps, disbursement instructions, and related logs;
Access to the personal data processed about you, including its source and recipients, subject to lawful restrictions;
The date, method, and channel of application;
The destination account, e-wallet, merchant, or other disbursement route, to the extent the lender may lawfully disclose it;
A written final investigation result explaining the evidence considered;
Closure or cancellation if the account is confirmed unauthorized; and
Correction or withdrawal of information sent to the CIC, a credit bureau, collector, affiliate, or other recipient.

The Financial Products and Services Consumer Protection Act requires financial service providers to maintain a free consumer-assistance mechanism. For alleged disputed amounts or unauthorized transactions, the provider must, pending its final investigation, suspend interest, fees, and charges or give a similar reasonable accommodation. It also prohibits abusive collection practices and protects consumers’ rights to data privacy and timely complaint handling.

Do not send passwords, PINs, CVVs, complete account credentials, or OTPs. If an ID is genuinely needed for verification, use the institution’s secure official channel and watermark the copy when practicable—for example, “For identity-theft dispute with [institution], [date] only.”

Secure your identity and accounts

Assume the person who opened the account may possess more than one item of personal information.

Change the passwords of your primary email, financial applications, cloud storage, and social-media accounts. Use unique passwords and enable multi-factor authentication.
Review email forwarding rules, recovery addresses, logged-in devices, and recent security activity.
Ask your mobile provider to check for an unauthorized SIM replacement or account change if calls or OTPs stopped unexpectedly.
Notify banks and e-wallet providers if an account, device, or mobile number may be compromised.
Review recent transactions, newly added beneficiaries, contact-detail changes, and password-reset messages.
Record when an ID, SIM, phone, or document was lost, copied, photographed, or submitted to another organization.
Do not delete suspicious messages, applications, or device data before preserving copies.

There is no general Philippine procedure equivalent to an automatic nationwide “credit freeze” that erases or prevents all new credit. Protection therefore depends on securing compromised channels, notifying affected institutions, monitoring your credit information, and disputing each unauthorized record.

Make a law-enforcement report

If the application or identity misuse occurred electronically, report it promptly to a cybercrime unit. The NBI and PNP are the law-enforcement authorities identified under the Cybercrime Prevention Act.

The BSP’s current fraud-reporting guidance lists these channels:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph; (0998) 598-8116; (+632) 414-1560
NBI Cybercrime Division: ccd@nbi.gov.ph; (+632) 523-8231 to 38, locals 3454 or 3455
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph; hotline 1326

The official addresses and additional contact numbers appear in the BSP’s guide on filing complaints and reporting fraud. You may also approach the nearest police station or appropriate NBI office, especially if there are threats or an ongoing attempt to obtain more money.

Bring or attach:

A government-issued ID;
Your written denial and complaint to the lender;
The lender’s acknowledgment and investigation reference;
Statements, demand letters, credit-report entries, or collection messages;
Screenshots showing dates, sender details, URLs, account references, and full conversation context;
Relevant email files or headers, call logs, and transaction records;
Proof showing where you were or what device or number you controlled at the material time, if relevant;
Evidence of a lost ID, compromised SIM, phishing message, malware, or prior data breach; and
A chronological account of how and when you discovered the unauthorized account.

Ask for a complaint, incident, or docket reference and keep a copy. Describe the facts rather than insisting on a particular criminal charge.

Escalate to the correct financial regulator

The lender’s internal complaint channel is normally the first level of recourse. If it does not act within a reasonable period or its response is unsatisfactory, use the regulator that supervises it.

Institution involved	Where to escalate	Important limitation
Bank, digital bank, credit-card issuer, or other BSP-supervised institution	BSP Consumer Assistance Mechanism through the BSP Online Buddy or the official CIR form	BSP-CAM is a second-level, facilitative remedy. Complain to the institution first and attach proof. It is not a criminal-investigation channel.
Lending company, financing company, online lending platform, or its collection agency	SEC complaint instructions or the SEC i-Message Mo portal	The SEC’s administrative complaint channel states that it cannot itself declare a loan contract void or cancel or settle a loan obligation. Separate civil relief may be necessary.
Credit or lending cooperative	The relevant CDA Extension Office or CDA complaint process	Cooperative banks and other BSP-supervised cooperative financial institutions fall under BSP jurisdiction.
Unknown, fake, or apparently unlicensed lender	Law enforcement and the SEC; also notify any legitimate financial institution used to receive or transfer funds	Do not give the operator more personal data merely to “verify” the account.

Under BSP Circular No. 1169, a BSP-supervised institution directed to answer through BSP-CAM must generally answer the consumer within 15 calendar days. The consumer may reply within 30 days after receiving the answer. Failure to communicate further within 30 days of the institution’s last response can terminate the CAM proceeding.

BSP adjudication is limited to purely civil financial-transaction claims seeking only payment or reimbursement of money not exceeding ₱10 million, exclusive of legal interest, attorney’s fees, and costs. Jurisdiction, mediation, adjudication, and court proceedings have additional requirements; a routine CAM complaint should not be confused with formal adjudication.

Check and correct your CIC credit record

Even if the lender stops collection, verify whether it reported the account to the Credit Information Corporation.

First obtain a CIC credit report through the current Direct-to-Consumer program or an accredited credit bureau. If the unauthorized account appears, use the CIC Online Dispute Resolution System.

Under CIC Circular No. 2019-01:

The report must generally have been obtained within the preceding 30 days. Otherwise, obtain a new report.
You need the report’s Transaction Reference Number and the same email address used to obtain it.
Target resolution periods are three working days for a simple dispute, seven for a complex dispute, and 20 for a highly technical dispute, subject to permitted extensions.
Respond to document requests or recommendations within five working days. Unjustified nonresponse may terminate the process.
Disputed data generally remains tagged as disputed unless there is a clear, mutually agreed resolution.

The CIC cannot simply rewrite a lender’s submission on request. Its process involves the submitting institution, supporting evidence, and—where appropriate—a correction file or CIC resolution. Continue the lender dispute even after filing with the CIC.

If inaccurate information appears in a credit report issued by another credit bureau, use that bureau’s own dispute process as well.

Exercise your data-privacy rights

The Data Privacy Act gives you rights to access and correct personal data and, in appropriate cases, to request blocking, removal, or destruction. A lender may deny complete erasure when retention remains necessary for a legal obligation, fraud investigation, or the establishment, exercise, or defense of legal claims. For that reason, request restriction, accurate annotation, and preservation for investigation rather than demanding immediate destruction of all evidence.

Write first to the lender or other organization that processed your information. Identify:

The data you believe was obtained or used without authority;
The unauthorized account and relevant dates;
The correction, restriction, access, or other action requested; and
The harm or continuing risk, such as collection calls or inaccurate credit reporting.

Under the 2021 NPC Rules of Procedure, as amended, the complainant ordinarily must first inform the organization in writing and give it an opportunity to act. A formal NPC complaint generally will not be given due course if the organization took appropriate action, or until it failed to respond within 15 calendar days. The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm.

A formal complaint must satisfy procedural requirements, including verification, supporting evidence, relevant correspondence, requested relief, and a certification against forum shopping. Filing fees apply unless an exemption or waiver is available. Follow the NPC’s current complaint instructions rather than sending an informal narrative alone.

An NPC complaint addresses personal-data processing. It does not by itself cancel a loan, correct every credit report, or replace a criminal complaint.

Evidence to preserve

Keep originals unchanged and create working copies. Maintain a simple chronology showing the date, event, person or organization involved, and supporting file.

Preserve:

Statements, contracts, disclosure statements, collection letters, and envelopes;
Screenshots with the date, time, sender, account reference, and full URL visible;
Original emails and headers, not only screenshots;
SMS messages, call logs, voicemail, and recordings lawfully obtained;
Complaint forms, reference numbers, delivery receipts, and automated acknowledgments;
Copies of the identification documents the lender says were used;
Known samples of your genuine signature from the relevant period;
Device-security alerts, login history, SIM-change notices, and password-reset messages;
Bank or e-wallet records showing whether you received or did not receive the proceeds;
Credit reports before and after the dispute; and
Notes of every call, including the representative’s name, department, date, and commitments.

Do not alter metadata, crop away identifying context, or communicate with the suspected offender in a way that could destroy evidence or put you at risk.

Common mistakes to avoid

Reporting only by telephone. Follow every call with a dated written complaint.
Calling it merely a “billing concern.” State that the entire account or application is unauthorized and that identity theft is alleged.
Paying solely to stop collection pressure. A payment may complicate the factual record. If the account also contains legitimate obligations, continue addressing the undisputed portion and obtain advice on how to document the distinction.
Ignoring collection letters or court papers. A disputed debt can still lead to proceedings. Court and agency notices have separate response deadlines.
Sending sensitive credentials to the BSP, SEC, police impostors, or collectors. Verify the channel and disclose only what is necessary.
Deleting the fraudulent application or suspicious messages. Preserve them before securing or resetting the affected device.
Assuming a police blotter automatically clears the credit report. File separate disputes with the lender, CIC, and any other reporting bureau.
Accusing a particular person without evidence. Report what you know and let investigators trace the application and proceeds.
Letting CIC emails lapse. The CIC process can be terminated if you fail to respond within five working days without justification.

Important deadlines

Act immediately even when a longer legal period may exist.

For a credit-card billing error or discrepancy, the Credit Card Industry Regulation Law requires issuers to give cardholders up to 30 calendar days from the statement date to report it, and the issuer must act within 10 business days after receiving notice. An identity-theft claim involving the creation of the entire account should be stated separately and reported as soon as discovered.
A CIC dispute generally requires a credit report obtained within the preceding 30 days.
Before an ordinary NPC complaint, the organization generally has 15 calendar days from receipt of your written notice to respond, subject to the NPC’s exceptions.
Under the Financial Products and Services Consumer Protection Act, claims accruing under that law generally prescribe five years from consummation of the transaction or discovery of deceit or nondisclosure, with an outside limit of 10 years from the violation. Other civil, criminal, regulatory, and procedural deadlines may differ.

These periods are not permission to wait. Delay can make electronic evidence, surveillance footage, device records, and witness recollection harder to obtain.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, formal demand, notice of adjudication, or small-claims filing;
The lender refuses to stop collection despite clear evidence of identity theft;
The loan is secured by land, a vehicle, payroll deductions, or another asset;
Proceeds entered an account you control, even if another person moved them;
You previously paid, signed, confirmed, or communicated in a way the lender claims adopted the account;
A spouse, relative, employee, agent, or business partner was involved;
Collectors threaten violence, public humiliation, arrest without lawful process, or disclosure to your employer or contacts;
Multiple accounts have been opened or your identity remains actively compromised; or
You need an injunction, damages, cancellation of an instrument, or relief beyond what an administrative complaint can provide.

Those who qualify may inquire with the Public Attorney’s Office or an appropriate legal-aid office. Bring a complete chronology and organized copies of the evidence.

Frequently asked questions

Must I pay while the lender investigates?

Do not pay an account you wholly deny merely to stop calls, unless a lawyer familiar with the documents advises otherwise. Submit the dispute in writing and invoke the accommodation required for alleged disputed amounts or unauthorized transactions. If the same account contains legitimate, undisputed charges, address those separately to avoid creating an unnecessary default.

Is a police report required before the lender investigates?

A lender may request one as supporting evidence, but report to the lender immediately rather than waiting for the police document. Ask the lender to open its fraud investigation and preserve records at once.

What if the lender shows an ID, selfie, OTP, or electronic signature?

Ask for the complete authentication trail, not only a screenshot. The source of the ID, device and IP records, timestamps, liveness checks, OTP destination, call recordings, application changes, and disbursement path may show whether the evidence genuinely connects the application to you. The documents must be assessed together.

What if the proceeds entered my bank or e-wallet?

Notify that institution immediately, preserve the complete transaction trail, and do not move or spend any remaining funds. Receipt or use of proceeds can materially affect the analysis, even if another person initiated the application. Obtain legal advice before making statements or returning funds through an unverified channel.

Can a relative open a loan using my identity?

A relative has no automatic authority to borrow in your name. However, prior authorization, agency, receipt of benefits, later adoption, and shared devices or credentials can make the issue fact-sensitive. Disclose the facts accurately to your lawyer and investigators.

Can collectors continue contacting me?

Tell both the collector and the original lender in writing that the account is disputed because of identity theft. Request the collector’s full name, authority, source lender, and account reference. Preserve abusive or misleading communications. Financial service providers are prohibited from using abusive collection practices and can be responsible for acts of authorized agents or collection providers.

Will correcting the CIC report remove every record of the incident?

Not necessarily. Correcting inaccurate credit information is different from deleting evidence that a lender must retain for fraud investigation, regulatory compliance, or legal claims. The practical goal is accurate reporting, a clear disputed status while the case is pending, and correction or withdrawal once the account is confirmed unauthorized.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Liability and the proper remedy depend on the application documents, authentication records, movement of funds, communications, and procedural status. Laws, rules, and official procedures were checked against primary and official sources on August 11, 2026.