Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar facility was opened using your identity without your knowledge or consent, immediately dispute it in writing with the lender, demand that collection and adverse credit reporting be suspended while the case is investigated, secure your accounts, obtain and dispute your credit report, and report the identity theft to law enforcement.

Do not acknowledge the debt, promise payment, or sign a restructuring agreement merely to stop collection calls. A person is not ordinarily bound by a loan that the person did not apply for, authorize, receive, or later ratify. However, the account will not necessarily disappear upon a phone call. The lender may require identity verification and must examine the application, authentication records, disbursement trail, and other evidence.

Use the regulator appropriate to the institution:

For a bank, digital bank, credit-card issuer, e-money issuer, or another institution supervised by the Bangko Sentral ng Pilipinas (BSP), complain first through the institution’s consumer-assistance mechanism. Escalate an unresolved complaint to the BSP.
For a financing company, lending company, or online lending platform regulated by the Securities and Exchange Commission (SEC), complain to the company and, when appropriate, the SEC.
If the unauthorized account appears in your Credit Information Corporation (CIC) credit report, file a separate CIC dispute.
If personal data was unlawfully obtained, disclosed, or processed, consider a complaint before the National Privacy Commission (NPC).
Report suspected identity theft, forgery, or online fraud to the Philippine National Police Anti-Cybercrime Group (PNP-ACG), National Bureau of Investigation (NBI), or another competent law-enforcement unit.

These remedies may proceed at the same time. A regulator’s consumer-assistance process does not replace a criminal complaint, and a police report does not automatically correct a lender’s records or your credit report.

What counts as an unauthorized credit account?

An account is unauthorized when someone used your identity or personal information to obtain credit without your valid consent. Examples include:

A stranger using stolen identification documents or leaked personal data;
A relative, employee, agent, partner, or acquaintance applying without authority;
Someone intercepting one-time passwords, taking control of a SIM or email account, or using a compromised device;
A fraudulent application containing a forged signature or fabricated selfie;
A loan app creating or recording an obligation that you never requested;
A legitimate application being altered to obtain a different or larger loan without your approval; or
An account opened after a lender accepted inadequate, manipulated, or stolen identity-verification materials.

Do not assume that an account is fraudulent solely because the lender’s name is unfamiliar. The creditor may use a different trade name, collection agency, payment processor, or credit-reporting name. Ask for enough information to identify the alleged transaction without confirming that the debt is yours.

Act immediately

There is no single waiting period that applies to every lender, regulator, and possible criminal offense. Report the problem as soon as you discover it. Delay can allow further borrowing, collection charges, transfer of funds, destruction of digital evidence, or additional adverse credit reporting.

1. Contact the lender through an official channel

Use contact details from the lender’s official website, mobile application, statement, or regulator listing—not a link supplied in a suspicious text message.

Send a written notice stating that:

You did not apply for, authorize, sign, receive, use, or benefit from the account;
You dispute both the account and the alleged debt;
You request an immediate fraud investigation and a fraud or dispute flag on the account;
You request suspension of collection activity and adverse credit reporting while the investigation is pending;
You do not consent to being treated as the borrower;
You request preservation of all application and transaction evidence; and
You want a written acknowledgment, complaint reference number, investigation result, and correction of all affected records.

If collectors are already contacting you, give them the lender’s dispute reference number and repeat the denial in writing. Keep the message factual. Do not insult, threaten, or accuse a particular person unless you have evidence.

2. Request the records used to open and operate the account

Ask the lender to preserve and, subject to lawful limitations, provide or allow access to relevant records, including:

The application form and alleged agreement;
Signature, selfie, facial-verification, liveness-check, or video records;
Copies of identification documents submitted;
Registered mobile numbers, email addresses, physical addresses, and devices;
Dates and times of application, approval, and disbursement;
Internet Protocol addresses, device identifiers, authentication logs, and one-time-password records;
The destination bank, e-wallet, card, merchant, or other account that received the proceeds;
Call recordings, chat transcripts, and customer-service records;
Payment history and collection endorsements; and
The dates and recipients of any credit-information submissions.

Under the Data Privacy Act, a data subject has rights that include access to personal data being processed and correction of inaccurate or erroneous information, subject to the law’s conditions and lawful exceptions. A lender may redact information belonging to another person or withhold material where disclosure is legally restricted. That does not excuse it from investigating the disputed account.

3. Secure the identity channels that may have been compromised

Change passwords for your primary email, banking, e-wallet, shopping, and social-media accounts. Use unique passwords and enable multi-factor authentication where available.

Also consider:

Asking your telecommunications provider whether there was a SIM replacement, porting request, or suspicious account change;
Signing out unknown devices and reviewing recent login activity;
Removing unrecognized recovery emails, phone numbers, and linked devices;
Blocking affected cards or financial accounts;
Notifying the issuing agency if an identification card was lost or stolen;
Scanning devices for malicious applications and removing unauthorized remote-access tools;
Checking email-forwarding rules and deleted messages; and
Warning close contacts if impersonators may approach them for money or information.

Never give a purported investigator your PIN, complete card number, password, or one-time password. The BSP expressly warns consumers not to share such credentials when filing a complaint.

4. Obtain and review your CIC credit report

One fraudulent account may indicate that other accounts were also opened. Obtain your report through the CIC’s official Direct-to-Consumer program or an authorized CIC credit-report provider.

Review:

All lenders and contracts;
Outstanding balances and payment status;
Personal addresses and contact details;
Government-identification numbers shown;
Inquiries or institutions you do not recognize; and
Multiple accounts opened within a short period.

An account may not appear immediately if it has not yet been submitted to the CIC. Conversely, the absence of an account from one report does not prove that no unauthorized account exists elsewhere.

5. File a CIC dispute for incorrect credit data

If the fraudulent account or incorrect personal information appears in your CIC report, use the CIC’s Online Dispute Resolution System. You generally need the transaction reference number of the credit report and the email address used to obtain it.

Identify the submitting institution, the disputed contract, the type of loan, and the exact error. Attach supporting documents where the process permits.

The CIC facilitates the dispute and transmits it to the submitting entity. It does not simply delete an entry based on an unsupported request and cannot unilaterally rewrite data submitted by a lender. The lender must investigate and submit the appropriate correction or resolution. Remain responsive to CIC and lender communications throughout the process.

Where to escalate the complaint

For banks and other BSP-supervised institutions

A financial consumer must ordinarily raise the complaint first through the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel. This gives the institution a chance to investigate and issue a response.

If the response is unsatisfactory or the problem remains unresolved, escalate it through the BSP Consumer Assistance Mechanism. The BSP identifies the following channels:

The BSP Online Buddy or BOB, accessible through the BSP consumer-assistance page;
A completed Complaint, Inquiry, and Request form emailed to consumeraffairs@bsp.gov.ph;
Postal mail or personal filing through the BSP consumer-assistance office; or
Assistance through the BSP’s published consumer hotline.

Include the complaint previously sent to the institution, its response if any, the resolution you seek, your contact information, and relevant supporting documents. The BSP describes its mechanism as a second-level recourse that facilitates resolution between the consumer and the BSP-supervised institution. It is not a substitute for a criminal investigation.

The Financial Products and Services Consumer Protection Act, or Republic Act No. 11765, protects rights that include equitable and fair treatment, protection of assets against fraud and misuse, data privacy and protection, and timely handling and redress of complaints.

For lending and financing companies

For a lending company, financing company, or online lending platform regulated by the SEC, use the company’s official complaint channel and preserve its acknowledgment.

An unresolved regulatory complaint may be filed through the SEC’s iMessage Mo portal or the SEC procedure applicable to lending and financing companies. The SEC advises complainants to complete the prescribed form, attach supporting evidence and a valid government-issued ID, and submit one complaint form per respondent company.

The SEC may investigate regulatory violations or refer matters to another agency. Its administrative complaint process does not itself declare a disputed contract void, cancel an obligation, or award every form of private relief. Whether a debt legally exists may ultimately require judicial determination if the facts remain contested.

Verify that the company is authorized through the SEC’s official Check with SEC service. An unregistered operator should still be reported; lack of registration does not make threats, fraudulent collection, or identity misuse lawful.

For privacy violations

Identity theft may involve the unauthorized collection, use, disclosure, alteration, or retention of personal data. First send the lender or other personal-information controller a written request for investigation, access, correction, and appropriate restriction or blocking of disputed data.

If the organization fails to address a possible privacy violation, consider filing with the National Privacy Commission. Under the NPC’s published procedure, a complainant may submit a notarized complaint-assisted form or a verified complaint, together with evidence and witness affidavits, personally, by registered mail, by courier, or through an electronic channel authorized by the Commission.

Not every fraudulent loan automatically establishes that the lender violated the Data Privacy Act. The thief may have obtained the information elsewhere, or the lender may have been deceived despite safeguards. Liability depends on how the data was obtained and processed, the security measures used, the lender’s response after notice, and the available evidence.

Report the identity theft to law enforcement

Using another person’s identifying information through a computer system without right may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on the evidence, other offenses—such as estafa, falsification, unlawful access, or offenses under the Data Privacy Act—may also be considered by investigators and prosecutors.

Report the incident to the PNP-ACG, the NBI Cybercrime Division, or the nearest competent law-enforcement office. The BSP’s current complaint guidance also identifies the PNP, NBI, and Cybercrime Investigation and Coordinating Center as agencies to which suspected scams or fraud may be reported.

Bring or submit:

A chronological affidavit or written narrative;
Government-issued identification;
The lender’s demand, statement, or account notice;
Your written dispute and the lender’s acknowledgment or response;
The disputed credit report, if available;
Screenshots, emails, text messages, call logs, and collection messages;
Evidence that the registered phone number, email, address, signature, or disbursement account is not yours;
Proof concerning a lost ID, compromised email, SIM replacement, or account takeover;
Names and contact details of possible witnesses; and
The original devices or files when investigators request them.

A police blotter or incident report documents that you reported the event. It does not, by itself, conclusively prove that the debt is fraudulent. The surrounding records and investigation remain important.

A practical written dispute

Your letter or email should contain enough detail to trigger a meaningful investigation:

I formally dispute Account No. [masked number] and deny having applied for, authorized, signed, received, used, or benefited from this loan or credit facility. Please mark the account as disputed and suspected identity theft; suspend collection and adverse credit reporting while investigating; preserve all application, authentication, device, communication, disbursement, and reporting records; and provide me with a written acknowledgment and investigation result. Please correct your internal records and all credit-information submissions if the account is confirmed unauthorized. Nothing in this notice acknowledges, assumes, or ratifies the alleged obligation.

Add the discovery date, how you learned of the account, your contact details, and a list of attachments. Mask identification and account numbers except where the recipient legitimately needs them. Send the notice through a channel that produces proof of transmission and receipt.

Evidence to preserve

Keep originals and unedited copies whenever possible. Preserve:

The first notice, demand, statement, email, or text that revealed the account;
Full screenshots showing the sender, number, date, time, and web address;
Email headers and original message files;
Recorded calls only when lawfully obtained;
Call logs and contemporaneous notes of conversations;
Complaint reference numbers and delivery receipts;
Credit reports obtained before and after the dispute;
Account-opening documents supplied by the lender;
Login alerts, password-reset messages, and SIM-related notices;
Proof of your location or activity when the application was submitted, if relevant;
Samples of your genuine signature, where forgery is disputed;
Bank or e-wallet records showing that you did not receive the proceeds; and
Copies of every correction, closure, or clearance issued.

Do not crop away identifying details from your only copy. Create a working copy for redaction while preserving the original securely.

What the lender should investigate

A proper review should go beyond comparing a name and ID number. Depending on how the account was opened, relevant questions include:

Was the identity document authentic, current, and actually presented by its owner?
Did the selfie or video match the ID holder?
Were liveness and anti-spoofing controls used?
Which phone number and email received verification codes?
What device and network submitted the application?
Where were the proceeds sent, and who controlled the receiving account?
Did the registered address or employment information belong to the victim?
Were prior fraud alerts or inconsistencies ignored?
Did the lender continue reporting or collecting after receiving a supported dispute?
Was the account sold or endorsed to a collector while the dispute remained unresolved?

Ask for a reasoned written finding, not merely a statement that the account “passed verification.”

Common mistakes to avoid

Paying a small amount “for the meantime”

Payment, restructuring, or a written promise may complicate your denial and could be argued as recognition or ratification, depending on the circumstances. Obtain advice before paying a debt you maintain is entirely unauthorized.

Relying only on telephone calls

Phone calls are difficult to prove. Follow every important call with an email summarizing what was discussed, the representative’s name, and the reference number.

Sending complete IDs to unverified contacts

Fraudsters may pose as lenders or investigators to collect more data. Verify the recipient independently. Watermark copies when appropriate and state their limited purpose.

Deleting messages after blocking collectors

Preserve the evidence first. Export, screenshot, or securely back up messages before blocking abusive senders.

Assuming a police report automatically removes the account

Send the report separately to the lender and, when relevant, to the BSP, SEC, CIC, or NPC. Each process has a different purpose.

Disputing only with the CIC

The CIC cannot independently determine every contractual or criminal issue. Dispute directly with the lender as well.

Publicly naming an alleged thief without sufficient proof

A suspicious phone number, email, or recipient account may itself belong to another victim. Give evidence to investigators and avoid unsupported public accusations.

Ignoring court papers

Collection messages and a summons are not the same. If a complaint has been filed in court, missing the deadline to answer can seriously prejudice your defense even if the account is fraudulent.

If collection continues

Tell the lender and collector in writing that the account is disputed because of identity theft. Request the legal name of the creditor, account basis, amount claimed, and authority of any collection agency.

Keep records of:

Calls at unreasonable times;
Threats of arrest or public humiliation;
Messages sent to relatives, employers, or unrelated contacts;
Publication of personal data;
False representations that the sender is a court, police officer, or government agency; and
Continued credit reporting after the institution confirmed the account was fraudulent.

A genuine unpaid loan is generally a civil obligation; ordinary nonpayment alone does not automatically result in imprisonment. Identity theft, fraud, forgery, or issuance of a court order presents different legal questions. Do not ignore legitimate subpoenas, summonses, or orders.

When legal help is urgent

Consult a lawyer promptly when:

A summons, subpoena, warrant, or formal demand with a short deadline has arrived;
The lender insists that biometric, signature, or device records identify you;
You made any payment or signed a settlement before discovering the fraud;
The unauthorized account is secured by land, a vehicle, a deposit, or another asset;
Several lenders or large amounts are involved;
A business, employer, relative, or household member may have used your authority or documents;
The lender refuses to release or preserve crucial records;
The fraud has affected employment, housing, financing, or an imminent transaction;
Personal data or intimate material is being used for threats or extortion; or
Collection activity continues after the lender has confirmed fraud.

Immediate law-enforcement assistance is warranted if there are credible threats of violence, ongoing account takeovers, rapid transfers of funds, blackmail, or continuing use of your identity.

Frequently asked questions

Must I pay an unauthorized loan while the investigation is pending?

Not merely because a lender or collector demands payment. Formally dispute the account and avoid conduct that could be treated as acknowledgment. Whether any liability exists depends on consent, authority, receipt or benefit, possible ratification, and the evidence.

Is an affidavit of denial required?

Not in every initial complaint, but a sworn, chronological affidavit can strengthen a lender, regulator, credit-report, or criminal complaint. It must be truthful, specific, and based on personal knowledge.

Can the lender require identity verification before handling my dispute?

Reasonable verification may be necessary to prevent further disclosure or fraud. It should be proportionate and conducted through a secure, official channel. Verification of your identity for the dispute is not an admission that you opened the loan.

Can I demand the IP address and receiving account?

You may request preservation and access to relevant personal data and transaction information. Disclosure may be limited by privacy, bank-secrecy, investigative, or other legal restrictions. Law enforcement or a court may need to obtain some records through lawful process.

What if the proceeds entered my bank or e-wallet without my knowledge?

Notify that institution immediately, do not spend or transfer the funds except under documented official instructions, and seek advice. Receipt into an account bearing your name may complicate the facts but does not necessarily prove that you applied for or controlled the transaction.

What if a relative opened the account?

Kinship does not by itself create authority to borrow in your name. Preserve the evidence and avoid informal arrangements that obscure what happened. If you later assume, pay, or restructure the debt, the legal consequences may change.

Can the credit entry be deleted immediately?

Usually not on demand alone. The lender and CIC must follow their dispute and correction processes. Request that the account be marked as disputed and that inaccurate submissions be corrected promptly after investigation.

Should I report even if no money was collected from me?

Yes. The account may damage your credit history, lead to future collection, or indicate broader misuse of your identity.

Official resources

This article provides general Philippine legal information, not legal advice for a particular account or dispute. The proper remedy depends on the lender’s regulatory status, the application and authentication records, where the proceeds went, and what occurred after discovery. Official sources and procedures were checked on August 26, 2026.