An unauthorized loan application is not just an “annoying text from a lending app.” It can mean someone used your name, mobile number, ID, selfie, employer details, bank account, or contact list to apply for credit without your consent. In the Philippines, the right response is usually not one complaint, but a coordinated paper trail: report it to the lender, preserve evidence, escalate to the correct regulator, dispute any credit record, and file a cybercrime or police/NBI report when identity theft or fraud is involved.

What Counts as an Unauthorized Loan Application?

An unauthorized loan application may involve any of these situations:

Someone applied for a loan using your name, ID, phone number, email, payslip, selfie, or e-wallet/bank details.
A lending app says you owe money even though you never applied, never received funds, or never signed/accepted loan terms.
You were listed as a guarantor, co-borrower, character reference, or emergency contact without consent.
A collector is contacting your family, employer, neighbors, or phone contacts about a loan you did not make.
A loan appears in your credit report even though you never borrowed from that company.
A scammer used your lost ID, SIM card, hacked account, or compromised phone to submit a loan application.

The first practical question is: Was the loan only applied for, or was money actually released? Your response is more urgent if funds were released to a bank account, e-wallet, or phone number you do not control.

Why You Do Not Automatically Owe a Loan You Did Not Apply For

A loan is a contract. Under Article 1318 of the Civil Code, a valid contract requires consent, a certain object, and a lawful cause. The Supreme Court has repeatedly treated these as essential requisites of a contract; without consent, there is no valid loan agreement binding you as borrower. (Lawphil)

This matters because a lender or collector cannot simply say, “Your name is in our system, so you must pay.” They should be able to show proof that you actually applied, accepted the terms, passed verification, and received the loan proceeds.

In practice, ask for:

The loan application form or digital application record
The date and time of application
The mobile number, email address, device, IP address, or account used
The ID, selfie, e-signature, OTP verification, or recorded verification call
The disbursement details showing where the funds were sent
The loan agreement, disclosure statement, and amortization schedule
The basis for reporting you to a credit database or contacting third parties

If they cannot validate the debt, demand that they stop collection, mark the account as disputed, preserve all records, and refrain from reporting or continuing to report the loan under your name.

Legal Bases That May Apply

Several Philippine laws may be relevant depending on what happened.

Civil Code: No Consent, No Valid Loan

If you never agreed to the loan, the core legal issue is lack of consent. Article 1318 of the Civil Code requires consent of the contracting parties. Article 1346 also provides that an absolutely simulated or fictitious contract is void. (Lawphil)

A lender that carelessly processed a fraudulent application may also face civil liability if its negligence caused damage. Article 1170 of the Civil Code provides that those guilty of fraud, negligence, delay, or contravention of obligations may be liable for damages. (Law Library - Legal Resource PH)

Data Privacy Act of 2012: Misuse of Your Personal Data

Republic Act No. 10173, or the Data Privacy Act of 2012, protects personal information in both government and private-sector systems. The National Privacy Commission explains that data subjects have rights over personal data collected, stored, and processed by personal information controllers and processors. (National Privacy Commission)

For unauthorized loan applications, the most important rights are usually:

The right to be informed how your data was collected and used
The right to access records about you
The right to object to unlawful or unauthorized processing
The right to correct inaccurate personal data
The right to erasure or blocking, which includes requesting suspension, withdrawal, blocking, removal, or destruction of personal data from a controller’s filing system (National Privacy Commission)

For online lending, the NPC has issued specific rules on loan-related personal data processing. NPC Circular No. 20-01 applies to lending and financing companies and other persons processing personal data for loan activities, and requires lawful processing, security measures, and respect for data subject rights. (National Privacy Commission)

Cybercrime Prevention Act: Identity Theft and Online Fraud

If your personal information was used online without authority, Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, may apply. The law penalizes computer-related identity theft, which includes intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. (Lawphil)

This is why it is important to save screenshots, emails, SMS messages, app notifications, and call logs before blocking numbers or deleting accounts.

Revised Penal Code: Falsification or Estafa

If someone submitted a fake signature, falsified ID, false employment certificate, fake payslip, or forged document, the Revised Penal Code provisions on falsification may apply. Article 172 covers falsification by private individuals and use of falsified documents, while Article 315 may be relevant for estafa or swindling when deceit caused damage. (Supreme Court E-Library)

RA 8484: Access Device Fraud

If the unauthorized application involved a credit card, debit card, account number, electronic access credential, or other “access device,” Republic Act No. 8484, as amended by RA 11449, may apply. RA 8484 treats certain acts involving unauthorized or fraudulently applied-for access devices as access device fraud. (Lawphil)

This law is especially relevant when the issue involves credit cards, virtual cards, account credentials, or loan proceeds routed through compromised banking or e-wallet access.

Which Agency Should You Report To?

Use the agency that regulates the entity or handles the type of harm.

Situation	Where to report	Main purpose
Lending company, financing company, or online lending app	SEC Financing and Lending Companies Department through SEC iMessage	Regulatory complaint, unfair collection, unauthorized lending activity
Bank, credit card issuer, BSP-supervised e-money issuer, or BSP-supervised financial institution	Bank’s complaint unit first, then BSP Consumer Assistance Mechanism	Financial consumer complaint and escalation
Misuse of personal data, contacts, ID, selfie, or privacy violation	National Privacy Commission	Data privacy complaint and possible enforcement
Identity theft, hacking, scam, threats, extortion, fake documents	NBI Cybercrime Division or PNP Anti-Cybercrime Group	Criminal investigation
Wrong loan record in credit report	Credit Information Corporation dispute process	Correction or dispute of credit data
Harassment, threats, public shaming, threats to employer/family	SEC, NPC, NBI/PNP depending on facts	Stop abusive collection and preserve evidence

The SEC iMessage portal accepts public tickets and includes “Complaints on Financing and Lending Companies” as a service under the Financing and Lending Companies Department. (Securities and Exchange Commission)

Step-by-Step: How to Report an Unauthorized Loan Application

1. Preserve Evidence Before Engaging Further

Do this immediately:

Screenshot the loan app message, SMS, email, Facebook message, or collection notice.
Save the sender’s number, email, profile link, app name, website, and company name.
Record dates and times of calls.
Save call recordings only if lawful and practical; at minimum, keep call logs and written notes.
Screenshot app permissions if an app was installed on your phone.
Save proof that you did not receive funds, such as bank or e-wallet transaction history for the relevant dates.
If collectors contacted third parties, ask those people to screenshot the messages.

Do not rely on memory. Regulators and investigators work better with a clear chronology.

2. Send a Written Dispute to the Lender or App Operator

Send a short written notice by email, app support ticket, or registered mail if available. The purpose is to create proof that you disputed the loan.

Include:

Your full name
Contact number and email
The alleged loan account number, if known
A clear statement: “I did not apply for, authorize, receive, or benefit from this loan.”
A request for validation documents
A demand to stop collection while the account is under dispute
A demand not to report the account to any credit database, or to mark it disputed if already reported
A request to preserve all application logs, KYC records, OTP logs, IP/device logs, disbursement records, and call recordings

Avoid sending more IDs than necessary. If they ask for identity verification, watermark the copy with: “For dispute of unauthorized loan application only,” plus the date and recipient.

3. If It Is a Lending App or Financing Company, File With the SEC

For lending companies, financing companies, and online lending platforms, file through SEC iMessage. Select the service for complaints on financing and lending companies where available. The SEC public advisory on online lending platforms also identifies the SEC Financing and Lending Companies Department as the proper office for unfair debt collection complaints and lists SEC iMessage and hotline 1-4732 as reporting channels.

Attach:

Your written dispute to the lender
Screenshots of collection messages
Proof you did not apply or receive funds
Copies of any loan records sent to you
Harassment screenshots, if any
Names and numbers of collectors
App name, website, company name, and SEC registration details if known

The SEC route is especially important if the app is:

Unregistered or using a different company name
Threatening public shaming
Contacting your employer or contacts
Refusing to provide validation
Continuing collection after you disputed the loan

4. If Personal Data Was Misused, File With the National Privacy Commission

If the issue involves misuse of your ID, selfie, contact list, phonebook, employer details, address, or other personal data, prepare an NPC complaint.

Under the NPC’s complaint mechanics, a complainant generally files a filled-out and notarized complaint-assisted form or verified complaint, with evidence and witness affidavits. The NPC also reminds complainants to first inform the respondent in writing and allow the respondent to address the violation; proof of this written notice should be attached, and failure to give the respondent an opportunity to address the matter may result in dismissal. (National Privacy Commission)

For unauthorized loan applications, your NPC evidence may include:

Copy of your written data privacy demand
Screenshot of the app’s privacy notice, if available
Proof the lender processed your data without consent
Proof the app accessed or contacted your phone contacts
Proof that a character reference or guarantor was contacted without consent
Screenshots of public shaming, threats, or disclosure of your alleged debt
The company’s response or proof of no response after 15 calendar days

The 2026 DICT-NPC-SEC public advisory on online lending platforms states that unnecessary app permissions, unauthorized or excessive processing of personal data, and contacting persons in the borrower’s contact list other than named guarantors are prohibited. It also clarifies that a guarantor must have given consent to be a guarantor.

5. If There Is Identity Theft, Fraud, Hacking, or Threats, Report to NBI or PNP

Go to the NBI Cybercrime Division or the PNP Anti-Cybercrime Group if there are signs of criminal activity, such as:

Your ID or selfie was used by another person
Your SIM, email, social media, e-wallet, or phone was hacked
The loan proceeds were sent to a stranger’s account
Someone forged your signature or documents
Collectors threatened violence, arrest, public shaming, or harm
Scammers are extorting money from you to “clear” the account

The NBI’s citizen charter for computer crime complaints provides that the general public may seek investigative assistance from the Cybercrime Division, where the complainant undergoes preliminary interview, executes sworn statements or submits prepared affidavits, and provides supporting documents. (National Bureau of Investigation)

Bring or prepare:

Government ID
Printed screenshots
USB drive or secure folder containing digital evidence
Written timeline
Sworn statement or draft affidavit
Proof of lost ID, hacked account, or compromised SIM if applicable
Bank/e-wallet statements showing you did not receive the funds
Names, phone numbers, URLs, account numbers, and app names involved

For urgent threats, also make a police blotter at the nearest police station. A blotter is not the same as a full criminal case, but it creates an official record and may help when dealing with lenders, employers, banks, or credit bureaus.

6. If the Loan Appears in Your Credit Report, Dispute It With the CIC

If the unauthorized loan appears in your credit record, file a dispute with the Credit Information Corporation. The CIC is the government credit registry created under Republic Act No. 9510, the Credit Information System Act, to receive and consolidate credit data and provide access to standardized credit information on borrowers. (Credit Information Corporation (CIC))

The CIC has an Online Dispute Resolution System designed to facilitate disputes with minimum contact. (Credit Information Corporation (CIC))

Before filing, gather:

Copy of the credit report showing the disputed loan
Your ID
Your dispute letter to the lender
Any SEC, NPC, NBI, PNP, or BSP reference number
Proof you did not receive proceeds
Any lender admission, correction, or failure to validate the debt

Ask that the disputed record be corrected, deleted, blocked, or marked as disputed, depending on the facts and the CIC process.

7. If the Entity Is a Bank, Credit Card Company, or BSP-Supervised Institution, Escalate to BSP

If the unauthorized loan is from a bank, credit card company, or BSP-supervised financial institution, complain to the institution’s official consumer assistance unit first. Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, requires financial service providers to establish a consumer assistance mechanism for financial transaction concerns. (Lawphil)

If you are not satisfied with the institution’s action, escalate to the BSP Consumer Assistance Mechanism. BSP materials describe BSP-CAM as a second-level recourse for financial consumers and identify BSP Online Buddy, or BOB, as a channel for escalation. (Bureau of Small and Medium Enterprises)

Practical Timeline

Step	Typical timing	Notes
Preserve evidence	Same day	Do this before deleting messages or uninstalling apps
Written dispute to lender	Same day to 2 days	Ask for validation and suspension of collection
SEC complaint	Within days if lender/app ignores you or collection continues	Use for lending/financing companies and online lending apps
NPC written notice to respondent	Immediately	NPC generally expects proof that respondent was informed in writing
NPC complaint	After no timely/appropriate action, commonly after 15 calendar days from respondent’s receipt	Attach proof of notice and evidence
NBI/PNP report	Immediately if fraud, threats, hacking, or identity theft exists	Criminal reporting should not wait for regulator action
CIC dispute	As soon as the wrong record appears	Attach credit report and dispute evidence
BSP escalation	After using the institution’s own complaint mechanism	For BSP-supervised institutions

What to Put in Your Written Dispute

A clear dispute letter is better than an angry message. Keep it factual.

Use this structure:

Identify the account. State the alleged loan account number, app name, company name, and collection reference if available.
Deny authorization. State that you did not apply, sign, accept, authorize, receive, or benefit from the loan.
Demand validation. Ask for the full application record, KYC documents, OTP logs, device/IP data, verification recordings, loan agreement, disclosure statement, and disbursement proof.
Demand suspension. Ask them to stop collection while the dispute is pending.
Demand data protection. Ask them not to disclose the alleged debt to third parties and not to contact anyone except a lawfully consenting guarantor.
Demand credit correction. Ask them not to report the loan, or to correct/delete/mark it disputed if already reported.
Preserve evidence. Ask them to preserve all records for regulatory or criminal investigation.

Common Mistakes to Avoid

Paying “Just to Stop the Harassment”

Paying a loan you did not make may be interpreted by the company as acknowledgment, and it may weaken your dispute. If you pay because of threats, document the threats and label the payment as made under protest.

Ignoring Court Papers

Most collection threats are just threats. But if you receive an actual subpoena, prosecutor’s notice, barangay summons, small claims notice, or court paper, do not ignore it. Respond within the stated period and bring your identity theft evidence.

Sending Too Many IDs to Unknown Collectors

Do not send a fresh, clean copy of your passport, UMID, driver’s license, National ID, or company ID to random collectors. Send documents only to official company channels or government agencies, and watermark copies when possible.

Deleting the App Too Soon

If the app itself contains evidence, screenshot the account page, permissions, loan details, messages, privacy notice, and support ticket before uninstalling.

Filing Only With One Agency

A criminal complaint does not automatically correct your credit report. An SEC complaint does not automatically punish identity theft. An NPC complaint does not automatically stop a bank from reporting to a credit database. Use the correct channel for each harm.

Special Situations

You Were Listed as a Character Reference

Being listed as a character reference does not make you a debtor or guarantor. The 2026 DICT-NPC-SEC advisory distinguishes character references from guarantors and states that guarantors must give separate consent before being bound to any obligation.

If collectors harass you, send a written demand that they stop processing your personal data and remove your number unless they can show a lawful basis.

You Were Listed as a Guarantor Without Consent

A guaranty is not something a lender can impose just because someone typed your name and number. Ask for the signed guaranty agreement, consent record, verification call, and proof that you expressly agreed to be bound.

The Loan Proceeds Went to Your Own E-Wallet or Bank Account

This is more complicated. If your own account received the money but you did not apply, check whether your phone, SIM, app, email, or OTP was compromised. Report immediately to the bank/e-wallet, request account security logs, change passwords, freeze access if necessary, and file a cybercrime report.

You Are an OFW or Abroad

If you are outside the Philippines, you can still send written disputes by email and file many initial reports online. For someone in the Philippines to appear for you, a Special Power of Attorney is usually needed. Philippine embassies and consulates may notarize or consularize private documents such as affidavits and SPAs, and DFA apostille rules may apply depending on where the document was executed. (Apostille Government)

You Are a Foreigner in the Philippines

Foreigners should keep copies of passport bio page, visa/ACR I-Card if applicable, local address proof, and entry/exit records if the alleged application happened while they were abroad. If your foreign passport or foreign ID was used, you may also need to report to your embassy, your bank, and the issuing authority in your home country.

Frequently Asked Questions

Can I be forced to pay a loan I never applied for?

Not simply because your name appears in a lender’s system. A valid loan requires consent. Demand proof of application, acceptance, verification, and disbursement. If they cannot validate the debt, dispute it in writing and escalate to the proper agency.

Should I report first to the SEC, NPC, NBI, or PNP?

It depends on the issue. Report lending company misconduct to the SEC, data misuse to the NPC, cyber identity theft or fraud to NBI/PNP, and credit report errors to the CIC. If several issues happened, file with more than one agency.

Can an online lending app contact my phone contacts?

The 2026 DICT-NPC-SEC advisory states that contacting persons in a borrower’s contact list other than named guarantors is prohibited for debt collection. Character references and guarantors are different, and guarantors must separately consent to be bound.

What if the lending app is not registered?

Still preserve evidence and report it. The SEC can act on unauthorized lending or financing activity, while NBI/PNP may handle fraud, identity theft, threats, or scams.

Do I need a notarized affidavit?

For NPC complaints, the NPC requires a notarized complaint-assisted form or verified complaint with evidence and witness affidavits. For NBI/PNP matters, sworn statements or affidavits are commonly required during investigation. (National Privacy Commission)

Can I ask the lender to delete my data?

Yes, when the processing is unauthorized, false, unlawfully obtained, or no longer necessary, you may invoke your data subject rights, including erasure or blocking. The NPC describes this right as the ability to request suspension, withdrawal, blocking, removal, or destruction of personal data from the controller’s filing system. (National Privacy Commission)

What if the lender says I gave an OTP?

Ask for the full OTP log, phone number used, date and time, device information, IP address, and verification trail. If your SIM or phone was compromised, report to your telco, bank/e-wallet if affected, and NBI/PNP.

Will a police blotter erase the loan?

No. A blotter is only an official incident record. To erase or correct the loan, you still need to dispute directly with the lender, the credit database if reported, and the regulator if the lender refuses to correct it.

Can collectors threaten me with arrest for non-payment?

Non-payment of a genuine debt is generally civil in nature. However, fraud, falsification, or identity theft may be criminal. If collectors threaten arrest, shame you publicly, contact unrelated third parties, or use threats of violence, preserve evidence and report the conduct.

How do I protect myself after discovering an unauthorized loan application?

Change passwords, secure your SIM and email, enable two-factor authentication, check bank and e-wallet activity, request your credit report, watermark IDs before sending them, and avoid installing lending apps from unverified sources.

Key Takeaways

A loan you did not authorize should be disputed in writing immediately.
Lack of consent is central: under the Civil Code, a valid loan contract requires consent.
Preserve screenshots, call logs, account records, app details, and proof that you did not receive funds.
Report lending or financing company issues to the SEC, privacy violations to the NPC, cyber identity theft to NBI/PNP, bank-related complaints to BSP, and wrong credit records to the CIC.
Do not pay an unauthorized loan just to stop harassment unless you clearly document that payment was made under protest.
Do not ignore real subpoenas, prosecutor notices, barangay summons, small claims notices, or court papers.
Character references are not guarantors, and guarantors must separately consent before being bound.
The strongest cases have a clear timeline, written dispute, preserved digital evidence, and reference numbers from the proper agencies.