Quick answer

If someone used your name, government ID, selfie, mobile number, bank or e-wallet details, or other personal information to obtain an online loan without your authority, you should dispute the account immediately. A lender cannot establish a valid loan against you merely because its records contain your identity details. Under Article 1318 of the Civil Code, consent is essential to a contract. The lender may still investigate whether you actually applied, authorized another person, received the proceeds, or later ratified the transaction, so the result depends on the application records and other evidence.

Do not pay, promise to pay, or sign a restructuring agreement simply to stop collection calls. Such actions may complicate your denial. Instead:

Secure your accounts and preserve the evidence.
Send the lender a written identity-theft dispute.
Demand the application and transaction records.
Report the incident to law enforcement.
Correct any affected credit record.
Escalate privacy, lending, or financial-consumer violations to the proper regulator.

These remedies may proceed at the same time. A police or NBI report does not automatically remove the loan, while a complaint to a regulator is not a substitute for reporting the suspected offender.

What counts as identity theft in an online loan

Common situations include:

Someone submits your ID, photograph, signature, address, or employment information in a loan application.
A fraudster takes over your mobile, email, bank, or e-wallet account and uses it to apply for or receive a loan.
A relative, partner, employee, agent, or acquaintance applies in your name without authority.
Your information is obtained through phishing, a fake lending page, a stolen phone, a data leak, or unauthorized access to an app.
A lender or its agent creates, alters, or processes an application that you did not make.
You are falsely listed as the borrower when you were only a contact person, reference, or recipient of collection messages.

Giving someone a copy of your ID for one purpose does not automatically authorize that person to borrow in your name. However, voluntarily giving another person your password, one-time password, signature, selfie verification, or authority to transact may create factual and legal issues. Be completely accurate when reporting what happened.

Are you legally required to pay the fraudulent loan?

Ordinarily, no valid loan obligation arises against a person who did not consent to the loan. The Civil Code, particularly Article 1318, requires consent, a certain object, and cause for a contract to exist.

A lender’s internal record is not necessarily conclusive proof that you consented. Relevant evidence may include:

The application form and loan agreement;
Electronic signatures and consent records;
Selfies, video verification, or liveness-check results;
Mobile numbers and email addresses used;
One-time-password and authentication logs;
Device identifiers, IP addresses, dates, and timestamps;
The bank or e-wallet account that received the proceeds;
Call recordings, chat records, and uploaded documents; and
Evidence that you used, withdrew, transferred, or benefited from the funds.

The position may be different if you truly applied for the loan, knowingly allowed someone to apply for you, received and retained the proceeds, or later clearly adopted the transaction. Disputes involving shared phones, joint accounts, relatives, employees, or authorized representatives require close examination of the facts.

Immediate steps to take

1. Secure your phone, email, bank, and e-wallet accounts

Change passwords using a trusted device. Enable multi-factor authentication, sign out other sessions, and revoke unfamiliar devices or app permissions. Contact your mobile provider if your SIM was lost, replaced, or unexpectedly lost service.

Notify the bank or e-wallet provider immediately if an account was accessed or used without authority. Ask it to preserve login, transfer, device, recipient, and verification records. If an access device was lost or stolen, prompt notice is especially important: Section 15 of the Access Devices Regulation Act addresses liability following notice to the issuer.

Do not delete the lending app, emails, or messages until you have preserved the evidence you may need.

2. Preserve a complete evidence file

Save original electronic files where possible, not only cropped screenshots. Preserve:

Collection texts, emails, call logs, voicemails, and chat conversations;
The lender’s name, app name, website, telephone numbers, email addresses, and payment instructions;
Account, reference, loan, or ticket numbers;
The alleged principal, charges, due dates, and disbursement details;
Screenshots of the app listing and its requested permissions;
Security alerts, password-reset notices, and SIM-replacement records;
Copies of IDs or photographs believed to have been misused;
Bank and e-wallet statements showing that you did not receive the proceeds, if applicable;
Any unknown credit-report entry;
Written disputes and proof of delivery; and
Names and affidavits of witnesses with personal knowledge.

Keep an incident timeline stating when you learned of the loan, whom you contacted, and what each party said. Preserve metadata and avoid editing original files.

3. Dispute the loan with the lender in writing

Send the lender and, if available, its data protection officer a dated written notice stating that:

You did not apply for, authorize, sign, or receive the identified loan;
Your identity or personal data appears to have been used without authority;
You dispute the entire account and do not acknowledge the debt;
Collection activity and adverse credit reporting should be suspended while the dispute is investigated;
Your data should not be disclosed to contacts or other third parties for collection;
Inaccurate information must be corrected, blocked, or removed as allowed by law; and
Relevant records must be preserved.

Ask for copies of the application, agreement, disclosures, authentication evidence, KYC materials, contact details used, disbursement destination, transaction history, and records showing the supposed consent. Request a written investigation result and confirmation of any account closure or correction.

You may redact information that the lender does not need, but it may reasonably require enough information to verify your identity. Use the lender’s official contact details, not a link supplied by an unknown collector.

4. Report the suspected crime promptly

Using another person’s identifying information through a computer system may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on the evidence, access-device fraud, estafa, falsification, unauthorized access, or offenses involving financial accounts may also be investigated. The precise charge is for investigators and prosecutors to determine.

You may seek investigative assistance from:

The NBI Cybercrime Division or an appropriate NBI regional or district office;
The Philippine National Police Anti-Cybercrime Group; or
The police station with jurisdiction, particularly if threats, extortion, or immediate safety risks are involved.

Bring a government ID, a clear narrative or affidavit, the lender’s details, copies of your written dispute, transaction records, and the preserved electronic evidence. Obtain and keep the complaint, blotter, or reference number.

Report quickly even if the offender is unknown. Electronic logs may be retained only for limited periods, and investigators may need lawful process to obtain them.

Data-privacy remedies

The Data Privacy Act of 2012 protects personal information against unauthorized processing and provides rights that include access, rectification, objection, erasure or blocking, damages, and filing a complaint. These rights are subject to lawful grounds for retaining evidence, complying with legal duties, or pursuing legitimate claims.

You may require the lender or other personal information controller to explain:

What personal data it holds about you;
Where the data came from;
Why and on what legal basis it was processed;
Who received or accessed it;
How long it will be retained; and
What correction, restriction, or deletion measures it will take.

The National Privacy Commission explains the right to rectify and the right to erasure or blocking. Erasure is not always immediate or absolute; an organization may retain information needed to investigate fraud, comply with law, or defend a legal claim. In that situation, ask that the disputed data be restricted, clearly marked as contested, and withheld from collection or credit reporting except where legally necessary.

Filing a complaint with the National Privacy Commission

Before filing an ordinary NPC complaint, you generally must first notify the respondent in writing and give it an opportunity to act. If it takes no timely or appropriate action, or does not respond within 15 calendar days after receiving your written notice, you may proceed and attach proof of that notice. Exceptions and waiver grounds are governed by the NPC rules.

The NPC requires a filled-out and notarized complaint-assisted form or a verified complaint, together with supporting evidence and, when applicable, witness affidavits. Filing fees may apply, subject to stated exemptions or waiver. Review the current NPC complaint mechanics and the 2021 NPC Rules of Procedure, as amended before filing.

A privacy complaint should identify the specific processing complained of—such as collecting, using, disclosing, retaining, or refusing to correct your data—not merely state that identity theft occurred.

Complaints against the lender or financial institution

SEC-regulated lending or financing company

Lending and financing companies and their online lending platforms generally fall under Securities and Exchange Commission supervision. Check the company’s exact corporate name, SEC registration, and authority to operate; an app name may differ from the legal company name.

After raising the dispute with the company, you may use the SEC’s complaint guidance for lending and financing companies or the SEC iMessage system. Submit one properly completed complaint per respondent and attach the evidence and a valid government-issued ID, as required by the SEC’s instructions.

An SEC complaint is particularly relevant if the company is unregistered or unauthorized, fails to investigate, continues collecting a disputed debt, uses unfair collection methods, or reports information it knows is disputed without appropriate action.

Bank, e-wallet issuer, or other BSP-supervised institution

First complain through the institution’s own consumer-assistance mechanism. If it remains unresolved, escalate the matter through the BSP Consumer Assistance Mechanism. The BSP mechanism applies to BSP-supervised institutions; it does not replace an SEC complaint against an ordinary lending company.

The Financial Products and Services Consumer Protection Act recognizes rights to fair treatment, protection of assets against fraud and misuse, data privacy, and timely complaint handling.

Cooperative or other specially regulated lender

A cooperative lender may fall under the Cooperative Development Authority, while other providers may be supervised by another financial regulator. Identify the legal entity behind the loan before choosing the complaint channel.

Correcting your credit record

Obtain your own Credit Information Corporation credit report through an authorized CIC channel. If the fraudulent loan appears, use the CIC’s Online Dispute Resolution System and separately notify the entity that submitted the information.

Under the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. Provide the identity-theft report, your lender dispute, proof that the proceeds went elsewhere if available, and any written acknowledgment from the lender.

A credit dispute does not itself decide criminal responsibility or conclusively invalidate the alleged loan. Continue pursuing the lender’s investigation and the appropriate regulatory or law-enforcement remedies.

If collectors contact your relatives, employer, or friends

Record the caller’s name, company, number, date, words used, and persons contacted. Preserve screenshots or statements from recipients.

Tell the collector in writing that the debt is disputed because of identity theft and require communications to be directed to you through a designated channel. Do not allow threats, humiliation, publication of your information, impersonation of authorities, or unauthorized disclosure to pressure you into payment.

NPC rules on loan-related data processing restrict online lenders from harvesting phone and social-media contact lists for debt collection. Official guidance is available in the NPC’s advisory on online lenders and borrowers’ contact lists. Unfair collection by an SEC-regulated lending or financing company may also be reported to the SEC.

Common mistakes to avoid

Paying a “small amount” or agreeing to installments before obtaining advice;
Saying “my loan” merely for convenience when you deny applying for it;
Communicating only by phone and keeping no written record;
Sending additional IDs or selfies to an unverified collector;
Clicking links or installing remote-access apps supplied by the caller;
Deleting messages, uninstalling the app, or resetting the phone before preserving evidence;
Publicly accusing a named person without adequate proof;
Filing only a police blotter and assuming the lender or credit record will update automatically;
Complaining to the wrong regulator because the app name was mistaken for the lender’s legal name;
Ignoring a summons, subpoena, demand letter, or court paper; or
Missing the NPC’s written-notice requirement before filing a privacy complaint.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, complaint, or court order;
Money is being taken from your bank, payroll, or e-wallet account;
The lender claims to have a video, electronic signature, OTP, or disbursement record connecting you to the loan;
You shared credentials or allowed another person to use your account;
Several loans or substantial amounts are involved;
A collector threatens arrest, violence, public shaming, or contact with your employer;
Your government ID, biometrics, or financial account remains compromised;
The lender refuses to provide records or continues adverse reporting after receiving strong evidence; or
You are being treated as the suspect rather than the victim.

The Public Attorney’s Office may assist qualified indigent persons, subject to its requirements. An Integrated Bar of the Philippines legal-aid office or a local law-school legal-aid clinic may also be able to help.

Frequently asked questions

Can I be arrested simply for not paying the disputed loan?

Nonpayment of a genuine debt, by itself, is not imprisonment for debt. Identity theft and fraud allegations are different: criminal liability depends on evidence of a criminal act and participation in it. A collector cannot lawfully arrest you. Do not ignore a genuine subpoena, warrant, or court process.

Should I pay first and dispute later?

Usually, that is unwise when you completely deny the loan. Payment, a promise to pay, or restructuring may be presented as acknowledgment. If there is an immediate risk such as an unauthorized automatic debit, contact the financial institution and obtain legal advice before acting.

Is an affidavit of denial enough?

It is useful but not conclusive. Combine it with objective evidence: account records, the destination of the proceeds, device and authentication information, messages, security alerts, and proof of your prompt written dispute.

Can I demand that the lender delete everything immediately?

You may request rectification, blocking, erasure, or destruction when the legal conditions are met. The lender may retain limited records required by law or genuinely needed to investigate and defend the dispute. Ask it to explain the legal basis and retention period and to stop using disputed data for collection or adverse reporting where appropriate.

What if the money entered my account without my knowledge?

Notify the institution immediately, do not spend or transfer the funds on instructions from an unknown person, and ask that the amount be secured while the transaction is investigated. How the funds entered and what happened afterward will be important evidence.

What if a family member made the application?

A family relationship alone does not create authority to borrow in your name. Report the facts accurately. Do not conceal consent, shared credentials, receipt of proceeds, or later approval, because those facts can materially affect civil and criminal liability.

Can I recover damages?

Potential remedies may include indemnity under data-privacy law or damages under applicable civil law, but recovery is not automatic. You must establish the violation, the responsible party, the legally recognized injury, and the required connection between them. Obtain individualized legal advice before filing a damages action.

Official references

Disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The proper remedy depends on the loan documents, authentication records, destination of the proceeds, conduct of the parties, and identity of the regulated entity. Official sources and procedures were checked as of September 4, 2026; verify current agency forms, fees, addresses, and filing instructions before submitting a complaint.