Quick answer

If a loan, credit card, credit line, or similar account was opened in your name without your knowledge or consent, report it immediately and in writing to the lender. State clearly that you dispute the entire account because of identity theft, request that collection and credit reporting be suspended while it is investigated, and ask the lender to preserve and provide the application and verification records.

Also secure your financial and online accounts, obtain your Credit Information Corporation (CIC) credit report, dispute any incorrect entry, and report the identity theft to the Philippine National Police (PNP) or National Bureau of Investigation (NBI). Escalate unresolved complaints to the regulator that supervises the provider—usually the Bangko Sentral ng Pilipinas (BSP) for banks and BSP-supervised institutions, or the Securities and Exchange Commission (SEC) for lending and financing companies.

Do not pay, sign a restructuring agreement, or promise to pay merely to stop collection calls. Those actions can complicate your position. At the same time, do not ignore demand letters, court papers, or threats involving immediate loss of money or property.

What counts as an unauthorized credit account?

An account is unauthorized when someone used your identity or personal information to obtain credit without your valid consent. Examples include:

A loan or credit card you never applied for;
An application containing a forged signature or fabricated selfie;
A digital loan approved using a compromised phone number, email address, one-time password, or online account;
An account opened by someone who had access to copies of your IDs;
A loan whose proceeds were released to a bank account, e-wallet, or person you do not control; or
An application you began but did not knowingly complete or authorize.

A disagreement about interest, charges, repayment terms, or the quality of a product is different from identity theft. Likewise, an account may not be “unauthorized” if you knowingly applied, authorized an agent, acted as a co-borrower or guarantor, or later expressly adopted the transaction. The contracts, authentication records, and surrounding facts matter.

You are not automatically liable just because the account bears your name

A lender must ordinarily establish that you entered into or authorized the credit agreement. A name, ID image, electronic record, or signature attributed to you is evidence that may be investigated, but it does not make a fraudulent transaction genuine by itself.

Electronic contracts and signatures can be legally valid in the Philippines. The real question is whether the electronic act was yours or was properly attributable to you. Consequently, do not assume that an online application is invalid merely because it has no handwritten signature—but do insist that the lender produce the records showing consent and attribution.

Depending on the facts, the impersonator’s conduct may constitute computer-related identity theft. Section 4(b)(3) of the Cybercrime Prevention Act of 2012 covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of another person’s identifying information. Other offenses, such as computer-related fraud, falsification, estafa, or violations of the Data Privacy Act, may also be relevant. The proper charge is determined by investigators and prosecutors, not by the label used in your complaint.

Act immediately: the first 24 hours

1. Contact the lender through a verified channel

Use contact details from the lender’s official website, app, statement, or regulatory listing—not a number contained only in a suspicious text message.

Tell the lender:

You did not apply for, authorize, receive, use, or benefit from the account;
You dispute the account and all related transactions;
The matter involves suspected identity theft;
Collection activity and adverse credit reporting should be suspended while the dispute is investigated;
No account detail, address, phone number, email address, or payout destination should be changed without enhanced verification;
Relevant records must be preserved; and
You want a case or reference number and written confirmation.

If the account can still be used, ask the provider to block or restrict it immediately. BSP rules require supervised institutions to maintain an active 24/7 channel for concerns involving unauthorized or fraudulent transactions and to give those concerns priority, with resolution appropriate to their complexity. See the BSP’s financial-consumer protection guidance.

A telephone report is useful for speed, but follow it with an email, secure message, or letter so there is a dated record.

2. Secure the accounts that may have been compromised

Change the passwords of your primary email account, mobile banking, e-wallets, social-media accounts, and government portals. Use new, unique passwords and enable multi-factor authentication.

Also:

Contact your mobile network if your SIM stopped working unexpectedly or you suspect a SIM replacement;
Review bank and e-wallet histories for unfamiliar transactions;
Sign out unknown devices and revoke suspicious app access;
Check whether recovery emails, phone numbers, or device settings were changed;
Remove unknown loan apps after preserving relevant evidence and checking their permissions;
Notify banks or e-wallet providers if an unfamiliar account received the loan proceeds; and
Replace a compromised ID or account credential where the issuing agency permits it.

Do not give anyone an OTP, password, PIN, card verification value, or remote access to your phone—even if the caller claims to be investigating the fraud.

3. Preserve evidence before deleting anything

Keep original electronic files whenever possible. Preserve:

Collection texts, emails, chat messages, call logs, and voice recordings lawfully in your possession;
Screenshots showing the full account name, number, date, time, sender, and URL;
The lender’s notices, statements, demand letters, and delivery records;
Your complaint, attachments, acknowledgment, and reference number;
Credit reports showing the disputed account;
Evidence that you were elsewhere or used a different device, phone number, email address, address, or bank account;
Alerts concerning password changes, SIM replacement, new-device logins, or ID use;
Proof that you did not receive the proceeds;
Police or NBI reports and affidavits; and
Notes identifying every collector who contacted you, what was said, and when.

Export chats and emails rather than relying only on cropped screenshots. Do not alter metadata or annotate the only copy of a file. Keep backups in a secure location.

Send a formal written dispute to the lender

Your written dispute should identify you sufficiently for the provider to locate the account without exposing more personal data than necessary. Include:

Your full name and safe contact details;
The disputed account number, if known;
When and how you discovered it;
An unequivocal statement that you did not apply for or authorize it;
Whether you received or benefited from any proceeds;
Any facts showing that the contact details, device, signature, selfie, payout account, employer, or address were not yours;
A list of supporting documents;
The specific remedies you request; and
A request for a written investigation result.

Ask the lender to preserve and, subject to lawful disclosure and redaction, provide or explain the records used to approve the account, including:

The complete application and contract;
Signatures, selfies, IDs, video-verification records, and liveness-check results;
Phone numbers, email addresses, and addresses supplied;
Dates and timestamps;
IP addresses, device identifiers, and authentication logs;
OTP and multi-factor-authentication records;
Call recordings and agent notes;
The destination account or e-wallet for the proceeds;
Delivery or activation records; and
The source and recipients of any credit information reported about you.

Request that the provider:

Flag the account as disputed for suspected identity theft;
Stop disbursement or further use if still possible;
Suspend collection and refrain from transferring or selling the disputed obligation while investigating;
Correct or withdraw inaccurate credit data;
Stop contacting relatives, employers, or other third parties about the alleged debt except where legally permitted;
Confirm that you will not be charged for an account determined to be fraudulent; and
Issue a written closure or correction letter if the dispute is upheld.

Do not send original IDs. Watermark copies where practical—for example, “For identity-theft dispute with [provider], [date] only”—without obscuring information the provider legitimately needs to verify you.

Check and correct your credit record

An unauthorized account may affect future applications even if no collector has contacted you.

Obtain your CIC credit report through the CIC’s official consumer credit-report channels. Examine the lender’s name, account type, opening date, balance, payment history, and status.

If the entry is wrong, file a free dispute through the CIC’s Online Dispute Resolution System. You must first obtain a CIC credit report containing the disputed data. Upload supporting records and respond promptly to CIC communications; under CIC’s dispute rules, failure to respond within five working days may cause the process to be terminated, without prejudice to refiling.

The Credit Information System Act gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information. It directs CIC to investigate and verify disputed information within five working days of receiving the complaint. If accuracy cannot be verified and proven, the disputed information must be deleted; affected parties must then be informed of the correction or removal within five working days.

A CIC dispute corrects the credit record. It does not, by itself, determine criminal liability or replace your direct dispute with the lender.

Report the identity theft to law enforcement

Report computer-assisted impersonation or a fraudulent digital application to either the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. You may also approach the police station or appropriate investigative office serving your area.

The NBI’s official procedure allows members of the public to request investigation by proceeding to its Cybercrime Division, undergoing an initial interview, executing a sworn complaint or statement, and submitting supporting documents or a relevant device for examination. See the NBI’s investigative-assistance procedure and online complaint page.

Bring:

A government-issued ID;
A chronological summary;
Copies of the lender’s records and collection demands;
Proof of your written dispute;
Credit-report entries;
Device, email, SIM, and account-security alerts;
Details of suspected persons, accounts, e-wallets, or phone numbers; and
Original devices or files if investigators request them.

Ask for the complaint, incident, or reference number. A police blotter or investigative report helps document that you reported the incident promptly, but it does not automatically cancel the debt or conclusively prove fraud. Continue the lender and credit-report disputes separately.

Escalate an unresolved complaint to the correct regulator

For banks, credit-card issuers, e-wallets, and other BSP-supervised institutions

First use the institution’s own Financial Consumer Protection Assistance Mechanism. If the response is absent or unsatisfactory, escalate the matter through the BSP Consumer Assistance Mechanism.

You may use BSP Online Buddy or submit the BSP Complaints, Inquiries and Requests form to consumeraffairs@bsp.gov.ph. Include:

A clear account of the dispute;
The resolution requested;
Your contact details;
Your complaint to the institution and its reply, if any; and
Supporting documents.

BSP’s mechanism is a second-level recourse process. It can facilitate communication and regulatory handling, but filing with BSP does not excuse you from responding to a court case or automatically erase an account.

For lending and financing companies supervised by the SEC

File a ticket through the SEC’s official iMessage portal. Identify the company’s exact registered name, the lending app or trade name, the disputed account, your prior complaint, and the requested corrective action.

You can use the SEC’s Check with SEC service to verify whether the company is registered and has the necessary authority. Report an unregistered or falsely represented lender as well as the identity-theft complaint.

Some groups—such as cooperatives and insurance providers—have different regulators. If the provider’s legal identity or regulator is unclear, check its registration documents and official regulator directories before filing.

Consider a National Privacy Commission complaint

Using your personal data to create an account may involve unlawful processing, inaccurate data, inadequate security, or a failure to honor your rights under the Data Privacy Act of 2012. The Act gives data subjects rights that include access and correction, subject to its conditions and exceptions.

Before filing a formal NPC complaint, generally write first to the lender or other personal information controller and give it an opportunity to act. Under the NPC’s complaint mechanics, the complainant should attach proof of the written request and either an unsatisfactory response or proof that the respondent failed to act within 15 calendar days after receiving it.

Use the NPC’s current Complaint-Affidavit form and follow its instructions carefully. The NPC introduced a new template effective July 1, 2025; incomplete complaints or missing evidence may lead to dismissal. Official forms and contact details are available from the National Privacy Commission.

The 72-hour data-breach notification rule is principally an obligation of the organization responsible for the data—not a deadline requiring an individual victim to file an NPC complaint within 72 hours.

What not to do

Do not make a “small payment” simply to stop calls if you deny the entire account.
Do not sign a restructuring, settlement, acknowledgment, or promissory note without legal advice.
Do not say the account might be yours merely because the collector knows your personal details.
Do not rely only on a telephone conversation or social-media message.
Do not send IDs, selfies, or signatures to an unverified collector.
Do not delete messages or reset a compromised device before preserving evidence.
Do not publicly accuse a named person without adequate proof.
Do not assume that blocking a collector corrects your credit report.
Do not ignore a summons, subpoena, demand with a real deadline, or notice of legal proceedings.
Do not file a knowingly false fraud report. Reporting protections are for genuine disputes, not attempts to avoid a valid debt.

If collectors contact your family, employer, or friends

Record the caller’s identity, company, number, date, exact statements, and intended recipient. Preserve screenshots or messages received by third parties with their permission.

Tell the lender in writing that the account is disputed for identity theft and demand that it review the collector’s conduct and personal-data use. Depending on the provider and conduct, complaints may be raised with the BSP, SEC, or NPC. Threats of violence, extortion, doxxing, or immediate physical danger should be reported promptly to law enforcement.

When legal help is urgent

Consult a Philippine lawyer immediately if:

You receive a court summons, subpoena, criminal complaint, or formal demand with a deadline;
A case has been filed, or wages, property, collateral, or funds are threatened;
The lender produces a signature, video, OTP, or device record that it attributes to you;
You know the suspected impersonator and there are family, employment, or business complications;
You initially participated in part of the application but dispute later acts;
You received, transferred, spent, or benefited from any of the proceeds;
The lender refuses to preserve records or continues adverse reporting after receiving strong evidence;
The fraud affects several institutions or involves substantial amounts; or
You are being threatened or harassed.

The Public Attorney’s Office may be an option for qualified indigent persons, subject to its requirements and conflict rules. A private lawyer can also assess civil, criminal, privacy, and procedural remedies based on the actual documents.

A practical reporting checklist

Verify the lender and account using an official channel.
Block or restrict any account that can still be used.
Send a written identity-theft dispute and obtain a reference number.
Ask the lender to preserve the application, authentication, and payout records.
Secure email, SIM, banking, e-wallet, and social-media accounts.
Save original messages, files, logs, demands, and security alerts.
Obtain and review your CIC credit report.
File a free CIC dispute for each inaccurate entry.
Report the incident to the PNP or NBI.
Escalate to the BSP or SEC if the provider does not resolve it.
Consider an NPC complaint after the required prior written approach.
Seek legal help immediately if formal proceedings or urgent loss are threatened.

Frequently asked questions

Should I pay while the lender investigates?

If you deny the entire account because you never authorized it, obtain legal advice before paying or agreeing to a repayment plan. Payment or acknowledgment may complicate the factual and legal dispute. If only some transactions are unauthorized but the underlying account is yours, continue dealing with undisputed obligations as appropriate and identify precisely what you dispute.

Is an affidavit of denial enough?

No single document guarantees cancellation. A sworn affidavit can clearly record your position, but the lender, CIC, regulators, investigators, or a court may examine the complete application, authentication records, payout trail, device evidence, and your conduct.

Will a police report remove the account from my credit report?

Not automatically. Submit the police or NBI record to the lender and use CIC’s separate dispute procedure. Credit correction and criminal investigation are different processes.

Can I demand a copy of the fraudulent application?

Request it in writing as part of your dispute and exercise of data-subject rights. The provider may need to verify your identity, protect third-party data, or redact information. If it refuses, ask for the legal and factual basis and raise the issue with the relevant regulator or NPC.

What if the lender says an OTP proves I applied?

An OTP record is important evidence but may not settle the issue. Ask where the OTP was sent, when it was generated, what device or IP address was used, whether a SIM replacement occurred, and where the proceeds went. Obtain legal assistance if the provider relies on technical records you cannot evaluate.

What if the loan does not appear on my CIC report?

Still dispute it directly with the provider and report the identity theft. An account may be new, not yet submitted, reported under different data, or held by an entity outside the particular report’s coverage. Recheck your report later and monitor further notices.

How quickly must I report?

Report as soon as you discover the account. Delay can allow further borrowing, collection, data sharing, or destruction of useful evidence. Different proceedings may have different limitation periods, but you should not wait for those periods to approach.

Can I handle the lender, CIC, police, and regulator reports at the same time?

Yes. These remedies serve different purposes and can generally proceed in parallel: the lender investigates the account, CIC addresses credit data, law enforcement investigates possible crime, and regulators address supervised conduct. Keep the facts consistent and update each office when material evidence or a resolution becomes available.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Liability and remedies depend on the contract, authentication records, payout trail, and other facts. Official sources and procedures were checked as of August 30, 2026.