Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar facility was opened using your identity without your authority, report it immediately in writing to the provider’s official consumer-assistance channel and data protection officer. State clearly that you did not apply for, authorize, receive, use, or benefit from the account—whichever facts are true.

Ask the provider to:

block further use or disbursement;
mark the account as disputed for identity theft;
investigate the application and disbursement;
suspend interest, fees, and charges while the unauthorized transaction is investigated, as required by the Financial Products and Services Consumer Protection Act;
pause collection and adverse credit reporting;
preserve the application, identity-verification, device, communications, and disbursement records; and
correct its records and any credit information it submitted if the account is confirmed unauthorized.

Report the incident separately to law enforcement if someone impersonated you, forged documents, used stolen credentials, or obtained money. If the account appears in your Credit Information Corporation report, file a CIC dispute as well. These are parallel remedies: a police report does not automatically remove the debt or correct your credit record, while a lender or regulatory complaint does not by itself prosecute the impostor.

As a general rule, you should not be bound by a loan you never consented to. The Civil Code requires consent for a contract and provides that a person cannot contract in another’s name without authority; an unauthorized contract may become enforceable, however, if the person later ratifies it. Whether an account is genuinely unauthorized can therefore depend on the application records, electronic authentication, destination and use of the proceeds, and any later conduct attributed to you. See Civil Code Articles 1317–1319.

First, make sure the account is real

A text message or collection call may itself be a scam designed to obtain more information or payment.

Do not click the message’s link, install an app, call the number supplied by the collector, or send an ID through an unverified chat account. Find the provider’s official website, app, statement, or regulator listing independently and contact it using the published details.

Ask only enough to identify the alleged account:

provider’s full legal and trade name;
masked account number;
application and opening dates;
type and original amount of credit;
date and method of disbursement;
current status and balance; and
identity of any authorized collection agency.

For a lending or financing company, verify both its corporate identity and active authority to lend through the SEC’s Check with SEC facility. Ordinary SEC registration alone does not necessarily mean that a company has an active Certificate of Authority to operate as a lending or financing company.

If the sender cannot identify a real provider or demands a “verification fee,” OTP, password, remote-access installation, or payment to a personal account, stop engaging and report the approach as a suspected scam.

Secure your identity and accounts immediately

Before investigating who may be responsible:

Change the password of the email account connected to your financial services. Sign out unknown sessions and enable multi-factor authentication.
Change compromised banking, e-wallet, shopping, and government-service passwords. Never reuse the new password.
Contact your mobile provider if your SIM unexpectedly lost service, you received an unrequested SIM-replacement notice, or OTP messages were diverted.
Lock or cancel any card or account that can still be used. Use the institution’s official fraud hotline.
Review recent email rules, recovery addresses, phone numbers, linked devices, beneficiaries, and app permissions.
If a physical ID was lost, report the loss and ask the issuing agency about replacement or invalidation. Preserve proof of the loss and replacement.
Warn close contacts if your hacked account is sending requests for money, but do not publish unverified accusations against a suspected person.

Take screenshots and export records before deleting suspicious messages or removing apps. If possible, use a clean device to change passwords.

Send a written identity-theft dispute to the provider

Report first through the provider’s Financial Consumer Protection Assistance Mechanism or equivalent customer-assistance channel. Copy its data protection officer when personal information was used without authority.

Your complaint should include:

your full name and reliable contact details;
the masked account number, application reference, or collector’s reference;
when and how you discovered the account;
a direct statement identifying every act you deny—for example, applying, signing, submitting the ID, taking a selfie, supplying an OTP, receiving the proceeds, using the account, or authorizing another person;
any facts that may explain the compromise, such as a lost ID, hacked email, stolen phone, phishing incident, or data leak;
the relief you want;
a list of attachments; and
a request for a complaint reference number and written final resolution.

A useful opening is:

I dispute this account as unauthorized and created through identity misuse. I did not apply for or authorize this credit facility and did not authorize anyone to act for me. I deny the alleged debt and request that the account be blocked from further use, marked as disputed, investigated, and excluded from collection and adverse credit reporting while the investigation is pending. Please preserve all application, authentication, disbursement, communication, and collection records and give me a written complaint reference and final investigation result.

Add only statements that are factually true. If money was deposited into an account you control, disclose that fact and state whether it remains untouched. Do not move, return, or spend the money based on instructions from an unknown caller. Ask the financial institution for secure, written reversal instructions.

What to request from the provider

Ask the provider to preserve and, to the extent legally available to you, provide or describe:

the complete application and alleged agreement;
signatures, electronic-signature records, consent screens, and timestamps;
the phone number, email address, residential address, employer, and references used;
ID images, selfie, liveness, video, or other know-your-customer records;
IP address, device identifier, device-change history, and authentication logs;
OTP, biometric, password, and account-recovery events;
calls, chats, emails, and recordings associated with the application;
approval and credit-assessment records containing your personal data;
the disbursement date, channel, destination, and transaction reference, subject to lawful privacy restrictions;
collection-agency details;
information submitted to the CIC or another credit bureau; and
the source from which the provider obtained your personal data and the recipients to whom it disclosed those data.

Under Section 16 of the Data Privacy Act, a data subject may request reasonable access to personal information, its sources, recipients, manner of processing, reasons for disclosure, and modification history. You may dispute inaccurate data and seek correction. Blocking, removal, or destruction may also be requested upon substantial proof that data are false, unlawfully obtained, used without authority, or no longer necessary.

Erasure is not always immediate or complete. A provider may have to retain limited evidence for fraud investigation, regulatory duties, or legal claims. Ask it to preserve evidence while blocking unauthorized use and correcting operational and credit records.

Where to escalate the complaint

Banks, credit-card issuers, e-wallets, and other BSP-supervised institutions

Complain first to the institution. If its response is unsatisfactory or it does not act within a reasonable period, escalate through the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism:

use the BSP Online Buddy chatbot on the BSP website; or
if BOB is inaccessible, submit the BSP Complaint/Inquiry/Reply form and proof of your prior complaint to consumeraffairs@bsp.gov.ph.

Follow the current BSP complaint guide. Do not send the BSP your PIN, password, full card or account number, passbook, passport, or full identification-card image; the guide states that these are not required for BSP-CAM.

Once BSP directs the institution to answer under BSP Circular No. 1169, the institution generally has 15 calendar days to respond. A complainant may reply within 30 calendar days after receiving that answer.

BSP-CAM is facilitative. Formal BSP adjudication is narrower: it covers certain purely civil claims for payment or reimbursement not exceeding ₱10 million, exclusive of specified add-ons, and excludes several matters—including relief that merely seeks to avoid payment and issues requiring prior determination by a court or another agency. A disputed account may therefore require another forum if facilitation does not resolve it.

Lending companies, financing companies, online lending platforms, and their collectors

After complaining to the company, submit the matter through the SEC’s iMessage ticketing system. Include:

the lender’s legal and app names;
its SEC registration and Certificate of Authority details, if found;
your complaint to the lender and proof of delivery;
its response, if any;
the disputed account details;
collection messages and call records; and
the relief requested.

Report an unregistered or unlicensed operator even if it refuses to identify its legal company name. Preserve the app-store page, website, social-media advertisement, payment instructions, phone numbers, and account names used.

Credit cooperatives

Use the cooperative’s own consumer-assistance mechanism, then contact the appropriate Cooperative Development Authority Extension Office. Current contact details are available from the CDA. The CDA’s financial-consumer rules provide complaint and redress mechanisms for regulated cooperative entities.

National Privacy Commission

A privacy complaint is appropriate when personal information was unlawfully obtained, processed, disclosed, or left uncorrected, or when a lender or collector misused your contacts or identity data.

Ordinarily, you must first notify the provider or other responsible entity in writing. The NPC may entertain a formal complaint when the entity fails to take timely and appropriate action or gives no response within 15 calendar days after receiving your notice. The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm.

The complaint must follow the NPC’s prescribed form and verification requirements. Consult the current NPC filing instructions and the 2021 Rules of Procedure, as amended.

For online lending, NPC rules prohibit harvesting phone or email contact lists for collection or harassment. A character reference is not automatically a guarantor, and persons in a borrower’s contact list who were not expressly named as guarantors cannot be contacted for debt collection. See NPC Circular No. 20-01 and its 2022 amendments.

Law enforcement

Impersonation may involve one or more offenses depending on the evidence:

computer-related identity theft under the Cybercrime Prevention Act;
opening a financial account using another person’s identity or identification documents under the Anti-Financial Account Scamming Act;
using or possessing an access device fraudulently applied for under the Access Devices Regulation Act; or
other offenses, such as falsification or estafa, if their separate legal elements are proved.

Only investigators, prosecutors, and courts can determine the proper charge and liability.

You may report to the PNP, including its Anti-Cybercrime Group, or the NBI Cybercrime Division. The NBI also maintains an online complaint page. The BSP’s official complaint guide lists these current cybercrime contacts:

PNP Anti-Cybercrime Group: acg@pnp.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
Cybercrime Investigation and Coordinating Center: report@cicc.gov.ph or hotline 1326

Bring a government-issued ID, a written chronology, the provider’s records, proof of the disputed account, messages, transaction references, relevant device or account logs, and your complaint reference numbers. A sworn affidavit may be requested as the investigation progresses.

Correct your credit record

Obtain your CIC credit report through the CIC Direct-to-Consumer program. Review the lender name, account type, opening date, balance, payment status, and identifying information.

If the unauthorized account appears, use the CIC Online Dispute Resolution System. The dispute must be based on a CIC credit report and requires its Transaction Reference Number. Under CIC Circular No. 2019-01, obtain a new report if the one supporting the dispute is more than 30 calendar days old.

CIC disputes are classified as:

simple: ordinarily three working days;
complex: ordinarily seven working days; or
highly technical: ordinarily 20 working days.

Allowed extensions and requests for supporting documents can lengthen the process. Respond to the submitting entity within five working days of its communication unless you have a justifiable reason; failure to respond may lead to termination of the dispute. Keep the entire email thread and copy the CIC Helpdesk on relevant offline communications when directed.

A CIC dispute corrects information in the CIC system. It does not replace the complaint against the lender or a criminal report. Conversely, a lender’s internal correction may not immediately fix data already submitted to the CIC, so obtain a later report and verify the result.

Evidence to preserve

Create a dated folder containing original files where possible:

the first notice, statement, email, text, or collection call;
screenshots showing the full sender, number, date, time, URL, and app name;
original emails with headers;
call logs, voicemails, and recordings lawfully made or received;
the application, contract, billing statement, or account screen;
proof that your actual phone number, email, address, signature, or photograph differs from what was used;
proof of your location or activity on the application and transaction dates, if relevant;
bank and e-wallet statements showing that you did not receive the proceeds—or showing where unexpected funds arrived;
lost-ID, stolen-phone, SIM-replacement, account-takeover, or phishing records;
credit reports and CIC dispute references;
complaints, delivery receipts, ticket numbers, and responses;
names and contact details used by collectors; and
a chronological incident log.

Keep unedited originals. If you annotate a screenshot, retain the original separately. Do not factory-reset a relevant device until important data have been backed up and investigators have advised whether the device may be needed.

Important deadlines and protections

There is no single reporting deadline for every kind of credit account. Report immediately and follow any shorter product-specific dispute period.

For credit-card billing errors, BSP rules require issuers to allow up to 30 calendar days from the statement date to report an error or discrepancy. The issuer must take action within 10 business days after receiving the notice and relevant records, and complete the investigation, corrections, and written explanation within 90 days before collecting the contested amount, subject to the investigation. See the BSP’s current Manual provisions on credit cards.

Under the Financial Products and Services Consumer Protection Act, a provider handling an alleged disputed amount or unauthorized transaction must, pending its final investigation, suspend interest, fees, and charges or give a similar reasonable accommodation.

Claims under that Act generally prescribe five years after the transaction or five years after discovery of deceit or material nondisclosure, with an ultimate limit of 10 years from the violation. Other civil, criminal, regulatory, or contractual periods may differ. These longer periods are not a reason to delay: records disappear, proceeds move, accounts age, and credit harm can spread.

Situations that may change the result

Get tailored legal advice if any of these applies:

You authorized another person to apply, manage, or receive credit for you.
The loan proceeds entered an account you control and were spent, transferred, or retained.
You signed a later acknowledgment, promise to pay, restructuring, settlement, or waiver.
You made a payment after learning of the account.
The account combines unauthorized charges with a legitimate account or balance.
You supplied an OTP, selfie, electronic signature, or credentials after being deceived.
The disputed facility is secured by land, a vehicle, salary deductions, postdated checks, or another person’s property.
You are named as a co-borrower, co-maker, or guarantor.
The application contains a signature or electronic record the provider claims is yours.

Sharing an OTP or falling for phishing does not automatically prove that you consented to every resulting loan, but it can make the evidence and allocation of responsibility more complicated. Describe exactly what happened; do not hide embarrassing facts from your lawyer or the investigating institution.

Common mistakes to avoid

Making a small payment merely to stop calls. It may complicate the factual dispute or be argued as acknowledgment.
Signing a restructuring agreement for a debt you deny.
Ignoring a real demand letter, court summons, subpoena, or prosecutor’s notice.
Reporting only by telephone and keeping no reference number.
Assuming a police blotter automatically closes the account.
Deleting messages, uninstalling the app, or resetting the device before preserving evidence.
Sending full IDs, passwords, PINs, OTPs, or card details through ordinary email or social media.
Negotiating with an unverified collection agent.
Asking the provider to erase every record before it preserves the evidence needed to establish fraud.
Missing CIC or regulator follow-up emails.
Posting the name of a suspected offender without reliable proof.
Stopping payment on unrelated, legitimate obligations.

When help is urgent

Contact the provider and law enforcement immediately if:

the account remains usable or another disbursement is pending;
funds have just been transferred and may still be traceable;
your SIM, email, or banking access has been taken over;
several accounts are appearing in quick succession;
an impostor is using your identity to contact other people;
collectors are threatening violence, publishing personal information, or contacting unrelated people;
a lien, mortgage, vehicle encumbrance, or salary deduction is involved; or
you face immediate physical danger—call 911.

Consult a Philippine lawyer promptly if you receive a summons, complaint, subpoena, demand involving collateral, or notice with a response deadline. Court and prosecutor deadlines continue to run even if a lender, regulator, or police investigation is pending. The Public Attorney’s Office may assist qualified indigent applicants, subject to its eligibility and merits requirements.

Frequently asked questions

Do I need a police report before contacting the lender?

No general rule requires you to wait for a police report before making the initial dispute. Report to the lender immediately. A police report or sworn affidavit can strengthen the record and may later be requested, but it should not delay the first fraud notice.

Should I pay while the investigation is pending?

If the entire account is genuinely unauthorized, avoid making a token payment or signing an acknowledgment without legal advice. Clearly identify the disputed amount. Continue paying any separate, legitimate, undisputed obligation when due.

Can the lender keep adding interest and fees?

For a disputed amount or alleged unauthorized transaction covered by the Financial Products and Services Consumer Protection Act, the provider must suspend interest, fees, and charges while its final investigation is pending or provide a similar reasonable accommodation. Request written confirmation of how this protection is being applied.

Can a character reference be forced to pay?

No. A character reference is not automatically a guarantor. Under the NPC’s amended loan-processing rules, guaranty requires the person’s express consent. For collection purposes, a lending or financing company may contact an actual guarantor, not unrelated people found in the borrower’s contact list.

What if the provider says its OTP or selfie proves I applied?

Ask for the complete authentication trail, not merely a screenshot of one event. Relevant facts include who controlled the phone and email, device and IP records, account-recovery changes, liveness results, where the proceeds went, and what happened afterward. The evidentiary effect depends on the complete record.

What if the provider refuses to disclose the recipient of the proceeds?

It may have legitimate restrictions on disclosing another person’s protected account information. Ask it to preserve the destination-account and transaction records, confirm whether the proceeds went to an account in your name, provide any information lawfully available to you, and make the records available to regulators or law enforcement through proper process.

What if the account does not appear in my CIC report?

Continue the complaint against the provider. Not every account or recent update will necessarily appear immediately. A clean CIC report does not prove that the collection demand is fake, and a police or lender complaint should not be delayed while waiting for the account to appear.

Can I demand immediate deletion of all my data?

You may seek correction, blocking, removal, or destruction when the statutory requirements are met. However, limited retention may remain lawful for fraud investigation, regulatory compliance, evidence preservation, or legal claims. The practical request is to block unauthorized use, correct live and downstream records, preserve necessary evidence securely, and delete data when lawful retention ends.

Will reporting guarantee that the debt is removed?

No agency can guarantee an outcome before examining the evidence. A well-documented, prompt dispute gives the provider, regulator, CIC, and investigators the information needed to determine whether the account was unauthorized and what correction or enforcement action is proper.

Official legal and procedural references

This article provides general Philippine legal information, not legal advice or a prediction of the outcome of any dispute. Rights and procedures can depend on the provider, product, documents, evidence, and pending proceedings. Official sources and current procedures were checked on 24 July 2026.