Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or similar credit account was opened in your name without your permission, report it immediately to the lender as identity theft and an unauthorized account. Tell the lender in writing that you did not apply for, authorize, receive, or benefit from the account; demand that collection activity be suspended while it investigates; request copies of the application and verification records; and obtain a case or reference number.

Do not pay, restructure, or promise to pay merely to stop collection calls. Those actions may later be presented as recognition of the debt. Do not ignore the problem either: escalate it to the proper regulator, dispute any incorrect CIC credit information, and report suspected criminal conduct to law enforcement.

An account appearing under your identity does not, by itself, prove that you validly agreed to the loan. Liability may depend on the actual application, authentication records, signatures, disbursement trail, and whether you authorized or benefited from the transaction.

Act immediately

1. Contact the lender through a verified channel

Use the lender’s official website, mobile application, hotline, branch, or published email address—not a link or number supplied by an unknown collector.

Ask the lender to:

mark the account as disputed for identity theft;
stop disbursement if the loan has not yet been released;
block further use of the credit facility;
suspend collection calls, penalties, adverse reporting, and transfer or endorsement to collectors while the dispute is investigated;
preserve all application, authentication, device, communications, and disbursement records;
confirm whether the account was reported to the Credit Information Corporation;
give you a complaint reference number and its investigation timetable; and
send its findings and final decision in writing.

If money was released, ask where and how it was disbursed. The destination bank account, e-wallet, cheque, remittance outlet, merchant, IP address, device identifier, and mobile number may help identify the person responsible.

2. Send a formal written dispute

A phone call is useful for urgent blocking, but it leaves less reliable evidence. Follow it with an email, branch-received letter, in-app ticket, or other traceable written complaint.

Your dispute should state:

your full name and safe contact details;
the disputed account number, masking unnecessary digits;
when and how you discovered the account;
that you did not apply for or authorize it;
whether you received any proceeds, goods, card, OTP, or benefit;
whether any ID, SIM, email, phone, or online account was lost or compromised;
the specific relief you want; and
a request for written acknowledgment and resolution.

A useful statement is:

I dispute this account as unauthorized and opened through identity theft. I did not apply for, consent to, sign, authenticate, receive, use, or benefit from this credit account. Please block further activity, suspend collection and adverse credit reporting, preserve all relevant records, investigate the application and disbursement trail, and provide your written findings and copies of the records attributed to me.

Only make statements that are true. If you unknowingly received funds or someone used your phone with your permission, disclose the facts accurately; they may affect the legal assessment.

3. Secure the identity and accounts that may have been compromised

Change passwords for your primary email, banking, e-wallet, government, shopping, and social-media accounts. Use unique passwords and enable multi-factor authentication. Sign out unknown devices and review recovery email addresses, phone numbers, forwarding rules, linked accounts, and recent activity.

Contact your mobile network promptly if your SIM was lost, replaced without authority, or suddenly stopped working. Ask whether a SIM replacement or account change occurred and request preservation of relevant records.

If an ID was lost or photographed, report it to the issuing agency where an official loss or replacement procedure exists. Do not upload additional IDs to an unverified collector or “investigator.”

Evidence to preserve

Keep original electronic files when possible, not just edited screenshots. Preserve:

the lender’s notices, statements, demand letters, and collection messages;
screenshots showing complete sender details, dates, URLs, and account numbers;
email headers and original message files;
call logs, voicemail, and the names or identifiers used by callers;
the lender’s complaint acknowledgment and reference number;
your credit report and its transaction reference number;
proof of your location or activities when the application was supposedly made;
records showing that the disbursement account, phone, email, address, device, or signature is not yours;
reports concerning a lost ID, SIM, phone, or compromised account;
affidavits from persons with direct knowledge, where appropriate; and
a chronological incident log.

Ask the lender to preserve the application form, submitted ID images, selfie or liveness recording, electronic signature, OTP and authentication logs, IP address, device information, recorded calls, delivery record, merchant record, and complete disbursement trail. Access to some records may be limited while an investigation is pending, but the preservation request should still be made promptly.

Do not alter, crop, annotate, or delete the only copy of evidence. Never impersonate the offender, access an account without authority, or attempt to obtain protected records through deception.

Where to escalate the complaint

The correct route depends on who issued the credit.

If the lender is regulated by the BSP

Banks, credit-card issuers, many e-money issuers, and other BSP-supervised financial institutions must maintain a consumer-assistance mechanism. Complain to the institution first and retain its answer or proof that it failed to act.

If the issue remains unresolved, escalate it through the BSP Consumer Assistance Mechanism. The BSP accepts its Complaints, Inquiries and Requests form at consumeraffairs@bsp.gov.ph and publishes additional mail, telephone, and walk-in channels on that page. Include:

your complaint to the institution;
its response, if any;
supporting documents;
the outcome you seek; and
reliable daytime contact details.

The Financial Products and Services Consumer Protection Act requires regulated financial service providers to protect consumer assets against fraud and misuse and to provide timely complaint handling. It also empowers financial regulators to provide consumer redress and adjudication within their jurisdiction.

If it is a lending or financing company regulated by the SEC

Use the SEC’s complaint procedure for lending and financing companies. The SEC presently requires a completed complaint form, supporting evidence, a valid government-issued ID, and one complaint form for each respondent company.

The SEC may investigate regulatory violations, but its own guidance explains that it cannot itself declare a loan contract void or cancel an obligation. A disputed company’s registration does not establish that the particular loan was authorized.

Check whether the company has authority to operate. Save the legal company name, app name, website, payment instructions, and collector details. An app’s brand name may differ from the registered corporation.

If the account appears on your CIC credit report

Obtain your report through the Credit Information Corporation’s official consumer channels. Then use the free CIC Online Dispute Resolution System for erroneous, misleading, incomplete, or outdated information.

The CIC currently requires the 14-digit transaction reference number from a credit report that is not more than 30 days old, together with the email address used to obtain that report. Follow all system messages and respond promptly. The CIC cannot simply rewrite lender-submitted data on its own; the dispute process involves the submitting entity and supporting evidence.

A CIC dispute corrects credit information. It does not replace the complaint to the lender, a regulatory complaint, or a criminal report.

If personal data was misused or inadequately protected

Under the Data Privacy Act of 2012, organizations must use reasonable safeguards against unauthorized access and fraudulent misuse of personal information. Data subjects also have statutory rights that may include access and correction, subject to lawful limitations.

Write first to the lender or other organization—preferably its Data Protection Officer—identifying the alleged misuse and requesting appropriate action. If it does not take timely or appropriate action, or gives no response within 15 calendar days after receiving your written notice, you may consider an NPC complaint. The NPC may waive prior-notice requirements in specified serious or urgent circumstances.

Use the NPC’s current complaint instructions and Complaint-Affidavit form. The current procedure calls for a properly completed and notarized complaint or verified complaint, supporting evidence, and compliance with the NPC Rules of Procedure. A consumer’s complaint is different from an organization’s mandatory personal-data-breach notification.

If identity theft, forgery, or fraud is suspected

Report the incident to the cybercrime unit of the Philippine National Police or National Bureau of Investigation, or to the appropriate police station or NBI office. Bring your government ID, written chronology, lender complaint, disputed records, and preserved electronic evidence.

Using another person’s identifying information without right may constitute computer-related identity theft under the Cybercrime Prevention Act of 2012. Depending on what occurred, computer-related forgery, computer-related fraud, access-device fraud, falsification, estafa, or offenses under the Anti-Financial Account Scamming Act may also be relevant. The precise charge is for investigators and prosecutors to determine from the evidence.

A police blotter or affidavit of loss can document your report, but it does not automatically erase the loan or correct a credit report. Continue the lender and regulator disputes separately.

Dealing with collection calls and demands

Tell each collector, in writing, that the account is disputed for identity theft and provide the lender’s case number. Ask for:

the collector’s full name and company;
the creditor’s legal name;
the account and claimed balance;
proof of authority to collect; and
a written copy of the demand.

Do not reveal OTPs, passwords, card security codes, or new copies of IDs to unsolicited callers. Do not install screen-sharing or remote-access software. Do not send a “verification payment.”

If a summons, subpoena, prosecutor’s notice, small-claims notice, or court pleading arrives, do not ignore it even if the debt is fraudulent. Regulatory complaints generally do not stop court deadlines. Obtain legal help immediately and file the required response with the correct office or court.

Common mistakes

Reporting only by phone and keeping no reference number.
Calling a number contained in a suspicious text instead of verifying the lender independently.
Paying a small amount or signing a restructuring agreement simply to stop harassment.
Treating a police blotter as automatic cancellation of the account.
Disputing only with the CIC and not with the lender that supplied the data.
Sending the NPC a complaint without first notifying the concerned entity in writing, unless a recognized waiver ground applies.
Giving collectors additional IDs, selfies, OTPs, or account credentials.
Deleting messages, resetting a compromised device, or discarding a SIM before preserving evidence.
Publicly accusing a named person without adequate proof.
Assuming that every unfamiliar lender message proves a real account; some messages are phishing attempts designed to obtain more information.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if you qualify, as soon as possible when:

court papers, a subpoena, or a prosecutor’s notice has been served;
the lender insists that biometric, OTP, signature, or device evidence proves authorization;
proceeds entered an account you own or control;
you previously shared your ID, phone, SIM, credentials, or account access with another person;
property, salary, collateral, or a legitimate account is threatened;
the disputed amount is substantial or several accounts are involved;
collection activity includes threats, public shaming, or contact with unrelated persons;
your credit correction has been rejected despite strong evidence; or
you need an injunction, damages, cancellation of a purported contract, or representation in a civil or criminal case.

Frequently asked questions

Am I required to pay while the investigation is pending?

Do not assume that you owe an account you never authorized. Dispute it immediately and request suspension of collection and adverse reporting. Whether payment can legally be required depends on proof of consent, authentication, receipt or benefit, agency, and other facts. If the lender maintains the claim, obtain legal advice before signing, paying, or admitting anything.

Should I submit an affidavit of denial?

A sworn affidavit can strengthen the record, especially for law enforcement or a regulator, but it does not automatically invalidate the account. Make it fact-specific and truthful. Do not state that an ID or phone was lost if that is not what happened.

Can I demand the application and verification records?

You may request the records attributed to you and the basis for treating you as the borrower, invoking applicable contractual, consumer-protection, and data-subject rights. The lender may redact third-party information or temporarily limit disclosure for a lawful reason. Ask it to preserve all unproduced records and explain any refusal in writing.

What if the lender says an OTP proves I applied?

An OTP is important evidence, but it is not conclusive in every case. Ask for the destination number, time sent, authentication logs, device and IP information, account changes, and disbursement trail. Explain any SIM loss, unauthorized replacement, compromised device, phishing event, or account takeover and preserve proof.

What if the money entered my bank account or e-wallet?

Act urgently. Do not spend or transfer it unless directed through a verified, documented process. Notify both institutions, preserve the transaction details, and obtain legal advice. Receipt into an account you control can materially affect the investigation, even if someone else initiated the application.

Will a CIC dispute remove the account immediately?

Not necessarily. The CIC process verifies disputed data with the submitting entity and relies on evidence; the CIC does not unilaterally alter reported information. Use a qualifying recent report, meet system deadlines, and continue pursuing the lender’s internal investigation.

Can I file with several agencies at once?

Yes, when each has a distinct role: the lender investigates and corrects its records; the BSP or SEC handles regulated-provider issues; the CIC handles credit-report data; the NPC handles data-privacy violations; and law enforcement investigates possible crimes. Filing with one does not necessarily replace the others.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may change with the lender, regulator, documents, and facts. Official sources and procedures were checked as of 28 August 2026.