Quick answer

If an online loan was opened using your identity without your knowledge or consent, dispute it immediately in writing. Tell the lender that you deny applying for, signing, receiving, or benefiting from the loan; demand that collection and disclosure of the alleged debt be suspended while it investigates; and request the complete application, authentication, disbursement, and collection records.

Do not pay a “small amount” merely to stop the calls, admit that the debt is yours, or negotiate a payment plan for a loan you did not obtain. Preserve the evidence before blocking callers or deleting the app. Secure your accounts, report the identity theft to law enforcement, and challenge any incorrect credit entry.

Harassment is not lawful simply because a debt is claimed. A legitimate lender may pursue a genuine obligation through lawful collection or court proceedings, but it may not use threats, humiliation, deception, uncontrolled access to contact lists, or disclosure to unrelated people as collection tactics.

First determine which problem you have

The correct response depends on the facts:

You never applied for or received the loan

Treat the matter as possible identity theft. Your dispute should focus on the absence of your consent, participation, electronic signature, and receipt of loan proceeds.

An online application bearing your name or ID is not automatically conclusive. Electronic documents and signatures can have legal effect, but their authenticity and connection to the person allegedly signing must be established under the Electronic Commerce Act and the Supreme Court’s Rules on Electronic Evidence. The lender’s records—and the circumstances under which an OTP, selfie, signature, device, or account was used—matter.

You borrowed, but the collector is harassing you

Dispute only what is genuinely incorrect, such as the balance, charges, payment history, or collection conduct. Do not falsely deny a loan you actually received.

A real debt does not authorize abusive collection. You may demand an accounting, insist on written communications, complain about prohibited practices, and seek legal advice about disputed interest or charges. The SEC, however, expressly states that its complaint process does not itself cancel a loan, alter contractual terms, or declare a contract or interest rate void; those issues may require settlement or a court ruling.

Your number was listed as a reference, but you are not the borrower or guarantor

State in writing that you are neither the borrower nor a guarantor and demand that collection calls stop. Being a contact person or character reference does not, by itself, make you liable for another person’s loan. Preserve evidence if the collector discloses the borrower’s debt, threatens you, or repeatedly contacts you after being corrected.

What to do immediately

1. Preserve the evidence before blocking anyone

Save original or unedited copies of:

Text messages, emails, app notifications, chat threads, call logs, and voicemails
Screenshots showing the sender, account or loan number, date, time, phone number, and complete message
Threats, insults, social-media posts, edited photos, group chats, or messages sent to relatives, employers, or colleagues
The app’s name, developer, download page, privacy notice, permissions, and terms
Collection notices, demand letters, disclosure statements, payment schedules, and account ledgers
Your written dispute and proof that it was delivered
Replies, ticket numbers, acknowledgment emails, and names used by collectors
Proof showing where you were or which device, SIM, email address, or bank or e-wallet account you controlled when the loan was supposedly created
Evidence of a lost ID, compromised account, SIM replacement, phishing incident, or unauthorized OTP request
Statements showing that the alleged loan proceeds never entered an account you own or control

Export chats where possible. Keep backups in a secure location. A screenshot is more useful when it preserves context rather than showing only an isolated sentence.

If recording a call, obtain case-specific legal advice before publishing or relying on the recording. Philippine rules on private communications can depend on how the recording was made. Written communications are usually easier to preserve safely.

2. Secure your identity and financial accounts

Change the passwords of the email, mobile-wallet, banking, social-media, and cloud accounts connected to the compromised phone or ID. Use unique passwords and enable multi-factor authentication.

Also:

Contact your mobile provider if your SIM stopped working unexpectedly or may have been replaced.
Sign out unknown devices and revoke suspicious app sessions.
Remove unnecessary app permissions, but document them first.
Notify the issuing agency if an ID was lost or compromised and follow its replacement or reporting procedure.
Tell your bank or e-wallet provider immediately if funds moved without authorization. Use only official contact details.
Warn close contacts that someone may impersonate you, without circulating more copies of your ID.

Do not send an unredacted ID to a collector through an unverified number. When an agency or verified institution legitimately requires identification, use its official channel and consider marking the copy with the recipient, purpose, and date.

3. Send a written identity-theft dispute

Send the dispute to the lender’s official customer-service and data-protection channels—not only to the collector. If a collection agency is involved, copy it and require it to identify the creditor it represents.

A clear dispute can say:

I dispute this account in full. I did not apply for, authorize, sign, receive, or benefit from this loan. Please mark the account as disputed, suspend collection and adverse reporting while the matter is investigated, preserve all records, and provide the complete application and verification records, the purported agreement and disclosure statement, the destination and proof of disbursement, and the source and authority for processing my personal data. Please communicate with me in writing and confirm the corrective action taken.

Add only statements that are true. Identify the account, app, dates, numbers used, and specific harassment. Do not speculate about who committed the fraud unless you have reliable evidence.

Ask for:

The original application and all information submitted
The agreement, promissory note, disclosure statement, and alleged electronic signature
Date and time records, IP addresses, device identifiers, and authentication logs
OTP delivery and verification records
Selfie, liveness, facial-matching, or video-verification records, if used
Copies and validation results of IDs submitted
The bank, e-wallet, or other destination of the loan proceeds and proof of successful disbursement
Call recordings, chat logs, and collection notes
The names of the creditor, online lending platform, collection agency, and relevant data-protection contact
Every credit bureau or third party to which the alleged account was reported or disclosed
Correction, blocking, or erasure of inaccurate data where legally appropriate
Written confirmation that collectors and recipients of the incorrect data have been notified of the correction

A lender may need to retain some records because of legal or regulatory duties. A request for deletion therefore does not guarantee immediate erasure of every record. It should still stop using inaccurate information as though the debt were established and should explain the lawful basis for any continued processing.

Why the lender’s digital records matter

Under the Electronic Commerce Act, electronic documents are not invalid merely because they are electronic. An electronic signature may be treated like a handwritten signature when the statutory requirements are met, including a reliable method connecting the signature to the person and indicating consent.

That does not mean an identity thief’s actions bind the victim automatically. If you deny the transaction, the specific evidence must be examined: who controlled the device and contact details, how identity was verified, where the money went, whether the authentication method was reliable, and whether the lender had notice of defects or suspicious circumstances.

Do not rely solely on the argument that there is no paper signature. Conversely, a lender should not treat possession of a photograph of your ID, an OTP log, or an app-generated contract as an unquestionable answer to a documented fraud claim.

The rules against collection harassment

For financing and lending companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt-collection practices. Prohibited conduct includes threats of violence or other criminal means, threats to harm a person’s reputation or property, and threats to take action that cannot legally be taken. The rules also address insults, deceptive representations, unreasonable communication practices, and improper disclosure associated with collection.

Privacy rules impose additional limits. Under NPC Circular No. 2020-01, as amended by Circular No. 2022-02, uncontrolled or excessive processing of a borrower’s contact list is prohibited, including processing that leads to harassment, collection from people outside the guarantors provided by the borrower, or other unfair collection practices. An app may provide limited access that lets a borrower choose references or guarantors; that is different from harvesting the entire address book for mass messaging.

The Data Privacy Act of 2012 requires personal-data processing to have a lawful basis and to comply with transparency, legitimate-purpose, and proportionality requirements. It also gives data subjects rights that may include access, correction, blocking or removal in appropriate cases, and complaint.

Possible warning signs include:

Threatening arrest merely because an alleged civil loan is unpaid
Claiming to be a court, government officer, police officer, or lawyer when that is false
Threatening action the collector has no legal ability or present authority to take
Insults, obscenities, humiliation, or threats against you or your family
Posting your photo, ID, alleged balance, or accusations online
Sending debt messages to unrelated contacts, coworkers, clients, or an employer
Altering images to label you a criminal or scammer
Continuing collection without meaningfully addressing a documented identity-theft dispute
Refusing to identify the creditor, account, or collection agency

A demand letter or an accurately described lawsuit is not harassment merely because it is unwelcome. The distinction is between lawful communication and threats, deception, humiliation, excessive contact, or unlawful disclosure.

Where to complain

The proper agency depends on the institution and violation. More than one complaint may be appropriate because debt collection, privacy, credit reporting, and identity theft are separate issues.

Securities and Exchange Commission

Use the SEC for complaints involving a lending company, financing company, online lending platform, or its collection agency. The SEC’s official complaint instructions require a completed complaint form, supporting evidence, a valid government-issued ID, and one complaint form for each respondent company. The SEC also accepts financing- and lending-company concerns through its iMessage portal.

Identify the company’s exact corporate name, not just the app or collector’s brand. Include your written denial of the loan, the records requested, the response received, and evidence of harassment. The SEC may investigate regulatory violations, but it does not use this administrative process to judicially declare the alleged contract void or cancel the debt.

National Privacy Commission

Use the NPC when personal information was obtained, processed, disclosed, or retained without lawful authority; when an app harvested contacts; or when personal data was used for harassment or public shaming.

Ordinarily, the NPC’s 2021 Rules of Procedure, as amended require you first to notify the personal information controller or concerned entity in writing and allow it to act. If it gives no response within 15 calendar days of receiving that notice, or fails to take timely and appropriate action, you may proceed with a complaint, subject to the rules and their exceptions.

Follow the NPC’s current filing instructions. A formal complaint uses the prescribed complaint-affidavit, must be notarized, and must include supporting evidence. It may be submitted through the official methods listed by the NPC. Keep proof that the lender received your earlier written privacy complaint.

Bangko Sentral ng Pilipinas

If the creditor is a bank, digital bank, e-money issuer, or another BSP-supervised institution, complain first through that institution’s Financial Consumer Protection Assistance Mechanism. If the response is unsatisfactory, escalate through the BSP’s second-level Consumer Assistance Mechanism using the current channels in its official complaint guide.

The BSP directs complaints about financing and lending companies, online lending apps, and their collection agencies to the SEC instead.

Credit Information Corporation

Obtain your CIC credit report and check whether the fraudulent account appears. The Credit Information System Act gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information.

The CIC’s Online Dispute Resolution Process requires information from the credit report, including its transaction reference number. Filing a credit dispute is separate from disputing directly with the lender; doing both creates a clearer record.

A clean CIC report does not necessarily prove that no fraudulent account exists. Not every threatened account will already appear there, and information may also have been furnished to other authorized credit bureaus.

Law-enforcement agencies

Using another person’s identifying information without right may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act. The facts may also implicate computer-related fraud, forgery, unauthorized account access, or other offenses, but the correct charge belongs to investigators and prosecutors.

You may report to:

The PNP Anti-Cybercrime Group at acg@pnp.gov.ph
The NBI Cybercrime Division at ccd@nbi.gov.ph
The Cybercrime Investigation and Coordinating Center at report@cicc.gov.ph

These channels are listed in the BSP’s official fraud-complaint guidance. The NBI also publishes its procedure for investigative assistance to computer-crime victims.

Bring a chronological statement, valid identification, disputed-loan records, proof of where the proceeds went if available, device or account-compromise evidence, and preserved messages. An incident report or affidavit supports your dispute but does not, by itself, automatically erase the account; continue the lender, regulatory, and credit-report disputes.

If the lender or collector files a court case

Do not ignore an actual summons, subpoena, court order, or pleading. Verify it directly with the court named in the document, using official contact information rather than a number supplied only by the collector.

A civil claim of ₱1 million or less, exclusive of interest and costs, may fall under the Supreme Court’s current Rules on Expedited Procedures in the First Level Courts, including the small-claims process. Deadlines in court papers can be short. Failure to respond or appear can seriously prejudice your defense.

Present the identity-theft dispute and supporting records, including evidence that you did not control the application credentials or receive the proceeds. The lender may present electronic evidence, and the court—not a collector or regulator—ultimately resolves a contested civil liability.

The Constitution states that no person may be imprisoned for debt. That does not protect someone from investigation or prosecution for an independently alleged crime, nor does it permit ignoring a civil case. A collector’s bare threat of arrest solely for nonpayment is therefore different from a genuine legal process based on alleged criminal conduct.

Common mistakes to avoid

Paying or signing a restructuring agreement for a debt you deny
Admitting the loan during an angry call just to end the conversation
Deleting messages or uninstalling the app before preserving evidence
Sending personal documents to an unverified collector
Posting complete IDs, account numbers, or affidavits publicly
Communicating only by phone and keeping no written record
Disputing with the collection agent but not the actual lender
Filing an NPC complaint without first giving the entity written notice, unless a procedural exception genuinely applies
Filing an SEC complaint without the prescribed form, evidence, ID, or separate form for each company
Assuming a police report automatically corrects a credit record
Ignoring a real summons because the underlying account is fraudulent
Confusing an app name with the registered corporate entity
Threatening or harassing collectors in return

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, prosecutor’s notice, or court order
A lender produces a contract, selfie, OTP, or disbursement record that appears to connect the account to you
Loan proceeds entered an account in your name, even if you did not control it
Your signature or government ID appears to have been forged or altered
Collectors threaten physical harm, publish private material, impersonate authorities, or contact your workplace
Several fraudulent accounts or institutions are involved
Your bank, SIM, email, or e-wallet remains compromised
A regulator rejects the complaint on procedural grounds
You know or suspect the perpetrator and an accusation could create family, employment, or safety consequences

For immediate threats or danger, contact the police or emergency services first. Do not arrange an in-person meeting with an unidentified collector.

Frequently asked questions

Must I pay a loan opened by an identity thief?

Not merely because the account carries your name or ID. Liability depends on proof of a valid obligation attributable to you. Promptly deny the transaction, require the lender’s evidence, and show that you neither authorized nor received the loan. A final contested determination may require a court.

Can I demand that all calls stop?

You can demand that harassment, third-party disclosure, and collection on an unresolved identity-theft claim stop, and that communications be made in writing. A creditor with a genuine claim is not necessarily barred from every lawful communication or from filing a case.

Can the lender contact everyone in my phone?

No. NPC rules prohibit unbridled processing of contact lists, including processing that leads to harassment or collection outside the guarantors supplied by the borrower. Limited access allowing a borrower to select references or guarantors does not authorize mass contact harvesting.

Are my relatives liable because they were contacted?

Not unless they independently became borrowers, co-makers, or guarantors under a legally enforceable arrangement. Relationship, friendship, or appearance in a phone’s contacts does not by itself create liability.

Does an OTP prove that I took the loan?

An OTP may be evidence, but its weight depends on the circumstances. Relevant questions include which SIM and device received it, who controlled them, whether a SIM swap or account takeover occurred, what the OTP authorized, and whether other verification records are reliable.

Should I block the collector?

Preserve the number, messages, calls, and account details first. After sending a written dispute and establishing a record, blocking abusive numbers may reduce distress. Keep at least one secure written channel open so you receive formal responses and can distinguish collection messages from genuine legal notices.

Will an SEC complaint remove the debt?

Not automatically. The SEC can address regulatory violations, but its complaint process does not itself cancel an alleged loan or declare a contract void. Pursue the direct dispute, privacy remedies, credit-report correction, law-enforcement report, and any necessary court defense separately.

How quickly must I act?

There is no advantage in waiting. Account records can change, data may be shared, and court or agency papers may carry specific deadlines. For an NPC complaint, preserve proof of your written notice and the entity’s response—or lack of response during the ordinary 15-calendar-day period. Follow any shorter deadline stated in a genuine court or government document.

Official references

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Liability and available remedies depend on the documents, authentication records, disbursement trail, parties involved, and procedural posture. Official sources and procedures were checked as of September 5, 2026.