Quick answer

If a loan, credit card, credit line, or similar account was opened in your name without your authority, dispute it immediately in writing with the lender. State clearly that you did not apply, consent, receive the proceeds, or authorize anyone to act for you. Ask the lender to flag the account as disputed, stop adding interest and charges while it investigates, preserve the application and authentication records, correct any adverse credit reporting, and give you its findings in writing.

At the same time:

Secure the email address, mobile number, financial accounts, and IDs that may have been compromised.
Preserve all evidence before blocking callers, deleting messages, or resetting the affected device.
Report suspected identity theft to the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or another appropriate law-enforcement office.
Escalate an unresolved lender complaint to the regulator—usually the BSP for BSP-supervised institutions, the SEC for financing or lending companies and online lending platforms, or the CDA for cooperatives.
Obtain your CIC credit report and dispute any inaccurate entry through the CIC’s free Online Dispute Resolution System.

Do not pay, restructure, or sign a settlement merely to stop collection calls without first obtaining legal advice. Although payment does not necessarily validate every forged transaction, later conduct may complicate the dispute or be offered as evidence that the account was accepted.

If the message is merely an unverified text claiming that you owe a loan, do not send an ID, selfie, OTP, or personal information to the sender. Verify the alleged lender independently through its official website, regulator listing, branch, or published telephone number.

An account opened without your consent is not automatically your debt

A valid contract generally requires the consent of the contracting parties. If someone fabricated your signature or impersonated you and you did not authorize, accept, or benefit from the transaction, there may be no valid loan contract binding you.

The Supreme Court has held that a transaction based on a forged signature may be void for lack of consent. It has also emphasized that forgery is proved through evidence: genuine signature specimens, travel or employment records, witness testimony, authentication records, and surrounding circumstances can all matter. Expert handwriting testimony may help but is not indispensable in every case. See Manzano v. Garcia, G.R. No. 179323.

The result remains fact-dependent. The lender may rely on an electronic signature, OTP, facial-recognition result, device record, recorded call, agent-assisted application, or evidence that the proceeds reached an account you controlled. Your position may also be affected if you authorized another person, knowingly provided authentication credentials, received or used the proceeds, or later clearly accepted the transaction. Report exactly what happened; do not guess or deny facts that records may contradict.

What to do immediately

1. Confirm that the account is real

Contact the alleged lender through a verified channel—not a link or number supplied by the collector. Ask for:

The lender’s complete legal and business names
The regulator supervising it
The account or application reference number, with most digits masked
The application and approval dates
The type and original amount of credit
The date, method, and destination of disbursement
The name and authority of any collection agency involved

Do not disclose more personal information than is reasonably necessary to verify your identity. Never provide an OTP, PIN, password, card security code, or remote access to your phone.

If the company cannot be verified, report the contact as a possible scam. A fabricated collection message and a real account fraudulently opened in your name require different responses.

2. Send a formal written dispute

Use the lender’s official consumer-assistance and data-protection channels. Email is useful because it creates a dated record, but use the lender’s required complaint form or portal as well. Keep delivery confirmations and reference numbers.

Your dispute should state:

“I dispute this account in full.”
“I did not apply for, authorize, sign, or consent to this loan or credit account.”
Whether you received, controlled, transferred, or benefited from any proceeds
When and how you discovered the account
Which details appear false, such as the signature, photograph, mobile number, email address, address, employer, references, or disbursement account
Whether an ID, phone, SIM, email account, or document had previously been lost or compromised
Any related police, NBI, PNP, CICC, NPC, regulator, or CIC reference number

Request that the lender:

Mark the account as disputed and suspected identity theft
Suspend interest, fees, and charges during the investigation
Stop collection activity directed at you except necessary written communications about the investigation
Refrain from making new adverse reports while the account’s authenticity remains unresolved
Preserve the complete application, KYC, authentication, transaction, and collection records
Provide the personal data about you that it processed, the source of that data, the purpose and method of processing, and the recipients to whom it was disclosed
Correct or block false personal and credit information as allowed by law
Notify the CIC, credit bureaus, collectors, insurers, assignees, and other recipients if previously reported information is found inaccurate
Provide a written final investigation report explaining the evidence and conclusion
Confirm whether the account has been closed, cancelled, corrected, or retained as disputed

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, a financial service provider must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, it must suspend interest, fees, and charges while its final investigation is pending, or provide a similar reasonable accommodation.

For BSP-supervised institutions, BSP Circular No. 1160 requires fraud concerns to receive priority and to be resolved within a reasonable time suited to their complexity. The institution must formally inform the client of the result within three banking days after concluding its investigation.

3. Exercise your data-subject rights

The Data Privacy Act of 2012 gives you rights to reasonable access to personal information processed about you, including its source, recipients, processing method, and relevant automated decision information. You may dispute inaccurate data and seek its correction. With substantial proof that information is false, unlawfully obtained, or used for an unauthorized purpose, you may also seek blocking, removal, or destruction, subject to lawful retention and legal-claim requirements.

Ask for records such as:

The application form and purported contract
Copies of IDs, selfies, photographs, video-KYC recordings, and signature records attributed to you
The mobile number and email address used
Consent records, OTP delivery and validation records, and recorded calls
Application timestamps, IP addresses, device identifiers, and available geolocation information
Agent, branch, merchant, or referral details
Credit-evaluation and approval records
The account to which proceeds were released
Changes to the borrower profile after application
Reports sent to the CIC, credit bureaus, collectors, or third parties

Your access right concerns personal data about you. The lender may need to redact another person’s information or preserve certain material for law enforcement rather than disclose it directly. Ask it to preserve unredacted originals for regulators, investigators, and courts.

4. Secure the accounts and identifiers that may have been used

From a trusted device:

Change the passwords of the affected email, financial, e-wallet, shopping, and social-media accounts.
Use unique passwords and enable multifactor authentication.
Sign out unknown devices and revoke unfamiliar sessions or connected applications.
Contact your telecommunications provider immediately if there are signs of SIM replacement, loss of signal, or unauthorized account changes.
Inform banks and e-money issuers if your mobile number, email, or ID was compromised.
Replace or report lost government IDs through the issuing agency’s official process.
Review transaction histories and account-profile changes.
Warn trusted contacts if the impersonator may approach them.

Changing credentials is important, but preserve relevant messages, logs, and device information first when safely possible.

Evidence to preserve

Keep originals whenever available and make a chronological incident file containing:

Collection texts, emails, chat messages, app notifications, and letters
Full email headers or exported .eml files
Screenshots showing the sender, date, time, URL, account reference, and full conversation
Call logs, voicemails, and lawful recordings already in your possession
The envelope and courier label of any demand letter or card
Copies of the alleged application, contract, disclosure statement, promissory note, and billing records
Credit reports and CIC Transaction Reference Numbers
Proof that the receiving bank or e-wallet account is not yours
Genuine signature specimens created before the disputed application
Passport stamps, attendance logs, payroll records, CCTV, receipts, or location records showing where you were
Evidence of a lost ID, stolen device, compromised email, phishing incident, or SIM problem
Statements from witnesses with personal knowledge
Every complaint, acknowledgment, ticket number, and written response

Keep an untouched copy of electronic evidence. Do not crop away dates, sender details, or URLs. Avoid editing the original file or repeatedly forwarding it through services that remove metadata. If investigators need to examine a device, ask how they want it preserved before factory-resetting it.

An affidavit of loss may help document a missing ID or device, but it is not a substitute for a complaint-affidavit describing the suspected offense and supporting evidence.

Where to report

The lender and its regulator

Use the lender’s internal complaint mechanism first unless immediate law-enforcement action is necessary.

Type of provider	Escalation route
Bank, digital bank, credit-card issuer, e-money issuer, or other BSP-supervised institution	Complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved, use the BSP Online Buddy or submit the BSP CIR form as explained in the BSP complaint guide.
Financing company, lending company, online lending platform, or its collection agency	File through the SEC iMessage system under complaints involving financing or lending companies.
Cooperative	Use the cooperative’s consumer-assistance mechanism, then contact the Cooperative Development Authority if unresolved.
Unclear or possibly unlicensed provider	Ask the BSP or SEC to identify the proper regulator, and report possible criminal activity to law enforcement.

Under BSP Circular No. 1169, a BSP-supervised institution directed to answer a BSP Consumer Assistance Mechanism complaint must provide its answer within 15 days. The complainant may file a reply within 30 days after receiving that answer.

For purely civil financial claims seeking only payment or reimbursement, RA 11765 gives the BSP and SEC adjudicatory authority up to ₱10 million, subject to their procedural rules. An identity-theft investigation or criminal prosecution is separate from that civil remedy.

Law enforcement

Report promptly to one appropriate investigative office and disclose any related complaint already filed elsewhere:

NBI Cybercrime Division or an NBI Regional Cybercrime Center
Philippine National Police Anti-Cybercrime Group
Cybercrime Investigation and Coordinating Center
The nearest police station, particularly if there are threats, document theft, or an identifiable local suspect

The NBI’s published procedure provides for a complaint sheet, preliminary interview, sworn statement or affidavit, supporting documents, and examination of a relevant device when necessary. Filing is listed as free.

A police or NBI report does not automatically cancel the loan or correct your credit record. Continue the lender, regulator, privacy, and CIC disputes separately.

National Privacy Commission

A fraudulent application may involve unauthorized processing, negligent access, unlawful disclosure, or inadequate security under the Data Privacy Act. Criminal and administrative liability depends on the evidence and the role of each person or organization; it is not established merely because an account was opened fraudulently.

Before a formal NPC complaint is ordinarily given due course, the 2021 NPC Rules of Procedure, as amended require you to:

Notify the lender, its data-protection officer, or other concerned entity in writing; and
Show that it failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive these requirements for properly shown good cause or a serious violation involving significant risk of harm. This 15-day exhaustion requirement does not prevent you from immediately securing accounts or reporting suspected crime to law enforcement.

Use the NPC’s current Complaint-Affidavit form. The complaint must be verified, include a certification against forum shopping, and be supported by evidence. Follow the current filing and notarization instructions on the NPC complaint page.

Credit Information Corporation

Obtain a current CIC credit report through the methods listed by the Credit Information Corporation. If the unauthorized account appears, file a free dispute through the CIC Online Dispute Resolution System.

Important CIC rules include:

The dispute must concern erroneous, misleading, incomplete, or outdated information in a CIC credit report.
You need the report’s Transaction Reference Number.
If the report was obtained more than 30 calendar days earlier, obtain a new report before filing.
Resolution periods are generally three working days for a simple dispute, seven for a complex dispute, and 20 for a highly technical dispute, with limited extensions under CIC Circular No. 2019-01.
Failure to respond to dispute communications within five working days may cause termination of the process.
The CIC cannot simply erase a lender’s entry on request; it coordinates with the submitting entity and evaluates the records under its dispute procedure.

An account’s absence from one report does not conclusively establish that no unauthorized account exists. Continue direct verification with any lender that contacted you.

Possible legal violations

Depending on how the account was created and used, authorities may consider:

Computer-related identity theft. Section 4(b)(3) of the Cybercrime Prevention Act covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of another person’s identifying information through a computer-related offense. The Supreme Court has explained that the identity information must be used for an illegitimate purpose. See Disini v. Secretary of Justice.
Computer-related forgery or fraud. These may apply when inauthentic computer data is created or used for a fraudulent design, or data or a system is manipulated with fraudulent intent.
Access-device fraud. Republic Act No. 8484 may apply to fraudulently applied-for or unauthorized credit cards, account numbers, codes, or other means of account access. The Supreme Court discusses the law’s application in Cruz v. People, G.R. No. 210266.
Data Privacy Act violations. Unauthorized processing, processing for an unauthorized purpose, negligent access, intentional breach, or unauthorized disclosure may apply depending on who handled the data and why.
Estafa, falsification, or use of falsified documents. These may be considered when their separate legal elements are supported by the evidence.

A victim should describe facts and preserve evidence rather than insist on a particular criminal charge. Investigators and prosecutors determine the proper offense and responsible persons.

Common mistakes to avoid

Ignoring the account because “it is not mine”
Communicating only by telephone and keeping no written record
Paying a token amount merely to stop calls
Signing a restructuring, compromise, acknowledgment, or waiver without advice
Sending complete IDs or account credentials to an unverified collector
Giving an OTP or live selfie to someone supposedly “canceling” the loan
Deleting messages or factory-resetting the device before preserving evidence
Assuming a police report automatically removes the debt
Filing only with the regulator while leaving the lender’s internal complaint unopened
Filing an NPC complaint without first notifying the respondent in writing or explaining why that step should be waived
Failing to dispute the CIC entry separately
Posting unredacted IDs, contracts, or account numbers publicly
Exaggerating facts, naming a suspect without evidence, or submitting altered screenshots
Ignoring a summons because the account is fraudulent

When legal help is urgent

Consult a lawyer promptly if:

You receive a court summons, subpoena, prosecutor’s notice, or formal administrative order
A mortgage, lien, chattel mortgage, vehicle encumbrance, or property annotation is involved
The lender claims that the proceeds entered an account you own or control
Your signature was notarized or biometric and OTP records supposedly identify you
You previously made a payment, signed a compromise, or authorized another person
A collector threatens violence, public exposure, contact with your employer, or disclosure to unrelated people
Several accounts were opened or your SIM, email, or primary financial account was taken over
You are being treated as the fraudster rather than the victim
The lender refuses to preserve evidence or continues adverse reporting after receiving substantial proof
A filing deadline stated in an official notice is approaching

Follow the deadline written in any summons or order; do not assume that a complaint pending with the lender, regulator, police, or NPC suspends a court deadline.

Those unable to afford private counsel may inquire with the Public Attorney’s Office, the IBP National Center for Legal Aid, or an accredited provider under the Supreme Court’s Unified Legal Aid Service, subject to eligibility and case assessment.

Key time limits

Lender/NPC exhaustion: A formal NPC complaint ordinarily requires written notice to the respondent and no timely appropriate action or response within 15 calendar days, unless the NPC waives the requirement.
CIC dispute: Use a credit report no more than 30 calendar days old; respond to dispute communications within five working days.
BSP-CAM: Once directed by the BSP, the supervised institution has 15 days to answer; the complainant may reply within 30 days after receiving the answer.
RA 11765 claims: Actions under the Financial Products and Services Consumer Protection Act generally prescribe five years after the transaction or discovery of deceit or material nondisclosure, but in any event 10 years after the violation.
Other actions: Data-privacy, cybercrime, falsification, civil, and procedural periods are governed by different laws. Do not rely on the longest possible period—delay can result in lost logs, overwritten CCTV, unavailable witnesses, and continued credit damage.

FAQ

Must I pay while the investigation is pending?

Do not pay an account you genuinely dispute merely because a collector demands it. Notify the lender formally. RA 11765 requires suspension of interest, fees, and charges during investigation of an alleged disputed amount or unauthorized transaction, or a similar reasonable accommodation. If part of the account is legitimate, identify precisely what is and is not disputed.

Can I demand that the lender delete everything immediately?

You may seek correction or blocking of false or unlawfully processed data. Complete deletion may not be appropriate while the lender must preserve evidence, comply with retention laws, answer a regulator, or pursue or defend a legal claim. Ask it to stop harmful use and reporting, correct the record, and preserve the underlying evidence securely.

Is an affidavit of denial enough?

It is helpful but may not resolve the dispute by itself. Attach objective evidence: genuine signatures, proof of location, account-ownership records, loss reports, messages, device information, credit reports, and evidence showing that the contact details or receiving account were not yours.

Should I report to every agency?

Use the channels that match the problem: the lender for investigation and correction, its regulator for consumer redress, the NPC for data-privacy violations, the CIC for credit-report correction, and law enforcement for suspected crime. Disclose related pending cases and avoid duplicative complaints that conceal earlier filings.

What if a relative, employee, agent, or former partner applied using my information?

Report the facts accurately. Authority, shared devices, access to OTPs, receipt of proceeds, and later conduct may affect both criminal and civil issues. Do not destroy messages or privately “settle” in a way that compromises evidence before obtaining advice.

What if the lender says its OTP or selfie proves the account is mine?

Ask for the complete authentication trail, not merely a screenshot or conclusion. Relevant records may include where the OTP was sent, delivery and validation timestamps, SIM or profile changes, device and IP information, liveness-check results, exception handling, agent activity, and the disbursement destination. Have a lawyer or investigator assess disputed technical evidence when the amount or consequences are serious.

Can collectors contact my family or employer?

A lender may use lawful, reasonable collection methods, but financial service providers are prohibited from abusive debt-recovery practices. Disclosure of debt or personal information to unrelated people may also raise privacy issues. Preserve every message and report harassment to the lender, its regulator, and the NPC where appropriate.

Does filing a dispute guarantee that the account will be removed?

No. The lender, regulator, CIC, NPC, investigator, prosecutor, or court will evaluate the evidence within its jurisdiction. A prompt, consistent, well-documented dispute substantially improves the ability to establish what happened and correct the record.

Official sources

This article provides general legal information, not advice for a particular case. Liability and the proper remedy depend on the documents, authentication records, receipt or use of proceeds, and later conduct. Official sources and procedures were checked as of 31 July 2026.