Finding out that someone used your name, ID, phone number, or selfie to take an online loan can feel terrifying. Victims usually face two problems at once: the financial fraud itself and the harassment that follows from collectors texting family, officemates, or contacts. In the Philippines, identity theft involving online loans may trigger several laws at the same time: cybercrime, data privacy, lending company regulation, access-device fraud, consumer protection, and civil liability. This guide explains what the law says, what evidence to preserve, where to report, and how to protect your name, credit record, and personal data.

What Identity Theft in Online Loans Usually Looks Like

Identity theft in online lending happens when another person uses your personal information without your consent to apply for, receive, or support a loan.

Common examples include:

Someone uses a lost or stolen government ID to create a loan account.
A scammer uses your name, mobile number, selfie, or social media photo for online loan verification.
A loan app accesses your contacts and starts sending collection messages to people you know.
A lender or collector claims you borrowed money even though you never downloaded the app.
Your name appears in a demand message, credit report, or “blacklist” for a loan you did not make.
A relative, partner, coworker, or stranger used your identity and number as the borrower, guarantor, or reference.

The most important distinction is this: a fraudulent loan is not the same as a legitimate unpaid loan. If you never applied, never consented, and never received the loan proceeds, your goal is not simply to “negotiate payment.” Your goal is to create a clear record that you are disputing the debt as identity theft.

The Philippine Laws That May Protect Victims

Identity theft is a cybercrime when personal data is misused through technology

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, punishes several computer-related offenses, including computer-related fraud, forgery, and identity theft. The law specifically covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person, without right. (Supreme Court E-Library)

The implementing rules explain that “identifying information” can include details such as name, date of birth, passport number, tax identification number, biometrics, electronic identification data, telecommunications identifying information, and access-device information. (Supreme Court E-Library)

In plain English: if someone used your identity details to create an online loan account, submit a fake loan application, access your e-wallet, or misrepresent themselves as you online, the situation may fall under cybercrime.

Your personal data is protected under the Data Privacy Act

Republic Act No. 10173, or the Data Privacy Act of 2012, protects the privacy of individuals while allowing legitimate information processing under proper safeguards. It applies to personal information controllers and processors, including companies that collect and process borrower data. (National Privacy Commission)

As a data subject, you generally have the right to be informed, access your personal data, correct inaccurate data, object to certain processing, request blocking or erasure in proper cases, complain before the National Privacy Commission, and claim damages when legally justified. (National Privacy Commission)

The law also requires personal information controllers to protect personal data against unlawful access and fraudulent misuse. Breach notification obligations may apply when sensitive personal information or information that may enable identity fraud is acquired by an unauthorized person. (National Privacy Commission)

This matters because online loan cases often involve more than one privacy violation: unauthorized use of ID documents, excessive collection of contacts, shaming messages, disclosure of alleged debt, and failure to correct inaccurate records.

Online lending companies are regulated by the SEC

Republic Act No. 9474, or the Lending Company Regulation Act of 2007, provides that a lending company must generally be a corporation and must have authority to operate from the Securities and Exchange Commission. The SEC has authority to regulate and supervise lending companies and impose sanctions such as fines, suspension, or revocation of authority. (Supreme Court E-Library)

This is important because some victims are harassed by apps or collectors that either:

are not properly registered;
use a different app name from the registered corporate name;
operate through multiple clone apps;
claim SEC registration but cannot show authority to operate as a lending or financing company; or
engage in unfair debt collection even if the company itself is registered.

The SEC has also issued rules against unfair debt collection practices. These include abusive tactics such as threats, insults, shaming, false representations, and contacting people in the borrower’s contact list who are not guarantors or co-makers. (Grant Thornton Philippines)

Financial account scams, e-wallets, and access devices may involve separate offenses

If the identity theft involved a bank account, credit card, e-wallet, OTP, SIM, or payment account, other laws may also apply.

Republic Act No. 8484, the Access Devices Regulation Act of 1998, covers access devices such as cards, account numbers, codes, PINs, telecommunications service identifiers, and other means of account access used to obtain money, goods, services, or fund transfers. It also covers fraudulently applied-for access devices using false information or fictitious identities. (Lawphil)

Republic Act No. 12010, the Anti-Financial Account Scamming Act of 2024, protects the public from schemes targeting financial accounts, including deposit accounts, credit card accounts, transaction accounts, e-wallets, and other financial products or services. It also provides penalties and recognizes jurisdiction when elements of the offense, devices, systems, financial accounts, or damage are connected to the Philippines. (Supreme Court E-Library)

If someone used your identity to open an e-wallet, receive loan proceeds, move money, or act as a mule account, report it quickly to the financial institution and law enforcement.

A loan without consent can be challenged

Under Philippine civil law, a valid contract requires consent, object, and cause. If you never gave consent to the loan, the alleged lender or collector should not simply treat the account as an ordinary unpaid debt. The problem is proof: you need records showing that you promptly denied the loan, disputed the account, and reported the identity theft.

The Civil Code also recognizes duties to act with justice, give everyone their due, and observe honesty and good faith. It allows liability for damage caused contrary to law, and for willful or negligent acts contrary to morals, good customs, or public policy. (Lawphil)

This can matter where a lender, collector, or third party damages your reputation by spreading false claims, harassing your contacts, or refusing to correct obviously inaccurate data.

What to Do in the First 24 to 48 Hours

1. Do not admit the debt if you did not borrow the money

If the loan is fraudulent, be careful with your words. Do not say:

“I will pay when I have money.”
“Please give me a discount.”
“Can I pay in installments?”
“I know I owe, but I need time.”

Those statements may later be used to argue that you acknowledged the debt.

Instead, say clearly and repeatedly:

“I dispute this account.”
“I did not apply for this loan.”
“I did not receive the proceeds.”
“My identity appears to have been used without my consent.”
“Please mark the account as disputed and stop collection while this is investigated.”

Use written channels whenever possible: email, support ticket, registered mail, or in-app support with screenshots.

2. Preserve evidence before blocking, deleting, or uninstalling

Before deleting the app or blocking numbers, save evidence. In identity theft and online loan cases, evidence disappears quickly because apps change names, numbers rotate, collectors delete messages, and links expire.

Preserve:

screenshots of all text messages, chat messages, emails, and in-app notices;
caller ID logs showing date, time, and number;
voice recordings if legally obtained and relevant;
screenshots of threats, insults, shaming posts, or messages to your contacts;
app name, developer name, website, email address, and social media pages;
the alleged loan account number, amount, date, and due date;
names and numbers of collectors;
proof that your contacts received messages;
proof you were abroad, hospitalized, offline, or otherwise unable to apply, if relevant;
police blotter, NBI complaint sheet, or affidavits already filed;
credit report entries showing the disputed account.

For screenshots, include the full phone number, date, time, profile name, and conversation thread. Do not crop too aggressively.

3. Secure your accounts and devices

Identity theft usually means your information is already exposed. Take practical steps immediately:

Change passwords for your email, e-wallets, banking apps, and social media.
Turn on two-factor authentication.
Log out unknown sessions from email and social media accounts.
Report a lost SIM or suspicious SIM activity to your telco.
Check if your email has unusual forwarding rules.
Review e-wallet and bank transaction history.
Never share OTPs, reset links, or remote-access codes.
Do not send another selfie or ID to an unknown collector “for verification.”

If your e-wallet, bank account, or card was affected, report to the financial institution immediately. Under financial consumer protection rules, consumers are generally expected to first raise complaints with the bank or financial institution; if it fails to act, the matter may be escalated through the BSP Consumer Assistance Mechanism. (Bureau of Small Enterprises)

4. Send a written fraud dispute to the lender or loan app

Even if the collector is abusive, create a paper trail. Send a short, firm written dispute to the company’s official email, support channel, or registered office.

Include:

your full name and mobile number;
the loan account number, if known;
a statement that you did not apply for or authorize the loan;
a request to mark the account as disputed;
a demand to stop collection calls and messages to you and your contacts while the dispute is investigated;
a request for copies of the loan application, KYC documents, selfie verification, e-signature record, disbursement details, device ID, IP logs, and consent logs;
a request to correct, block, or erase inaccurate personal data when legally proper;
a request not to report, or to correct, the disputed account with credit bureaus or databases;
a deadline for written response.

A practical wording is:

I am formally disputing this alleged loan account. I did not apply for this loan, did not authorize the use of my personal information, and did not receive the loan proceeds. Please mark the account as disputed, preserve all records, stop collection activity against me and my contacts while this is investigated, and provide the documents and logs showing how this account was created and disbursed.

Keep proof that you sent it.

5. Report urgent scam activity

If you are receiving scam messages, phishing links, or threats connected to identity theft, you may report suspicious SMS and online scam activity through official government channels. The Cybercrime Investigation and Coordinating Center has urged the public to report SMS scams through the eGov app’s eReport feature and has directed fraud victims to the Inter-Agency Response Center hotline 1326. (Philippine News Agency)

This does not replace a full complaint with the NBI, PNP, SEC, NPC, or your bank, but it helps create an immediate report trail.

Where to Report Identity Theft and Online Loan Harassment

Different agencies handle different parts of the problem. Victims often need to report to more than one office.

Problem	Where to Report	What to Prepare	Practical Notes
Someone used your identity online to apply for a loan	NBI Cybercrime Division or PNP Anti-Cybercrime Group	Affidavit or written narrative, screenshots, IDs, messages, app details, account numbers	Best for criminal investigation and cybercrime evidence preservation
Online loan app harassment, threats, shaming, or contact-list blasting	SEC	Screenshots, company/app name, collector numbers, proof messages were sent to contacts	Best for lending/financing company violations and unfair collection
Unauthorized use, disclosure, or misuse of personal data	National Privacy Commission	Notarized complaint, evidence, IDs, proof of data processing or disclosure	Best for privacy violations, contact scraping, data misuse, failure to correct data
Bank, card, or e-wallet account used in the scam	Bank/e-wallet provider first; BSP if unresolved	Transaction records, account details, complaint ticket, IDs	Act quickly because fraud claims often depend on prompt reporting
Fraudulent loan appears in credit report	Credit Information Corporation dispute process and the reporting entity	Credit report, dispute letter, police/NBI report, lender response	Best for correcting credit records
Threats, extortion, physical harassment, or local collector visits	Police station, prosecutor, or court process as appropriate	Screenshots, witnesses, CCTV, recordings, barangay blotter if useful	Barangay blotter can help document events but does not replace cybercrime reporting

Filing with the NBI Cybercrime Division

The NBI Citizens Charter describes an investigative assistance process for victims of computer crimes. A complainant may proceed to the Cybercrime Division to file a complaint or request investigation, undergo an initial interview, execute sworn statements or submit affidavits, and provide supporting documents or devices for examination where needed. The listed service step has no fee and an estimated initial processing time of about one hour and ten minutes, although the full investigation may take longer depending on evidence, subpoenas, coordination with platforms, and prosecutor action. (National Bureau of Investigation)

Bring both printed and digital copies if possible. If your phone contains the messages, bring the phone itself. Do not rely only on screenshots saved in cloud storage.

Filing with the SEC

For complaints against lending or financing companies and online lending apps, the SEC provides public complaint and reporting channels through its iMessage platform. (Securities and Exchange Commission)

When reporting, include:

the app name and exact spelling;
the registered company name, if known;
SEC registration or Certificate of Authority number, if shown in the app;
screenshots of abusive messages;
proof that collectors contacted non-guarantor contacts;
screenshots of threats, insults, or public shaming;
your written dispute to the company;
the company’s reply or failure to reply.

A common bottleneck is identifying the real company behind the app. Look at the app store listing, privacy policy, terms and conditions, emails, payment instructions, and demand letters. Many apps use brand names that do not match the corporate name.

Filing with the National Privacy Commission

For data privacy complaints, the NPC requires formal complaints to be filed in the proper form. Its procedure directs complainants to print and fill out the complaint form, have it notarized, and submit it to the NPC either personally, by courier, or by scanned copy through email. (National Privacy Commission)

An NPC complaint may be appropriate when:

your ID, selfie, or personal details were used without consent;
the lender refuses to correct inaccurate personal data;
the app accessed or used your contact list excessively;
collectors disclosed your alleged debt to family, friends, coworkers, or employers;
your personal data was posted publicly;
the company cannot explain how it obtained your data;
the company continues processing your data after you disputed the account.

NPC proceedings can take time, so your complaint should be organized. Attach a timeline, screenshots, names of apps and companies, and copies of all written demands.

Filing with the BSP for bank or e-wallet issues

The BSP does not regulate every lending app, but it does supervise banks and certain financial institutions. If your bank account, card, e-wallet, or BSP-supervised financial institution was involved, complain first to the institution. If there is no action or an unsatisfactory response, you may escalate through the BSP Consumer Assistance Mechanism. (Bureau of Small Enterprises)

Examples:

loan proceeds were sent to an e-wallet opened using your identity;
your e-wallet was taken over;
unauthorized transfers were made;
your card or account details were used;
the bank or wallet provider refuses to give a complaint ticket or investigate.

Disputing credit report entries

If a fraudulent online loan appears in your credit history, check your credit report and dispute inaccurate information. The Credit Information Corporation provides access to credit reports and an Online Dispute Resolution Process for disputed credit information. (Credit Information Corporation (CIC))

Do not assume the issue disappears just because collectors stop texting. A disputed online loan can affect future credit card, housing loan, car loan, employment, or visa-related financial checks.

Documents Victims Should Prepare

Document	Why It Matters
Valid government ID	Proves your identity when filing complaints
Affidavit of denial or identity theft	Creates a sworn narrative of what happened
Screenshots of messages and calls	Shows harassment, threats, collection activity, and dates
Proof messages were sent to contacts	Supports privacy and unfair collection complaints
Loan account details	Helps agencies identify the transaction
Written dispute to lender	Shows you denied the debt early
Police, NBI, or PNP report	Supports criminal complaint and credit disputes
Bank/e-wallet complaint ticket	Shows prompt reporting of financial account issues
Credit report	Shows whether the fraudulent loan was reported
Special Power of Attorney	Useful if an OFW or foreign victim authorizes someone in the Philippines to file or follow up

If you are abroad

OFWs and foreigners outside the Philippines can still prepare documents for use in Philippine complaints. A Philippine Embassy or Consulate may notarize affidavits and special powers of attorney for use in the Philippines, often requiring personal appearance and identification. (Philippine Embassy)

If a document is notarized by a foreign notary in a country that is part of the Apostille Convention, it may need an apostille from the competent authority in that country before it can be used in the Philippines. (Philippine Embassy)

For practical purposes, an OFW victim often signs:

an affidavit explaining the identity theft;
a special power of attorney authorizing a trusted person in the Philippines to file complaints, receive notices, and submit documents;
copies of passport pages, visas, work IDs, or travel records showing location abroad when the loan was allegedly made.

How to Deal with Collectors Contacting Your Family, Friends, or Employer

Collectors often pressure victims by contacting their address book. This is one of the most distressing parts of online loan identity theft.

Tell your contacts:

not to pay;
not to send your new number, address, workplace, or IDs;
not to click links;
to screenshot the messages with the number and date visible;
to reply only once if needed: “This person disputes the loan as identity theft. Stop contacting me. I am not a guarantor or co-maker.”

If collectors are sending insults, threats, or “wanted” graphics, preserve them. These may support complaints for unfair debt collection, privacy violations, cybercrime, grave threats, unjust vexation, libel or cyberlibel, or civil damages depending on the facts.

Be careful about posting the collector’s name or face publicly unless you have verified the facts. Public accusations can create a separate defamation risk. It is usually safer to send evidence to the proper agencies.

Should You Pay an Online Loan Made Through Identity Theft?

Generally, if you truly did not borrow the money, did not authorize the loan, and did not receive the proceeds, you should be very careful about paying “just to make it stop.”

Paying may create problems:

it can look like acknowledgment of the debt;
collectors may demand more;
the real fraudster remains unidentified;
the lender may still report the account;
it weakens your position if you later claim you never borrowed.

If you decide to make any payment because of extreme pressure, document that it is made under protest and without admission of liability. But in a genuine identity theft case, the better first step is to dispute in writing, report, preserve evidence, and demand investigation.

What If the Lender Files a Case Against You?

Do not ignore summons, demand letters, barangay notices, small claims notices, or court papers simply because the loan is fraudulent.

If a lender files a civil collection case, it generally must prove the loan, your consent, and the disbursement of funds. Your defense may include:

you did not apply;
the signature, selfie, number, email, or device was not yours;
the proceeds went to an account you do not own or control;
the KYC process was defective;
you promptly disputed the account;
you filed reports with law enforcement or regulators;
the lender continued collection despite notice of identity theft.

If you receive actual court documents, check the deadline immediately. Court deadlines are strict. Bring your evidence, affidavits, complaint records, and proof of identity theft. Do not wait until a default judgment or adverse order is issued.

Common Mistakes That Hurt Victims

Deleting the app or messages too early

Victims understandably want to remove the source of stress. But once messages, app screens, or account details are deleted, it becomes harder to prove what happened.

Capture evidence first. Then secure the device.

Handling everything by phone call

Phone calls are hard to prove unless properly recorded and preserved. Use written channels. Ask for ticket numbers. Follow up by email.

Sending more IDs to suspicious collectors

Some collectors ask victims to send a new ID, selfie, or signature “to clear the account.” Be careful. If the channel is not verified, you may be giving fraudsters more material.

Filing only one report

Identity theft with online loans often involves several issues. A police or NBI report may help with criminal investigation, but it may not automatically correct your credit report. An SEC complaint may address unfair collection, but it may not fully resolve data privacy violations. An NPC complaint may address personal data misuse, but it may not freeze a bank transaction.

Use the right office for the right problem.

Ignoring credit records

Even if the harassment stops, the alleged loan may remain in a database. Check and dispute your credit record if the loan was reported.

Assuming SEC registration means all collection conduct is legal

A company may be registered and still violate debt collection or privacy rules. Registration is not a license to shame, threaten, or contact everyone in your phonebook.

Practical Timeline: What Usually Happens

Timeframe	What You Can Do	What to Expect
Same day	Save evidence, secure accounts, dispute with lender, report urgent scam messages	Collectors may continue contacting you, so keep documenting
1–3 days	File NBI/PNP report, notify bank/e-wallet, send formal dispute	You may receive complaint tickets or initial intake records
1–2 weeks	File SEC/NPC complaints if harassment or data misuse continues	Agencies may require complete documents, notarized forms, or clearer evidence
2–8 weeks	Follow up with lender, credit report, bank/e-wallet, and agencies	Responses vary; incomplete company details can delay action
Longer	Criminal investigation, prosecutor review, regulatory action, or court case	Timelines depend heavily on evidence, cooperation from platforms, subpoenas, and agency workload

The most common bottlenecks are missing screenshots, unclear app identity, no written dispute, no proof the victim denied the loan early, and difficulty tracing the account that received the proceeds.

Frequently Asked Questions

Do I have to pay an online loan I never applied for?

If you did not apply, did not consent, and did not receive the money, you should dispute the loan in writing instead of treating it as an ordinary debt. Ask the lender to provide the application, KYC records, disbursement details, device logs, and proof of consent. Report the identity theft and preserve all evidence.

What if the online loan app is texting my contacts?

Ask your contacts to screenshot the messages and avoid engaging. Contacting non-guarantor contacts, shaming borrowers, using threats, and disclosing alleged debts may support complaints with the SEC and NPC. It may also support criminal or civil action depending on the content of the messages.

Can online lending apps access my contact list?

A loan app should not freely harvest and use your contact list for harassment. Processing personal data must comply with the Data Privacy Act, and the NPC has recognized problems involving online lenders using borrower and contact data in ways that cause reputational harm and violate rights. (National Privacy Commission)

Should I report to NBI or PNP first?

Either may be appropriate for cybercrime. Many victims go to the NBI Cybercrime Division or PNP Anti-Cybercrime Group for identity theft, fake accounts, phishing, or online fraud. If there is immediate danger, threats, or local harassment, you may also report to the nearest police station.

Should I file with SEC or NPC?

File with the SEC if the issue involves an online lending company, illegal lending, unfair collection, harassment, threats, or abusive collectors. File with the NPC if the issue involves misuse of personal data, contact-list blasting, unauthorized disclosure, refusal to correct data, or identity documents used without consent. In many online loan identity theft cases, both agencies may be relevant.

What if the loan app is not SEC-registered?

Include that in your SEC complaint. Under RA 9474, lending companies are subject to SEC authority, and operating without proper authority may expose the company or persons involved to sanctions or penalties. Also preserve the app listing, website, payment details, and messages because unregistered apps may disappear quickly.

How do I clear my name from a credit report?

Get your credit report, identify the disputed entry, send a written dispute to the lender or reporting entity, and use the Credit Information Corporation’s dispute process where applicable. Attach your affidavit, police/NBI report, written dispute to the lender, and any proof that you did not receive the proceeds.

Can I file a complaint if I am an OFW?

Yes. You can prepare an affidavit and special power of attorney abroad so a trusted representative in the Philippines can file or follow up. Depending on where you are, documents may need consular notarization or apostille before use in the Philippines.

Can foreigners be victims under Philippine law?

Yes. If the identity theft, online loan, account, device, financial institution, offender, victim, or damage has a sufficient Philippine connection, Philippine agencies may have authority to act depending on the law involved. RA 12010, for example, recognizes jurisdiction where elements, devices, systems, financial accounts, or damage are connected to the Philippines.

Can I sue for damages?

Possibly, depending on the facts and evidence. Civil claims may be considered when a person or company causes damage through unlawful, willful, negligent, abusive, or bad-faith conduct. In practice, victims should first organize evidence, establish the fraudulent nature of the loan, identify the responsible parties, and document the harm caused.

Key Takeaways

Do not admit or negotiate a fraudulent online loan as if it were your debt. Clearly dispute it in writing.
Preserve screenshots, call logs, app details, account numbers, and messages sent to your contacts.
Report cyber identity theft to the NBI Cybercrime Division or PNP Anti-Cybercrime Group.
Report abusive or illegal online lending practices to the SEC.
Report misuse of personal data, contact-list harassment, and refusal to correct data to the NPC.
Report bank, card, or e-wallet involvement to the financial institution first, then escalate to BSP if unresolved.
Check your credit report and dispute fraudulent entries through the proper credit reporting channels.
OFWs and foreigners can prepare affidavits and special powers of attorney abroad for use in Philippine complaints.
The earlier you create a written record, the easier it is to show that the account is identity theft, not an ordinary unpaid loan.