Finding a loan you never applied for in your Philippine credit report can affect loan approvals, credit limits, interest rates, housing applications, and even collection activity. Act quickly, but do not panic or pay the account simply to make it disappear. The proper approach is to dispute the loan with the lender that reported it, file a formal dispute through the Credit Information Corporation (CIC), preserve evidence of identity theft, secure your accounts, and escalate the matter to the correct regulator when necessary.

What an Unknown Loan in Your Credit Report May Mean

An unfamiliar loan does not always mean the same thing. It may involve:

Identity theft, where someone used your name, identification documents, mobile number, email address, signature, selfie, or personal details to obtain credit.
Mixed or mismatched records, such as a loan belonging to another person with a similar name.
Incorrect encoding, including a wrong birth date, address, loan status, account number, or borrower identification number.
Unauthorized use by a relative, employee, agent, or former partner who had access to your documents or devices.
An old or legitimate account reported incorrectly, such as a fully paid loan still marked as outstanding.
Fraudulent digital onboarding, where a criminal used stolen identity documents, a compromised SIM card, or manipulated electronic know-your-customer records.

The distinction matters. A genuine identity-theft case should be treated as a false or unauthorized account—not merely as a delinquent loan that will eventually age out of your record.

Your Rights Under Philippine Law

A loan generally requires your consent

Article 1318 of the Civil Code of the Philippines provides that a contract requires the consent of the contracting parties, a definite object, and a lawful cause. Article 1319 further explains that consent arises from a meeting of the offer and acceptance. When another person impersonates you, forges your signature, or completes a digital loan application without your authority, there is ordinarily no genuine consent on your part. (Lawphil)

The lender should therefore be required to produce the records showing how the alleged loan was created and authorized. Depending on the method of application, these may include:

The original application form
The signed loan agreement
Electronic consent records
Identity-verification documents
Selfie or video-verification records
One-time password or OTP logs
Mobile number and email records
Device identifiers and IP-address logs
Date and time stamps
The bank or e-wallet account that received the proceeds
Call recordings and collection notes

An OTP, electronic signature, or uploaded ID may be evidence, but it does not automatically prove that you personally applied for the loan. A stolen SIM, compromised email account, falsified ID, manipulated selfie, or fraudulent device enrollment can also produce electronic records.

You have a statutory right to dispute incorrect credit information

The Credit Information System Act of 2008, Republic Act No. 9510, gives borrowers the right to access their credit information and dispute information that is erroneous, incomplete, outdated, or misleading.

The law directs the CIC to investigate and verify disputed information within five working days from receipt of the complaint. When the accuracy of the information cannot be verified or proven, it must be deleted. The borrower and entities that received the information must also be informed of the correction or removal. Unjustified denial of these borrower rights may give rise to indemnity. (Credit Information Corporation (CIC))

However, the CIC does not create the underlying loan records. The lender or other institution that submitted the account—called the Submitting Entity—normally has to investigate and send the necessary correction to the CIC. The CIC expressly states that it cannot unilaterally alter submitted data and must evaluate the lender’s records, the borrower’s evidence, and the parties’ documented communications. (Credit Information Corporation (CIC))

You have rights under the Data Privacy Act

Republic Act No. 10173, or the Data Privacy Act of 2012, protects your personal information. Its implementing rules give a data subject—the person whose information is being processed—the right to:

Access personal data and learn where it came from
Dispute inaccurate information
Require correction of inaccurate data
Request blocking, removal, or destruction of data that is false, unlawfully obtained, or used without authority
Ask that prior recipients be informed of the correction
Seek compensation for damage caused by false, inaccurate, unlawfully obtained, or unauthorized processing

A lender or credit-data provider should correct inaccurate personal data promptly unless the request is vexatious or unreasonable. (National Privacy Commission)

Financial institutions must provide a complaint mechanism

Under Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, and BSP Circular No. 1160, institutions supervised by the Bangko Sentral ng Pilipinas must maintain a free and accessible Financial Consumer Protection Assistance Mechanism, commonly called an FCPAM. This is the institution’s first-level process for complaints, inquiries, and requests. (Bureau of the Treasury)

For a bank, digital bank, BSP-supervised financing institution, e-money issuer, or other BSP-supervised entity, you generally must complain to the institution first. If its response is unsatisfactory or it fails to act within a reasonable period, you may escalate the complaint through the BSP Consumer Assistance Mechanism. (Bureau of the Treasury)

Identity theft may be a criminal offense

Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175, penalizes computer-related identity theft, including the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right. (Lawphil)

The Access Devices Regulation Act of 1998, Republic Act No. 8484, as amended by Republic Act No. 11449, may also apply when an access device or credit facility was obtained through false information, a fictitious identity or address, falsified documents, or other fraudulent pretenses. Depending on the facts, falsification, estafa, unauthorized access, and other offenses may also be investigated. (Lawphil)

What to Do Immediately After Finding the Fake Loan

1. Preserve the credit report and every related record

Download or print the full credit report. Do not keep only a cropped screenshot of the disputed line.

Save:

The report’s issue date
The name of the reporting lender
Account or contract number
Loan type and amount
Opening date
Outstanding balance
Payment status
Dates of reported delinquency
The 14-digit CIC Transaction Reference Number or TRN
Emails, text messages, call logs, and collection notices
Screenshots showing when and where you discovered the account

Keep the original electronic files. Metadata, email headers, dates, and complete message threads may later help establish what happened.

2. Send a written fraud dispute to the lender

Contact the lender’s fraud department, data protection officer, complaints unit, or FCPAM. A telephone report may be useful for speed, but follow it with an email, web complaint, or signed letter that creates a permanent record.

State clearly that:

You did not apply for, sign, authorize, receive, or benefit from the loan.
You dispute any obligation to pay it.
You are requesting an immediate hold on collection activity.
You want the account marked as disputed or suspected identity theft.
You are exercising your rights to access and correct personal data.
You want the complete application and disbursement records.
You want the lender to correct its submission to the CIC and any other credit bureau or recipient.

Ask for a complaint reference number and a written response.

3. Do not make a token payment or sign a restructuring agreement

A collector may suggest paying a small amount “while the investigation is ongoing” or signing a payment arrangement to stop calls. Doing so may create unnecessary ambiguity about whether you acknowledged, adopted, or ratified the alleged debt.

Do not sign:

A promise to pay
A loan restructuring agreement
A compromise agreement
An acknowledgment of debt
A waiver or release
A settlement that describes you as the borrower

You may state that you are willing to cooperate with an investigation without admitting liability.

4. Secure the accounts that may have been compromised

Change passwords for your:

Primary email account
Mobile-banking accounts
E-wallets
Social-media accounts
Cloud-storage accounts
Government-service accounts

Enable multi-factor authentication using an authenticator application where available. Check whether your email has unknown forwarding rules, recovery addresses, or logged-in devices.

If your mobile number unexpectedly lost service, was replaced, or received suspicious OTP requests, contact the telecommunications company and ask whether a SIM replacement, porting request, or account change occurred.

If a passport, driver’s licence, Philippine Identification card, UMID, company ID, or other identity document was lost or exposed, report the loss to the issuing authority and preserve the incident report.

5. Report apparent criminal identity theft

A criminal report does not automatically correct a credit report, but it creates an independent record and may help the lender, CIC, regulator, or court evaluate your claim.

You may report cyber-enabled identity theft to the Philippine National Police Anti-Cybercrime Group or seek investigative assistance from the National Bureau of Investigation. The NBI maintains an online complaint channel and a Cybercrime Division. (National Bureau of Investigation)

Bring or attach:

Your credit report
The lender’s collection notices
Copies of the identity documents apparently used
Evidence of account or SIM compromise
Emails and text messages
Proof that you were elsewhere when the account was opened
Bank statements showing that you did not receive the proceeds
The lender’s application records, if already provided
A chronological written account of what happened

How to Dispute the Loan Through the CIC

1. Obtain a recent CIC credit report with a TRN

The CIC’s Online Dispute Resolution System requires the 14-digit Transaction Reference Number appearing on a CIC credit report. The report must generally be no more than 30 days old when the dispute is filed. If your report does not show a TRN, ask the provider that issued it to supply the number. (Credit Information Corporation (CIC))

Credit reports may be obtained through the CIC’s available direct-to-consumer or accredited-provider channels. Identity verification is generally performed online rather than through an ordinary walk-in request. The provider may require a valid government ID, facial verification, or a video-based know-your-customer procedure. (Credit Information Corporation (CIC))

2. File through the CIC Online Dispute Resolution System

Use the official CIC Online Dispute Resolution Process. Select the disputed account and describe the problem accurately.

A useful description is:

I did not apply for, authorize, sign, receive, or benefit from this loan. I believe my identity or personal information was used without authority. I request verification of the complete application, KYC, consent, device, OTP, and disbursement records, and correction or deletion of the account if the reporting entity cannot prove that I entered into the loan.

The current system may use Philippine Identification System authentication. The CIC states that a user is allowed up to two unsuccessful PhilSys authentication attempts before being redirected to the older dispute process. (Credit Information Corporation (CIC))

3. Submit a focused evidence package

Do not overwhelm the investigator with hundreds of unrelated pages. Organize the evidence in date order and add a one-page index.

Document	Why it helps
Full CIC credit report	Identifies the disputed lender, account, dates, and TRN
Valid government IDs	Establishes your correct identity and signature
Affidavit of denial or identity theft	Gives a sworn, chronological account
Proof of address	Shows discrepancies in the application
Passport stamps, employment records, or travel records	May show you were abroad or elsewhere when the loan was opened
Bank and e-wallet statements	May show that you never received the proceeds
SIM-replacement or telecom records	May support a SIM-swap or mobile takeover claim
Email security logs	May show unauthorized account access
Police or NBI report	Creates an independent record of reported identity theft
Lost-ID report	Shows when an identification document was compromised
Specimen signatures	Helps compare your genuine signature with the application
Lender correspondence	Shows what you requested and how the lender responded

The CIC may require a sworn affidavit with supporting evidence, particularly when the submitting entity does not respond or its records are unavailable. CIC rules may give the disputing borrower only five working days to provide the requested affidavit or other documents.

4. Keep all important communications inside the official dispute trail

A lender may call you or send a separate email outside the CIC thread. Summarize that communication in writing and report it through the official CIC channel. CIC rules warn that offline communications not reported to the CIC may not be considered when the dispute is resolved.

After every call, send an email such as:

This confirms our telephone conversation on 15 July 2026. Your representative stated that the loan was applied for using mobile number ______ and disbursed to ______. I reiterated that neither account belongs to me and requested copies of the supporting records.

5. Respond to every CIC or lender message promptly

CIC dispute rules generally require the borrower to respond to communications within five working days. Failure to respond without justification may be treated as loss of interest and may lead to termination of the dispute, although refiling may remain possible.

Check:

Inbox
Spam or junk folder
The email account used to obtain the report
CIC case notifications
Messages from the lender’s designated dispute officer

6. Review the lender’s recommendation carefully

The lender should provide a reasoned recommendation identifying the disputed information, the documents reviewed, and the basis for accepting or rejecting your claim.

You normally have five working days to accept or reject that recommendation. If you reject it, state exactly why. For example:

The selfie does not depict you.
The mobile number is not yours.
The email address was never under your control.
The proceeds went to an unrelated bank or e-wallet account.
The signature differs from your specimen signatures.
The address and employment details are incorrect.
The lender produced an OTP log but no evidence that you controlled the device or SIM.
The lender failed to produce the application or disbursement record.

The CIC may then resolve the case based on the documents submitted. Its circular provides for a resolution within three working days after receiving the borrower’s acceptance, rejection, or other triggering response under the procedure.

7. Obtain proof of correction

Do not stop after receiving a message saying the complaint was “closed.”

Request:

The lender’s written finding that the account was fraudulent or not yours
Confirmation that collection activity has stopped
Confirmation that the balance has been removed from your customer profile
Confirmation that corrected data was submitted to the CIC
The date and reference number of the correction file
Confirmation that other recipients were notified, where applicable

After allowing time for the correction to enter the reporting system, obtain a fresh credit report and confirm that the account has been removed or correctly marked.

Expected Timelines

Stage	Official or practical period
CIC statutory verification	RA 9510 states that disputed information should be investigated and verified within five working days from receipt
Submitting entity investigation	CIC Circular No. 2019-01 classifies matters as simple, complex, or highly technical, with periods of approximately 3, 7, or 20 working days
Possible extension	An extension corresponding to the applicable 3-, 7-, or 20-working-day period may be allowed
Borrower response to requests	Usually five working days
Acceptance or rejection of lender recommendation	Usually five working days
CIC resolution after the relevant response	Generally three working days under the circular
Finality of CIC resolution	Fifteen calendar days from receipt unless properly refiled on an allowed ground
BSP escalation	The BSP-supervised institution is ordinarily directed to answer the escalated complaint within 15 days
NPC complaint	No dependable short completion period; the duration depends on completeness, service, investigation, conferences, and the parties’ submissions

The CIC periods should not be read as a guarantee that every identity-theft case will be completely corrected within five days. Obtaining archived applications, reviewing digital logs, tracing a disbursement account, securing an affidavit, and waiting for a lender’s corrected submission can extend the end-to-end process. CIC rules expressly recognize different complexity levels and possible extensions.

Where to Escalate an Unresolved Dispute

If the lender is supervised by the BSP

First use the institution’s official FCPAM, customer-service, fraud, or complaints process. Preserve the reference number and proof of your complaint.

If the institution rejects the dispute, gives an incomplete response, or fails to act within a reasonable period, file through the BSP Consumer Assistance Channels. You may use the BSP Online Buddy or the prescribed Complaint, Inquiry and Reply form and attach proof that you first complained to the institution. (Bureau of the Treasury)

Under BSP Circular No. 1169, the BSP Consumer Assistance Mechanism is a second-level process. The supervised institution is generally required to answer within 15 days after the BSP’s directive. Further exchanges, mediation, or adjudication may follow when the matter remains unresolved.

If the lender is a lending or financing company regulated by the SEC

Many online lending platforms and financing companies are regulated by the Securities and Exchange Commission rather than the BSP.

After complaining directly to the company, submit an escalation through the SEC iMessage complaint portal. Include:

The company’s legal and trade names
Loan or account number
Screenshots of the app or collection messages
Your written dispute
The company’s response
CIC report
Proof of identity theft
Evidence that you never received the loan proceeds

The BSP’s own consumer guidance directs complaints involving lending and financing companies to the SEC’s Financial and Lending Company Division. (Securities and Exchange Commission)

If inaccurate personal data remains uncorrected

Send a written exercise-of-rights request to the lender’s data protection officer. Ask for access, rectification, blocking, and notification of recipients under the Data Privacy Act.

If the organization refuses, ignores the request, or continues processing demonstrably false information, use the current National Privacy Commission complaint procedure. The NPC requires its prescribed complaint format, supporting evidence, and notarization. Filing may be made personally, by courier or registered mail, or through an authorized electronic channel. Incomplete complaints may be dismissed, so use the current form rather than an outdated template. (National Privacy Commission)

Special Considerations for OFWs, Filipinos Abroad, and Foreigners

A person does not have to be physically present in the Philippines to begin the lender and CIC dispute processes. Electronic submissions are commonly used, although the lender, CIC, NPC, police, or court may later require a sworn affidavit or formally authenticated document.

An affidavit executed abroad may be:

Signed before a Philippine embassy or consulate; or
Notarized locally and apostilled by the competent authority if the country is a party to the Apostille Convention; or
Authenticated or legalized under the applicable consular process if the country is not an Apostille Convention member.

Requirements differ by country and receiving agency, so verify the format before paying for notarization or authentication. DFA guidance confirms that documents from Apostille Convention countries can generally be apostilled for use in the Philippines, while non-member countries may require the traditional authentication or legalization process. (Philippine Embassy in New Delhi)

Useful evidence for a person abroad includes:

Passport entry and exit stamps
Overseas employment records
Foreign residence permits
Payroll and attendance records
Local phone records
Proof that the Philippine mobile number used in the application was inactive or not yours
Bank statements showing that no loan proceeds reached you
A notarized or consularized affidavit explaining where you were when the loan was opened

Foreign nationals may use a passport, Alien Certificate of Registration card, or other government identification to establish their correct identity. Their nationality does not make an unauthorized Philippine loan valid; the central question remains whether they consented to and received the credit.

Common Problems That Delay or Weaken a Dispute

Disputing only with the CIC

The lender is usually the source of the account. Filing only with the CIC while ignoring the lender can delay correction because the CIC must obtain and evaluate the submitting entity’s records.

Relying only on telephone calls

Calls are difficult to prove. Confirm each important conversation by email and keep complaint reference numbers.

Missing the five-working-day response period

A valid dispute may be terminated simply because the borrower did not answer a request for documents or did not accept or reject the lender’s recommendation on time.

Sending unprotected copies of IDs

When submitting identification, watermark each copy—for example, “For identity-theft dispute with ABC Lending only, 17 July 2026.” Redact unrelated information when it is not necessary, and use the institution’s official secure channel.

Treating the account as ordinary negative information

CIC guidance allows certain settled negative information to stop appearing after the applicable retention period, commonly described as three years after payment, liquidation, settlement, or a court finding. That rule should not be used to tell an identity-theft victim to wait three years. A false account should be investigated and corrected or deleted if it cannot be verified. (Credit Information Corporation (CIC))

Accepting an OTP as conclusive proof

Ask which mobile number received the OTP, when that number was registered, which device completed the application, and where the loan was disbursed. An OTP proves that a code was generated and entered; it does not necessarily identify the human being who controlled the compromised account.

Applying repeatedly for new credit during the dispute

Multiple applications may create additional inquiries and rejections before the incorrect account is removed. Where possible, finish the correction and obtain a fresh report before making an important housing, vehicle, business, or personal-loan application.

Frequently Asked Questions

Can I remove a loan I never took without paying it?

Yes. You should dispute the account as unauthorized and require the lender to verify that you applied for, consented to, and received the loan. If the information cannot be verified or proven, RA 9510 requires deletion of the disputed information. (Credit Information Corporation (CIC))

Is an affidavit of denial enough to win the dispute?

An affidavit is useful, especially when it gives a detailed timeline, but it is stronger when supported by objective evidence such as travel records, account statements, telecom records, genuine signature samples, lost-ID reports, and proof that the disbursement account was not yours.

How long does a CIC identity-theft dispute take?

The law contains a five-working-day verification rule, while CIC procedures classify cases into approximately 3-, 7-, or 20-working-day investigation periods, with possible extensions. Complex identity-theft cases often take longer from initial complaint to final correction because the lender must retrieve records and submit updated data.

What if the lender says the loan was verified by selfie and OTP?

Request the actual selfie or video, mobile number, SIM-registration information available to the lender, device and IP logs, time stamps, email address, uploaded IDs, and disbursement account. Point out every mismatch. A verification process can be defeated by stolen IDs, account takeover, SIM swapping, or manipulated images.

Can I file a CIC dispute using an old credit report?

The CIC currently requires a report with a 14-digit TRN that is generally no more than 30 days old. Obtain a new report or ask the report provider for the TRN before filing. (Credit Information Corporation (CIC))

Will a police blotter automatically remove the loan?

No. A police or NBI report supports your claim but does not itself alter CIC data. You must still dispute the account with the reporting lender and through the CIC process.

Can collectors continue contacting me while the loan is disputed?

Tell the lender and collection agency in writing that the debt is disputed because of identity theft. Demand that collection activity be suspended while the institution verifies the account. Keep records of abusive, deceptive, threatening, or public-shaming conduct for possible regulatory and privacy complaints.

What if the loan proceeds went to a GCash, Maya, or bank account that is not mine?

Ask the lender to identify the destination account, account holder, transaction reference number, and date of disbursement. This is often one of the strongest pieces of evidence that you did not receive or benefit from the loan. Law enforcement may seek subscriber and transaction records through the proper legal process.

Will my credit score improve after the fraudulent account is removed?

Removing a delinquent account may improve the information used to assess your creditworthiness, but the exact change depends on the scoring model and the rest of your credit history. Obtain a new report after correction rather than relying only on the lender’s assurance.

Can I claim damages for a false loan in my credit report?

Potential remedies may arise under RA 9510, the Data Privacy Act, consumer-protection laws, and general civil-law principles when inaccurate or unauthorized information causes proven loss. Useful evidence includes rejected applications, higher financing costs, lost business opportunities, collection harassment, expenses incurred in correcting the record, and medical or other proof of resulting harm. (Credit Information Corporation (CIC))

Key Takeaways

Do not pay, restructure, or acknowledge a loan you genuinely never took.
Dispute the account simultaneously with the reporting lender and through the CIC.
Use a recent CIC credit report with a 14-digit TRN.
Demand the complete application, identity-verification, OTP, device, and disbursement records.
Preserve written evidence and respond to CIC communications within five working days.
Report credible identity theft to the NBI or PNP anti-cybercrime authorities.
Escalate bank and BSP-supervised institution complaints to the BSP; escalate lending and financing company complaints to the SEC.
Use Data Privacy Act rights to demand access, correction, blocking, and notification of prior recipients.
Verify the correction by obtaining a fresh credit report.
A false identity-theft account should be corrected or deleted—not merely left to expire as ordinary negative credit information.