I. Introduction

Identity theft has become one of the most common and damaging forms of financial fraud in the Philippines, especially with the rapid growth of online lending applications. The convenience of digital lending has allowed borrowers to obtain loans with minimal paperwork, fast approval, and remote identity verification. However, the same convenience has also created opportunities for fraudsters to misuse another person’s name, government IDs, mobile number, photographs, contacts, and other personal information to apply for loans without consent.

In the Philippine setting, identity theft involving online lending apps usually happens when a person’s personal data is used to create an account, pass digital verification, and obtain a loan. The victim later discovers the fraud only after receiving collection calls, threats, demand letters, text messages, emails, app notifications, or reports that their name has been blacklisted or associated with unpaid debt.

This article discusses the legal issues, liabilities, remedies, and practical steps involved when identity theft is used for online lending apps in the Philippines.

II. What Is Identity Theft?

Identity theft is the unauthorized acquisition, possession, use, misuse, transfer, or processing of another person’s identifying information, usually for fraudulent purposes.

In online lending fraud, the stolen identity may include:

Full name;
Date of birth;
Address;
Mobile number;
Email address;
Government-issued IDs;
Selfie photos;
Signatures;
Employment information;
Bank or e-wallet details;
Contact list;
Social media accounts;
One-time passwords or verification codes;
SIM card information;
Taxpayer Identification Number, SSS, GSIS, PhilHealth, UMID, passport, driver’s license, or national ID details.

Identity theft becomes especially serious when the stolen data is used to obtain money, credit, goods, services, or financial access in the victim’s name.

III. Online Lending Apps and the Risk of Identity Fraud

Online lending apps typically rely on digital onboarding. A borrower may be asked to upload an ID, take a selfie, provide personal details, link a mobile number, grant access to contacts, or authorize access to device information. While legitimate digital verification can help prevent fraud, weak verification systems can also be abused.

Fraud may occur in several ways. A person may steal a lost ID and use it to apply for a loan. Someone may obtain copies of IDs from old job applications, photocopying shops, social media messages, or data leaks. A scammer may trick a victim into sending a selfie while holding an ID. In other cases, a relative, coworker, partner, or friend may misuse personal documents already in their possession.

The rise of online lending apps has also raised concerns about abusive collection practices. Some victims of identity theft are harassed by collectors even though they never borrowed money. Others are shamed through text blasts to their contacts, threatened with criminal cases, or falsely accused of fraud.

IV. Common Scenarios in the Philippines

1. Loan Taken Out Using a Stolen ID

A fraudster uses the victim’s government ID and personal details to create an account with an online lending app. The app approves the loan and releases the funds to a bank account or e-wallet controlled by the fraudster. The victim later receives demands for payment.

2. Loan Application Through a Compromised Phone Number

A scammer gains access to the victim’s SIM card, mobile number, OTPs, or messaging apps. Because many lending apps rely heavily on mobile verification, the scammer may pass authentication and borrow under the victim’s name.

3. Use of Edited or Fabricated Documents

The perpetrator may use altered IDs, edited screenshots, fake payslips, or manipulated personal data to obtain loans. The victim’s real name may be mixed with fake employment, address, or bank details.

4. Misuse by a Known Person

Identity theft is not always committed by strangers. It can be committed by a partner, family member, coworker, employee, friend, or acquaintance who has access to the victim’s ID, phone, email, or personal records.

5. Victim Harassed for a Loan They Never Made

The victim may never have installed the app, signed an agreement, or received loan proceeds. Yet collectors may call, text, threaten, or shame them because their identity was used in the loan application.

6. Contacts Harassed After Data Harvesting

Some lending apps or collectors may access the borrower’s phone contacts. In identity theft cases, the victim’s relatives, friends, coworkers, or employers may receive messages accusing the victim of nonpayment, fraud, or criminal conduct.

V. Relevant Philippine Laws

Several Philippine laws may apply depending on the facts.

A. Cybercrime Prevention Act of 2012

The Cybercrime Prevention Act penalizes certain offenses committed through computer systems or information and communications technology. Identity theft committed online may fall under computer-related identity theft when identifying information belonging to another person is intentionally acquired, used, misused, transferred, possessed, altered, or deleted without right.

If the fraudulent loan application was done through a mobile app, website, email, online platform, or digital system, the cybercrime law may be relevant.

Possible related offenses may include:

Computer-related identity theft;
Computer-related fraud;
Illegal access, if accounts or systems were accessed without authority;
Misuse of devices or credentials, depending on the facts;
Cyber libel, if false defamatory accusations were spread online or through digital means.

B. Revised Penal Code

The Revised Penal Code may also apply, particularly where deception, falsification, or unlawful taking of money is involved.

Possible offenses include:

1. Estafa

Estafa may be involved where the perpetrator defrauds the lender by pretending to be the victim or by using false pretenses to obtain money.

In identity theft lending cases, the lender may be the direct party deceived into releasing funds. The victim whose identity was stolen may also suffer damage through reputational harm, harassment, credit damage, and possible collection pressure.

2. Falsification of Documents

If a government ID, signature, loan agreement, employment record, proof of billing, or other document was falsified, the offense of falsification may arise.

This may include:

Using a fake ID;
Altering a real ID;
Forging a signature;
Creating false loan documents;
Submitting fabricated employment or income documents;
Using edited digital copies of records.

3. Use of Falsified Documents

A person who knowingly uses falsified documents may incur liability, separate from the act of falsification itself.

4. Unjust Vexation, Grave Coercion, Grave Threats, or Slander

Where collectors or other persons threaten, shame, insult, or harass the victim, other offenses under the Revised Penal Code may potentially apply depending on the conduct.

C. Data Privacy Act of 2012

The Data Privacy Act protects personal information and sensitive personal information. Online lending apps collect and process large amounts of personal data, including IDs, contact details, financial information, device data, and sometimes phone contacts.

The law may be relevant in several ways.

First, if a lending company processed the victim’s personal data without lawful basis, adequate consent, or proper verification, it may have violated data privacy principles.

Second, if the app collected excessive data, accessed contacts without proper consent, disclosed debt information to third parties, or used personal data for harassment, privacy issues may arise.

Third, if the company failed to secure personal data against unauthorized access, leaks, or misuse, it may face accountability.

The National Privacy Commission may receive complaints involving unauthorized processing, improper disclosure, data breaches, harassment through contact lists, and misuse of personal information by online lending platforms or collectors.

D. Lending Company Regulation Act and SEC Rules

Lending companies and financing companies in the Philippines are regulated. Online lending platforms are generally expected to be registered and to comply with rules on fair collection, disclosure, corporate registration, and lawful conduct.

The Securities and Exchange Commission has taken enforcement actions against abusive or unregistered online lending operators. A victim may check whether the lending app is registered, whether it has authority to operate, and whether it has been the subject of complaints or regulatory action.

A lending app that operates without proper registration or uses unfair, abusive, deceptive, or humiliating collection practices may face regulatory consequences.

E. Financial Consumer Protection Laws and Regulations

Online lending involves financial consumer protection concerns. Borrowers and affected persons should be treated fairly, transparently, and without harassment. Even where a debt is valid, collection must be lawful. Where the debt is fraudulent, the company should investigate, suspend collection, and avoid harming the victim further.

F. SIM Registration and Telecommunications-Related Issues

Because online lending apps often rely on mobile numbers and OTPs, SIM misuse may play a role. If a SIM card was fraudulently registered, stolen, swapped, or used to receive OTPs, the incident may involve telecommunications, identity verification, and cybercrime concerns.

Victims should secure their mobile number immediately and report possible SIM-related compromise to their telecommunications provider.

VI. Is the Victim Liable for the Loan?

As a general legal principle, a person should not be held liable for a loan they did not apply for, did not authorize, did not sign, and did not receive.

A valid loan requires consent. If the victim’s identity was used without consent, the alleged loan may be challenged on the ground that there was no meeting of minds between the victim and the lender.

However, in practice, the victim may still face collection attempts until the fraud is formally disputed. The lending company may initially rely on its records, uploaded IDs, selfies, device data, logs, or loan agreement. This is why the victim must act quickly to dispute the debt in writing and demand an investigation.

Important points:

The victim should not admit liability.
The victim should not pay merely to stop harassment unless advised after careful review.
The victim should demand proof of the loan.
The victim should ask where the proceeds were disbursed.
The victim should request account creation logs, date and time of application, bank or e-wallet recipient, IP/device information, and verification records.
The victim should file reports with appropriate authorities.

Payment may be interpreted as acknowledgment of the debt, depending on surrounding facts. Victims should be careful with language in messages to collectors.

VII. What the Lending App Should Do Upon Notice of Identity Theft

Once notified that the loan may be fraudulent, a responsible lending company should:

Suspend collection activity against the alleged victim;
Stop contacting the victim’s relatives, friends, coworkers, and employer;
Preserve all records related to the loan application;
Verify whether the account was opened fraudulently;
Provide the victim with available information, subject to lawful privacy limits;
Investigate the disbursement account;
Check whether the uploaded documents were forged or misused;
Coordinate with authorities if necessary;
Correct internal records if fraud is confirmed;
Remove adverse tagging or reporting caused by the fraudulent loan.

Failure to act responsibly may expose the company to regulatory, civil, administrative, or privacy complaints.

VIII. Abusive Collection Practices

Online lending disputes often worsen because of collection harassment. Even assuming a debt exists, collection must remain lawful. In identity theft cases, aggressive collection is especially problematic because the person being pursued may not be the borrower at all.

Common abusive practices include:

Threatening imprisonment for nonpayment of a civil debt;
Sending humiliating messages to contacts;
Posting the alleged borrower’s photo or ID online;
Calling employers or coworkers to shame the victim;
Using profanity, intimidation, or threats;
Claiming that police or lawyers will arrest the victim immediately;
Creating fake legal documents or fake court notices;
Misrepresenting oneself as a government officer;
Disclosing personal debt information to unrelated third parties;
Repeated calls at unreasonable hours;
Refusing to investigate identity theft claims.

A legitimate lender may pursue lawful collection, but it cannot use threats, public shaming, privacy violations, or deception.

IX. Can Nonpayment of a Loan Lead to Imprisonment?

As a general rule, no person is imprisoned merely for inability to pay a debt. The Philippine Constitution prohibits imprisonment for debt.

However, criminal liability may arise if there is fraud, falsification, estafa, bouncing checks, identity theft, or other criminal conduct. In the context of identity theft, the criminal offender is usually the person who fraudulently used another’s identity, not the innocent victim.

Collectors sometimes exploit fear by saying the victim will be arrested for nonpayment. Such statements may be misleading, especially where no valid debt exists or where the matter is purely civil.

X. Evidence the Victim Should Preserve

A victim should collect and preserve evidence immediately. Useful evidence includes:

Screenshots of text messages, emails, and app notifications;
Call logs from collectors;
Names and numbers used by collectors;
The name of the lending app or company;
Screenshots of the alleged loan account;
Demand letters or collection notices;
Proof that the victim never received the loan proceeds;
Bank and e-wallet statements around the alleged disbursement date;
Proof of lost ID or compromised account, if applicable;
Police blotter or cybercrime report;
Copies of government IDs that may have been misused;
Affidavit of denial or affidavit of identity theft;
Communications sent to the lending app disputing the loan;
Responses from the lender;
Evidence that third parties were contacted or harassed;
Screenshots of defamatory posts or messages;
Device compromise evidence, OTP messages, or SIM replacement records.

The victim should keep original screenshots and not merely copied text. Where possible, screenshots should show timestamps, sender numbers, email headers, app names, and full conversation threads.

XI. Immediate Steps for Victims

1. Do Not Admit the Debt

The victim should avoid statements such as “I will pay,” “I borrowed,” or “I just need more time.” Instead, the victim should clearly state that the loan is disputed because of identity theft.

2. Send a Written Dispute to the Lending App

The victim should send a formal written notice to the lending company stating that:

They did not apply for the loan;
They did not authorize anyone to apply on their behalf;
They did not receive the proceeds;
Their identity appears to have been misused;
Collection must stop while the matter is under investigation;
The company must preserve all records.

3. Request Documents and Verification Records

The victim may request copies or details of:

Loan application date and time;
Uploaded documents;
Selfie or biometric verification used;
Mobile number and email used;
Disbursement account;
Device and IP logs, where available;
Loan agreement;
Consent records;
Collection history.

Some information may be limited by privacy and investigation rules, but the company should still address the complaint and provide sufficient information to help resolve the dispute.

4. Secure Accounts and IDs

The victim should change passwords, secure email accounts, check e-wallets, review bank activity, enable two-factor authentication, and report compromised SIMs or accounts.

5. Report to Authorities

Depending on the facts, the victim may report to:

Philippine National Police Anti-Cybercrime Group;
National Bureau of Investigation Cybercrime Division;
National Privacy Commission;
Securities and Exchange Commission, for lending app concerns;
Barangay or police station for blotter purposes;
Telecommunications provider, if SIM misuse is involved;
Bank or e-wallet provider, if funds were routed through financial accounts.

6. Prepare an Affidavit

An affidavit of denial or affidavit of identity theft may be useful. It should state the relevant facts clearly, including that the victim did not apply, did not authorize the loan, did not receive proceeds, and discovered the matter only through collection attempts or notices.

7. Warn Contacts

If the victim’s contacts are being harassed, the victim may inform them that identity theft occurred and ask them to preserve screenshots of any messages received.

8. Monitor Credit and Future Loan Activity

The victim should monitor whether other loans or accounts were opened using their identity.

XII. Possible Claims and Complaints Against the Perpetrator

The person who used another’s identity may face criminal, civil, and administrative consequences, depending on the facts.

Possible liability may include:

Computer-related identity theft;
Computer-related fraud;
Estafa;
Falsification of documents;
Use of falsified documents;
Unauthorized access;
Data privacy violations;
Civil liability for damages.

If the perpetrator is known, such as a former partner, relative, coworker, or employee, the victim may file a complaint supported by evidence showing access, motive, transaction records, admissions, messages, or links to the receiving account.

XIII. Possible Complaints Against the Lending App

A lending app may not be the original identity thief, but it may still be accountable if it failed to verify identity properly, processed personal data unlawfully, ignored a fraud report, or engaged in abusive collection.

Possible complaints may involve:

1. Failure to Conduct Adequate Verification

If the app approved a loan based on weak, inconsistent, or obviously suspicious documents, it may be questioned for poor due diligence.

2. Unauthorized Processing of Personal Data

If the app processed the victim’s data without lawful basis or continued processing after being notified of fraud, a privacy complaint may arise.

3. Improper Disclosure to Contacts

If the app contacted the victim’s friends, employer, relatives, or coworkers about the alleged debt, that may raise privacy and harassment issues.

4. Harassment and Unfair Collection

Threats, public shaming, abusive calls, and misleading legal claims may be the subject of complaints.

5. Failure to Correct Records

If the company refuses to correct a fraudulent account despite evidence, the victim may seek regulatory intervention.

XIV. Data Privacy Concerns in Online Lending

Online lending apps often request broad access to personal data. The Data Privacy Act requires that processing of personal information be lawful, fair, transparent, adequate, relevant, limited to what is necessary, accurate, and secure.

Key privacy issues include:

Consent

Consent must be informed and specific. Broad or hidden consent buried in app permissions may be problematic, especially if the app collects excessive data.

Purpose Limitation

Data collected for loan verification should not be used for unrelated purposes, harassment, public shaming, or unauthorized disclosure.

Proportionality

The app should collect only data necessary for legitimate lending purposes. Access to a borrower’s entire contact list may be questioned if excessive.

Security

Lending companies must protect personal data from unauthorized access, leaks, insider misuse, and weak verification.

Rights of the Data Subject

A victim may assert rights such as access, correction, objection, erasure or blocking, and complaint, subject to lawful limitations.

XV. Harassment of Contacts

One of the most distressing parts of online lending identity theft is the harassment of people in the victim’s contact list. Friends, relatives, coworkers, or employers may receive messages saying the victim is a scammer, criminal, or delinquent borrower.

This may give rise to several issues:

Unauthorized disclosure of personal financial information;
Defamation or cyber libel, depending on the content and medium;
Unfair debt collection;
Data privacy violations;
Emotional distress and reputational damage;
Employer-related harm if the messages affect work.

Contacts who receive messages should save screenshots, numbers, timestamps, and message content. Their evidence may support the victim’s complaint.

XVI. The Role of Consent in Fraudulent Loan Applications

Consent is central to any loan. A person whose identity was stolen did not consent to the loan. Fraudulent use of an ID, selfie, or OTP does not automatically prove valid consent if those materials were obtained or used without authority.

The lender may argue that its system recorded consent through app clicks, digital signatures, OTPs, or uploaded documents. The victim may respond that these were generated by the fraudster and not by the victim.

Important factual questions include:

Who controlled the device used to apply?
Who owned the bank or e-wallet account that received the funds?
Was the selfie real, edited, coerced, or reused?
Was the ID lost, stolen, copied, or leaked?
Was the mobile number controlled by the victim at the time?
Were OTPs intercepted?
Was the email address created by the fraudster?
Did the victim benefit from the loan proceeds?

XVII. Civil Liability and Damages

A victim may suffer actual, moral, reputational, and financial harm. Depending on the facts, civil claims may be considered.

Possible damages include:

Costs incurred in clearing the victim’s name;
Legal expenses;
Lost employment opportunities;
Business reputation damage;
Emotional distress;
Anxiety and humiliation caused by harassment;
Damage caused by false reporting or blacklisting;
Expenses related to account recovery and security measures.

Civil liability may be pursued against the perpetrator and, in appropriate cases, against entities that contributed to the harm through negligence, unlawful processing, or abusive collection.

XVIII. Online Lending Apps, Credit Reporting, and Blacklisting

Victims may worry that fraudulent loans will affect their ability to borrow in the future. If a loan was fraudulently created, the victim should demand correction, deletion, or blocking of adverse records associated with the fraudulent account.

The victim should ask the lending company to confirm in writing that:

The account is under fraud investigation;
Collection is suspended;
The victim is not treated as liable;
Any negative internal or external report will be corrected if fraud is confirmed.

If the lender has reported the alleged debt to any credit bureau, collection agency, or database, the victim should demand correction and written confirmation.

XIX. What to Put in a Formal Dispute Letter

A dispute letter should be calm, firm, and specific. It may include:

Full name and contact details of the victim;
Reference number, loan account number, or collection message details;
Statement that the victim did not apply for or authorize the loan;
Statement that the victim did not receive the loan proceeds;
Request for immediate suspension of collection;
Request to stop contacting third parties;
Request for investigation and preservation of records;
Request for copies or details of the loan application;
Warning that continued harassment may be reported to authorities;
Attachments such as valid ID, affidavit, police blotter, screenshots, and proof of non-receipt.

The letter should avoid unnecessary admissions. It should not say “my loan” or “my debt.” It should refer to the matter as “the disputed account” or “the fraudulent loan application.”

XX. Sample Dispute Language

A victim may use language similar to the following:

I am formally disputing the alleged loan account under my name. I did not apply for this loan, did not authorize any person to apply on my behalf, did not sign or consent to any loan agreement, and did not receive any loan proceeds. I believe my personal information was used without my consent. Please immediately suspend all collection activity, stop contacting my relatives, friends, employer, or other third parties, preserve all records related to the account, and conduct a full fraud investigation.

The victim may also add:

Please provide the application date and time, mobile number and email used, uploaded documents, verification records, disbursement account, and all other information necessary to determine how this account was created.

XXI. Defenses Available to the Victim

A victim may raise several defenses:

Lack of Consent

The victim never entered into a loan agreement.

Forgery or Fraud

Any digital signature, uploaded document, or selfie was used without authority or falsified.

Non-Receipt of Proceeds

The victim did not receive or benefit from the loan proceeds.

Identity Theft

The transaction was created by a third party using stolen personal information.

Failure of Verification

The lender failed to ensure that the applicant was truly the person named in the documents.

Privacy Violations

The lender or collector unlawfully processed or disclosed the victim’s personal information.

Abusive Collection

The collection methods were unlawful or excessive, especially after notice of identity theft.

XXII. Duties of Victims After Discovery

A victim should act promptly. Delay may make evidence harder to collect and may allow further misuse of personal data.

Practical duties include:

Immediately dispute the account;
Secure compromised accounts;
Report lost IDs;
Notify banks and e-wallets;
Preserve evidence;
File complaints where appropriate;
Avoid communicating only by phone;
Ask for written responses;
Keep a timeline of events.

A clear timeline is especially useful. It should include the date the victim first received collection messages, the date the alleged loan was supposedly made, the date the victim disputed it, and the dates of any reports filed.

XXIII. Special Issues Involving Family Members or Partners

Identity theft by a known person can be emotionally and legally complicated. A family member may claim that the victim gave permission. A partner may have access to IDs, phones, or selfies. A coworker may have copied documents from employment records.

Important evidence may include:

Messages asking for permission or admitting use;
Proof that the suspect controlled the receiving account;
CCTV or workplace access records;
Device access history;
Witness statements;
Prior incidents of misuse;
Financial records showing who benefited.

The victim should avoid informal settlement without documentation, especially if the fraudulent loan remains under the victim’s name.

XXIV. Special Issues Involving Lost IDs

If an ID was lost before the fraudulent loan, the victim should report the loss and obtain documentation. If the loss was reported before the loan application date, that strengthens the victim’s position.

Even if the ID was not reported lost earlier, the victim may still assert identity theft. Many people discover misuse only after the fact.

Victims should consider replacing compromised IDs where possible and monitoring for further misuse.

XXV. Special Issues Involving Selfies and Biometric Verification

Some lending apps require a selfie or liveness check. Fraudsters may bypass this through:

Reusing old photos;
Editing images;
Using screenshots;
Coercing the victim into taking a photo;
Using deepfake or face manipulation tools;
Taking photos while the victim is unaware;
Using weak verification systems.

A selfie alone does not always prove valid consent. The surrounding circumstances matter.

XXVI. Special Issues Involving OTPs

OTP verification is often treated as strong proof that the user authorized a transaction. However, OTPs can be compromised through:

SIM swap;
Lost or stolen phone;
Malware;
Phishing;
Social engineering;
Shared devices;
Unauthorized access by a household member;
Fake customer service calls;
Remote access apps.

Victims should report OTP compromise immediately and secure the phone number.

XXVII. What Not to Do

Victims should avoid:

Ignoring the issue completely;
Paying without disputing;
Admitting the debt;
Deleting messages;
Arguing emotionally with collectors;
Sending more IDs to unknown collectors without verifying legitimacy;
Posting sensitive personal information online;
Threatening violence or using abusive language;
Relying only on phone calls;
Failing to document complaints.

The safer approach is written, documented, and evidence-based communication.

XXVIII. Remedies Before Government Agencies

1. PNP Anti-Cybercrime Group

A victim may report cyber-related identity theft, online fraud, unauthorized access, or digital harassment.

2. NBI Cybercrime Division

The NBI may receive complaints involving cybercrime, identity theft, online fraud, and digital evidence.

3. National Privacy Commission

The NPC may be relevant where personal data was unlawfully processed, disclosed, accessed, or used for harassment.

4. Securities and Exchange Commission

The SEC may be relevant for complaints against lending or financing companies, especially those involving abusive collection, unregistered lending operations, or regulatory violations.

5. Local Police or Barangay

A blotter may help document the incident, especially if the victim needs evidence that the matter was promptly reported.

6. Banks and E-Wallet Providers

If the loan proceeds were sent to a bank or e-wallet account, the financial institution may be able to freeze, investigate, or trace the account subject to legal processes and internal rules.

XXIX. Burden of Proof and Practical Reality

Legally, the person or company claiming payment should be able to prove the basis of the obligation. In practice, however, the victim often bears the burden of actively disputing the fraudulent account and gathering evidence.

The lender may have system records. The victim must counter with facts showing non-consent and non-receipt. This is why a written dispute, affidavit, reports, screenshots, and financial records are important.

XXX. Possible Outcomes

After investigation, several outcomes are possible:

The lending app confirms fraud and clears the victim;
The lender suspends collection but requires additional documents;
The company refuses to recognize the dispute;
The matter escalates to regulators;
The perpetrator is identified through the disbursement account;
The victim files criminal complaints;
Collection continues unlawfully, giving rise to further complaints;
Records are corrected after regulatory intervention.

Victims should insist on written confirmation of resolution.

XXXI. Preventive Measures

To reduce the risk of identity theft:

Do not send photos of IDs casually through messaging apps;
Add watermarks to ID copies when submitting them, stating the purpose and date;
Avoid posting personal documents online;
Secure email and mobile accounts;
Use strong passwords and two-factor authentication;
Do not share OTPs;
Be careful with fake job posts, fake loan offers, and fake verification requests;
Report lost IDs promptly;
Review app permissions before installing lending apps;
Avoid granting unnecessary contact or storage access;
Use official app stores and verify company legitimacy;
Monitor bank, e-wallet, and credit activity.

A good watermark may say: “For [Company Name] loan verification only, submitted on [date]. Not valid for other purposes.”

XXXII. Responsibilities of Online Lending Companies

Online lenders should implement strong safeguards, including:

Robust know-your-customer verification;
Liveness detection;
Anti-fraud monitoring;
Duplicate identity detection;
Secure storage of IDs and selfies;
Clear consent mechanisms;
Limited data collection;
Proper handling of fraud disputes;
Trained collection agents;
Vendor and third-party collector oversight;
Data breach response protocols;
Easy reporting channels for identity theft;
Prompt correction of fraudulent records.

Digital lending companies benefit from speed and automation, but speed should not come at the expense of identity protection and due process.

XXXIII. Criminal, Civil, and Administrative Dimensions

Identity theft in online lending is rarely just one legal issue. It may involve three overlapping dimensions.

Criminal

The perpetrator may be prosecuted for identity theft, fraud, falsification, or related offenses.

Civil

The victim may seek damages, correction of records, and relief from liability.

Administrative or Regulatory

The lending company may face complaints before regulators for privacy violations, abusive collection, or failure to comply with lending rules.

A single incident may require several parallel actions.

XXXIV. Frequently Asked Questions

Am I required to pay a loan I never made?

Generally, no. A person should not be liable for a loan they did not authorize and did not receive. But the loan must be formally disputed.

Can collectors call my family or employer?

They should not harass, shame, threaten, or improperly disclose personal debt information to third parties. This is especially problematic when the account is disputed as identity theft.

Should I file a police report?

Yes, it is usually advisable to file a report or blotter to document the incident.

Should I send my ID again to the lending app?

Only send documents through verified official channels. Consider watermarking copies and limiting the purpose of submission.

Can the lending app refuse to give information?

It may limit certain disclosures for privacy or security reasons, but it should still investigate and provide enough information to address the dispute.

Can I sue the person who used my identity?

Yes, if evidence supports the claim. Criminal complaints and civil claims may be available.

Can I complain against the lending app?

Yes, especially if it mishandled your personal data, refused to investigate, or used abusive collection methods.

What if I know who did it?

Preserve evidence linking the person to the transaction, such as messages, admissions, account details, disbursement records, or witness statements.

XXXV. Suggested Structure of an Affidavit of Identity Theft

An affidavit may include:

Personal details of the affiant;
Statement that the affiant discovered an alleged loan account;
Statement that the affiant did not apply for or authorize the loan;
Statement that the affiant did not receive proceeds;
Description of collection calls or messages;
Identification of the lending app or collector;
Details of possible compromised ID, phone, or account;
Steps taken to report and dispute the matter;
Attachments;
Statement that the affidavit is executed to attest to the truth and support complaints or investigations.

The affidavit should be truthful, specific, and consistent with available evidence.

XXXVI. Conclusion

Identity theft involving online lending apps is a serious legal and financial problem in the Philippines. It affects not only the victim’s finances, but also reputation, privacy, employment, family relationships, and emotional well-being.

The key legal point is that a person should not be liable for a loan they did not consent to, authorize, or benefit from. However, the victim must act quickly and formally. The matter should be disputed in writing, evidence should be preserved, accounts should be secured, and reports should be filed with the proper authorities.

At the same time, online lending companies have a duty to verify borrowers properly, protect personal data, investigate fraud reports, and avoid abusive collection practices. Digital lending may be convenient, but it must operate within the boundaries of consent, privacy, fairness, and accountability.

Identity theft is not merely a private inconvenience. It may involve cybercrime, fraud, falsification, privacy violations, regulatory breaches, and civil liability. A victim who responds promptly, documents carefully, and invokes the proper legal remedies has a stronger chance of stopping collection, clearing their name, and holding the responsible parties accountable.