I. Introduction

SIM card fraud is no longer a minor inconvenience. In the Philippines, a compromised SIM card can expose a person to identity theft, unauthorized loan applications, e-wallet takeovers, phishing, harassment by online lending platforms, and misuse of personal data. When loan texts suddenly arrive after SIM-related fraud, the situation should be treated as a possible identity theft incident, not merely spam.

This article explains the legal context, practical remedies, and government reporting channels available in the Philippines for individuals who suspect that their mobile number, personal information, or identity has been misused in connection with SIM card fraud and loan-related messages.

This article is for general legal information and does not replace advice from a lawyer.

II. What Is SIM Card Fraud?

SIM card fraud refers to schemes involving the unauthorized use, takeover, registration, cloning, swapping, or exploitation of a mobile number or SIM card. Common forms include:

SIM swap fraud – where a fraudster causes the victim’s mobile number to be transferred to another SIM, usually to intercept one-time passwords or account recovery messages.
Unauthorized SIM registration – where a SIM is registered using another person’s identity documents, photo, or personal information.
Use of a stolen or lost SIM – where a person uses a victim’s active SIM to access accounts, contacts, or financial services.
Phishing-linked SIM fraud – where the victim is tricked into revealing OTPs, passwords, ID photos, or personal details.
Loan harassment or fake loan texts – where a victim receives loan approval, collection, verification, or threat messages from lending apps or unknown numbers despite not applying for a loan.
Identity-linked account creation – where a mobile number or personal data is used to create accounts with e-wallets, banks, online lending apps, or other digital platforms.

III. Why Loan Texts After SIM Fraud Are Serious

Receiving loan texts after a SIM fraud incident may mean several things:

Your number was entered into an online lending app.
Your identity documents may have been uploaded without authority.
Someone may have applied for a loan in your name.
Your phone contacts may have been harvested.
Your personal data may have been sold, leaked, or shared.
Your number may have been used as a reference contact.
The messages may be phishing attempts pretending to be lenders.
Debt collectors may be contacting the wrong person.
An online lending platform may be using abusive collection practices.

Even if no loan was actually taken, the messages may indicate that your personal data is circulating in fraud networks or lending databases.

IV. Relevant Philippine Laws

A. SIM Registration Act

Republic Act No. 11934, or the SIM Registration Act, requires SIM users to register their SIM cards using truthful and accurate information. The law seeks to prevent scams, fraud, and anonymity-based crimes involving mobile numbers.

A person who uses false information, fictitious identities, or another person’s identity in SIM registration may face legal consequences. Victims of unauthorized SIM registration should report the matter to their telecommunications provider and relevant authorities.

Important points:

A SIM registered using your identity without consent may indicate identity misuse.
Telcos may be asked to investigate the registration details of numbers linked to fraud.
Victims should request blocking, deactivation, or replacement of compromised SIMs.
Fraudulent SIM registration may be relevant evidence in cybercrime and identity theft complaints.

B. Data Privacy Act of 2012

Republic Act No. 10173, or the Data Privacy Act, protects personal information and sensitive personal information. Names, addresses, mobile numbers, ID documents, photos, financial data, biometrics, and government ID numbers are covered by the law.

If a lending app, collector, agent, or unknown party collected, processed, shared, disclosed, or used your personal data without lawful basis, the Data Privacy Act may apply.

Possible violations may include:

Unauthorized processing of personal information.
Unauthorized access to personal data.
Improper disclosure of personal data.
Malicious disclosure.
Unauthorized access due to negligence.
Processing of personal data without consent or lawful basis.
Use of personal data for harassment, shaming, or unlawful collection practices.

The National Privacy Commission may receive complaints involving misuse of personal data, unauthorized loan-related processing, contact-list harvesting, and abusive disclosure of alleged debts.

C. Cybercrime Prevention Act

Republic Act No. 10175, or the Cybercrime Prevention Act, may apply when fraud is committed using computers, mobile devices, telecommunications systems, internet platforms, or digital accounts.

Relevant cybercrime issues may include:

Computer-related identity theft.
Computer-related fraud.
Illegal access.
Misuse of digital credentials.
Phishing.
Unauthorized account takeover.
Use of electronic communications to commit threats, extortion, or harassment.

Complaints may be brought to the Philippine National Police Anti-Cybercrime Group or the National Bureau of Investigation Cybercrime Division.

D. Revised Penal Code

Traditional criminal offenses under the Revised Penal Code may also apply, depending on the facts.

Possible offenses include:

Estafa – if deceit was used to obtain money, loans, goods, or services.
Falsification – if documents, signatures, IDs, or application forms were falsified.
Usurpation or misuse of identity-related representations – depending on how the fraud was committed.
Grave threats or unjust vexation – if collectors or fraudsters send threatening or abusive messages.
Libel or cyberlibel – if false accusations are publicly posted online or sent in a manner that damages reputation.

E. Lending Company Regulation Act and SEC Rules

Lending companies and financing companies in the Philippines are regulated by the Securities and Exchange Commission. Online lending platforms must comply with laws and SEC regulations, including rules against abusive, unfair, deceptive, or harassing collection practices.

Potentially unlawful practices may include:

Threatening borrowers or alleged borrowers.
Contacting persons who are not borrowers.
Public shaming.
Posting false statements online.
Accessing or misusing phone contacts.
Sending threatening text blasts.
Misrepresenting legal consequences.
Pretending to be government officers, police, lawyers, or court personnel.
Using profane, abusive, or coercive language.
Collecting from someone who did not borrow money.

If loan texts come from an online lending app or its collector, a complaint may be filed with the SEC, especially when the lender is registered, identifiable, or operating as a lending or financing company.

F. Financial Products and Services Consumer Protection Act

Republic Act No. 11765 strengthens protection for financial consumers. It applies to financial products and services under the supervision of financial regulators such as the Bangko Sentral ng Pilipinas, Securities and Exchange Commission, Insurance Commission, and Cooperative Development Authority.

Victims may invoke consumer protection principles when financial service providers fail to protect customer accounts, mishandle complaints, allow unauthorized transactions, or use unfair collection methods.

G. Anti-Financial Account Scamming Law

The Anti-Financial Account Scamming Act strengthens legal tools against financial account scams, money mule activities, social engineering schemes, phishing, and fraudulent use of financial accounts. It is relevant where SIM fraud is connected to bank accounts, e-wallets, unauthorized transfers, or account takeover.

Victims should immediately coordinate with banks, e-wallet providers, and law enforcement when SIM fraud is linked to financial account access.

V. Immediate Steps After Suspected SIM Card Fraud

1. Secure the SIM and mobile account

Immediately contact your telecommunications provider. Request urgent action, such as:

Temporary suspension of the SIM.
SIM replacement.
Blocking of unauthorized SIM activity.
Investigation of SIM registration details.
Record of recent SIM replacement, porting, or account changes.
Written confirmation that you reported suspected fraud.

Use official hotlines, official stores, or verified customer support channels only.

2. Change passwords immediately

Change passwords for accounts connected to the mobile number, especially:

Email accounts.
E-wallets.
Online banking accounts.
Social media accounts.
Shopping apps.
Messaging apps.
Cloud storage accounts.
Government portals.
Online lending or financial apps.

Prioritize your primary email account because it is often used to reset other accounts.

3. Disable SMS-based recovery where possible

SMS one-time passwords are vulnerable after SIM fraud. Where available, use:

Authenticator apps.
Hardware security keys.
App-based verification.
Email alerts.
Biometric app locks.
Transaction PINs.

Avoid relying only on text-message OTPs for critical accounts.

4. Log out unknown sessions

Check security settings and remove unfamiliar devices or sessions from:

Google account.
Apple ID.
Facebook.
Instagram.
TikTok.
Viber.
Telegram.
WhatsApp.
Bank and e-wallet apps.

Review login history and account recovery information.

5. Freeze or secure financial accounts

Contact banks, e-wallets, credit card issuers, and financial apps. Ask them to:

Block suspicious transactions.
Reset credentials.
Disable device binding to unknown devices.
Investigate unauthorized access.
Issue written incident reports.
Place enhanced verification on the account.
Reverse or dispute unauthorized transactions, when applicable.

Report the matter promptly because banks and e-wallets may impose deadlines for disputes.

VI. What To Do About Loan Texts

1. Do not reply with personal information

Do not send:

ID photos.
Selfies.
OTPs.
Bank details.
E-wallet details.
Address confirmation.
Employer information.
Contact lists.
Signature samples.

Fraudsters may use replies to verify that the number is active.

2. Preserve all messages

Do not delete loan texts, threats, collection messages, or verification codes. Save:

Screenshots.
Sender number or sender ID.
Date and time.
Full message content.
Links included in the message.
App names or company names mentioned.
Names of collectors.
Voice recordings or call logs, if lawful and available.
Proof that you did not apply for any loan.

Make backup copies in secure cloud storage or external storage.

3. Identify whether the lender is legitimate

Check whether the message identifies:

A lending company.
Financing company.
Online lending app.
Collection agency.
Reference number.
Loan account number.
Amount allegedly owed.
Borrower name.
Contact person.
Payment channel.

Be cautious: scammers often use fake company names or pretend to be legitimate lenders.

4. Send a formal denial and data request only through official channels

Where the lender is identifiable and appears legitimate, send a formal message through official customer service channels stating:

You did not apply for the loan.
You deny liability.
You request copies of the alleged loan application, consent records, ID submissions, IP logs, device logs, and verification records.
You demand preservation of evidence.
You demand deletion or blocking of unlawfully processed personal data, subject to lawful investigation.
You demand that all collection against you stop unless they can prove lawful obligation.
You reserve your rights under the Data Privacy Act, SEC rules, consumer protection laws, and other applicable laws.

Do not negotiate payment for a debt you do not recognize.

5. Do not pay an alleged loan just to stop harassment

Payment may be interpreted as acknowledgment or may encourage further extortion. If the debt is fraudulent, the proper response is documentation, dispute, complaint, and legal reporting.

VII. Evidence Checklist

A strong complaint should include organized evidence. Keep a folder containing:

Government ID copy used for verification purposes, if relevant.
Screenshot of suspicious loan texts.
Screenshot of SIM fraud notices or loss of signal.
Telco reference number.
Bank or e-wallet incident numbers.
Emails from lenders or collectors.
Call logs.
Screenshots of missed calls.
Names and numbers of collectors.
Links sent by scammers.
Proof of unauthorized account access.
Police blotter or cybercrime complaint acknowledgment.
Affidavit of denial, if prepared.
Timeline of events.
List of affected accounts.
Credit report or financial record showing disputed accounts.
Screenshots of public shaming, if any.
Copies of demand letters or responses sent.

A simple timeline is especially useful:

Date	Event	Evidence
June 1	Lost mobile signal	Screenshot / telco report
June 2	Received OTPs not requested	SMS screenshots
June 3	Loan text received	Screenshot
June 4	Reported to telco	Reference number
June 5	Filed complaint	Complaint acknowledgment

VIII. Where To Report in the Philippines

A. Telecommunications provider

Report immediately to the telco that issued the SIM. Request written acknowledgment and ask for account-level investigation.

Relevant requests:

Was the SIM replaced?
Was the number ported?
Was there a change in registration details?
Was there an unauthorized account update?
Can the SIM be suspended or replaced?
Can the number involved in fraud be blocked or investigated?

B. National Telecommunications Commission

The National Telecommunications Commission may receive complaints involving telecommunications services, SIM registration issues, scam texts, and telco-related concerns.

A complaint may be appropriate where:

The telco fails to act.
Fraudulent SIM registration is suspected.
Scam texts persist.
The number appears to be used for fraud.
The victim needs regulatory intervention.

C. National Privacy Commission

The National Privacy Commission is the primary authority for personal data protection concerns.

A complaint may be appropriate where:

Your data was used for a loan without consent.
A lending app accessed your contacts.
Collectors contacted your family, friends, employer, or colleagues.
Your personal data was disclosed publicly.
Your ID was used without authority.
A company refuses to provide information about how it obtained your data.
A company refuses to correct, delete, or block unlawfully processed data.

D. Securities and Exchange Commission

The SEC regulates lending and financing companies. Report lending apps or companies that engage in abusive or illegal practices.

A complaint may be appropriate where:

A lending app harasses you for a loan you did not make.
A collector threatens you.
A lender contacts your phone contacts.
A lender publicly shames borrowers or alleged borrowers.
A lending app misuses personal data.
A lending company operates without proper authority.
A collector uses fake legal threats.

E. Philippine National Police Anti-Cybercrime Group

The PNP Anti-Cybercrime Group handles cybercrime complaints involving identity theft, online fraud, phishing, account takeover, and digital harassment.

Bring:

Valid ID.
Screenshots.
Device used.
SIM information.
Telco report.
Bank or e-wallet report.
Timeline of events.
Names, links, and numbers involved.

F. National Bureau of Investigation Cybercrime Division

The NBI Cybercrime Division may investigate cyber-related offenses, including identity theft, phishing, online fraud, unauthorized account access, and cyber harassment.

Victims may file a complaint supported by affidavits, screenshots, and digital evidence.

G. Banks, e-wallets, and financial institutions

Report immediately if any bank, e-wallet, credit card, or financial account may be affected.

Ask for:

Incident ticket.
Account freeze or security hold.
Transaction dispute.
Investigation report.
Confirmation of unauthorized access.
Blocking of suspicious devices.
Reset of account recovery details.

H. Credit information and credit bureaus

If a fraudulent loan may have been opened in your name, check whether it appears in your credit records. In the Philippines, credit data may be reported through the Credit Information Corporation ecosystem and accredited credit bureaus.

Dispute any loan that you did not authorize. Keep all written dispute records.

IX. Rights of the Victim Under the Data Privacy Act

A victim whose personal data was misused may invoke several rights, including:

1. Right to be informed

You may ask how your personal data was collected, used, stored, shared, and disclosed.

2. Right to access

You may request copies of personal data processed about you, including loan application records, consent logs, documents submitted, and verification data.

3. Right to object

You may object to processing when there is no lawful basis or when your data is used for harassment or unauthorized collection.

4. Right to erasure or blocking

You may request deletion, blocking, or removal of unlawfully processed data, subject to legitimate retention for investigation or legal claims.

5. Right to damages

A person harmed by unlawful processing may seek damages where allowed by law.

6. Right to file a complaint

You may file a complaint with the National Privacy Commission when your personal data rights are violated.

X. Dealing With Debt Collectors

Debt collectors must not treat an alleged debtor as guilty without proof. If you did not borrow money, the collector should be required to validate the debt.

A. What collectors should provide

A proper collector or lender should be able to provide:

Name of lender.
SEC registration details, if applicable.
Loan agreement.
Date of application.
Amount released.
Recipient account.
Verification method.
Identity documents allegedly submitted.
Consent record.
Basis for contacting you.

B. What collectors should not do

Collectors should not:

Threaten imprisonment for a purely civil debt.
Threaten public shaming.
Contact your employer without lawful basis.
Harass family members.
Use obscene language.
Pretend to be police, court staff, or government officers.
Send fake subpoenas or warrants.
Post your photo online.
Access your phone contacts without valid consent.
Demand payment without proving the debt.

C. Sample response to a collector

I deny applying for or receiving any loan from your company. I dispute any alleged obligation connected to my name, mobile number, or personal data. Please provide the complete loan application record, verification logs, consent record, disbursement details, and the legal basis for processing my personal information. Pending validation, cease collection communications against me and preserve all records for investigation. I reserve all rights under Philippine law, including the Data Privacy Act, Cybercrime Prevention Act, SEC regulations, and other applicable laws.

XI. What To Do If Your ID Was Used for a Loan

If you discover or suspect that your government ID was used for a loan application:

Prepare an affidavit of denial.
Report to the lending company.
Demand a copy of the loan application.
Ask for the disbursement account used.
Ask what ID, selfie, signature, and phone number were submitted.
Report the identity theft to PNP ACG or NBI Cybercrime.
File a complaint with the NPC if personal data was misused.
File a complaint with the SEC if a lending company is involved.
Notify banks and e-wallets.
Monitor credit reports.
Preserve all communications.
Avoid paying unless liability is legally established.

XII. What To Do If Your Contacts Are Being Harassed

Some online lending apps have been known to access phone contacts and send threatening messages to relatives, friends, co-workers, or employers. This may raise serious legal concerns.

Steps to take:

Ask affected contacts to screenshot the messages.
Collect sender numbers and message timestamps.
Identify the lender or app mentioned.
Send a cease-and-desist demand to the lender.
File complaints with the NPC and SEC.
Report threats to PNP ACG or NBI Cybercrime.
Document reputational harm, employment consequences, anxiety, or damages.

A person who is not a borrower should not be harassed for another person’s alleged loan. Even if a person is a borrower, collection must still be lawful, fair, and respectful of privacy rights.

XIII. Police Blotter vs. Cybercrime Complaint

A police blotter is a record of an incident. It may be useful as supporting documentation but may not be enough to trigger a full cybercrime investigation.

A cybercrime complaint is more detailed and should include:

Complaint-affidavit.
Evidence screenshots.
URLs or phone numbers.
Device details.
Account details.
Timeline.
Financial loss, if any.
Identity documents misused.
Names of suspected persons or entities, if known.

For serious cases, consult a lawyer for preparation of affidavits and preservation requests.

XIV. Sample Affidavit Points for Identity Theft or Fraudulent Loan

An affidavit of denial may state:

Your full name, address, and contact details.
That you are the owner or user of the affected mobile number.
That you experienced SIM fraud, unauthorized access, or suspicious messages.
That you did not apply for the questioned loan.
That you did not authorize anyone to use your identity.
That you did not receive the loan proceeds.
That you did not consent to the processing of your personal data for the loan.
That you received collection or verification messages.
That you reported the matter to relevant entities.
That you are executing the affidavit for complaint, investigation, dispute, and protection of rights.

Avoid false statements. An affidavit must be truthful and may be notarized.

XV. Protecting Your Digital Identity Going Forward

1. Strengthen account security

Use strong, unique passwords for each account. Use a password manager where possible.

2. Enable stronger authentication

Use authenticator apps instead of SMS OTP where supported.

3. Secure your email

Your email is often the master key to your digital life. Review recovery numbers, recovery emails, forwarding rules, filters, and login devices.

4. Protect government IDs

Do not send ID photos casually. When submitting IDs, watermark the image with the recipient name, purpose, and date, such as:

Submitted to ABC Bank only for account verification, 6 June 2026.

5. Avoid unknown loan apps

Many fraudulent or abusive lending operations use mobile apps, social media ads, or text links. Avoid installing apps that request unnecessary permissions such as full contact access, gallery access, SMS access, or call log access.

6. Review app permissions

Remove permissions for apps that do not need access to:

Contacts.
SMS.
Camera.
Microphone.
Photos.
Location.
Files.
Call logs.

7. Be careful with OTPs

Never disclose OTPs to anyone, including persons claiming to be from banks, telcos, law enforcement, or government agencies.

8. Monitor financial accounts

Review bank, e-wallet, credit card, and lending app records regularly.

9. Keep a fraud folder

Maintain a secure digital folder for all fraud-related evidence, reports, reference numbers, and communications.

10. Use official channels only

Do not click links in loan texts. Go directly to the official website, app, branch, hotline, or verified support channel.

XVI. Common Scenarios and Legal Responses

Scenario 1: You receive a text saying your loan is approved, but you never applied

Treat it as possible identity misuse. Do not click links. Preserve the message. Contact the named lender through official channels and deny the application. Request all application records and file complaints if your data was used.

Scenario 2: A collector demands payment for a loan you did not receive

Dispute the debt in writing. Demand proof of obligation and disbursement. Do not pay merely to stop harassment. Report abusive collection to SEC and data misuse to NPC.

Scenario 3: Your SIM suddenly loses signal, then financial alerts appear

This may indicate SIM swap fraud. Contact your telco immediately, freeze bank and e-wallet accounts, change passwords, and report to cybercrime authorities.

Scenario 4: Your relatives receive threats about your alleged loan

Collect screenshots from relatives. Report the lender or collector to the NPC and SEC. Threats and public shaming may create civil, administrative, or criminal liability.

Scenario 5: A loan app says your number was used as a reference

You are not automatically liable for another person’s loan merely because your number was used as a reference. Demand deletion of your data unless there is lawful basis for retention.

Scenario 6: A lender refuses to show the loan documents

Escalate the matter. File a privacy complaint with the NPC and a regulatory complaint with the SEC if a lending or financing company is involved.

XVII. Possible Legal Remedies

Depending on the facts, victims may pursue:

Complaint with telco.
Complaint with NTC.
Complaint with NPC.
Complaint with SEC.
Cybercrime complaint with PNP ACG.
Cybercrime complaint with NBI.
Bank or e-wallet dispute.
Credit report dispute.
Civil action for damages.
Criminal complaint for fraud, falsification, identity theft, threats, or cybercrime.
Cease-and-desist demand.
Data access, correction, deletion, or blocking request.
Complaint against abusive collectors or unlawful lending operations.

XVIII. Practical Demand Letter Outline

A formal letter to a lender, collector, telco, or platform may include:

Subject line: “Formal Dispute, Data Privacy Request, and Demand to Preserve Evidence.”
Identification of the affected mobile number.
Statement that you did not apply for or authorize the loan.
Statement that you deny liability.
Request for copies of all records.
Request for source of personal data.
Demand to stop collection and harassment.
Demand to preserve evidence.
Demand to correct, block, or delete unlawfully processed data.
Notice that complaints may be filed with NPC, SEC, NTC, PNP ACG, NBI, and other authorities.
Request for written response within a reasonable period.
Reservation of rights.

XIX. Important Cautions

Do not ignore serious loan texts if they contain your name, ID details, address, workplace, or family contacts.
Do not click links in suspicious loan messages.
Do not send additional IDs to unknown senders.
Do not admit liability for a loan you did not make.
Do not pay without verification.
Do not delete evidence.
Do not rely only on phone calls; use written communications.
Do not delay reporting SIM swap or unauthorized financial access.
Do not assume that blocking numbers solves the legal problem.
Do not post sensitive evidence publicly online.

XX. Conclusion

SIM card fraud combined with loan-related text messages can signal a wider identity theft problem. In the Philippine context, the victim should respond quickly, preserve evidence, secure accounts, dispute any unauthorized loan, and report the incident to the proper authorities. The most relevant legal frameworks include the SIM Registration Act, Data Privacy Act, Cybercrime Prevention Act, financial consumer protection laws, SEC lending regulations, and general criminal and civil remedies.

The safest approach is to treat the incident as both a cybersecurity problem and a legal problem. Secure the number, secure the accounts, document everything, deny unauthorized obligations in writing, and escalate to regulators and law enforcement when personal data, financial accounts, or reputation are at risk.