Quick answer

Report the account immediately and in writing to the lender or credit issuer. State clearly that you did not apply for, authorize, receive, use, or benefit from the account or its proceeds. Ask the institution to flag the account as identity theft, stop any pending release, suspend collection and disputed charges, preserve all application and authentication records, investigate, correct its records, and confirm the result in writing.

An account does not become your valid debt merely because it bears your name. Consent is an essential requirement of a contract. But identity theft, forgery, authorization, receipt of proceeds, and later adoption of an account are factual questions, so do not ignore demands or rely on a phone call alone.

Depending on the provider and what happened, you may need separate reports to:

The provider’s fraud unit, consumer-assistance unit, and Data Protection Officer;
The Bangko Sentral ng Pilipinas (BSP), Securities and Exchange Commission (SEC), or Cooperative Development Authority (CDA);
The National Bureau of Investigation (NBI) or Philippine National Police Anti-Cybercrime Group;
The National Privacy Commission (NPC); and
The Credit Information Corporation (CIC), if the account appears in your credit report.

A police blotter or regulator complaint does not automatically close the account or erase a credit entry. Each track serves a different purpose.

What Philippine law says

Under Article 1318 of the Civil Code, there is no contract without the consent of the contracting parties. If another person applied using your identity and you never authorized or adopted the transaction, the lender must have a legal and factual basis before treating you as the borrower.

In BPI v. Spouses Sarda, the Supreme Court upheld the dismissal of a credit-card collection case where the bank failed to prove the respondents’ receipt and use of the cards and their consent to a supplementary card. Statements of account alone did not establish liability under the facts of that case. The ruling is helpful but not an automatic result for every identity-theft dispute; each case depends on its documents, transactions, communications, and conduct.

Using another person’s identifying information online without right may constitute computer-related identity theft under the Cybercrime Prevention Act. Depending on the evidence, computer-related forgery, computer-related fraud, access-device fraud, falsification, or estafa may also be investigated. The Access Devices Regulation Act amendments cover specified fraudulent acts involving credit cards, account credentials, online banking, and other access devices. Law-enforcement officers and prosecutors—not the victim or lender—determine the appropriate charge.

Financial providers are also subject to the Financial Products and Services Consumer Protection Act. It requires free consumer-assistance mechanisms, protection of client data, fair treatment, and timely complaint handling. For an alleged disputed amount or unauthorized transaction, the Act requires the provider, pending its final investigation report, to suspend interest, fees, and charges or give a similar reasonable accommodation.

What to do immediately

1. Verify the account without using the sender’s links

Contact the lender through the telephone number, website, branch, or app shown on its verified official channels. Do not call a number contained only in a suspicious text, email, demand letter, or social-media message.

Ask for enough information to identify the account:

Full legal name of the lender or credit issuer;
Account or application reference number;
Product type and opening or application date;
Principal amount or credit limit;
Whether money has already been released;
Disbursement account, e-wallet, or channel, subject to lawful disclosure;
Current balance and collection status; and
Whether information has been sent to the CIC or another credit-information provider.

Do not give an OTP, password, PIN, remote-access permission, or payment merely to “verify” your identity.

2. Contain any continuing compromise

If your email, mobile number, SIM, financial app, or device may have been compromised:

Change the password of your primary email first, then financial and social-media accounts.
Use unique passwords and activate multi-factor authentication.
Sign out unknown sessions and remove unfamiliar recovery numbers or email addresses.
Contact your telecommunications provider if your SIM stopped working unexpectedly or may have been replaced.
Check your real bank and e-wallet accounts for unauthorized transfers.
Scan devices for malicious applications, especially remote-access or screen-sharing software.
Tell the issuing agency if a physical government ID was lost, and follow its replacement or cancellation procedure.
Warn household members not to respond to collectors or disclose additional information.

Preserve evidence before deleting suspicious messages or applications.

3. Send a formal written dispute

Send the dispute to the provider’s fraud or consumer-assistance unit and copy its Data Protection Officer when possible. Use a channel that produces proof of receipt, such as an official ticket, acknowledged email, registered mail, courier receipt, or branch-stamped copy.

Include:

Your full name and safe contact details;
The account or application reference;
When and how you discovered it;
A direct statement that you did not apply, consent, sign, receive the credit card, authorize another person, or receive or use the proceeds, as applicable;
Any known compromise involving an ID, SIM, email, device, or account;
A list of attached evidence; and
The specific relief you want.

Request that the provider:

Stop any pending disbursement, card delivery, or account activation.
Mark the account and all collection records as formally disputed for identity theft.
Suspend interest, penalties, fees, collection activity, and adverse reporting while the dispute is investigated.
Instruct its collection agency that liability is disputed.
Preserve the complete application, KYC, authentication, transaction, disbursement, and communications records.
Provide the personal data and documents you are entitled to access.
Correct inaccurate personal and credit information and notify recipients of the correction where required.
Confirm in writing whether the account is closed, whether you are being held liable, and what credit-reporting correction was submitted.

A concise statement may read:

I formally dispute Account/Application No. [reference] as an account opened through unauthorized use of my identity. I did not apply for or authorize it, sign its documents, receive or use its proceeds, or authorize any person to act for me. Please flag the account for identity theft, prevent further use or disbursement, preserve all relevant records, investigate, suspend disputed charges and collection activity, correct any adverse reporting, and provide your written findings.

Describe only facts you can truthfully swear to. Do not claim that an ID was physically lost if only a copy or photograph may have been misused.

4. Ask for the underlying records

Under the Data Privacy Act, a data subject generally has rights to reasonable access and correction. Ask for:

The application and loan or card agreement;
Signatures, selfies, video verification, ID images, and submitted contact details;
Recorded application or confirmation calls;
Electronic-signature or authentication records;
Dates, IP addresses, device identifiers, and login records;
The mobile number or email that received an OTP;
Delivery records for any card;
Disbursement instructions and proof of release;
Transaction history;
The source of your personal data;
Persons or entities to whom the data was disclosed; and
Credit-reporting submissions and correction notices.

Access is not unlimited. The provider may lawfully redact another person’s data or restrict material covered by an investigation, bank-secrecy rules, privilege, or another legal exception. Even if immediate disclosure is restricted, expressly request preservation so the records remain available to regulators or law enforcement through lawful process.

5. Secure an incident or case reference

Keep the provider’s case number and the name or unit handling the dispute. After every call, send a written confirmation of what was discussed. If the provider refuses to accept the report, document the refusal and escalate it.

Important deadlines

Report immediately even if you do not yet have every document.

For credit-card billing errors, the Philippine Credit Card Industry Regulation Law gives a cardholder up to 30 calendar days from the statement date to report an error or discrepancy. The issuer must take action within 10 business days after receiving the notice. If you discovered identity theft later, still dispute it; do not assume that missing the billing period validates an account you never authorized.

Claims under the Financial Products and Services Consumer Protection Act generally prescribe five years from consummation of the financial-consumer transaction, or five years from discovery of deceit or nondisclosure of material facts, with an outside limit of ten years from the violation. Other civil, criminal, privacy, and procedural deadlines may differ.

Escalate to the correct financial regulator

Complain to the provider first unless delay would expose you to continuing loss or another urgent remedy applies. Attach the original complaint, acknowledgment, response, and supporting documents when escalating.

Provider	Regulator and route
Bank, credit-card issuer, e-money issuer, pawnshop, money-service business, operator of a payment system, or another BSP-supervised institution	Use the BSP Consumer Assistance Mechanism. Complaints may be filed through the BSP Online Buddy or by sending the prescribed form to `consumeraffairs@bsp.gov.ph`.
SEC-licensed lending or financing company, including its online lending platform	File through SEC iMessage or contact the SEC Financing and Lending Companies Division. Identify both the app or trade name and the corporation operating it.
Cooperative offering a loan or credit service	Complain first through the cooperative’s consumer-assistance mechanism, then use the CDA’s consumer-redress process. The CDA’s current framework is described in Memorandum Circular No. 2025-08.
Unidentified, unlicensed, or fictitious lender	Report it to the SEC and law enforcement. Do not send more identity documents or money to the operator.

If you are unsure who regulates the provider, ask the BSP or SEC to confirm jurisdiction and check the entity’s license—not only its corporate name or app-store listing.

A regulator complaint deals with the provider’s conduct and handling of your dispute. It does not, by itself, prosecute the identity thief. Under the Financial Products and Services Consumer Protection Act, BSP and SEC adjudicatory authority includes certain purely civil financial claims where the only relief is payment or reimbursement not exceeding ₱10 million, subject to the regulator’s formal rules and prerequisites.

Make a cybercrime or fraud report

Report to the NBI Cybercrime Division, the PNP Anti-Cybercrime Group, or the appropriate regional unit. The Cybercrime Prevention Act designates the NBI and PNP as cybercrime law-enforcement authorities.

The NBI provides an online complaint page and investigative assistance through its Cybercrime Division and regional offices. For initial anti-scam guidance or referral, the DICT also lists the national 1326 reporting channel on its official contact page.

Be prepared to:

Present a valid ID;
Execute a truthful sworn complaint or affidavit;
Submit the lender’s acknowledgment and available account documents;
Identify all relevant phone numbers, email addresses, usernames, URLs, accounts, and devices;
Provide original electronic evidence when requested; and
Explain the chronology from discovery through your reports.

A blotter entry, affidavit of loss, or online tip may support your case, but it is not necessarily the same as a formally docketed criminal complaint. Ask for the official reference number and what further appearance or affidavit is required.

The criminal report will not automatically correct the lender’s database or your credit report. Send its reference number to the lender, regulator, NPC, and CIC as supporting evidence.

File a privacy complaint when appropriate

Unauthorized collection, use, disclosure, or continued processing of your identity data may raise issues under the Data Privacy Act. Start by notifying the provider or its Data Protection Officer in writing.

Under the NPC’s 2021 Rules of Procedure, an NPC complaint generally requires proof that:

You informed the respondent in writing; and
The respondent failed to take timely or appropriate action, or failed to respond within 15 calendar days after receiving your written notice.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy, or patently illegal action.

Use the NPC’s current Complaint-Affidavit and filing instructions. The complaint must generally be verified or notarized and supported by evidence, correspondence, the relief requested, a valid ID, and the required certification against forum shopping. Filing fees apply unless an exemption or waiver is available. The NPC currently accepts authorized electronic submissions at complaints@privacy.gov.ph, as well as the other modes stated in its rules and filing page.

The NPC addresses privacy violations and data-subject rights. It is not a substitute for the financial regulator’s dispute process, credit-report correction, or a criminal complaint.

Check and dispute your credit report

Obtain your CIC credit report through a channel listed by the Credit Information Corporation. If the fraudulent account appears, file through the CIC Online Dispute Resolution System. The portal requires information from the credit report, including its transaction reference number.

Attach:

Your written dispute to the lender;
The lender’s acknowledgment or decision;
Law-enforcement and regulator references;
Proof that the application details, contact channels, signature, device, or disbursement destination were not yours; and
Any confirmation that the lender has corrected or closed the account.

Under the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated, or misleading credit information. The law directs the CIC to investigate and verify disputed information within five working days from receipt of the complaint. Information that cannot be verified or proven accurate must be deleted, and affected recipients must be informed of the correction or removal within five working days. In practice, the CIC’s system also relies on the submitting lender to send the correction, so answer CIC communications promptly.

Notify the credit-report provider that issued your report as well. Continue monitoring because an account may be reported or updated after your first check.

Evidence to preserve

Keep originals where possible and make backed-up copies of:

Texts, emails, demand letters, envelopes, chat threads, and call logs;
Full screenshots showing dates, account names, URLs, and phone numbers;
Original emails with headers;
Statements, account references, collection notices, and credit reports;
The lender’s application, KYC materials, agreements, and investigation result;
Proof that the phone number, email, device, address, employer, or bank account used was not yours;
Travel, attendance, employment, location, or medical records showing you could not have made an in-person application;
SIM-replacement, email-compromise, or account-recovery records;
Evidence showing where the proceeds went;
Reports filed with the provider, regulators, CIC, NPC, NBI, or PNP; and
Notes of calls, including date, time, number called, representative, and case number.

Do not crop away important context, edit original files, or delete the device or account from which evidence may be retrieved.

Common mistakes to avoid

Reporting only by telephone and keeping no proof.
Paying a “small amount” to stop calls without legal advice.
Signing a restructuring agreement, settlement, promissory note, or acknowledgment of debt.
Saying an ID was lost when it was not.
Sending additional selfies, IDs, or OTPs through an unverified collector’s channel.
Assuming a police blotter automatically cancels the debt.
Disputing only with the collector instead of the actual lender.
Ignoring statements, demand letters, prosecutor notices, or court summons.
Deleting messages or resetting a device before preserving evidence.
Making a false report against a family member when authority or consent was actually given.
Assuming that closing the account automatically removes the credit entry.

When legal help is urgent

Consult a lawyer promptly if:

A court summons, subpoena, prosecutor’s notice, or formal collection complaint has been served;
The account is secured by a mortgage, vehicle, payroll deduction, guaranty, or other property;
Foreclosure, repossession, garnishment, or salary deduction is threatened;
You received or used any part of the proceeds, even unintentionally;
Someone claims that you authorized them orally or through a power of attorney;
You previously made payments or signed documents relating to the account;
Several fraudulent accounts have appeared;
The lender refuses to preserve records or continues adverse reporting after receiving strong contrary evidence; or
There are threats, extortion, impersonation, or continuing access to your accounts.

Do not miss the response date stated in a summons or official notice. If private counsel is unaffordable, ask the Public Attorney’s Office or a recognized legal-aid office whether you qualify for assistance.

Frequently asked questions

Do I have to pay an account I never opened?

Not merely because it is in your name. A valid contract requires consent, and a collecting lender must prove its claim if it goes to court. However, documents, electronic authentication, receipt or use of proceeds, payments, and later conduct can affect the result. Formally dispute the account instead of ignoring it.

Is an affidavit of loss required?

Only state that an ID or item was lost if that is true. If your information was copied or misused while the original ID remained with you, a truthful affidavit of complaint, denial, or identity theft is more accurate. The receiving agency may provide its required form.

Is a police report enough to clear my credit record?

No. It is supporting evidence. You must still dispute the account with the lender and, if reported, through the CIC process.

Can I demand deletion of all my data?

You may seek correction, blocking, removal, or destruction when the legal requirements under the Data Privacy Act are met. But a provider may be required to retain certain records for regulation, fraud investigation, litigation, or another lawful purpose. Ask it to correct the account, restrict unauthorized use, mark the matter disputed, and retain only what the law permits.

What if a relative opened the account?

Unauthorized use by a relative can still be identity misuse. But previous permission, shared benefit, receipt of proceeds, payments, or later approval may materially change the case. Do not make a knowingly false criminal report; obtain legal advice if consent or benefit is disputed.

Should I pay first and seek a refund later?

Usually not without advice. Payment or a signed settlement can complicate the factual dispute and may be presented as evidence that you accepted the account. If immediate payment is necessary to prevent a specific harm, consult counsel and document any payment under written protest.

Can I report to several agencies at the same time?

Yes. The lender, financial regulator, law enforcement, NPC, and CIC address different problems. Keep every report consistent, truthful, and cross-referenced by case number.

Official legal and procedural sources

This article provides general Philippine legal information, not advice for a particular case. Liability and the proper remedy depend on the account documents, authentication records, transactions, communications, and procedural posture. Laws and official procedures checked as of 25 August 2026.