Quick answer

If a loan, credit card, credit line, buy-now-pay-later account, or online lending account was opened using your identity without your knowledge or consent, immediately dispute it in writing with the lender and state clearly that you did not apply for, authorize, receive, or benefit from the account. Ask the lender to:

freeze collection and further disbursements;
preserve all application and transaction records;
investigate the identity theft;
provide copies of the application, contract, identification documents, selfie or video verification, device and login records, contact details, disbursement destination, and payment history;
stop reporting the account as yours; and
correct any credit information already submitted under your name.

Also secure your compromised accounts, obtain and dispute your Credit Information Corporation (CIC) credit report, and report the incident to the appropriate regulator and law-enforcement agency.

A police blotter, affidavit of denial, or cybercrime complaint is important evidence, but it does not automatically erase the account. The lender and any credit-reporting entity must still be formally notified, and inaccurate credit information must be separately disputed.

Do not pay merely to stop collection calls if the debt is not yours. A payment, restructuring request, promise to pay, or settlement proposal may later be cited as evidence that you recognized the account. If you receive a demand letter, subpoena, summons, or court notice, obtain legal advice promptly and respond within the stated deadline.

Why an unauthorized account is not automatically your debt

A valid contract generally requires consent, a definite object, and a lawful cause. Under Article 1318 of the Civil Code of the Philippines, consent is an essential element of a contract.

If an impostor used your name, identification document, signature, photograph, mobile number, or personal information without authority, your identity alone does not establish that you agreed to the loan. The institution asserting the obligation may need to prove that you—or someone whom you authorized—actually entered into the transaction.

The result may depend on evidence such as:

whether the signature or electronic acceptance is authentic;
whether a one-time password was sent to and used through your registered device;
whether biometric or video verification was performed;
where the proceeds were sent;
who controlled the receiving bank or e-wallet account;
whether you received or benefited from the money;
whether you later acknowledged or paid the account; and
whether another person had actual authority to transact for you.

This is different from a genuine loan that you personally obtained but now dispute because of interest, collection conduct, or inability to pay. Identity theft should not be used to deny an account that was actually authorized.

Act immediately: contain the identity theft

1. Secure your email, phone, financial accounts, and devices

Change the passwords of the email address, bank accounts, e-wallets, social-media accounts, government portals, and other services connected to your identity. Use unique passwords and enable multi-factor authentication where available.

Check for:

unfamiliar password-reset messages;
unknown devices or active sessions;
changed recovery addresses or phone numbers;
unauthorized SIM replacement or loss of mobile service;
unfamiliar bank or e-wallet transfers;
newly linked beneficiaries;
unknown applications installed on your phone; and
altered contact or mailing information.

If your SIM may have been taken over, contact the telecommunications provider immediately. If an ID was lost or copied, notify the issuing agency and ask what replacement, annotation, or protective procedure is available.

Do not delete suspicious messages, applications, or account histories before preserving the evidence.

2. Contact the lender through a verified channel

Use the lender’s official website, app, published hotline, branch, or regulatory listing—not a link or telephone number supplied by the collector or suspected impostor.

Tell the institution that the account is disputed for identity theft. Request a case or reference number and written acknowledgment.

A concise notice may state:

I formally dispute Account No. [reference] as an unauthorized account opened through identity theft. I did not apply for, consent to, sign, receive the proceeds of, or benefit from this account. Please freeze collection and further transactions, preserve all relevant records, investigate the application, prevent or correct adverse credit reporting, and provide the records on which you rely in attributing the account to me.

State only what is accurate. If you do not yet know whether money entered an account under your control, say that the matter is under investigation rather than making an unsupported categorical statement.

3. Ask the lender to preserve and disclose the relevant records

Request preservation of:

the complete application and all attachments;
the loan or credit agreement and disclosure statement;
signatures and electronic acceptance records;
copies of IDs, photographs, selfies, video recordings, and biometric results;
mobile numbers, email addresses, home and employment details used;
dates and times of application, approval, and disbursement;
IP addresses, device identifiers, browser or app records, and authentication logs;
one-time-password and verification records;
call recordings and customer-service notes;
the account into which proceeds were disbursed;
subsequent transfers, withdrawals, or purchases;
delivery records for cards or documents;
collection communications; and
information supplied to the CIC or other credit bureaus.

Some records may not be released immediately because they involve security procedures, third-party data, or an ongoing investigation. Nevertheless, a prompt preservation request helps reduce the risk that relevant electronic information will be lost through ordinary retention practices.

Under Section 13 of the Cybercrime Prevention Act of 2012, certain traffic data and subscriber information held by service providers must be preserved for at least six months from the transaction. Law-enforcement authorities may also issue lawful preservation and disclosure measures. This is a reason to report promptly rather than wait for collection to escalate.

4. Send supporting documents without oversharing

Depending on the circumstances, attach:

a signed dispute letter or affidavit of denial;
a police blotter or cybercrime complaint reference;
proof that your ID, phone, or SIM was lost or compromised;
screenshots of unauthorized-account notices;
proof of your actual mobile number, email address, and address at the relevant time;
bank or e-wallet records showing that you did not receive the proceeds;
travel, employment, or location records when relevant;
samples of your genuine signature; and
the disputed entry from your CIC credit report.

Redact unrelated account numbers, passwords, PINs, card security codes, and personal data that the recipient does not need. The BSP specifically warns complainants not to disclose passwords, PINs, complete card details, passports, or identification cards unnecessarily in a BSP complaint.

Check and dispute your credit record

An unauthorized account may affect future applications even before collectors contact you.

Obtain your CIC credit report

Get your credit report through the CIC’s Direct-to-Consumer Program or an authorized Special Accessing Entity. Review it for:

institutions you do not recognize;
incorrect loan or contract entries;
unfamiliar addresses, telephone numbers, or employers;
balances or delinquency records that are not yours; and
multiple accounts created around the same time.

A report from one private credit bureau may not contain every account. The CIC report is particularly important because covered financial institutions submit credit data to the government-owned central credit-information system.

File a CIC dispute

The CIC’s Online Dispute Resolution System covers erroneous, misleading, incomplete, or outdated information appearing in a CIC credit report. You generally need to obtain the report first because the online process asks for its transaction reference number.

Identify the institution, contract, account type, disputed balance or status, and the reason the account is not yours. Submit supporting evidence and monitor the email address used for the dispute.

The CIC forwards the dispute to the submitting institution and monitors the correction process. However, the CIC states that it cannot simply alter a lender’s submission unilaterally. For that reason, dispute the account both with the lender and through the CIC.

Do not confuse the rule allowing certain corrected negative information to remain for a limited period with an obligation to retain a completely fraudulent account under your identity. Your position should be that the account was never yours and that inaccurate attribution must be investigated and corrected.

Report to the correct financial regulator

The regulator depends on the type of institution.

Bank, credit-card issuer, digital bank, e-money issuer, or other BSP-supervised institution

First submit the complaint to the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. This is the first-level remedy required under the financial-consumer protection framework.

If the response is absent or unsatisfactory, escalate through the Bangko Sentral ng Pilipinas Consumer Assistance Mechanism. The BSP describes this as a second-level remedy. Complaints may be filed through the BSP Online Buddy on the BSP website or, if that channel is unavailable, through the current Complaint/Inquiry/Reply procedure described in the BSP’s official complaint guide. Include proof that you first raised the matter with the institution.

The Financial Products and Services Consumer Protection Act requires regulated financial-service providers to maintain consumer-protection mechanisms and gives financial regulators enforcement and adjudicatory powers within their respective jurisdictions.

Lending company, financing company, or online lending platform

Complaints involving SEC-regulated lending or financing companies and their online platforms may be submitted through the SEC’s I-Message Mo Portal. Follow the current requirements and provide one complete complaint for each respondent company.

The SEC may investigate regulatory violations or refer privacy, criminal, or other issues to the appropriate agency. However, the SEC explains that its complaint process does not itself declare a loan contract void or cancel an alleged debt. The identity-theft dispute must therefore still be pursued directly with the company, through the credit-report correction process, and, where appropriate, through law enforcement or court proceedings.

Before communicating with an online lender, verify the company and platform through official SEC records. Scammers may use the name of a legitimate company or operate an unregistered application.

Report the identity theft to law enforcement

Section 4(b)(3) of the Cybercrime Prevention Act penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion, without right, of another person’s identifying information. Depending on how the account was created and used, the facts may also involve computer-related forgery, computer-related fraud, falsification, estafa, unauthorized access, or other offenses. The precise charge is for investigators and prosecutors to determine from the evidence.

You may seek assistance from:

the NBI Cybercrime Division;
the PNP Anti-Cybercrime Group or the appropriate local cybercrime unit; or
the Cybercrime Investigation and Coordinating Center when its reporting channel is appropriate.

Bring printed and electronic copies of the evidence. Be ready to execute a sworn statement explaining:

when and how you discovered the account;
what information or ID may have been compromised;
why you deny authorizing the transaction;
what the lender disclosed;
where the proceeds apparently went;
the losses or collection activity caused; and
the steps already taken to secure your accounts.

A barangay or police blotter can document when you reported the incident, but it is not a judicial finding that the account is fraudulent. A formal investigation and supporting records remain important.

Consider a privacy complaint

The Data Privacy Act of 2012 gives data subjects rights relating to access, correction, objection, erasure or blocking in proper cases, and damages for violations of protected rights. An unauthorized credit account may raise privacy issues if an institution processed inaccurate or unlawfully obtained personal data, failed to apply appropriate safeguards, refused a proper correction request, or disclosed the supposed debt improperly.

First write to the institution or its data protection officer. Ask for access to your personal data, correction of inaccurate information, restriction of inappropriate processing, and an explanation of the source and recipients of the data, subject to lawful limitations.

If the privacy issue remains unresolved, review the National Privacy Commission’s complaint procedure. The NPC requires either a filled-out and notarized complaint-assisted form or a verified complaint, together with supporting evidence and, when applicable, witness affidavits. Filing may be personal, by registered mail, by courier, or through an electronic method authorized by the NPC.

A privacy complaint is not a substitute for disputing the debt, correcting the CIC record, or reporting the crime. These remedies address different aspects of the incident.

Evidence to preserve

Keep the originals and make backed-up copies of:

collection texts, emails, letters, and call logs;
screenshots showing the full sender, date, time, and web address;
account-opening, approval, and disbursement notifications;
your written disputes and proof of delivery;
complaint and regulator reference numbers;
credit reports before and after correction;
bank and e-wallet statements;
SIM-replacement or device-loss reports;
authentication and login alerts;
copies or photographs of the compromised ID;
affidavits and blotter or investigation records;
names and positions of employees who spoke with you; and
any document bearing the forged signature or false personal details.

Export original emails where possible instead of relying only on screenshots. Preserve suspicious links as text, but do not open them merely to gather evidence. Record the chronology while events are fresh.

Do not secretly record private conversations without first obtaining legal advice. The Anti-Wiretapping Act may apply depending on the circumstances and manner of recording.

If collectors contact your family, employer, or contacts

Respond once in writing that:

the account is disputed as identity theft;
you do not acknowledge the alleged debt;
the matter has been reported to the lender and relevant authorities; and
all future communications should be directed to you through a specified channel.

Ask the collector to identify the creditor, collection agency, account reference, basis of authority, and source of your information. Do not give additional identity data until you have independently verified the caller.

Document threats, public shaming, impersonation, disclosure of the alleged debt to unnecessary third parties, repeated harassment, or access to contacts and photographs. Depending on the institution and conduct, these matters may be raised with the BSP, SEC, NPC, or law enforcement.

Do not assume, however, that every contact with a reference person is automatically unlawful. The legality depends on what information was collected, the purpose and manner of contact, consent or another lawful basis, regulatory rules, and whether the communication unnecessarily disclosed the alleged debt.

If money entered your own account

Do not spend, transfer, return, or “refund” the funds based solely on instructions from a caller or text message. The supposed lender or scammer may be attempting to route stolen money through your account.

Immediately notify your bank or e-wallet in writing, ask it to restrict the suspicious funds where appropriate, and request instructions through verified channels. Report the transaction to law enforcement. Keep the amount intact unless your institution or competent authority gives lawful instructions.

Receipt of funds into an account under your control can complicate the dispute, but it does not by itself resolve who applied for the loan, who controlled the account, or whether you consented. Prompt reporting and non-use of the money are important evidence of good faith.

If the impostor is a relative, employee, or acquaintance

The account does not become authorized simply because the person knew you or had access to your documents. The central questions remain whether you consented, granted authority, ratified the transaction, or received its benefit.

Do not fabricate a loss report or conceal the person’s identity to protect them. Provide investigators with truthful information. If you previously allowed that person to use your phone, email, bank account, ID, or electronic signature, disclose the scope of that permission precisely. Limited permission for one purpose is not necessarily authority to obtain credit, but the facts may materially affect the case.

Common mistakes to avoid

Paying or negotiating before clearly disputing the account. This may create ambiguity about whether you recognize the debt.
Reporting only to the police. The lender and CIC must also receive a direct written dispute.
Dealing only with the collector. Notify the actual creditor through a verified channel.
Deleting the suspicious app or messages too soon. Preserve evidence first.
Sending complete IDs and account details to unverified addresses. Confirm the recipient and redact unnecessary information.
Assuming a blotter automatically cancels the loan. It documents a report but does not decide contractual liability.
Ignoring a credit report after the lender says the account is closed. Confirm that the CIC entry and demographic information were corrected.
Ignoring court papers because the debt is fraudulent. A valid defense can be lost or made harder by failing to respond.
Making absolute accusations without evidence. State what you know, what you deny, and what requires investigation.
Using an identity-theft claim for a loan you actually authorized. False statements in affidavits or official complaints can create separate liability.

When legal help is urgent

Consult a lawyer promptly if:

you receive a summons, subpoena, formal demand, or notice of a collection case;
the lender refuses to provide a meaningful investigation or continues adverse reporting;
substantial money was disbursed into an account connected to you;
the fraudulent account is secured by property or linked to a mortgage, vehicle, or business;
several accounts were opened using the same identity;
the institution alleges that you used an OTP, biometric check, electronic signature, or registered device;
you previously made a payment or signed a restructuring document;
the incident involves an insider, relative, employee, or former partner;
collectors threaten arrest, public exposure, or harm;
your personal information is being circulated online; or
you suffered a denial of credit, employment consequences, or significant financial loss.

Bring the complete chronology and unedited records. A lawyer may evaluate contractual defenses, evidentiary issues, regulatory remedies, privacy claims, criminal complaints, and the need for urgent court relief.

Frequently asked questions

Am I required to pay a loan that I never applied for?

Not merely because your name or ID appears in the lender’s records. The existence of liability depends on whether a valid agreement can be attributed to you and on the surrounding evidence. Formally dispute the account and avoid statements or payments that could be interpreted as acknowledgment.

Should I execute an affidavit of denial or loss?

It can help document your position, particularly when accompanied by objective evidence. It is not conclusive by itself. The affidavit must be truthful, specific, and based on personal knowledge.

Will a police blotter remove the account from my credit report?

No. Use the blotter or complaint as supporting evidence, but separately dispute the record with the lender and through the CIC’s dispute system.

Can I demand the full loan application?

You may request access to personal data and the records relied upon to attribute the account to you. Release may be subject to authentication, third-party privacy, security, evidentiary, and investigative restrictions. Ask for a written explanation if any material record is withheld.

What if the lender says an OTP proves I applied?

An OTP record is relevant but not always conclusive. Ask which number received it, when it was sent, what device and IP address were used, whether the SIM had been replaced, and where the proceeds went. The complete authentication trail matters.

What if the loan proceeds were sent to someone else?

That strongly supports further investigation, but it does not automatically decide the case. Obtain records identifying the destination account and report them to the lender and law enforcement.

Can the CIC immediately delete the fraudulent entry?

The CIC facilitates disputes but relies on the submitting institution’s correction or resolution. File with both the CIC and the institution, supply evidence, and retain the dispute reference.

Should I block collectors?

Preserve their messages and identify the creditor first. You may direct communications to a controlled written channel and block abusive numbers afterward, but ensure that you can still receive legitimate notices from the lender, regulator, prosecutor, or court.

Can I recover damages?

Potential remedies may exist under contract, tort, privacy, financial-consumer, cybercrime, or other laws, but entitlement depends on proof of the violation, responsible parties, causation, and actual injury. Regulatory complaints do not automatically produce compensation.

Official resources

This article provides general legal information, not legal advice for a particular case. Liability and the appropriate remedy depend on the account documents, authentication records, flow of funds, communications, and procedural history. Official sources and procedures were checked as of 24 August 2026.