A Legal Article in the Philippine Context

I. Introduction

The growth of online lending in the Philippines has created new convenience for borrowers, but it has also produced serious legal problems: identity theft, unauthorized loan applications, abusive debt collection, data privacy violations, public shaming, threats, and harassment of contacts. Many victims discover the problem only when they receive collection calls for a loan they never applied for, when friends and relatives are contacted by collectors, or when their name, photo, identification card, or mobile number is used in an online lending application without consent.

The legal issues usually involve two connected situations:

First, identity theft in an online loan application, where a person’s personal information is used by another to obtain a loan, register an account, verify identity, or impersonate the victim.

Second, collection harassment, where online lending companies, collection agents, or third-party collectors use abusive or unlawful methods to pressure payment, including threats, repeated calls, defamatory messages, unauthorized contact with relatives or employers, and misuse of the borrower’s phone contacts.

In the Philippine legal context, these acts may implicate the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, the Lending Company Regulation Act, the Consumer Act, rules and regulations of the Securities and Exchange Commission, and other related laws. Depending on the facts, liability may be criminal, civil, administrative, or regulatory.

II. Nature of the Problem

Online loan identity theft and collection harassment often occur because many online lending platforms collect sensitive personal information through mobile applications, online forms, uploaded identification documents, facial verification, device permissions, contact lists, and bank or e-wallet data.

The problem may arise in several ways:

A person’s valid ID is stolen or copied and used to apply for a loan.
A scammer uses another person’s name, phone number, or email address in an online loan application.
A borrower lists another person as a reference without consent.
A lending app accesses the borrower’s phone contacts and sends messages to contacts.
A victim’s photo or social media account is used to create a fake loan profile.
A collector pressures the victim to pay a loan that the victim never obtained.
A borrower is threatened with public shaming, criminal prosecution, arrest, or harm.
A collector sends defamatory messages to family members, friends, co-workers, or employers.
A lending company continues to process personal data despite a dispute of identity theft.
A person’s personal information is sold, shared, or used for repeated loan attempts.

The legal response depends on identifying who committed the act: the identity thief, the online lending platform, the collection agency, the individual collector, or all of them.

III. Identity Theft in Online Loan Applications

A. Meaning of Identity Theft

Identity theft occurs when a person uses another person’s identifying information without authority, usually to obtain a benefit, commit fraud, evade liability, or cause harm.

In online loan applications, identifying information may include:

full name;
date of birth;
address;
mobile number;
email address;
government-issued ID;
SSS, GSIS, TIN, PhilHealth, or UMID information;
passport or driver’s license details;
photo or selfie;
biometric data;
digital signature;
e-wallet or bank account details;
social media profile;
employment information;
contact list;
emergency contact details.

Identity theft is especially harmful because the victim may be treated as the debtor even though the victim did not receive the loan proceeds, did not consent to the loan, and did not sign or submit the application.

B. Common Methods

Identity theft in online lending may be committed through:

stolen wallets or lost IDs;
screenshots of IDs sent through messaging apps;
phishing links;
fake job applications;
fake SIM registration schemes;
compromised email or social media accounts;
unauthorized access to mobile phones;
use of old loan applications;
data breaches;
insider misuse by employees or agents;
fake references;
falsified selfies or manipulated images.

A victim should not assume that the lending company’s record is correct simply because the company has a copy of an ID. IDs can be copied, altered, or submitted without authority.

IV. Legal Character of an Unauthorized Online Loan

A loan requires consent. If a person did not apply for the loan, did not authorize another person to apply, did not receive the proceeds, and did not agree to the terms, the alleged loan may be denied as to that person.

Under basic civil law principles, consent is essential to a contract. A person whose identity was used without authority may argue that no valid loan contract exists between the person and the lender.

However, the issue is factual. The lender may claim that the application was verified through the app, OTP, ID submission, facial recognition, device records, e-wallet transfer, or other digital evidence. The victim must therefore gather evidence showing impersonation, lack of consent, non-receipt of proceeds, or misuse of personal information.

V. Possible Criminal Liability for Identity Theft

Identity theft in online loan applications may involve several criminal offenses, depending on the facts.

A. Computer-Related Identity Theft

Where the identity theft is committed through an information and communications technology system, online platform, mobile application, account, or digital device, it may fall under cybercrime-related identity theft.

This may include unauthorized acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person, whether natural or juridical, without right.

The online nature of the loan application is important because the use of a digital platform may bring the act within cybercrime laws.

B. Estafa or Swindling

If the offender uses another person’s identity to obtain money from a lending company, the act may constitute estafa if the required elements are present, such as deceit, damage, and fraudulent inducement.

The lending company may be the direct party defrauded, while the identity theft victim may also suffer damage to reputation, credit standing, privacy, and peace of mind.

C. Falsification

If the offender fabricates signatures, alters identification documents, submits false certificates, uses forged documents, or creates fake digital forms, the act may involve falsification of public, official, commercial, or private documents, depending on the document involved.

Government-issued IDs are particularly sensitive because misuse may implicate falsification or use of falsified documents.

D. Use of Fictitious Name or Concealment of True Name

If the offender assumes another person’s name to evade liability or commit fraud, related offenses concerning false identity may be considered.

E. Unjust Vexation, Grave Threats, or Other Offenses

If the identity thief or collector harasses the victim through repeated messages, threats, or intimidation, other offenses may arise depending on the words used and the conduct committed.

F. Cyber Libel

If collectors, scammers, or other persons post or send defamatory accusations online or through electronic means, such as calling the victim a scammer, thief, criminal, or intentional non-payer, cyber libel may be considered if the elements are present.

VI. Data Privacy Issues

Identity theft in online loan applications almost always involves data privacy concerns.

The Data Privacy Act protects personal information and sensitive personal information. Lending companies and collection agencies that collect, process, store, share, or disclose personal data must have lawful basis, observe transparency, use data only for legitimate purposes, protect data security, and respect the rights of data subjects.

A. Personal Information and Sensitive Personal Information

Personal information includes data from which a person’s identity is apparent or can be reasonably ascertained.

Sensitive personal information includes information about age, marital status, health, education, government-issued identifiers, licenses, tax returns, and other sensitive categories.

Online loan applications usually involve both personal and sensitive personal information.

B. Consent and Lawful Processing

A lender may process a borrower’s data to evaluate and service a loan, but processing must still be lawful, fair, and proportionate.

A victim of identity theft may challenge the lender’s continued processing of personal data if the victim did not apply for the loan and did not give consent.

C. Unauthorized Access to Contact Lists

Many abusive online lending cases involve app permissions that allow access to a borrower’s phone contacts. Even where a borrower grants permission, the lender’s use of contacts for public shaming, intimidation, or pressure may be excessive, unfair, or unlawful.

Contact persons are also data subjects. A lending company does not automatically gain the right to harass or disclose debt information to all contacts merely because their numbers appear in the borrower’s phone.

D. Disclosure to Third Parties

Disclosure of a person’s debt, alleged debt, or identity theft issue to relatives, friends, employers, co-workers, or social media contacts may violate privacy rights if not authorized or legally justified.

Collectors should not disclose unnecessary personal information to third parties. At most, a legitimate collector may verify contact information or request that the borrower communicate, but threatening, shaming, or revealing alleged debt details may be legally problematic.

E. Data Subject Rights

A victim may invoke data subject rights, such as:

right to be informed;
right to access;
right to object;
right to erasure or blocking;
right to rectification;
right to damages;
right to file a complaint.

A victim may demand that the lender provide information on what data it holds, where it obtained the data, how the loan was approved, where the proceeds were sent, who accessed the account, and to whom the data was disclosed.

VII. Collection Harassment

A. Meaning of Collection Harassment

Collection harassment refers to abusive, oppressive, threatening, defamatory, deceptive, or unfair debt collection practices.

Not every collection effort is unlawful. A lender has the right to collect a legitimate debt. However, collection must be done lawfully, respectfully, and within regulatory limits.

Harassment may include:

repeated calls at unreasonable hours;
threats of arrest without legal basis;
threats of imprisonment for nonpayment of ordinary debt;
threats of physical harm;
threats to shame the borrower online;
contacting the borrower’s employer to embarrass the borrower;
sending defamatory messages to contacts;
posting the borrower’s photo as a scammer;
using obscene or abusive language;
pretending to be a lawyer, police officer, prosecutor, or court sheriff;
sending fake subpoenas, fake warrants, or fake court notices;
disclosing the loan to third parties;
collecting from a person who is only a reference and not a debtor or guarantor;
collecting from a victim of identity theft despite notice of dispute;
threatening to file fabricated criminal cases;
misrepresenting the amount due;
adding unlawful charges;
refusing to validate the debt.

B. Debt Collection Is Not a License to Abuse

A creditor may demand payment, send reminders, file a civil action, submit lawful collection notices, or pursue remedies under the contract. But it may not use threats, humiliation, privacy invasion, or deception.

Debt collection must remain within law. The fact that a person owes money does not strip that person of dignity, privacy, and legal rights.

VIII. Threats of Arrest and Criminal Charges

One of the most common forms of harassment is the threat that the borrower or alleged borrower will be arrested or imprisoned for nonpayment.

As a general rule, mere inability to pay a debt is not a crime. The Philippine Constitution prohibits imprisonment for debt. However, criminal liability may arise if the facts involve fraud, bouncing checks, falsification, identity theft, or other criminal acts.

Collectors often blur this distinction. They may threaten criminal prosecution to pressure payment even when the matter is purely civil. Such threats may be deceptive or abusive.

A legitimate criminal case requires proper complaint, investigation, filing in court, and judicial process. A collector cannot order arrest. Only a court may issue a warrant of arrest under proper legal standards.

Fake threats of police action, warrants, subpoenas, or public prosecution may expose the collector to liability.

IX. Harassment of References and Contacts

Many victims are not borrowers at all. They may be listed as references, emergency contacts, relatives, co-workers, or phone contacts. Collectors sometimes pressure these persons to pay or force the borrower to pay.

A reference is generally not liable for the loan unless the reference separately agreed to be a co-maker, guarantor, surety, or debtor. Merely being listed as a reference does not make a person legally responsible for payment.

Harassing references may violate:

privacy rights;
data protection rules;
debt collection regulations;
civil law protections against abuse of rights;
criminal laws on threats, unjust vexation, or defamation, depending on the acts.

A reference may demand that collectors stop contacting them and may file complaints if harassment continues.

X. Public Shaming and Defamation

Online lenders or collectors sometimes send messages to contacts accusing the borrower of being a scammer, thief, fraudster, criminal, or intentional evader. Some threaten to post the borrower’s photo or ID online.

Such conduct may constitute defamation or cyber libel if the statements are false, malicious, and made publicly or through electronic means to third persons.

Even where a debt exists, collectors must be careful. Saying “please ask the borrower to contact us” is different from saying “this person is a criminal and scammer.” The latter may damage reputation and create legal liability.

Public posting of a borrower’s photo, ID, address, or alleged debt may also violate data privacy law.

XI. Administrative Regulation of Online Lending Companies

Online lending companies are subject to regulation. Lending companies must generally be registered and authorized to operate. Online lending platforms must comply with rules on corporate registration, lending operations, disclosure, fair collection, data privacy, and consumer protection.

Regulators may act against companies that engage in abusive collection, unauthorized lending, deceptive practices, or privacy violations.

Administrative sanctions may include:

fines;
suspension;
revocation of registration or authority;
takedown of applications;
cease-and-desist orders;
referral for criminal prosecution;
disqualification of officers;
other regulatory penalties.

A victim should check whether the lending company is registered and whether it has authority to operate. However, even an unregistered or illegal lender may still cause harm, and complaints may be filed with law enforcement and regulators.

XII. Liability of Lending Companies for Collection Agents

A lending company may not avoid responsibility simply by saying that harassment was done by a third-party collection agency. If the collector acted on behalf of the lender, the lender may still face administrative, civil, or data privacy liability.

Companies that outsource collection remain responsible for choosing lawful agents, supervising their conduct, protecting borrower data, and preventing abusive practices.

Possible responsible parties include:

the online lending company;
its directors and officers;
employees involved in approving or collecting the loan;
third-party collection agencies;
individual collectors;
app operators;
data processors;
identity thieves or scam applicants.

XIII. Civil Liability

Victims may have civil remedies.

A. Damages for Abuse of Rights

Philippine civil law recognizes that rights must be exercised with justice, honesty, and good faith. Even a creditor with a valid claim may be liable if it abuses its right by using oppressive or unlawful means.

B. Damages for Privacy Violations

Unauthorized use, processing, or disclosure of personal data may support claims for damages.

C. Damages for Defamation

If defamatory statements are made to third persons, the victim may seek damages.

D. Damages for Emotional Distress, Reputation Harm, and Business Loss

Collection harassment may cause anxiety, humiliation, job problems, family conflict, business damage, and reputational injury. These may be considered in appropriate civil claims if proven.

E. Injunctive Relief

In proper cases, a victim may seek court relief to stop harassment, prevent disclosure, or restrain unlawful acts.

XIV. Criminal Liability for Collectors

Depending on the facts, collection harassment may involve criminal liability.

Possible offenses include:

grave threats;
light threats;
unjust vexation;
coercion;
slander or oral defamation;
libel or cyber libel;
identity theft;
illegal access or misuse of data;
falsification;
usurpation of authority, if pretending to be law enforcement;
violation of data privacy laws;
other special law offenses.

The exact charge depends on the words used, the medium, the target, whether threats were conditional, whether third persons received the statements, and whether data was unlawfully processed or disclosed.

XV. When the Victim Never Borrowed

If the person did not apply for the loan, the situation should be treated as identity theft and disputed debt.

The victim should avoid admitting liability. The victim should not make partial payment merely to stop harassment unless advised by counsel, because payment may be misinterpreted as acknowledgment of the debt.

The victim should demand proof of the loan, including:

loan application form;
date and time of application;
device used;
IP logs, if available;
mobile number used;
email used;
ID submitted;
selfie or biometric verification;
OTP verification records;
loan agreement;
disbursement account;
recipient of loan proceeds;
collection records;
consent records;
privacy notice and authorization relied upon.

If the lender cannot prove that the victim applied for and received the loan, collection should stop.

XVI. When the Victim Is Merely a Reference

If a person is only a reference, the person is not automatically liable for payment. A reference may confirm contact details or personal knowledge, but does not assume the debt unless there is a separate legal undertaking.

A reference should tell the collector:

they are not the borrower;
they did not guarantee the loan;
they do not consent to repeated contact;
they demand deletion or blocking of their personal data if unlawfully processed;
further harassment will be reported.

A reference may file complaints if collectors continue to threaten or shame them.

XVII. When the Borrower Actually Owes the Loan

Even where the borrower actually owes money, the lender must still collect lawfully. The borrower should separate two issues:

the existence of the debt; and
the legality of the collection method.

A valid debt does not justify illegal collection. A borrower may negotiate, request a statement of account, verify charges, ask for a payment plan, or settle the obligation, while still complaining against harassment and privacy violations.

Borrowers should document abusive collection even if they intend to pay.

XVIII. Evidence to Gather

Evidence is essential. Victims should preserve:

screenshots of text messages;
call logs;
voice recordings, where lawfully obtained and safely preserved;
chat messages;
emails;
social media posts;
names and numbers of collectors;
company name and app name;
loan account number;
demand letters;
fake legal notices;
threats sent to contacts;
messages received by family, friends, or employer;
proof of identity theft;
proof of non-receipt of loan proceeds;
bank or e-wallet records;
police blotter;
affidavits from contacted persons;
copies of IDs allegedly used;
complaints filed with agencies.

Screenshots should show dates, times, sender details, phone numbers, account names, and full message threads when possible.

XIX. Immediate Steps for Victims of Identity Theft

A person whose identity was used in an online loan should act promptly.

Step 1: Do Not Admit the Debt

Do not say “I will pay” or “I borrowed” if untrue. State clearly that the debt is disputed because of identity theft.

Step 2: Demand Validation

Ask the lender to provide proof that the victim personally applied for and received the loan.

Step 3: Demand Suspension of Collection

Request that collection be suspended while the identity theft dispute is investigated.

Step 4: Demand Data Protection

Ask the lender to stop processing, sharing, or disclosing personal data except as necessary to investigate the fraud.

Step 5: Secure Accounts

Change passwords, secure email, secure social media, protect e-wallets, and check whether SIM or banking information was compromised.

Step 6: Execute an Affidavit

Prepare an affidavit of denial or identity theft stating the facts: the victim did not apply, did not authorize anyone, did not receive proceeds, and discovered the matter only through collection.

Step 7: File a Police Report or Blotter

Report the identity theft and harassment to the proper police station or cybercrime unit.

Step 8: Notify Relevant Agencies

File complaints with appropriate regulators and enforcement agencies.

Step 9: Inform Contacts

If contacts are being harassed, inform them not to pay and ask them to preserve messages.

Step 10: Consult Counsel

Legal advice is especially important if large amounts are involved, if there are threats of criminal cases, or if the victim’s employment or reputation is affected.

XX. Complaints and Where to File

Depending on the facts, complaints may be filed with several offices.

A. National Privacy Commission

For unauthorized processing, disclosure, access to contacts, data misuse, identity theft involving personal data, and privacy violations.

B. Securities and Exchange Commission

For abusive online lending practices, unregistered lending companies, unfair debt collection, violations by lending companies, and regulatory complaints against online lending apps.

C. Philippine National Police Anti-Cybercrime Group

For cyber identity theft, online threats, cyber harassment, cyber libel, phishing, and other cyber-related offenses.

D. National Bureau of Investigation Cybercrime Division

For cybercrime complaints, identity theft, online fraud, and related digital evidence investigation.

E. Prosecutor’s Office

For criminal complaints supported by affidavits and evidence.

F. Barangay

For local harassment, threats, or disputes where barangay processes are applicable. However, serious cybercrime or offenses involving parties in different cities may go directly to law enforcement or prosecutors.

G. Department of Trade and Industry

For consumer complaints involving unfair or deceptive practices, depending on the nature of the entity and transaction.

H. Courts

For civil cases, injunctions, damages, or criminal proceedings once filed by prosecutors.

XXI. Sample Demand to Stop Collection Due to Identity Theft

A victim may send a written notice substantially as follows:

“I dispute the alleged loan account under my name. I did not apply for this loan, did not authorize anyone to apply on my behalf, and did not receive the loan proceeds. I demand that you provide proof of the application, identity verification, consent, loan agreement, and disbursement of proceeds. Pending investigation, I demand that you stop all collection activities against me and stop contacting my relatives, friends, employer, and other third parties. I also object to any further unauthorized processing, disclosure, or sharing of my personal information.”

This should be sent through a traceable channel, such as email, official support ticket, registered mail, or documented chat.

XXII. Sample Notice from a Reference or Contact

A person being contacted as a reference may state:

“I am not the borrower, co-maker, guarantor, or surety of this loan. I did not consent to repeated collection calls or messages. Do not contact me again regarding this account, and do not disclose further personal or debt information to me. Any further harassment or unauthorized use of my personal information will be reported to the proper authorities.”

The reference should preserve all messages and call records.

XXIII. Role of Affidavits

Affidavits are useful in formal complaints. A victim may prepare:

affidavit of identity theft;
affidavit of denial of loan application;
affidavit of non-receipt of proceeds;
affidavit of harassment;
affidavits of relatives or contacts who received messages;
affidavit of account ownership for bank or e-wallet records;
affidavit explaining lost ID or data breach.

The affidavit should be factual, chronological, and supported by attachments.

XXIV. Important Facts to Include in an Affidavit

An affidavit should include:

complete name and identifying details of the victim;
statement that the victim did not apply for the loan;
statement that the victim did not authorize anyone to apply;
when and how the victim learned of the alleged loan;
names of lending app or company;
phone numbers, emails, or collector identities used;
exact messages received;
persons contacted by collectors;
proof that the victim did not receive proceeds;
any lost ID, phishing incident, or suspected source of identity theft;
steps taken to dispute the debt;
harm suffered;
request for investigation and legal action.

XXV. Legal Effect of Paying a Disputed Loan

Victims sometimes pay a small amount to stop harassment. This may be understandable, but legally risky.

Payment may be interpreted by the lender as acknowledgment of the debt. It may weaken the victim’s position, especially if the victim later denies the loan.

If payment is made under pressure, the victim should document that the payment was made under protest and without admission of liability. Legal advice is recommended before paying a loan believed to be fraudulent.

XXVI. Illegal Interest, Fees, and Charges

Some online lenders impose excessive interest, penalties, service fees, processing fees, rollover fees, or hidden charges. The legality of these charges depends on applicable law, disclosure, usury-related principles, lending regulations, and whether the borrower freely agreed to them.

Even when a loan is valid, unlawful or unconscionable charges may be challenged. Borrowers may demand a full statement of account showing:

principal;
interest rate;
service fee;
processing fee;
penalties;
payments made;
computation of balance;
legal basis for charges.

Harassment often accompanies inflated charges. The borrower should verify the amount before paying.

XXVII. Fake Legal Notices and Misrepresentation

Collectors sometimes send messages styled as:

“final court notice”;
“warrant warning”;
“barangay subpoena”;
“police blotter filing”;
“cybercrime case approved”;
“legal department arrest notice”;
“NBI record notification.”

Many of these are scare tactics. A real subpoena, warrant, or court order has formal identifying details, issuing authority, case number, signatures, and official service procedures.

Misrepresenting oneself as a lawyer, prosecutor, police officer, sheriff, or court employee may create additional liability.

Victims should not panic. They should preserve the notice, verify with the issuing office, and consult counsel.

XXVIII. SIM Cards, Mobile Numbers, and Identity Theft

Online loan scams often involve mobile numbers. A victim’s number may be used in applications, or a scammer may use a SIM registered under another identity.

Victims should:

secure their SIM and phone;
report unauthorized SIM activity to the telecom provider;
check whether their number was used for OTPs;
preserve SMS records;
deactivate compromised numbers if necessary;
strengthen account security;
monitor e-wallet and banking accounts.

If a loan was verified through OTP sent to the victim’s number, the lender may argue that the victim had control of the application. The victim must then explain whether the phone was stolen, SIM was compromised, OTP was fraudulently obtained, or device access was unauthorized.

XXIX. E-Wallets and Disbursement Accounts

Online loans are often released through e-wallets or bank accounts. A key question in identity theft cases is: Where did the money go?

The victim should demand proof of disbursement. If the proceeds were sent to an account not belonging to the victim, this strongly supports the identity theft claim.

If proceeds were sent to an account under the victim’s name but the victim did not receive them, further investigation may be needed. The victim should check whether an e-wallet or bank account was opened fraudulently using the victim’s identity.

XXX. Employer Harassment

Collectors sometimes contact employers and claim that the borrower is a fraudster or delinquent debtor. This may cause embarrassment, disciplinary action, or job loss.

A debt collector should not use employment pressure as a tool of harassment. Contacting an employer may be improper if it discloses debt information, damages reputation, or interferes with employment.

Victims should document:

who contacted the employer;
what was said;
when it happened;
who heard it;
whether any written messages were sent;
whether employment consequences occurred.

The employer should also be informed that the alleged debt is disputed, especially in identity theft cases.

XXXI. Harassment of Family Members

Family members are often targeted. Collectors may tell parents, spouses, siblings, or children that the borrower is a criminal or will be arrested.

Family members generally are not liable unless they signed as co-debtors, guarantors, sureties, or co-makers. Harassment of family members may support complaints for privacy violations, harassment, threats, or defamation.

If minors are contacted or exposed to threats, the matter becomes more serious.

XXXII. Social Media Harassment

Some collectors threaten to post a borrower’s photo, ID, or debt details on Facebook, Messenger groups, workplace pages, or community groups.

This may involve:

cyber libel;
data privacy violations;
unjust vexation;
harassment;
civil damages;
violation of lending regulations;
possible criminal liability depending on content.

Victims should screenshot the post, preserve the URL, identify the account, record the date and time, and avoid engaging in public arguments that may worsen exposure.

XXXIII. Cease-and-Desist Strategy

A victim may send a cease-and-desist letter to the lender and collection agency. The letter should:

identify the account being disputed;
deny liability if identity theft occurred;
demand validation of the debt;
demand cessation of harassment;
demand cessation of third-party contact;
invoke privacy rights;
demand preservation of records;
warn of complaints to authorities;
request written response.

A lawyer’s letter may be more effective, especially where the harassment is severe.

XXXIV. Preservation of Digital Evidence

Digital evidence can disappear quickly. Victims should preserve evidence carefully.

Recommended steps:

take full screenshots, not cropped images;
include date, time, and sender details;
export chat history where possible;
save voice messages;
write down call details;
ask contacted persons to forward messages;
save URLs of posts;
avoid deleting apps or messages before backup;
preserve the phone used to receive threats;
keep copies in cloud storage or external storage.

For formal complaints, printed screenshots may be attached, but investigators may also ask to inspect the device.

XXXV. Possible Defenses of Lending Companies

Lending companies may defend themselves by claiming:

the applicant passed identity verification;
the loan was approved through OTP;
the ID matched the selfie;
the proceeds were sent to an account under the same name;
the borrower consented to app permissions;
the collection messages were sent by a third party without authorization;
the messages were legitimate reminders;
the borrower defaulted;
the data processing was necessary for contract enforcement.

These defenses are not always valid. Verification can be flawed, consent can be invalid or excessive, third-party collectors can still create liability, and legitimate collection cannot include harassment.

XXXVI. Responsibility of Borrowers

Borrowers should also act responsibly. A borrower who actually obtained a loan should not falsely claim identity theft. False claims may expose the borrower to civil or criminal liability.

Borrowers should:

read loan terms before accepting;
avoid giving unnecessary app permissions;
use registered lending companies;
keep proof of payments;
request official receipts or confirmations;
communicate in writing;
avoid rolling over debt without understanding charges;
report harassment even while settling valid debt.

XXXVII. Preventive Measures Against Identity Theft

Individuals can reduce risk by:

watermarking ID copies when submitting online;
writing the purpose and date on ID copies;
avoiding sending IDs through unsecured channels;
using strong passwords;
enabling two-factor authentication;
securing email and e-wallet accounts;
avoiding suspicious loan or job links;
limiting app permissions;
checking app legitimacy before installation;
avoiding public Wi-Fi for financial transactions;
monitoring SIM, bank, and e-wallet activity;
reporting lost IDs immediately;
keeping records of where IDs were submitted.

A watermark such as “For [Company Name] loan verification only, [date]” can help prevent reuse of ID copies.

XXXVIII. Corporate and Regulatory Compliance for Online Lenders

Legitimate online lenders should maintain strong compliance systems, including:

proper registration and authority to lend;
transparent loan terms;
fair interest and fee disclosures;
lawful identity verification;
data minimization;
secure storage of personal data;
limited and lawful use of contact information;
documented borrower consent;
complaint handling procedures;
identity theft dispute mechanisms;
supervision of collection agents;
training on lawful collection;
audit logs;
cybersecurity controls;
quick suspension of collection when identity theft is credibly alleged.

A lender that ignores identity theft complaints and continues harassment risks legal exposure.

XXXIX. Distinguishing Civil Debt from Criminal Fraud

A key legal distinction must be emphasized.

A person who borrows money and later cannot pay usually faces civil liability, not imprisonment for debt. But a person who uses false identity, forged documents, or deceit to obtain the loan may face criminal liability.

Thus:

Nonpayment due to inability is generally civil.
Borrowing with fraud from the beginning may be criminal.
Using another person’s identity may be criminal.
Falsifying documents may be criminal.
Issuing bad checks, where applicable, may trigger special legal consequences.
Threatening a debtor to collect payment may itself be unlawful.

Collectors often use the word “fraud” loosely. The law requires proof of elements, not mere default.

XL. The Role of Good Faith Dispute

Once a victim formally disputes a loan as identity theft, a responsible lender should investigate. Continuing aggressive collection without investigation may strengthen the victim’s claim of bad faith.

A good dispute notice should be clear, written, dated, and supported by evidence. It should ask the lender to preserve records and provide proof.

The victim should keep copies of all communications.

XLI. Remedies Against Continued Harassment

If harassment continues, the victim may:

block numbers after preserving evidence;
send a written cease-and-desist demand;
report to the lending company’s official compliance channel;
file complaint with the SEC;
file complaint with the National Privacy Commission;
file cybercrime complaint with PNP or NBI;
file criminal complaint with the prosecutor;
seek barangay assistance for local harassment where appropriate;
seek civil damages;
ask counsel to send a formal legal notice.

The remedy should match the severity of the conduct.

XLII. Practical Checklist for Victims

A victim of identity theft and collection harassment should do the following:

Save all messages and call logs.
Identify the lender, app, and collector.
Do not admit liability if the loan is fraudulent.
Demand proof of the loan.
Demand suspension of collection.
Demand deletion or blocking of unlawfully processed data.
Ask where the proceeds were disbursed.
Notify contacts not to pay or engage.
Secure email, phone, SIM, bank, and e-wallet accounts.
File a police blotter or cybercrime complaint.
File complaints with appropriate regulators.
Prepare an affidavit.
Consult counsel if threats, public shaming, or large amounts are involved.
Keep all documents organized.

XLIII. Practical Checklist for References and Contacts

A contacted reference should:

state that they are not the debtor;
demand that contact stop;
save all messages;
avoid paying unless legally obligated;
ask for the collector’s name and company;
report abusive messages to the borrower or victim;
file a complaint if harassment continues;
block the number after preserving evidence.

XLIV. Practical Checklist for Borrowers With Valid Loans

A borrower who did take the loan but is being harassed should:

request a statement of account;
verify principal, interest, fees, and penalties;
negotiate in writing;
avoid verbal-only arrangements;
pay through official channels only;
keep receipts;
document harassment;
demand that collectors stop contacting third parties;
file complaints for abusive collection;
seek legal advice for excessive charges or threats.

XLV. Conclusion

Identity theft in online loan applications and collection harassment are serious legal problems in the Philippines. They involve more than unpaid debt. They may involve fraud, cybercrime, data privacy violations, abusive lending practices, defamation, threats, and civil liability.

A person whose identity was used without consent should immediately dispute the loan, demand proof, preserve evidence, secure accounts, and report the matter to the proper authorities. A person who is merely a reference or contact should understand that being listed in an app does not automatically make them liable for the debt. A borrower who actually owes money remains obligated to address the debt, but still has the right to be free from unlawful harassment, public shaming, threats, and privacy violations.

The central legal principles are clear: a loan requires consent; a person cannot be imprisoned for mere debt; debt collection must be lawful; personal data must be processed fairly and securely; and identity theft victims should not be forced to pay obligations they never incurred.

In the digital lending environment, documentary evidence is critical. Screenshots, call logs, affidavits, account records, and formal complaints can determine whether the victim obtains relief. The best response is prompt, organized, and legally grounded action: deny fraudulent liability, demand validation, stop unlawful processing, preserve proof, and pursue remedies against identity thieves, abusive collectors, and noncompliant lending companies.