Introduction

Identity theft through unauthorized loan accounts is a growing legal and financial problem in the Philippines. It happens when a person’s identity, personal data, identification documents, mobile number, email address, biometrics, digital credentials, or financial information are used by another person to apply for or obtain a loan without the victim’s knowledge or consent.

The unauthorized loan may be opened with a bank, lending company, financing company, online lending platform, credit card issuer, buy-now-pay-later provider, pawnshop, cooperative, microfinance institution, or other credit provider. The victim usually discovers the fraud only after receiving collection calls, demand letters, credit bureau notices, text messages, app notifications, or threats from collection agents.

This type of identity theft is serious because it can damage a person’s credit standing, expose the victim to harassment, create false debt records, affect employment or business transactions, and force the victim to spend time and money proving that the debt is not theirs.

In the Philippine legal context, identity theft through unauthorized loan accounts may involve violations of laws on cybercrime, data privacy, lending regulation, falsification, fraud, unfair debt collection, consumer protection, and credit reporting.

I. What Is Identity Theft Through Unauthorized Loan Accounts?

Identity theft through unauthorized loan accounts occurs when someone uses another person’s identity to create, apply for, access, or maintain a loan account without authority.

It may involve:

Using another person’s name to apply for a loan.
Using a stolen government ID.
Uploading a fake selfie or manipulated image.
Using a victim’s SIM card, mobile number, or email.
Using stolen one-time passwords or account credentials.
Creating an online lending account in the victim’s name.
Using a victim’s personal data from leaked databases.
Using a victim’s payslip, company ID, or employment details.
Forging a signature on a loan application.
Using a victim’s digital wallet or bank account.
Making the victim appear to have consented to the loan.
Creating a loan account using falsified supporting documents.
Naming the victim as borrower, co-borrower, guarantor, or reference without authority.

The essence of the wrongdoing is the same: a person is made to appear as a borrower or obligated party even though they did not knowingly and voluntarily enter into the loan.

II. Why Unauthorized Loan Accounts Are Especially Harmful

Unauthorized loan accounts can create immediate and long-term harm.

The victim may suffer:

Collection calls for a debt they did not incur.
Repeated text messages and emails from lenders.
Harassment from collection agents.
Public shaming or threats, especially from abusive online lenders.
Negative credit reports.
Rejection of legitimate loan applications.
Difficulty opening bank accounts or credit facilities.
Damage to reputation with family, employer, friends, or business contacts.
Anxiety, stress, and financial uncertainty.
Time spent filing disputes, affidavits, police reports, and complaints.
Risk of being sued for a loan they never obtained.
Exposure of additional personal data.

The harm is not limited to money. Identity theft attacks a person’s legal identity, privacy, reputation, and financial credibility.

III. Common Ways Unauthorized Loan Accounts Are Created

1. Stolen Physical IDs

A fraudster may use a lost, stolen, photographed, or copied government-issued ID to apply for a loan. Commonly misused IDs include:

Philippine Identification System ID
Passport
Driver’s license
UMID
SSS ID
GSIS ID
PRC ID
Postal ID
Voter’s ID or certification
Company ID
School ID

Some online lenders require only an ID photo, selfie, mobile number, and basic personal information. This can make identity theft easier if the lender has weak verification procedures.

2. Data Leaks and Purchased Personal Information

Personal data may be obtained from leaked databases, phishing schemes, illegal data brokers, compromised websites, employment records, contact tracing forms, delivery records, raffles, social media profiles, or old application forms.

Fraudsters may use:

Full name
Address
Birthdate
Mobile number
Email address
Government ID number
Employer name
Income information
Emergency contacts
Family details
Photos
Signatures
Bank or e-wallet details

The more complete the stolen data, the easier it becomes to impersonate the victim.

3. SIM-Related Identity Theft

A mobile number is often central to online lending. It may be used for registration, verification, one-time passwords, account recovery, and collection.

Identity theft may involve:

SIM swapping
Lost SIM cards
Unauthorized SIM registration
Compromised mobile accounts
Malware that intercepts messages
Phishing for OTPs
Use of a recycled mobile number
Fraudulent registration of a SIM under another person’s name

If a fraudster controls the mobile number, they may be able to pass basic identity checks.

4. Phishing and Credential Theft

The victim may be tricked into giving away:

OTPs
Passwords
Email access
Digital wallet credentials
Banking credentials
ID photos
Selfie videos
App permissions

Fraudsters may use fake websites, fake customer support accounts, fake loan offers, fake job applications, fake government aid forms, or fake verification links.

5. Fake Loan Apps and Malicious Applications

Some fraudulent apps collect excessive personal data and then use it to create unauthorized accounts. Others ask for access to contacts, photos, SMS, camera, microphone, or storage.

A victim may think they are merely checking eligibility or applying for a small loan, but the app may collect and misuse their information.

6. Insider Misuse

Identity theft may also occur through people with access to personal documents, such as:

Employees of lending companies
Agents
Brokers
Recruiters
HR personnel
Sales representatives
Telecom personnel
Bank or financing staff
Relatives or acquaintances
Former partners
Household members

Insider misuse can be difficult to detect because the fraudster may already have legitimate access to parts of the victim’s information.

7. Forged Signatures and Paper-Based Loans

Identity theft is not limited to online loans. A person may be falsely named in traditional loan documents through:

Forged promissory notes
Forged loan applications
Forged guaranty agreements
Fake co-maker signatures
Falsified employment certificates
Fake payslips
Falsified residence certificates
Fake acknowledgment receipts

The legal issue then involves not only unauthorized borrowing but also possible falsification and fraud.

IV. Philippine Laws That May Apply

Several Philippine laws may apply depending on how the unauthorized loan was created, how personal data was used, and how the lender or collector responded.

1. Cybercrime Prevention Act

If the identity theft was committed through a computer system, mobile app, website, online platform, electronic communication, or digital account, cybercrime laws may apply.

Possible acts include:

Computer-related identity theft
Illegal access
Data interference
System interference
Computer-related fraud
Computer-related forgery
Misuse of devices
Cyber libel, if defamatory collection or posting occurs

Unauthorized use of another person’s identity online to obtain a loan may fall within computer-related identity theft or fraud, depending on the facts.

2. Data Privacy Act

The Data Privacy Act protects personal information and sensitive personal information. Loan providers and online lending platforms are generally personal information controllers or processors when they collect and process borrower data.

Relevant privacy issues may include:

Unauthorized processing of personal data
Processing without valid consent or lawful basis
Failure to verify identity before creating an account
Failure to secure personal data
Failure to respond to a data subject request
Disclosure of borrower data to contacts without proper basis
Excessive collection of personal information
Use of contact lists for harassment
Failure to correct inaccurate personal data
Failure to delete or block unlawfully processed data
Data breach notification failures

Victims may invoke data subject rights, including the right to access, correction, objection, blocking, erasure, and damages where applicable.

3. Revised Penal Code

Depending on the conduct, traditional criminal offenses may also apply.

Possible offenses include:

Estafa or swindling
Falsification of public, official, or commercial documents
Use of falsified documents
Other deceits
Unjust vexation
Grave threats
Light threats
Slander or oral defamation
Libel, if written or published
Coercions
Usurpation of name, depending on facts

For example, if someone forged a signature on a loan document or submitted a falsified ID, falsification and estafa may be relevant.

4. Lending Company and Financing Company Regulations

Lending companies and financing companies are regulated entities. They are expected to observe legal requirements on registration, fair lending, proper collection, disclosure, and lawful conduct.

Unauthorized loan accounts may raise regulatory questions such as:

Did the lender properly verify the borrower’s identity?
Did it follow know-your-customer procedures?
Did it obtain valid consent?
Did it disclose terms and charges?
Did it engage in abusive collection?
Did it threaten, shame, or harass the victim?
Did it report false debt information?
Did it refuse to investigate a fraud complaint?

Regulators may investigate lenders or online lending platforms that engage in abusive, deceptive, or unlawful practices.

5. Financial Consumer Protection Laws and Regulations

Financial institutions and credit providers may be subject to financial consumer protection standards. These require fair treatment of consumers, transparency, proper handling of complaints, protection of consumer data, and mechanisms for dispute resolution.

A victim of identity theft may argue that a lender failed to:

Conduct adequate identity verification.
Protect consumer information.
Investigate disputed transactions.
Suspend collection during investigation.
Correct inaccurate records.
Provide copies of documents.
Provide a meaningful complaints process.
Prevent abusive collection practices.

6. Credit Information and Credit Reporting Rules

Unauthorized loans may be reported to credit bureaus or credit information systems, damaging the victim’s credit standing.

Relevant concerns include:

False reporting of loan obligations
Failure to mark an account as disputed
Failure to correct inaccurate credit data
Failure to remove fraudulent accounts
Continued negative reporting after notice of identity theft
Reporting debts without proper verification

A victim should dispute the unauthorized account both with the lender and, where applicable, with credit reporting entities.

7. Consumer Protection Law

Unauthorized loan accounts may also raise consumer protection concerns where the victim is treated as a consumer by the lender, collector, or platform despite not having consented to the transaction.

Possible issues include:

Deceptive practices
Unfair collection
Misrepresentation
Failure to disclose information
Refusal to provide account documents
Unreasonable complaint handling
Abuse of vulnerable consumers

8. SIM Registration and Telecommunications Issues

Where a mobile number was used fraudulently, SIM registration records may become relevant. A victim may need to check whether a SIM is registered under their name without authority or whether their mobile account was compromised.

Telecommunications-related issues may include:

Unauthorized SIM registration
SIM swap fraud
Use of stolen identity documents for SIM registration
Failure to secure mobile account recovery
Fraudulent OTP interception

V. Is the Victim Legally Liable for the Unauthorized Loan?

As a general principle, a person should not be held liable for a loan they did not apply for, consent to, authorize, benefit from, or ratify. Consent is essential to a valid contract. If the victim’s identity was stolen and used without authority, the supposed loan obligation may be disputed as fraudulent or void as to the victim.

However, the practical problem is proof. The lender may initially rely on its records showing that an account was created in the victim’s name. The victim must then assert that the account is unauthorized and demand investigation.

Important questions include:

Did the victim sign any document?
Did the victim submit the application?
Was the victim’s ID used?
Was the victim’s selfie genuine or manipulated?
Was the victim’s mobile number used?
Did the victim receive the loan proceeds?
Did the proceeds go to the victim’s bank or e-wallet?
Did the victim benefit from the loan?
Did the victim make any repayment?
Did the victim later acknowledge the loan?
Was there a valid agency relationship?
Was the victim a co-maker or guarantor?
Were documents forged?

A victim should avoid making payments “just to stop the calls” unless carefully advised, because payment may be argued as acknowledgment or ratification of the debt.

VI. Immediate Steps for Victims

Step 1: Do Not Panic and Do Not Admit the Debt

The first response should be firm and careful. The victim should not say, “I will pay,” “I borrowed,” or “I forgot about it.” Instead, say:

“This account is unauthorized. I did not apply for or consent to this loan. I dispute this debt and demand that collection be suspended while you investigate.”

Keep communications written whenever possible.

Step 2: Collect Evidence

Preserve all evidence, including:

Text messages
Emails
App notifications
Collection letters
Screenshots
Call logs
Names of collectors
Phone numbers used
Social media posts
Demand letters
Credit report entries
Account numbers
Loan reference numbers
Copies of IDs allegedly used
Proof of location or employment at the relevant time
Bank or e-wallet records showing no receipt of funds
Police blotter or complaint documents
Communications with the lender

Do not delete messages even if they are upsetting. Evidence is crucial.

Step 3: Demand Loan Documents from the Lender

Ask the lender for copies of all documents and records supposedly supporting the loan, including:

Loan application
Promissory note
Disclosure statement
Borrower profile
Submitted IDs
Selfie or liveness verification record
IP address logs
Device information
Mobile number used
Email address used
Bank or e-wallet account where proceeds were released
Date and time of application
Consent records
Electronic signature records
Call recordings, if any
Collection history
Credit reporting history

The victim has a legitimate interest in seeing the basis of the alleged debt.

Step 4: Send a Formal Written Dispute

The victim should send a written dispute to the lender or platform. The dispute should include:

Full name of victim
Contact details
Account or reference number, if known
Clear denial of authorization
Demand for suspension of collection
Demand for investigation
Demand for copies of documents
Demand for blocking or correction of personal data
Demand for removal of negative credit reporting
Warning against harassment or disclosure to third parties
Request for written confirmation of action taken

The letter should be sent through traceable means: email, registered mail, courier, official app support, or official complaint portal.

Step 5: File a Police Report or Complaint

A police blotter or complaint helps create an official record. For cyber-enabled identity theft, the victim may approach appropriate cybercrime authorities or law enforcement offices.

Bring:

Valid ID
Screenshots
Demand letters
Account reference numbers
Evidence of collection
Proof that the victim did not receive proceeds
Copy of the written dispute
Details of suspected fraudster, if known

A police report is often requested by lenders, credit bureaus, banks, and regulators before processing fraud claims.

Step 6: Report to the Proper Regulator

Depending on the entity involved, the victim may file a complaint with the proper government office or regulator.

Possible complaint avenues include:

Regulator of lending companies or financing companies
Regulator of banks or financial institutions
Privacy regulator for data misuse
Cybercrime enforcement authorities
Consumer protection offices
Credit reporting dispute mechanisms
Telecommunications provider, if SIM misuse is involved

The complaint should include evidence and a clear statement of the relief requested.

Step 7: Check Credit Reports

The victim should check whether the fraudulent loan appears in credit records. If it does, file a dispute and demand correction or deletion.

The dispute should state:

The account is unauthorized.
Identity theft is suspected.
The victim did not apply for the loan.
The victim did not receive proceeds.
The account is under formal dispute.
Negative reporting should be removed or marked as disputed.

The victim should also ask the lender to confirm in writing that it has withdrawn or corrected any credit reporting.

Step 8: Secure Personal Data and Accounts

Identity theft often means more data has been compromised. The victim should immediately:

Change email passwords.
Change banking and e-wallet passwords.
Enable two-factor authentication.
Secure recovery email and phone number.
Check SIM registration status.
Report lost or stolen IDs.
Request replacement IDs where needed.
Monitor bank and e-wallet transactions.
Check for unauthorized accounts.
Avoid sharing OTPs.
Remove suspicious apps.
Scan devices for malware.
Revoke app permissions.
Notify employer or family if collectors are contacting them.

VII. What to Include in a Formal Dispute Letter

A good dispute letter should be concise, firm, and documented.

Sample Dispute Letter

Subject: Formal Dispute of Unauthorized Loan Account / Identity Theft

To whom it may concern:

I am writing to formally dispute the loan account allegedly opened under my name, with reference number __________.

I did not apply for, authorize, consent to, benefit from, or receive proceeds from this loan. I believe my identity and personal information may have been used without my knowledge and consent.

I demand that you immediately:

Suspend all collection activities while this matter is under investigation.
Stop contacting my employer, relatives, friends, references, or third parties regarding this disputed account.
Provide copies of all documents and records supporting the alleged loan, including the loan application, submitted IDs, selfie or verification records, IP/device logs, disbursement details, consent records, and account history.
Confirm the bank account, e-wallet, or payment channel where the loan proceeds were released.
Block, correct, or delete any inaccurate personal data processed in relation to this unauthorized account.
Withdraw, correct, or dispute any negative credit reporting related to this account.
Provide written confirmation of the result of your investigation.

This letter is sent without admission of liability and with full reservation of my rights and remedies under Philippine law.

Sincerely,

Name Date Contact details

VIII. Evidence That Can Help Prove the Loan Was Unauthorized

Useful evidence may include:

No deposit of loan proceeds into the victim’s account.
Bank or e-wallet statements.
Proof that the mobile number used was not controlled by the victim.
Proof that the email address used was not the victim’s email.
Proof of lost or stolen ID.
Police report.
Affidavit of denial.
Signature comparison.
Location records showing victim was elsewhere.
Employer certification.
Device logs inconsistent with victim’s device.
IP address from another city or country.
Fraudulent selfie or altered ID photo.
Mismatch in address, employer, or personal details.
Communications showing immediate dispute.
Prior reports of similar fraudulent accounts with the same lender.

The goal is to show lack of consent, lack of benefit, and lack of authorization.

IX. Unauthorized Co-Maker, Guarantor, or Reference Use

Identity theft is not limited to being named as borrower. A person may also be falsely listed as:

Co-maker
Co-borrower
Guarantor
Surety
Emergency contact
Character reference
Employer contact
Relative
Spouse

A person should not be treated as a co-maker, guarantor, or surety unless they actually consented and signed or otherwise validly agreed to assume such obligation.

Being listed as a “reference” is different from being legally liable for the debt. A reference is generally someone who may be contacted for verification, not someone who must pay the loan. Collectors should not mislead references into believing they are liable.

If a victim is falsely named as co-maker or guarantor, they should demand copies of the alleged signed documents and dispute any forged signature or unauthorized consent.

X. Liability of Lenders and Online Lending Platforms

A lender may face legal or regulatory liability if it negligently or unlawfully allows unauthorized loan accounts to be created or fails to act after receiving notice.

Potential issues include:

1. Weak Identity Verification

A lender may be questioned if it approved a loan based on inadequate verification, especially where obvious red flags existed.

Examples:

Blurry ID accepted
Mismatched selfie and ID photo
Different account name for disbursement
Suspicious device or IP location
Reused documents
Multiple applications from same device
Use of obviously fake information
No meaningful consent record
No verification call
No liveness check
Disbursement to an account not owned by the alleged borrower

2. Continued Collection After Notice of Fraud

Once a victim formally disputes the debt, the lender should investigate. Continuing aggressive collection without investigation may be unfair, abusive, or negligent.

The lender should not:

Ignore the dispute.
Continue threatening the victim.
Shame the victim publicly.
Call the victim’s employer repeatedly.
Contact relatives with false claims.
Report the debt as valid without review.
Refuse to provide documents.
Demand payment without proving the obligation.

3. Improper Processing of Personal Data

A lender may be liable if it processes inaccurate, unauthorized, excessive, or unlawfully obtained personal data.

Examples:

Keeping an unauthorized account active.
Refusing correction or deletion.
Sharing the victim’s data with collectors.
Uploading the victim’s contact list.
Using personal contacts for collection.
Reporting false debt information.
Disclosing loan information to third parties.

4. Abusive Debt Collection

Some collection practices may be unlawful or abusive, especially if they involve:

Threats of imprisonment for debt
Threats of public shaming
Posting the victim’s photo
Contacting employer with defamatory statements
Harassing relatives
Using obscene or insulting language
Pretending to be police or court officers
Sending fake subpoenas or warrants
Repeated calls at unreasonable hours
Disclosing the debt to unrelated third parties
Claiming that references are legally liable when they are not

Even if a debt were valid, abusive collection may still be actionable. If the debt is unauthorized, the misconduct becomes even more serious.

XI. Can the Victim Sue?

Depending on the facts, the victim may have civil, criminal, administrative, or regulatory remedies.

Possible claims or remedies include:

Criminal complaint for identity theft, fraud, falsification, or related offenses
Complaint for data privacy violations
Complaint for abusive collection practices
Consumer protection complaint
Credit report dispute
Civil action for damages
Injunction or restraining relief in serious cases
Demand for correction, blocking, or deletion of personal data
Demand for written clearance from the lender
Demand for removal of negative credit information
Complaint against collection agency
Complaint against telecom provider in SIM-related fraud
Complaint against suspected fraudster

A civil action may seek actual damages, moral damages, exemplary damages, attorney’s fees, litigation expenses, and other relief, depending on proof and applicable law.

XII. When to Consider Filing a Criminal Complaint

A criminal complaint may be appropriate where there is evidence of:

Forged signature
Falsified ID
Fake loan application
Use of stolen personal data
Unauthorized account creation
Misappropriation of proceeds
Use of fake bank or e-wallet accounts
Phishing
Hacking
SIM swap
Impersonation
Threats or extortion by collectors
Public shaming or defamatory posts

The complaint should identify the offender if known. If unknown, the complaint may still be filed against unidentified persons, subject to investigation.

XIII. The Role of Affidavits

Victims are often asked to submit an affidavit of denial, affidavit of loss, or affidavit of identity theft.

An affidavit may state:

The victim’s personal details
The disputed loan account
That the victim did not apply for the loan
That the victim did not sign documents
That the victim did not receive proceeds
That the victim did not authorize anyone
When and how the victim discovered the loan
What collection efforts occurred
What evidence is attached
What relief is requested

An affidavit should be truthful, specific, and supported by attachments. False statements in an affidavit can create legal consequences.

XIV. Credit Record Repair After Identity Theft

Removing the unauthorized loan from credit records is often one of the hardest parts.

The victim should:

Get a copy of their credit report.
Identify all unauthorized accounts.
File a formal dispute with the lender.
File a dispute with the credit reporting entity.
Attach police report, affidavit, and dispute letter.
Demand that the account be marked as disputed.
Demand deletion or correction after investigation.
Request written confirmation.
Follow up regularly.
Keep all proof of submission and responses.

The victim should also request a clearance or certification from the lender stating that the account was fraudulent, unauthorized, cancelled, closed, or not attributable to the victim.

XV. Special Problem: The Victim Received the Loan Proceeds Without Realizing It

Sometimes identity theft is mixed with deception. A fraudster may trick the victim into receiving money and forwarding it elsewhere, claiming it is salary, investment proceeds, job processing funds, financial assistance, or a mistaken transfer.

This situation is more complicated. The lender may argue that the victim benefited from the loan. The victim may argue that they were deceived and did not knowingly borrow.

Important questions include:

Did the victim apply for anything?
Did the victim know it was a loan?
Did the victim receive disclosures?
Did the victim sign or click consent?
Did the victim forward the funds to a fraudster?
Did the victim keep any benefit?
Were there misleading representations?
Was there phishing or social engineering?

Victims in this situation should seek legal advice before communicating further or making payments.

XVI. Special Problem: A Relative Used the Victim’s Identity

Identity theft is often committed by someone known to the victim, such as:

Spouse
Former partner
Parent
Child
Sibling
Cousin
Friend
Co-worker
Household member
Caregiver
Business partner

The victim may hesitate to file a complaint. However, from a legal standpoint, unauthorized use of identity and documents remains serious even when committed by a relative.

The victim must decide whether to:

File a formal dispute only
Demand that the relative pay and clear the account
Execute a settlement agreement
File a police report
File criminal or civil action
Notify the lender of the fraud
Protect themselves from further misuse

A private family arrangement may not be enough to remove credit damage unless the lender and credit reporting entities formally correct the records.

XVII. Special Problem: The Lender Says the Victim’s ID and Selfie Were Used

Online lenders may claim that the victim must be liable because the application contains the victim’s ID and selfie. This is not conclusive.

Possible explanations include:

The ID was stolen.
The ID photo was copied from a prior transaction.
The selfie was manipulated.
The selfie was taken for another purpose.
A fraudster used a deepfake or edited image.
The victim was tricked into submitting verification materials.
The lender failed to perform proper liveness verification.
The lender failed to match the disbursement account to the borrower.
The application was completed from a device not owned by the victim.

The victim should demand full verification records, not just screenshots.

XVIII. Special Problem: Collection Agents Contact the Victim’s Contacts

Some online lending platforms access the borrower’s contact list or contact third parties to pressure payment. In an identity theft case, this may harm innocent people and spread false information.

The victim should document:

Who was contacted
What was said
Date and time of contact
Phone number used
Screenshots of messages
Whether threats or defamatory statements were made
Whether the collector disclosed the alleged debt
Whether the collector claimed the victim committed a crime
Whether photos or personal data were shared

The victim may demand that the lender and collector stop contacting third parties and delete unlawfully collected contact information.

XIX. Debt Collection Harassment and Threats

Victims may receive messages saying:

“You will be arrested.”
“We will file a case today.”
“We will post your photo.”
“We will call your employer.”
“You are a scammer.”
“Your family will be liable.”
“Police will come to your house.”
“You cannot travel.”
“We will shame you online.”
“Your barangay will be notified.”

Many such statements are misleading or abusive. Nonpayment of a debt, by itself, is generally not imprisonment-worthy. Criminal liability may arise from fraud or falsification, but a collector cannot simply threaten arrest to force payment.

Victims should not engage emotionally. They should preserve evidence and file complaints where appropriate.

XX. What Lenders Should Do Upon Receiving an Identity Theft Complaint

A responsible lender should:

Acknowledge the complaint.
Suspend collection temporarily.
Secure the account records.
Investigate identity verification.
Review application logs.
Verify disbursement details.
Check whether proceeds went to an account owned by the alleged borrower.
Review device, IP, email, and mobile number data.
Examine the submitted ID and selfie.
Check for similar fraud patterns.
Stop third-party disclosure.
Mark the account as disputed.
Correct credit reporting if fraud is found.
Close or cancel the account if unauthorized.
Provide written results to the complainant.

Failure to investigate fairly may expose the lender to complaints and liability.

XXI. Preventive Measures for Individuals

To reduce the risk of unauthorized loan accounts:

Do not send ID photos casually.
Watermark ID copies when possible, stating the purpose and date.
Do not share OTPs.
Use strong passwords.
Enable two-factor authentication.
Protect your email account.
Avoid posting full birthdate, address, and ID details online.
Do not install suspicious lending apps.
Review app permissions.
Report lost IDs immediately.
Monitor credit reports.
Check SIMs registered under your name when possible.
Use separate emails for financial accounts.
Keep copies of reports for lost documents.
Avoid clicking loan offers from unknown senders.
Do not submit personal data through unofficial links.
Be careful with online job applications asking for IDs.
Be cautious with “loan assistance” agents.
Check bank and e-wallet activity regularly.

A useful practice is to write across an ID copy: “For [specific purpose] only, submitted to [recipient], on [date].” This may reduce misuse, though it does not completely prevent fraud.

XXII. Preventive Measures for Lenders

Lenders should strengthen identity verification and fraud controls by using:

Reliable KYC procedures
Liveness detection
ID authenticity checks
Face matching
Device fingerprinting
IP risk scoring
SIM ownership checks where lawful
Disbursement only to accounts matching borrower identity
Duplicate application detection
Fraud watchlists
Manual review of suspicious applications
Clear consent records
Secure storage of personal data
Minimal data collection
Audit logs
Complaint handling mechanisms
Collection compliance monitoring
Credit reporting correction workflows

Poor onboarding controls can create harm not only for victims but also for lenders, who may end up with uncollectible fraudulent accounts and regulatory exposure.

XXIII. Distinguishing Identity Theft From Ordinary Loan Default

A lender may initially treat the matter as ordinary nonpayment. The victim must clearly distinguish the case.

Ordinary default means:

The borrower applied for the loan.
The borrower received or benefited from proceeds.
The borrower agreed to repay.
The borrower later failed to pay.

Identity theft means:

The victim did not apply.
The victim did not consent.
The victim did not authorize anyone.
The victim did not receive or benefit from proceeds.
The victim’s identity was misused.

The legal and practical response should be different. A disputed identity theft account should not be handled like a normal delinquent loan.

XXIV. Practical Checklist for Victims

A victim should do the following:

Write down when and how the unauthorized loan was discovered.
Save all collection messages and call logs.
Do not admit the debt.
Send a formal dispute to the lender.
Demand copies of loan documents.
Demand suspension of collection.
Demand deletion or correction of false data.
Ask where the proceeds were released.
File a police report or cybercrime complaint.
File a complaint with the appropriate regulator.
Check credit reports.
Dispute negative credit entries.
Secure email, mobile, banking, and e-wallet accounts.
Report lost or stolen IDs.
Notify contacts if they are being harassed.
Keep a folder of all evidence.
Consult counsel if the amount is large, threats continue, or a case is filed.

XXV. Practical Checklist for Disputing With a Lender

When communicating with the lender, ask:

What is the exact loan account number?
What date was the loan allegedly applied for?
What ID was used?
What mobile number was used?
What email address was used?
What device was used?
What IP address was used?
What bank or e-wallet received the proceeds?
Was the receiving account in my name?
What consent record do you rely on?
Was there a signed promissory note?
Was there a recorded verification call?
Why was the loan approved?
Has the account been reported to credit bureaus?
Has collection been outsourced?
What collectors have my data?
What steps will you take to correct the account?

The lender’s answers may reveal whether the account was clearly fraudulent.

XXVI. Practical Checklist for Complaints to Regulators

A complaint should usually include:

Full name and contact information
Name of lender or platform
Loan account or reference number
Summary of facts
Date of discovery
Statement that the loan is unauthorized
Copies of collection messages
Copy of formal dispute letter
Proof of submission to lender
Police report, if available
Affidavit, if available
Credit report entry, if any
Description of harassment, if any
Specific relief requested

Requested relief may include:

Investigation
Suspension of collection
Deletion or correction of fraudulent account
Removal from credit reports
Sanctions against abusive lender or collector
Protection of personal data
Written confirmation of resolution

XXVII. What If the Lender Files a Collection Case?

If a lender files a civil collection case, the victim should not ignore it. Failure to respond may result in an adverse judgment.

Possible defenses may include:

No consent
No valid contract
Forged signature
Fraudulent application
No receipt of proceeds
Lack of authority
Mistaken identity
Violation of consumer protection rules
Violation of privacy rights
Unreliable electronic records
Failure to prove the loan
Payment to a third party not authorized by the victim

The victim may also consider counterclaims if there was harassment, false reporting, or unlawful data processing.

Legal representation is strongly recommended once a formal case is filed.

XXVIII. What If the Victim Is Threatened With Criminal Charges?

Collectors sometimes threaten criminal cases for estafa or fraud. A victim of identity theft should respond carefully.

The victim may state:

“I did not apply for this loan, did not authorize it, and did not receive the proceeds. I have reported this as identity theft and formally dispute the account.”

If a real complaint is filed, the victim should submit a counter-affidavit with evidence. If the threat is fake or abusive, the victim should preserve the message and report the collector.

XXIX. Employer and Workplace Issues

Some collectors contact employers to pressure payment. This can cause embarrassment or reputational harm.

The victim may:

Inform HR or management that the account is disputed and unauthorized.
Ask the employer to document collection calls.
Request that the employer not disclose personal information.
Preserve call logs and messages.
Include employer harassment in the complaint.
Demand that the lender stop contacting the workplace.

Collectors should not use employment pressure to collect a disputed debt, especially one arising from alleged identity theft.

XXX. Family and Contact Harassment

If family members or contacts are harassed, they should also save evidence. They may send their own demand to stop contact, especially if they are not borrowers, co-makers, guarantors, or legally responsible parties.

A reference is not automatically liable for a loan. A collector who tells a reference that they must pay may be engaging in misleading or abusive conduct.

XXXI. The Role of Notarized Documents

Some lenders or victims may rely heavily on notarized documents. A notarized document carries evidentiary weight, but notarization does not make a forged or unauthorized document valid.

If a notarized loan document contains a forged signature, the victim may challenge it and request investigation of:

The notarial register
Identity documents presented
Personal appearance
Competent evidence of identity
Signature authenticity
Notary details

Forgery of a notarized document can create serious criminal and administrative issues.

XXXII. Electronic Signatures and Digital Consent

Online loans often rely on electronic consent, checkbox agreements, OTP verification, electronic signatures, or app-based authorization.

The legal validity of electronic records depends on authenticity, reliability, and proof. A lender should be able to show that the victim actually performed or authorized the electronic act.

Relevant evidence may include:

Account creation logs
OTP delivery and validation records
Device ID
IP address
Email verification
Mobile verification
Uploaded ID
Selfie or liveness video
Timestamp
E-signature record
Terms accepted
Disbursement account

The victim may challenge electronic consent if the records are unreliable, incomplete, inconsistent, or connected to a device or account not controlled by the victim.

XXXIII. Data Subject Rights in Identity Theft Cases

A victim may exercise privacy rights over personal data processed by the lender.

The victim may request:

Confirmation whether personal data is being processed
Access to personal data
Source of personal data
Purpose of processing
Recipients of personal data
Copies of data used for the loan
Correction of inaccurate data
Blocking or deletion of unlawfully processed data
Objection to processing
Withdrawal of consent, where applicable
Information on automated processing
Damages where legally justified

A lender should not hide behind “confidentiality” to refuse all information to the person whose identity was allegedly used. At minimum, it should provide a lawful and reasonable process for identity verification and dispute resolution.

XXXIV. When the Unauthorized Loan Is With a Bank

If the unauthorized loan account is with a bank, the victim should act quickly because banks are regulated and have formal fraud investigation channels.

The victim should:

Call the bank’s official hotline.
Visit a branch if needed.
File a written fraud dispute.
Request account freeze or investigation.
Ask for copies of application documents.
Request correction of credit records.
File a complaint with the appropriate financial regulator if unresolved.
Monitor related deposit accounts or cards.

If the unauthorized loan is tied to a credit card, personal loan, salary loan, or digital banking product, the victim should also check whether related accounts were compromised.

XXXV. When the Unauthorized Loan Is With an Online Lending App

Online lending app cases often involve faster disbursement, weaker documentation, and aggressive collection.

The victim should:

Identify the exact app and company name.
Check whether the app is operated by a registered lending or financing entity.
Preserve app messages and SMS.
Send a written dispute through official channels.
Demand suspension of collection.
Demand deletion of contact list data if collected.
Report abusive collection messages.
File privacy and regulatory complaints if needed.
Warn contacts not to engage with collectors.

If the app refuses to identify its company, address, or registration details, that itself is a red flag.

XXXVI. When the Unauthorized Loan Is a Buy-Now-Pay-Later Account

Buy-now-pay-later identity theft may involve purchases made under the victim’s name. The fraudster may obtain goods or services while the victim is billed later.

The victim should ask:

What merchant processed the purchase?
What item was purchased?
Where was it delivered?
Who received it?
What phone number and email were used?
What ID or selfie was submitted?
What device and IP were used?
Was the delivery address connected to the victim?

Delivery records may help identify the fraudster.

XXXVII. When the Unauthorized Loan Is a Salary, Cooperative, or Employer-Linked Loan

Some unauthorized loans may involve employer-linked lending, payroll deductions, cooperatives, or employee benefits.

The victim should verify:

Whether the employer endorsed the application
Whether HR records were used
Whether payroll deduction was authorized
Whether signatures were forged
Whether the loan was released through payroll
Whether a co-worker or insider was involved

If payroll deductions begin for an unauthorized loan, the victim should immediately notify HR in writing and dispute the deduction.

XXXVIII. Prescription and Timing Concerns

Victims should act promptly. Delay can create practical problems, such as:

Loss of logs
Deletion of CCTV or digital records
Continued credit damage
Escalation of collection
Assignment to collection agencies
Filing of cases
Argument that the victim failed to dispute promptly
Difficulty tracing proceeds

Immediate written dispute is important. Even if the victim discovers the account late, they should still report it as soon as discovered.

XXXIX. Settlement: Should the Victim Pay to End the Problem?

Some victims consider paying the unauthorized loan to stop harassment. This may be understandable but risky.

Payment may:

Be interpreted as acknowledgment of the debt.
Fail to remove negative credit history.
Encourage further fraud.
Leave the victim unable to recover the amount.
Fail to stop other unauthorized accounts.
Weaken the identity theft position.

If payment is considered for practical reasons, the victim should seek legal advice and require a written agreement stating that payment is not an admission of liability and that records will be corrected. Even then, caution is necessary.

XL. Remedies the Victim Should Demand

The victim may demand:

Written confirmation that the account is disputed.
Suspension of collection.
Closure or cancellation of the fraudulent account.
Confirmation that the victim is not liable.
Deletion or correction of personal data.
Removal of negative credit reporting.
Recall of the account from collection agencies.
Written instruction to collectors to stop contact.
Identification of data source.
Copies of loan documents.
Investigation of fraud.
Apology or corrective notice where reputation was harmed.
Damages, where warranted.

XLI. Practical Red Flags of Unauthorized Loan Identity Theft

A person may suspect identity theft if they receive:

Collection notices for a loan never obtained.
OTP messages from lending apps never used.
Loan approval messages without applying.
Calls from unknown collectors.
Credit report entries for unknown lenders.
Demand letters from unfamiliar finance companies.
Messages to family members about alleged debt.
Emails confirming account creation.
SIM registration issues.
Notifications of password reset attempts.
Small deposits followed by repayment demands.
Loan accounts linked to lost IDs.
Complaints from contacts that collectors are calling them.

Any of these should be investigated immediately.

XLII. Practical Red Flags in Loan Documents

If the lender provides documents, look for:

Wrong signature
Wrong address
Wrong employer
Wrong mobile number
Wrong email address
Wrong bank account
Wrong selfie
Mismatched ID photo
Incorrect birthdate
Inconsistent application timestamps
IP address from unfamiliar location
Disbursement to a third party
Loan purpose inconsistent with victim’s life
Terms never disclosed to victim
No wet signature or unreliable e-signature
Suspicious notarization

These inconsistencies support the identity theft claim.

XLIII. Sample Affidavit Outline

An affidavit of identity theft may follow this structure:

Personal circumstances of the affiant
Statement of discovery of unauthorized loan
Identification of lender and account number
Denial of loan application and consent
Denial of signature or electronic authorization
Denial of receipt of proceeds
Description of collection attempts
Statement of suspected identity theft
List of attached evidence
Actions taken, such as dispute letter and police report
Request for investigation and correction
Reservation of rights

The affidavit should be notarized and supported by documents.

XLIV. Best Practices for Communication

Victims should communicate in writing and use clear language.

Use phrases such as:

“I formally dispute this account.”
“I did not authorize this loan.”
“I did not receive the proceeds.”
“Please suspend collection while investigating.”
“Please provide the documents you rely on.”
“Please stop contacting third parties.”
“Please correct any credit reporting.”
“This communication is without admission of liability.”

Avoid phrases such as:

“I will try to pay.”
“Maybe I forgot.”
“Give me a discount.”
“I borrowed but cannot pay.”
“I promise to settle.”

Careless wording may be used against the victim.

XLV. Common Mistakes Victims Should Avoid

Victims should avoid:

Ignoring demand letters.
Arguing by phone without written records.
Deleting threats or messages.
Paying without written terms.
Admitting liability out of fear.
Sending more IDs to suspicious collectors.
Clicking links sent by collectors.
Installing apps recommended by collectors.
Failing to check credit reports.
Failing to report lost IDs.
Failing to secure email and SIM.
Waiting too long to file disputes.
Assuming the lender will automatically fix the issue.
Posting sensitive documents publicly online.

XLVI. Common Mistakes Lenders Should Avoid

Lenders should avoid:

Treating all disputes as excuses for nonpayment.
Continuing collection after credible identity theft notice.
Refusing to provide any documentation.
Ignoring data subject rights.
Reporting disputed debts as final and valid.
Allowing collectors to harass contacts.
Using shame-based collection.
Disbursing proceeds to mismatched accounts.
Accepting low-quality IDs and selfies.
Failing to keep audit logs.
Outsourcing collection without compliance controls.
Retaining fraudulent personal data unnecessarily.

Responsible lenders should recognize that identity theft is not merely a collection issue but a fraud, privacy, and consumer protection issue.

XLVII. Practical Case Scenarios

Scenario 1: Lost ID Used for Online Loan

Maria lost her driver’s license. Months later, she received messages from an online lending company demanding payment. The lender showed a copy of her ID, but the proceeds went to an e-wallet not owned by her. Maria should dispute the loan, file a police report, demand the disbursement records, and request correction of credit data.

Scenario 2: Fraudster Used Victim as Co-Maker

Jose received a demand letter claiming he was a co-maker for his cousin’s loan. Jose never signed any document. He should demand a copy of the alleged co-maker agreement and challenge any forged signature.

Scenario 3: Contact List Harassment

Ana never borrowed from a lending app, but her friends received messages calling her a scammer. She should preserve screenshots, send a formal dispute and cease-contact demand, and file complaints for privacy and abusive collection violations.

Scenario 4: SIM Swap Used for Loan

Carlo’s mobile signal disappeared. Later, he discovered that loans were taken using OTPs sent to his number. He should report the SIM incident to the telco, secure accounts, file a police or cybercrime report, and dispute all unauthorized loans.

Scenario 5: Fake Job Application Harvested IDs

Liza submitted her ID and selfie to a fake recruiter. Weeks later, a loan appeared in her name. She should report the fake recruitment scheme, dispute the loan, and document that the ID submission was for employment verification, not borrowing.

XLVIII. Legal Principles to Remember

Several principles are central:

Consent is essential to a loan obligation. A person who did not consent should not be treated as borrower.
Identity theft must be investigated, not merely collected.
A reference is not automatically liable for a loan.
A co-maker or guarantor must have validly agreed to be liable.
Forged signatures do not create valid consent.
Electronic consent must still be proven.
Personal data must be processed lawfully, fairly, and securely.
False credit reporting can cause legal harm.
Abusive collection may be actionable even if a debt exists.
Victims should act promptly and document everything.

Conclusion

Identity theft through unauthorized loan accounts is a serious legal problem in the Philippines. It involves more than an unpaid loan. It may include fraud, falsification, cybercrime, data privacy violations, abusive collection, false credit reporting, and consumer protection breaches.

A victim should not immediately pay or admit liability. The proper response is to formally dispute the account, demand documents, preserve evidence, file reports, secure personal data, check credit records, and pursue correction or cancellation of the fraudulent account. Lenders, for their part, must investigate identity theft claims responsibly, suspend abusive collection, protect personal data, and correct inaccurate records.

The central question in every case is whether the alleged borrower truly consented to the loan and received its benefit. If the account was created through stolen identity, forged documents, unauthorized digital access, or misuse of personal data, the victim has legal grounds to challenge the debt and seek remedies.