Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or other credit account was opened using your identity without permission, notify the lender immediately and in writing that:

You did not apply for, sign, authorize, receive, or benefit from the account.
You dispute the account and every related charge.
The lender should flag the account as fraud, stop collection activity while investigating, preserve its records, and correct any information reported under your name.
You want written acknowledgment, a complaint reference number, and copies of the application and identity-verification records.

Do not pay, promise to pay, sign a restructuring agreement, or describe the debt as yours merely to stop collection calls. Those actions may complicate your position. An unauthorized account does not become your valid obligation simply because the fraudster used your name or identification documents. Under the Civil Code, a contract requires the parties’ consent and generally takes effect only between the parties; however, the final legal conclusion may depend on evidence showing who applied, authenticated the transaction, received the proceeds, or later ratified the agreement. See Articles 1311 and 1318 of the Civil Code.

Report the identity theft to the appropriate law-enforcement agency, escalate unresolved complaints to the lender’s regulator, and check your Credit Information Corporation credit report for other accounts opened in your name.

Act immediately

1. Secure the accounts and devices the fraudster may have used

From a trusted device:

Change the passwords for your primary email, online banking, e-wallets, mobile accounts, and government-service accounts.
Use unique passwords and enable multifactor authentication.
Sign out unknown devices and terminate unfamiliar login sessions.
Ask your mobile provider about possible SIM replacement or SIM-swap activity if you unexpectedly lost cellular service or stopped receiving OTPs.
Block compromised cards and report unauthorized transactions directly to the issuer.
If an email account was compromised, check for forwarding rules, recovery-address changes, deleted security notices, and unfamiliar linked applications.
Preserve evidence before deleting malicious messages, applications, or accounts.

If money is currently moving or an account remains under the fraudster’s control, contact the relevant bank, e-wallet, or other financial institution through its official fraud channel immediately.

2. Send a written identity-theft dispute to the lender

Use contact details independently obtained from the lender’s official website, statement, branch, or verified application—not from a threatening text or caller.

State clearly:

I dispute this account as identity theft. I did not apply for, authorize, sign, receive, use, or benefit from this loan or credit account. Please flag the account as fraudulent, suspend collection and adverse reporting while the matter is investigated, preserve all application and transaction records, and provide me with a written investigation result.

Include only the information reasonably necessary to identify you and the disputed account. Ask for:

The lender’s full legal and business names;
The account or application number, with unnecessary digits masked where appropriate;
The application date, approval date, amount, and current status;
A complete copy of the application, contract, promissory note, disclosure statement, and attachments;
Copies of identification documents, selfies, signatures, recordings, and declarations submitted;
The phone numbers, email addresses, residential or delivery addresses, employers, references, and bank or e-wallet accounts used;
Authentication, OTP, device, IP-address, login, and audit records, to the extent lawfully releasable;
The destination and proof of disbursement of any loan proceeds;
Records of withdrawals, purchases, deliveries, or fund transfers;
The source from which the lender obtained your personal information;
The entities to which the account or alleged delinquency was disclosed, including credit-information providers and collection agencies;
Confirmation that collection agencies have been informed that the account is disputed; and
Correction or removal of inaccurate information from the lender’s records and from every credit-information recipient.

The Data Privacy Act gives a data subject rights that include access to personal data, correction of inaccurate data, and—when the legal conditions apply—blocking, removal, or destruction of unlawfully processed data. These rights are subject to lawful limitations and do not automatically require deletion of evidence that must be preserved for an investigation. See Republic Act No. 10173 and its Implementing Rules and Regulations.

Keep proof of delivery. If reporting by telephone is necessary, obtain a reference number and follow up by email or letter the same day.

3. Ask for a hold on collection and credit reporting

Request—not merely assume—that the lender:

Suspend demands for payment while investigating;
Stop automatic debits and prevent further use of the account;
Mark the account as disputed in its internal and external records;
Instruct collection agencies not to contact your relatives, employer, or unrelated persons;
Preserve rather than overwrite CCTV, call recordings, device logs, application files, and disbursement records; and
Correct prior reporting if the investigation confirms impersonation.

A dispute does not necessarily stop a creditor from taking action automatically. Continue monitoring letters, emails, court papers, and credit reports until you receive written confirmation of the outcome.

Preserve evidence

Create a dated incident file containing:

Screenshots showing the entire message, application page, account number, sender, date, and time;
Emails saved with their full headers when possible;
Call logs, voicemails, collection messages, and lawful recordings;
Statements, demand letters, delivery notices, and credit-report entries;
Your written disputes and proof that the lender received them;
Complaint and ticket reference numbers;
Proof that you were elsewhere when an in-person application or transaction allegedly occurred;
Specimen signatures and authentic documents from the relevant period;
Evidence showing that the proceeds went to an account, phone number, address, or person unrelated to you;
Notices of compromised email, mobile, or financial accounts; and
A chronology of when you discovered the account and every action taken afterward.

Keep original electronic files. Avoid relying only on cropped screenshots. Do not alter suspicious documents or communicate with a suspected offender in a way that could destroy evidence or place you at risk.

A police or investigative report can support your dispute, but it does not by itself decide civil liability, erase a credit entry, or guarantee prosecution.

Report the identity theft to law enforcement

Using another person’s identifying information without right through a computer system may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on how the account was created or used, other offenses may also be relevant, including access-device fraud under Republic Act No. 8484, as amended by Republic Act No. 11449. The proper charge depends on the evidence and should be determined by investigators and prosecutors.

You may report to:

The nearest police station or the Philippine National Police Anti-Cybercrime Group;
The National Bureau of Investigation, including its online complaint channel or appropriate cybercrime or fraud division; or
The Department of Justice Office of Cybercrime, particularly for cybercrime reporting or referral.

Bring or attach a government-issued ID, your chronology, copies of the lender’s communications, account details, proof of your written dispute, and available technical evidence. Ask for the report, docket, or reference number.

Do not delay an urgent report while trying to identify the offender yourself. You may report against an unknown person and provide the evidence presently available, subject to the receiving agency’s requirements.

Escalate to the correct financial regulator

The appropriate route depends on the type of institution. Reporting to a regulator is separate from reporting the suspected crime.

Banks, credit-card issuers, e-wallet issuers, and other BSP-supervised institutions

First file the complaint through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. Obtain its reference number.

If the response is unsatisfactory, or the institution does not resolve the issue through its first-level mechanism, escalate through the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism. The BSP describes this as a second-level recourse. Complaints may be lodged through the BSP Online Buddy on the BSP website or, if BOB is inaccessible, through the current Complaint/Inquiry/Reply form and instructions in the BSP’s official complaint guide.

Attach:

Proof that you first complained to the institution;
Its answer, if any;
Your identification;
The disputed account records;
Your police or investigative report, if already available; and
A precise remedy request, such as investigation, cessation of collection, and correction of inaccurate reporting.

Financial consumers have statutory rights to protection of their assets against fraud and misuse, data privacy and protection, and timely complaint handling under the Financial Products and Services Consumer Protection Act. BSP escalation does not replace a criminal complaint or a court action.

Lending and financing companies, including online lending platforms

For a lending or financing company regulated by the Securities and Exchange Commission, use the SEC’s current iMessage ticketing system or its official complaint procedure for lending and financing companies.

The SEC’s published procedure requires a completed complaint form, a valid government-issued ID, supporting evidence, and one complaint form for each respondent company. The SEC may send the complaint to the company for an answer and may commence administrative action when warranted. Consult the SEC complaint instructions before filing because submission channels and office locations can change.

Identify both the application’s brand name and the company’s full corporate name. If the operator is unlicensed, fictitious, or cannot be identified, say so and attach screenshots of its app-store page, website, payment instructions, phone numbers, and messages.

The SEC’s administrative process cannot itself declare a loan contract void, cancel an alleged obligation, or finally decide every private civil dispute. Those remedies may require settlement or court action.

Other providers

A cooperative, insurance-related credit provider, pawnshop, government lender, or another specialized institution may fall under a different regulator. Ask the provider for its full legal name and regulator, then verify that information through the regulator’s official directory. Do not rely solely on the name or logo displayed in an app.

Check and dispute your credit record

An unauthorized account may appear in your credit history even if no collector has contacted you.

Obtain your own CIC credit report through the Credit Information Corporation’s official consumer-access page. Review:

Lender and account names;
Application and opening dates;
Outstanding balances;
Payment status;
Addresses and contact details; and
Other unfamiliar accounts or inquiries.

If the report contains erroneous, misleading, incomplete, or outdated credit data, use the CIC’s Online Dispute Resolution System. A CIC credit report must first be obtained before a dispute is filed.

Name the specific account and explain that it resulted from identity theft. Upload the lender dispute, supporting records, and any police or investigative report available. The CIC facilitates the dispute with the entity that submitted the information; it does not simply change submitted data unilaterally. Continue pursuing the lender directly because correction generally requires the submitting entity’s participation.

After the dispute is resolved, obtain a fresh report and verify that the correction appears. A correction by one lender does not necessarily reveal or fix other fraudulent accounts.

File a privacy complaint when personal data was misused

A fraudulent account may involve unlawful collection, use, disclosure, retention, or reporting of personal information. Examples include using a stolen ID to create an account, processing data for an unauthorized purpose, disclosing an alleged debt to unrelated contacts, or refusing to correct demonstrably inaccurate personal data.

Before filing a formal complaint with the National Privacy Commission, ordinarily notify the lender or other personal information controller in writing and give it an opportunity to act. Under the NPC’s amended Rules of Procedure, exhaustion is generally shown when the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving written notice. Exceptions may apply, including serious violations or circumstances in which effective relief cannot reasonably be obtained from the respondent.

A formal NPC complaint must follow the prescribed form and requirements. The NPC’s current instructions say to complete and notarize the complaint and submit it in person, by courier, or by scanned email. Check the NPC complaint-filing page and complaint mechanics before filing.

Do not miss the NPC filing period. Under its amended procedural rules, a complaint generally must be filed within six months from the privacy violation or personal data breach, or 30 days from the last communication with the respondent, whichever is earlier, subject to the rules and any applicable exception. Because this calculation can be consequential, obtain legal advice promptly if the dates are close or disputed.

For loan-related data processing, also consult NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02.

If a collector contacts you

Respond briefly and in writing:

The account resulted from identity theft.
You dispute the debt in full.
You have not admitted or assumed the obligation.
Future communications should be sent through a specified written channel.
The collector should provide its authority, the creditor’s full legal name, the account records, and the basis for associating the debt with you.

Do not give callers OTPs, passwords, card details, selfies, remote access to your phone, or additional IDs. Verify the collector independently with the named lender.

Save threats, public-shaming posts, messages to relatives or coworkers, and false representations. Depending on the institution and conduct, these may support complaints to the SEC, BSP, NPC, law enforcement, or a court.

Common mistakes to avoid

Paying a “small amount” to make the calls stop. A payment can create factual disputes about acknowledgment or ratification.
Agreeing to restructuring or a settlement before obtaining advice. The document may characterize the account as your debt.
Reporting only by phone. Without written notice and proof of receipt, escalation is harder.
Sending excessive personal data to an unverified caller or email address. Confirm the recipient through an official channel.
Deleting the fraudulent app or messages before preserving evidence.
Focusing only on the first account discovered. Check your email security, financial accounts, SIM, and credit report for a broader compromise.
Assuming a police blotter automatically clears the debt. The lender and credit-information records must still be disputed and corrected.
Ignoring a demand letter or court summons. A disputed or fraudulent debt still requires a timely response if formal proceedings begin.
Publicly accusing a named person without adequate evidence. Provide suspicions and evidence to investigators instead.
Using an outdated agency email or unofficial social-media account. Confirm current channels on the agency’s official website.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, formal demand, or notice of a collection case;
Property, salary, benefits, or an account is threatened with attachment, garnishment, foreclosure, or set-off;
The lender claims you authenticated the loan through an OTP, selfie, biometric check, electronic signature, or device linked to you;
Loan proceeds entered an account you own, even if another person controlled or withdrew them;
You previously paid, negotiated, or signed a document concerning the account;
The fraud involves a relative, employee, business partner, agent, or someone who had limited authority to act for you;
A forged mortgage, guaranty, postdated check, or notarized instrument is involved;
Several creditors or substantial amounts are involved;
The NPC filing period or another legal deadline may be near; or
Collection activity is causing immediate threats, harassment, reputational harm, or safety concerns.

If court papers have been served, do not rely solely on a regulator’s investigation. Court deadlines continue unless the court orders otherwise.

Frequently asked questions

Am I required to pay a loan that I never applied for?

Not merely because the account bears your name. A valid contract requires consent, and a person who genuinely did not apply for or authorize the loan has a substantial basis to deny liability. The result may still depend on evidence concerning authentication, receipt of proceeds, agency, and any later acknowledgment or ratification.

Should I pay while the lender investigates?

Avoid paying or promising to pay an account you maintain is wholly unauthorized without first obtaining legal advice. Instead, dispute it promptly, request a collection hold, and preserve proof of your position.

Is a police report required before the lender must investigate?

Requirements vary. A police or investigative report is useful evidence, but you should report to the lender immediately rather than wait for it. Ask the lender to identify any additional document it lawfully requires.

Can the CIC delete the fraudulent account?

The CIC provides a dispute process but does not ordinarily alter submitted credit data on its own. It coordinates with the submitting entity, which must investigate and submit the appropriate correction. Verify the result through a new credit report.

Can I complain directly to BSP?

For a BSP-supervised institution, complain first through the institution’s official consumer-assistance mechanism. BSP’s Consumer Assistance Mechanism is generally the second-level recourse, and proof of the first complaint is required.

Can I complain directly to the NPC?

The general rule is that you must first notify the respondent in writing and allow it to act. If it takes no timely or appropriate action—or does not respond within 15 calendar days—you may proceed, subject to the NPC’s filing requirements, deadline, and recognized exceptions.

What if I do not know which company opened the account?

Ask the collector for the creditor’s full legal name and account records, but do not provide additional sensitive information until verified. Search your CIC credit report, preserve the collector’s payment instructions and communications, and give those details to law enforcement and the relevant regulator.

What if the fraudster used my OTP or a phone registered to me?

Dispute the account, but expect closer examination of device access, SIM history, messages, login records, and the handling of the proceeds. Tell the lender exactly how your phone, SIM, email, or credentials may have been compromised. Do not invent an explanation. Obtain legal advice if the lender treats the OTP as conclusive authorization.

Will replacing my ID erase the fraudulent account?

No. Replacing a compromised ID may reduce future misuse, but it does not automatically correct lender or credit-information records. Each disputed account must still be reported and followed through to written resolution.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and available remedies depend on the provider, evidence, documents, and dates involved. Official sources and filing information were checked as of July 27, 2026.