Quick answer

If a lending app is fake, misuses your identity, creates a loan in your name, takes money from your account, harvests your contacts, or threatens you, act immediately:

Preserve the evidence before deleting the app.
Secure your phone, email, SIM, bank accounts, and e-wallets.
Tell the supposed lender in writing that the loan is unauthorized and formally dispute it.
Report the lender or app to the Securities and Exchange Commission (SEC).
Report unauthorized collection or disclosure of personal data to the National Privacy Commission (NPC).
Report identity theft, fraud, threats, or account intrusion to the PNP Anti-Cybercrime Group or National Bureau of Investigation (NBI).
Immediately notify any bank or e-wallet involved and dispute unauthorized transactions.
Check your credit report and dispute any fraudulent loan recorded under your name.

These remedies serve different purposes. An SEC complaint addresses unlawful lending and collection practices; an NPC complaint addresses misuse of personal data; and a police or NBI complaint begins the criminal-investigation process. Filing with one agency does not necessarily replace reporting to the others.

Do not pay merely because someone threatens arrest, public humiliation, or immediate legal action. But do not ignore a loan that may be genuine either. Dispute it promptly, ask for the underlying records, and obtain legal advice if the documents or facts are unclear.

First, identify what happened

“Fake lending app” can describe several different problems:

An app lends without the SEC registration and Certificate of Authority required for a lending or financing company.
An app impersonates a legitimate lender.
Someone used your name, ID, selfie, SIM, contacts, bank account, or e-wallet to apply for a loan.
You installed an app but never knowingly completed a loan, yet money was sent or a debt was created.
A lender or collector accessed your contacts, photos, messages, or social-media information without a lawful basis.
Collectors disclosed an alleged debt, contacted unrelated people, posted your information, or used threats and insults.
A criminal obtained your credentials and moved money through a bank or e-wallet.

The correct response depends on which of these occurred. A legitimate lender may still commit privacy or collection violations. Conversely, an unfamiliar app name does not by itself prove fraud because an app may operate under a different corporate name. Verify both the app and the company behind it.

Preserve evidence before blocking or uninstalling the app

Take screenshots or screen recordings showing:

The app’s name, icon, developer, download page, URL, and app-store listing
The corporate name, SEC registration number, Certificate of Authority number, address, email addresses, phone numbers, and website displayed by the app
The loan application, disclosure statement, promissory note, repayment schedule, account number, reference number, and claimed balance
Permissions requested or granted, particularly access to contacts, SMS, call logs, camera, storage, location, and microphone
Text messages, chats, emails, collection messages, threats, caller numbers, social-media posts, and communications sent to your contacts
Any ID, selfie, signature, or personal details used without permission
Bank or e-wallet statements, transaction references, recipient accounts, dates, amounts, and one-time-password alerts
Your communications disputing the loan and the company’s responses
The date and time you discovered each incident

Save original files where possible, not just cropped screenshots. Export emails or chats, retain message headers, download statements, and make a backup that the app cannot access. Ask affected relatives, co-workers, or contacts to preserve the messages they received and to write down when and how they received them.

Do not edit messages, fabricate conversations, impersonate the suspected offender, or publicly post unredacted IDs and account details. Those actions can compromise evidence or expose you to further harm.

Secure your identity and accounts immediately

After preserving evidence:

Revoke the app’s permissions, uninstall it, and remove any device-administrator or accessibility access it obtained.
Change the password of the email account connected to your phone first, then change passwords for banking, e-wallet, social-media, cloud-storage, and shopping accounts.
Use unique passwords and enable multi-factor authentication. Sign out unknown devices and revoke unfamiliar sessions.
Change your device PIN and your bank or e-wallet PIN. Never give anyone an OTP, password, recovery code, or screen-sharing access.
Contact your mobile provider if your SIM stopped working unexpectedly, you received an unexplained SIM-replacement notice, or you suspect a SIM swap.
Notify the agencies that issued any compromised government IDs and ask what replacement, annotation, or protective procedure applies.
Run the phone’s security scan and install operating-system and app updates. If you suspect deep compromise, obtain technical help before resetting the device so important evidence is not lost.

If money is moving, a new account has appeared, or someone presently controls your email or SIM, treat the situation as urgent.

Dispute the loan directly with the company

Send a written notice to the lender using a verified official channel. State clearly that:

You did not apply for, authorize, receive, or benefit from the loan, if that is true.
You dispute the debt and do not admit liability.
The company must stop representing the account as yours while the dispute is being investigated.
You request the complete application and transaction record, including the contract, disclosure statement, submitted IDs, selfie or facial-verification record, signatures or electronic consent, IP and device records, disbursement destination, and collection history.
You request correction of inaccurate personal data and records.
You object to unnecessary processing or disclosure of your data and request appropriate blocking or deletion, subject to records the company must lawfully preserve.
The company must communicate directly with you and stop contacting unrelated people.

Do not send additional selfies, IDs, or sensitive credentials to an address or account you have not independently verified. A fraudster may use a supposed “verification” process to collect more information.

Keep proof of delivery and the complaint or ticket number. If the company claims the debt is valid, ask it to identify the exact evidence on which it relies. Whether a contract exists and whether you are legally liable may require examination of the actual records; an agency complaint does not automatically cancel a debt.

Report the lender or app to the SEC

Under the Lending Company Regulation Act of 2007, a lending company must be organized as a corporation and obtain SEC authority before engaging in lending activities. A certificate of incorporation alone is not the same as authority to operate as a lending company.

Check the company information displayed in the app. Legitimate online lending platforms should conspicuously disclose their corporate name, SEC registration number, and Certificate of Authority number. Compare those details with the SEC’s official records and lists. Be alert to slight spelling differences and to apps using the credentials of an unrelated legitimate company.

For a complaint involving a lending or financing company:

Use the SEC’s official complaint instructions and form or the SEC iMessage ticketing system.
Complete the form accurately.
Attach a copy of a valid government-issued ID and the relevant evidence.
Submit one complaint form for each respondent company.
For email complaints, follow the SEC’s prescribed subject format: COMPLETE NAME_RESPONDENT COMPANY_SUBJECT OF COMPLAINT.
Keep the acknowledgment and ticket number.

The SEC identifies flcd_complaints@sec.gov.ph as a channel for lending complaints. Check the linked official SEC page before filing in case its address, form, or submission procedure has changed.

Possible SEC issues include:

Operating without the required authority
Failure to give the required loan disclosure statement
Misrepresentation in advertisements or an online platform
Threats, insults, deception, or unlawful pressure in collection
Disclosure or publication of a borrower’s personal information
Contacting people in the borrower’s contact list who are not guarantors or co-makers
Contact at prohibited or unreasonable hours

Under SEC Memorandum Circular No. 18, Series of 2019, contacting people in a borrower’s contact list other than named guarantors or co-makers is an unfair collection practice even if the borrower supposedly consented. The circular generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to stated exceptions—including an account more than 15 days past due or documented express consent that those are the only reasonable times.

The SEC can investigate regulatory violations and impose administrative remedies within its authority. Its complaint process does not itself rewrite payment terms, declare a contract void, cancel an obligation, or finally decide every private contractual dispute.

File a privacy complaint with the NPC

The Data Privacy Act of 2012 applies to the processing of personal information. Depending on the facts, privacy issues may include excessive collection, unauthorized access, use of an ID or selfie for another purpose, contact-list harvesting, disclosure of an alleged debt, failure to secure data, or refusal to correct inaccurate records.

The NPC has specifically stated that online lenders may not harvest phone or social-media contact lists for the purpose of harassing delinquent borrowers. See the NPC’s guidance on online lenders and contact lists.

Before escalating, send the company or its data protection officer a written privacy complaint when it is safe and practicable. Identify the information involved, what you believe happened, the relief requested, and a reasonable deadline for response. Keep proof that you attempted to resolve the issue; the NPC’s procedural rules may require proof of prior resort to the respondent in applicable cases, subject to recognized exceptions.

For a formal NPC case:

Follow the current NPC complaint procedure.
File a completed and notarized complaint-assisted form or a verified complaint.
Include copies of the evidence and any witness affidavits.
Submit it personally, by registered mail, by courier, or by an electronic method authorized by the NPC.
Follow the NPC’s requirements for digitally signed PDF documents and applicable filing or printing fees.

A data subject may file personally. A representative generally needs a special power of attorney; additional corporate authority is required when a juridical entity acts as representative.

The NPC states that its Complaints and Investigation Division has 30 calendar days from receipt to determine whether to give due course to or dismiss a complaint without prejudice. That is an initial procedural period, not a guarantee that the entire case will be finished within 30 days.

A request to block processing temporarily is a specialized remedy that may require a summary hearing or pleadings and a bond. Seek legal advice if continued use or publication of your data is causing serious, immediate harm.

Report identity theft, fraud, threats, or hacking

Computer-related identity theft is an offense under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. It covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another person or entity. Other offenses may apply depending on how the information or accounts were obtained and used.

Report the incident to either:

The PNP Anti-Cybercrime Group, through its official contact channels or the nearest cybercrime unit; or
The NBI Cybercrime Division or an NBI regional or district office. The NBI also maintains an online complaint page and publishes its current divisions and contacts on the NBI website.

Bring or attach:

A valid ID
A chronological account of events
The app and company details
Copies of the fraudulent loan documents
Screenshots and original messages
Transaction records and recipient-account details
Proof that you disputed the loan
Names and contact information of witnesses
Any police blotter, affidavit of loss, or account-provider incident report already obtained

Ask for the complaint, reference, or blotter number. An initial report is not the same as the filing of a criminal case in court; investigators and prosecutors must evaluate the evidence and the offenses supported by it.

Call 911 or contact the nearest police station immediately if there is a credible threat of violence, stalking, extortion, an attempt to enter your home or workplace, or another immediate danger. Preserve the threat, but do not arrange an in-person meeting with the sender.

Notify the bank or e-wallet without delay

If a bank, credit card, payment service, or e-wallet was used:

Contact the institution through the number in its official app, website, or the back of the card—not through a link sent by the suspected scammer.
Freeze or restrict the affected account or card when appropriate.
Report every unauthorized transaction and obtain a case number.
Request transaction tracing, preservation of logs, and coordination with the receiving institution.
Submit the institution’s fraud or dispute form and all requested documents.
Follow up in writing.

Speed matters because funds can be transferred or withdrawn rapidly. Philippine rules under the Anti-Financial Account Scamming Act and its implementing regulations provide mechanisms for participating supervised institutions to coordinate and temporarily hold disputed funds in qualifying cases. A report does not guarantee recovery, and intentionally filing a completely unwarranted or false report can create liability.

The institution’s Financial Consumer Protection Assistance Mechanism is ordinarily the first level of recourse. If the institution is supervised by the Bangko Sentral ng Pilipinas and its response is unsatisfactory, escalate through the BSP Consumer Assistance channels, including BSP Online Buddy or consumeraffairs@bsp.gov.ph.

The BSP does not regulate every lending company. Ordinary lending and financing companies generally fall under SEC supervision, while banks, e-money issuers, and other BSP-supervised institutions fall within the BSP’s mandate.

Check and correct your credit record

A fraudulent loan may appear in your credit history even if collectors stop contacting you.

Obtain your credit report through the Credit Information Corporation’s official process. Review it for:

Lenders you do not recognize
Accounts you never opened
Incorrect balances or payment histories
Variations of your name, address, phone number, or birth date
Duplicate accounts or unfamiliar inquiries

Under the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. The CIC provides a free Online Dispute Resolution Process.

Attach the identity-theft report, your written dispute to the lender, and documents showing the discrepancy. A police or NBI report can support the dispute, but it does not automatically cause deletion; the lender or submitting entity and the CIC must follow the applicable verification and correction process.

What not to do

Avoid these common mistakes:

Deleting the app and messages before preserving evidence
Paying a “verification,” “release,” “cancellation,” or “account-closing” fee to an unverified recipient
Giving an OTP, password, PIN, recovery code, selfie, or additional ID to the suspected scammer
Installing a remote-access app at a caller’s request
Assuming an SEC certificate of incorporation proves authority to lend
Treating an app-store listing as proof that an app is lawful
Publicly posting unredacted IDs, account numbers, or the personal data of other victims
Ignoring court papers, subpoenas, or formal notices because the original contact looked fraudulent
Filing a knowingly false fraud report to avoid a loan you actually authorized
Assuming a regulator will automatically cancel a debt or recover money

Report the app to the relevant app store after preserving its listing and evidence. An app-store report may help remove harmful software, but it is not a substitute for reporting to government authorities or disputing the account.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You received a summons, subpoena, demand letter, or court pleading.
A lender produced documents that appear to carry your signature, selfie, or electronic consent.
Your employer, relatives, clients, or social-media contacts are being repeatedly targeted.
Intimate images, health information, government IDs, or other highly sensitive data have been exposed.
A collector threatens violence, extortion, arrest, seizure, or public shaming.
A bank or e-wallet rejects a substantial unauthorized-transaction claim.
Fraudulent entries are preventing you from obtaining housing, employment, or credit.
You need an injunction, a temporary ban on data processing, damages, or representation in criminal proceedings.
The disputed loan may partly involve a transaction you did authorize, making liability fact-dependent.

Those unable to afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility and case-assessment rules, or seek assistance from a recognized legal-aid clinic.

FAQ

Am I required to pay a loan opened through identity theft?

Not merely because it appears under your name. Liability depends on whether you actually consented, received or benefited from the proceeds, and what the authentic records show. Dispute the account immediately and request the application, authentication, and disbursement records. Do not sign an acknowledgment or restructuring agreement without understanding its effect.

Can collectors have me arrested simply for not paying a loan?

Ordinary nonpayment of a debt does not by itself authorize a collector to arrest you. Fraud or another criminal offense is a separate matter that requires lawful investigation and process. Threats of automatic or immediate arrest are a serious warning sign. Never ignore an authentic subpoena or court notice, however.

May a lending app contact everyone in my phone?

SEC rules prohibit a lending or financing company from contacting people in the borrower’s contact list who were not named as guarantors or co-makers. Accessing or using contacts can also raise Data Privacy Act issues. Preserve the messages received by those contacts and report the conduct to the SEC and NPC.

Should I report to the SEC, NPC, or police?

Often, all three:

SEC: unauthorized lending, misleading disclosures, and unfair collection
NPC: unauthorized collection, access, use, disclosure, or insecure handling of personal data
PNP or NBI: identity theft, fraud, hacking, threats, extortion, or other possible crimes

Also report to the bank or e-wallet if an account or transfer is involved.

Should I pay back money that unexpectedly entered my account?

Do not spend or transfer it on instructions from an unknown caller. Notify the institution through an independently verified channel and ask it to document and reverse or otherwise resolve the transaction properly. Returning money directly to a different account could make you part of another fraudulent transfer.

Will deleting the app stop the misuse of my data?

Not necessarily. Uninstalling can stop some future access, but information already copied may remain with the operator or other parties. Revoke permissions, secure connected accounts, send a written privacy request, and report continuing misuse.

Does an SEC registration number prove that the app is legitimate?

No. The number may be false, copied, revoked, or belong to another company. A lending company needs the appropriate Certificate of Authority, and the app must genuinely belong to that company. Verify the corporate name and authority through official SEC sources.

Is there a fixed deadline for reporting identity theft?

Different complaints, offenses, contracts, and disputed transactions may have different time limits. More importantly, digital evidence disappears and stolen money moves quickly. Report and dispute the incident as soon as it is discovered. Obtain legal advice promptly if substantial money, court proceedings, or older incidents are involved.

Official sources

This article provides general legal information, not legal advice or a prediction of how an agency or court will decide a particular case. Applicable remedies depend on the evidence, the identity and regulator of the provider, and the documents involved. Official sources and procedures were checked as of September 4, 2026.