Quick answer

If an online loan account was created using your identity without your consent, dispute it immediately in writing. State clearly that you did not apply for, authorize, sign, receive, or benefit from the loan, as applicable. Demand that the lender:

stop collection and all contact with your family, employer, friends, and other third parties;
place the account under fraud investigation;
preserve its application, device, IP, identity-verification, disbursement, call, and message records;
provide the documents and electronic records on which it claims you became liable;
block further use or disclosure of your personal data; and
correct or remove false account and credit information after investigation.

Do not admit the debt, promise payment, click collection links, send additional identity documents through an unverified channel, or pay merely to stop the harassment. A collector’s demand does not by itself prove that you entered into a valid loan. Consent is essential to a contract, including one concluded electronically.

Preserve the evidence before blocking callers. Secure your phone, email, SIM, financial accounts, and government-linked accounts. Report unfair collection to the Securities and Exchange Commission (SEC), privacy violations to the National Privacy Commission (NPC), and threats, impersonation, fraud, or identity theft to cybercrime authorities. If money was deposited into an account you control, do not spend or transfer it on the collector’s instructions; notify the financial institution and obtain case-specific legal advice.

Unauthorized account creation and harassment are separate problems

There are usually two connected issues:

Identity or account fraud. Someone may have used your name, mobile number, ID, selfie, email address, device, or financial account to create a loan account.
Abusive collection or misuse of personal data. The lender or its collection agent may repeatedly call, threaten, shame, impersonate authorities, disclose the alleged debt, or message people in your contacts.

Address both. Closing or disputing the account may not immediately stop data already circulating among collectors, while blocking messages alone will not correct the lender’s records or a possible credit entry.

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and gives data subjects rights that include access, correction, objection, erasure or blocking in proper cases, damages, and complaint. The Financial Products and Services Consumer Protection Act also protects financial consumers’ rights to fair treatment, protection against fraud and misuse, data privacy, and timely complaint handling.

Unauthorized acquisition or use of another person’s identifying information through a computer system may, depending on the evidence, fall under computer-related identity theft in Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Other offenses may apply to particular threats, coercion, falsification, fraud, or defamatory publication, but the correct charge depends on the precise acts and proof.

What collectors are not allowed to do

A real unpaid debt does not give a lender or collector unlimited collection powers. The rule is even more important when the supposed borrower disputes ever creating the account.

SEC Memorandum Circular No. 18, series of 2019, prohibits unfair debt-collection practices by financing and lending companies. Prohibited conduct includes, among other things:

threats of violence or other criminal means against a person, reputation, or property;
threats to take action that cannot legally be taken;
obscenities, insults, or profane language;
disclosure or publication of borrowers’ names and personal information, subject to limited lawful reporting;
communicating loan information to persons in the borrower’s contacts other than lawful guarantors or co-makers;
false representations that the collector is connected with the police, courts, or another government authority;
false or deceptive representations about the debt or the legal consequences of nonpayment;
unreasonable or excessive contact; and
contacting a borrower at an unreasonable time, generally before 6:00 a.m. or after 10:00 p.m., unless the account agreement or circumstances recognized by the rule permit otherwise.

A March 18, 2026 joint advisory from the DICT, NPC, and SEC reiterates that an online lending platform may not engage in unnecessary, unauthorized, excessive, or disproportionate processing of personal data. It specifically states that contacting people in a borrower’s contact list other than consenting guarantors is prohibited. A character reference is not automatically a guarantor. Read the official advisory.

The NPC’s amended loan-data rules likewise distinguish a character reference, used for identification or verification, from a guarantor who has expressly consented to assume responsibility. See NPC Circular No. 2022-02.

What to do immediately

1. Preserve the evidence before blocking anyone

Take screenshots or export records showing:

the sender’s number, account, profile, email address, and displayed name;
every message, threat, image, post, voice message, and collection demand;
complete call logs with dates, times, and frequency;
the loan-account number, claimed principal, charges, due date, and payment destination;
the app name, developer, website, app-store page, privacy notice, and requested permissions;
any text or email showing an OTP, password reset, account registration, approval, or disbursement you did not request;
messages sent to relatives, coworkers, employers, or friends;
social-media posts or group chats disclosing the alleged debt;
payment account names, QR codes, wallet numbers, and bank details supplied by the collector;
your written dispute and proof that the lender received it; and
reference numbers and responses from every authority or financial institution contacted.

Ask affected contacts to preserve the original messages on their devices and provide screenshots plus a brief signed account of what they received. Do not edit screenshots. Keep the original files, make backups, and note the date, time, platform, and person who obtained each item.

If possible, record the screen while opening the conversation so the account name, number, timestamps, and message sequence are visible. Recording a conversation presents fact-sensitive privacy and evidentiary issues; seek legal advice before secretly recording calls.

2. Verify the lender without using the collector’s links

Identify the legal company behind the app. An app name may differ from the registered lending or financing company.

Check whether the company and online lending platform appear in the SEC’s official records or published lists. Use contact details from the company’s verified website, app-store listing, loan disclosure, or SEC record—not a number supplied only in a threatening message.

Absence from a list is a serious warning sign, but do not assume that a familiar brand or polished app is genuine. Scammers may impersonate licensed companies.

3. Send a formal written dispute

Send the dispute to the company’s customer-service or consumer-assistance channel and data protection officer, if listed. Use a traceable method and retain proof of delivery.

Include:

your full name and safe contact details;
the disputed account number, if known;
the date you first learned of the account;
a direct statement that you did not create or authorize it;
which alleged acts you specifically deny—application, electronic signature, OTP confirmation, receipt of funds, designation of guarantors, or consent to access contacts;
a request that collection and third-party contact stop while the fraud dispute is investigated;
a request for a fraud case or ticket number;
a request to preserve all relevant records;
a request for copies of the application, agreement, disclosure statement, consent record, identity-verification material, device and login records, and disbursement details;
an objection to unauthorized processing and a request to block or restrict disputed data;
a demand to correct information sent to the Credit Information Corporation (CIC), credit bureaus, collectors, affiliates, or other recipients if the account is fraudulent; and
a reasonable deadline for acknowledgment and a written resolution.

Do not send a full unwatermarked ID unless the verified company establishes that it is necessary and provides a secure channel. If an ID copy is genuinely required, consider marking it for the named recipient and specific fraud-dispute purpose, without covering information the recipient lawfully needs to verify.

A concise opening may read:

I formally dispute this account as unauthorized. I did not apply for, consent to, sign, authenticate, receive, or benefit from this loan, except as specifically stated in this letter. Please suspend collection and third-party contact, preserve all records, investigate the account as identity fraud, and provide the documents and technical records on which you claim I am liable.

Make every factual statement accurate. If you are unsure whether funds entered one of your accounts, say that you are checking; do not make an absolute denial that records may disprove.

4. Secure the accounts that could have been used

From a trusted device:

change the passwords for your primary email, lending-app, banking, e-wallet, and social-media accounts;
use unique passwords and enable multifactor authentication;
sign out unknown devices and review recovery email addresses and phone numbers;
check email forwarding rules, linked applications, and recent login activity;
remove suspicious apps and review camera, contacts, SMS, call-log, storage, and location permissions;
call your mobile provider if your SIM unexpectedly lost service or you suspect a SIM replacement;
report compromised bank or e-wallet accounts through their official fraud channels;
reset exposed PINs and security questions; and
retain confirmation emails and case numbers.

If the device may contain evidence or sophisticated malware, obtain technical assistance before wiping or factory-resetting it.

5. Warn contacts without spreading the disputed claim

Tell close contacts and your workplace, if targeted, that someone is using your identity and that they should:

avoid responding or paying;
avoid clicking links or downloading attachments;
preserve the complete message and sender details;
block the sender after preserving evidence; and
forward threats to you or the investigating authority.

They should not argue with collectors or publish accusations that cannot yet be proved.

Where to complain

Different agencies address different parts of the problem. You may need more than one complaint.

Securities and Exchange Commission

For a lending or financing company, report unfair collection practices and possible unauthorized lending operations to the SEC Financing and Lending Companies Department through the official SEC iMessage portal.

Attach:

your written dispute and proof of receipt;
the company and app names;
account and collector details;
a chronological summary;
screenshots and call logs;
messages sent to third parties; and
the company’s response, if any.

The SEC complaint is directed at regulatory violations. It does not itself replace a police complaint for threats or identity theft, an NPC privacy complaint, or a court action.

National Privacy Commission

Use the NPC route when your personal information was collected, used, disclosed, retained, or accessed without a lawful basis, or when the lender refuses an appropriate access, correction, objection, or blocking request.

As a general rule, the NPC requires exhaustion of remedies: notify the respondent in writing and allow it an opportunity to address the violation. If it does not take timely and appropriate action or does not respond within 15 calendar days from receipt, you may proceed with an NPC complaint and attach proof of your prior notice. The NPC may excuse prior exhaustion in circumstances recognized by its rules, so urgent or exceptional cases should be assessed individually.

The NPC says a complaint should be filed through a notarized Complaints-Assisted Form or a verified complaint, with supporting evidence and witness affidavits. It may be filed personally, by registered mail, by courier, or by electronic mail as authorized by the Commission. Check the current form and submission requirements on the NPC complaint page and complaint mechanics page. The NPC currently publishes complaints@privacy.gov.ph as its complaints email on its official contact page.

If continuing processing presents an urgent risk of serious harm, ask counsel or the NPC about an application for a temporary ban on processing. That is a formal remedy with separate procedural requirements and is not automatically granted.

Bangko Sentral ng Pilipinas

If the provider is a bank, digital bank, non-bank electronic-money issuer, payment operator, or another BSP-supervised institution, first complain through the institution’s Financial Consumer Protection Assistance Mechanism. If unresolved or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism, including the BSP Online Buddy.

Keep the complaint acknowledged by the institution, its response, and all supporting documents. The BSP route is for BSP-supervised entities; ordinary SEC-regulated lending and financing companies generally belong with the SEC.

Cybercrime and law-enforcement authorities

Report credible threats, fraudulent impersonation, unauthorized account creation, account takeover, or computer-related identity theft promptly. The March 2026 joint government advisory identifies these official channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

The same advisory lists the NBI and PNP telephone details then in use. Because government contact details can change, verify them in the official joint advisory or the agency’s official website before submitting sensitive documents.

For an immediate threat to life or physical safety, call 911 or go to the nearest police station. Tell the officer whether the sender knows your home, workplace, family, or real-time location and whether a weapon, deadline, or specific act was mentioned.

Check and correct your credit information

An unauthorized loan may have been reported as part of your credit history. Obtain your CIC credit report through an official CIC access channel and examine:

lender names;
account opening dates;
outstanding balances;
delinquency status;
addresses and contact information; and
inquiries or accounts you do not recognize.

Under the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. Use the CIC’s Online Dispute Resolution Process and keep the dispute reference number.

Also send the lender a written demand to correct any false data it supplied. A CIC dispute and a lender dispute serve related but distinct purposes; doing one may not automatically complete the other.

If loan proceeds were deposited into your account

Do not spend the money. Do not send it to a collector’s personal account, unfamiliar e-wallet, QR code, or “refund” link.

Immediately notify the receiving bank or e-wallet through its official fraud channel and ask it to:

identify the incoming transaction;
restrict further unauthorized activity where appropriate;
document your report;
coordinate with the originating institution; and
provide written instructions for a safe, traceable resolution.

Receipt of funds is important evidence, but it does not necessarily settle who made the application or whether a valid agreement exists. Returning money incorrectly can also expose you to a second scam or destroy the transaction trail. Obtain legal advice before transferring disputed funds.

What the lender should be asked to prove

Request the complete basis of the claim, not merely a screenshot of a balance. Relevant records may include:

the loan application and terms accepted;
the identity-verification and liveness-check results;
the electronic signature, clickwrap, OTP, or other authentication record;
the mobile number and email used;
device identifiers, IP addresses, timestamps, and login history;
uploaded ID images and selfies;
privacy notice and consent records;
the disclosure statement and computation of charges;
the bank or wallet account to which proceeds were disbursed;
the name of the account holder who received the proceeds;
any recording relied upon as consent;
the identity and authority of the collection agency; and
reports submitted to the CIC or other credit bureaus.

Electronic documents and signatures can have legal effect under the Electronic Commerce Act, but electronic form does not cure forgery, impersonation, lack of consent, or unreliable authentication. Whether a contract exists depends on the actual records and circumstances.

Common mistakes to avoid

Paying only to make the messages stop

A payment may complicate your position and may be portrayed as recognition of the account. It also may not stop harassment. Obtain advice before paying or negotiating a debt you deny.

Saying only “that is not my loan”

Give the lender enough identifying information to locate the disputed account, but use its verified, secure channel. Specify what you did not authorize and request the underlying records.

Blocking and deleting everything immediately

Preserve the full evidence first. Cropped screenshots without the sender, number, date, or surrounding conversation are less useful.

Giving collectors more personal information

Do not provide a new selfie, OTP, PIN, password, contact list, bank login, or full ID through a collection link or chat. Verify the company independently.

Assuming every collection threat is legally possible

Collectors cannot issue arrest warrants, order imprisonment, or seize property by sending a text. A private debt dispute does not allow a collector to impersonate police, prosecutors, or courts. However, do not ignore authentic court papers or official notices; verify them directly with the issuing court or agency.

Publicly accusing a named person without proof

Report facts and evidence to the proper authorities. Public accusations can create separate legal risks and may compromise an investigation.

Treating a character reference as a debtor

Being listed as a contact or character reference does not, by itself, make someone liable for the borrower’s obligation. A guarantor must have actually consented to that legal role, and the form and enforceability of any guarantee depend on the governing law and documents.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly when:

there is a credible threat of violence, stalking, or a visit to your home or workplace;
intimate images, fabricated arrest materials, or defamatory posts are being circulated;
the lender refuses to suspend collection despite substantial identity-fraud evidence;
money entered an account you control;
your IDs, SIM, email, bank, or e-wallet accounts were compromised;
several fraudulent loans appear under your name;
your credit report has been affected;
you receive a subpoena, prosecutor’s notice, summons, complaint, or other official document;
the disputed amount is substantial; or
you need an injunction, temporary privacy remedy, damages claim, or defense in a filed case.

A lawyer can assess which criminal, civil, privacy, consumer-protection, and regulatory remedies fit the evidence. Not every offensive message establishes every possible offense.

Frequently asked questions

Do I have to pay a loan I never applied for?

Not merely because a collector says you do. The claimant must have a legal and factual basis for holding you liable. Whether an enforceable obligation exists depends on proof of consent, authentication, disbursement, benefit, and the surrounding facts. Formally dispute the account and request the records.

Can an online lender contact everyone in my phone?

No. Current NPC and joint government guidance prohibits unconstrained or excessive contact-list processing. For debt collection, lenders and financing companies may not contact people in the borrower’s contact list other than consenting guarantors. A character reference is not automatically a guarantor.

Should I block the collection numbers?

Yes, after preserving the evidence and sending a written stop-and-dispute notice through the lender’s verified channel. New numbers may appear, so keep a simple incident log.

Can collectors have me arrested for nonpayment?

A collector cannot order an arrest. Ordinary inability or failure to pay a civil debt does not, by itself, authorize imprisonment. Fraud and other criminal allegations are different and depend on specific facts, due process, and action by lawful authorities. Verify any supposed police, prosecutor, or court communication directly.

What if the company says an OTP proves I borrowed?

Ask for the complete OTP and authentication trail, including the destination number, timestamp, device, IP address, login history, and identity-verification records. An OTP entry is evidence to examine, not an automatic answer to account takeover, SIM misuse, malware, or impersonation.

Can I demand deletion of all my data immediately?

You may object and request correction, erasure, or blocking where legally justified. But complete deletion is not always immediate or absolute. A company may need to retain limited records for a fraud investigation, legal claims, regulatory duties, or another lawful purpose. Demand that disputed data be restricted, not used for harassment, and retained only as lawfully necessary.

What if the lender never replies to my privacy complaint?

Keep proof of receipt. As a general NPC procedural rule, if there is no response within 15 calendar days—or no timely and appropriate action—you may file an NPC complaint with the required form and evidence.

Will filing with one agency automatically notify all others?

Do not assume so. SEC, NPC, BSP, CIC, and law-enforcement complaints have different jurisdictions and purposes. File with each relevant body and cross-reference your other case numbers.

Official legal and complaint resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Liability and remedies depend on the account records, transactions, communications, and other evidence. Laws, procedures, forms, and agency contacts were checked against official sources current as of September 4, 2026.