here’s a practical, everything-you-need legal guide (Philippine context) on liability for a loan obtained using a “borrowed” ID—whether you’re the ID owner, the actual borrower, or the lender/collector. We’ll cover civil, criminal, and regulatory angles; how e-KYC and e-signatures change the analysis; how to dispute, defend, or unwind the debt; and include ready-to-use templates.

1) Big picture (read this first)

Debt follows the person who actually contracted, not the plastic card. An ID is only evidence of identity, not the contract itself.
The ID owner is not liable for the loan unless they (a) signed (as borrower, co-maker, or guarantor), (b) authorized an agent in writing (SPA/board resolution) who signed for them, or (c) are estopped (their own acts reasonably led the lender to believe the agent had authority).
If someone stole or “borrowed” your ID and took a loan without your authority, your default position is no civil liability—but you must act quickly to dispute, document, and report or you risk estoppel and credit-damage.
Using someone else’s ID (even with “permission”) to get a loan can cross into criminal offenses (estafa, falsification, use of fictitious name, access-device offenses) plus administrative sanctions for the lender if its KYC was sloppy.

2) Scenario map (who can be liable for what)

Scenario	Civil liability (who pays the loan)	Criminal exposure	Notes
ID stolen / used without any consent (in-person or online)	Actual impostor is liable. ID owner is not contractually bound.	Impostor: estafa, falsification, use of falsified docs, access-device or cyber offenses (depending on method).	ID owner must dispute fast (see §8) to avoid estoppel and limit credit harm.
*ID “borrowed” with owner’s verbal* permission** (owner didn’t sign anything)	Still impostor is liable; owner usually not, unless lender can prove agency by estoppel (owner’s acts caused reasonable reliance).	Both may face estafa/falsification if deception was intended.	Verbal “go ahead” rarely equals valid SPA; but facts can create estoppel (e.g., owner present at signing, vouches, benefits directly).
Owner co-signed/guaranteed (co-maker/surety)	Solidary liability—lender may collect 100% from owner or borrower.	None by itself; criminal only if deceit/forgery.	Co-makers often waive defenses; read the fine print.
Forged wet signature (paper loan)	Owner not liable; lender must sue the forger.	Forger: falsification; possibly estafa.	Owner should raise forgery and demand examination of original document.
e-KYC selfie/OTP shared by owner to borrower	Likely owner bound if attribution shows owner’s device/credentials were used by or with owner’s participation; otherwise disputable.	Borrower may face estafa; owner may face aiding/abetting if complicit.	E-Commerce Act recognizes electronic attribution; sharing OTPs undermines your defense.
Employer/agent took loan “for the company” using officer’s ID without corporate authority	Company not bound unless actual/apparent authority proven; individual taker liable.	Possible estafa/falsification.	Lenders should require board/SPA; officers should limit mandates in writing.

3) Civil liability: how courts decide “who owes”

Privity of contract controls. The person who signed the promissory note/loan agreement (physically or electronically) is the debtor.
Agency & authority. A principal is bound if the agent had actual authority (e.g., SPA) or apparent authority (principal’s acts led lender to reasonably rely).
Forgery breaks privity. A forged signature is a nullity—no contract formed as to the purported signer.
E-signatures & attribution. Under the E-Commerce Act, electronic signatures and records are valid if reliably attributable to the person (device IDs, audit logs, selfies, liveness checks, IPs, OTPs). Attribution is rebuttable: you can defeat it with credible evidence of compromise or impersonation.
Co-makers/guarantors. Most forms create solidary (co-equal) liability. You can end up paying everything even if you didn’t receive the proceeds.

4) Criminal angles (when “borrowing” an ID becomes a crime)

Estafa (Art. 315) – deceiving the lender (e.g., misrepresenting identity or authority) to obtain the loan.
Falsification – forging/altering signatures; use of falsified document; presenting fake or altered IDs.
Use of fictitious name / concealing true name (Art. 178) – passing off as another to gain advantage.
Access Devices Regulation offenses (RA 8484) – for credit cards and similar instruments, if applicable.
Cyber-qualified fraud – when deceit is executed via computer systems (apps/e-KYC), penalties can be heavier.
Conspiracy & accomplice liability – the ID owner who knowingly “lends” an ID to facilitate deceit can be treated as a co-conspirator.

No jail for simple debt: failure to pay without deceit is civil, not criminal. The crime is the lying/forgery used to get the loan or to collect it.

5) Lenders’ duties (why weak KYC can backfire)

KYC & CIP (customer identification program) commensurate with risk—collect valid government ID, selfie/liveness where applicable, compare data, and keep tamper-evident logs.
Truthful disclosures (APR/fees), fair debt collection, and data-privacy compliance.
If a lender cut corners, courts may (a) refuse to bind a disputed party, (b) reduce recoverable charges, and/or (c) regulators can sanction the lender (suspension/fines/takedown for abusive apps, etc.).

6) Defending an ID owner who’s being dunned for a loan they didn’t take

Goal: create a clean paper trail that (i) you never consented, (ii) the signature/e-attribution is not yours, and (iii) you’re invoking your privacy and consumer rights.

Freeze & dispute (within days). Send a written dispute to the lender and collector (email + courier): “I did not apply/authorize; stop processing/collection; give me the file copies (application, IP/device logs, selfie, voice clips).”
Affidavit of Non-Involvement (notarized). Attach ID copies; explain loss/theft (if any), deny consent, and authorize forensic checking.
Police blotter / NBI complaint if you suspect fraud.
Credit file alert. Ask the Credit Information Corporation / bureaus to flag the tradeline as disputed identity fraud; keep ticket numbers.
Data privacy request. Exercise access/correction rights; demand deletion/cease-processing if you’re not the customer; insist on lawful basis for holding your data.
Demand proof. Ask for the wet-ink original (if paper) or forensic trail (if digital): device IDs, IPs, time stamps, selfie/liveness results, OTP logs.
If sued: In your Answer, specifically deny due execution and authenticity; ask for originals and forensic; consider counterclaim for abusive collection/defamation if facts fit.

7) When the ID owner actually “helped” (hard truths)

If you handed over your ID, selfies, or shared OTPs, you handed the other side a presumption that you participated. Civilly, you can still argue no authority (no SPA, no signature), but:

You risk agency by estoppel if you appeared, vouched, or benefited (proceeds to your account, your bills got paid).
You risk criminal complicity if the plan involved deception.
Best strategy: settle the account (e.g., have the true borrower assume/refinance) and seek written releases; if collectors are abusive, negotiate through counsel.

8) Online/app loans and e-KYC: special rules of thumb

Never share OTPs or logins. Attribution will point back to your device/session.
Revoke intrusive app permissions (contacts/photos). Harassment and contact-shaming are illegal; document and complain if they happen.
Screenshots are king. Pre-loan screens, consent pages, and SMS flows decide attribution and disclosure issues.
If you truly didn’t apply, ask for the selfie/liveness capture, device fingerprint, and location/IP logs—then compare against your phone and whereabouts.

9) Evidence kit (what each side should keep)

ID owner (victim):

Dispute letters + courier proofs; Affidavit of Non-Involvement; blotter/NBI; copy of your ID; travel/phone records that contradict alleged application times.
Credit bureau tickets; any harassing messages (screenshots).

Lender:

KYC files: ID images, selfies, liveness outcomes, time/IP/device logs, voice confirmations, consent screens, signed PN/contract (or e-signature audit).
Collection logs (to prove fairness).

Borrower (actual):

If you intend to fix it: written settlement/restructure; receipts; release & waiver.

10) Practical playbooks

A) You’re the ID owner and it wasn’t you

Same day: Send dispute + data-access request; turn on fraud alert at CIC.
Within 48–72h: Execute Affidavit; police/NBI report.
Week 1: File privacy/consumer complaints if lender ignores you; demand cease-and-desist from contacting your employer/contacts.
If suit filed: Deny execution, seek forensic, and consider counterclaims.

B) You’re the actual borrower who used a borrowed ID

Stop digging. Do not double down with new misrepresentations.
Engage to restructure/settle; ask for a no-filing/no-complaint clause in the settlement.
If there was deception, obtain counsel—risk includes estafa/falsification.

C) You’re the lender/compliance officer

Hold collections upon a plausible identity-fraud dispute; re-KYC; give document copies.
If fraud confirmed, block devices, segregate the file, and correct credit reporting.
Strengthen e-KYC (liveness, anti-spoofing, device binding), and train agents on fair debt collection.

11) FAQs (quick hits)

“They say I’m liable because my photo is on the ID used.” No. Identity proof ≠ contract. Liability arises from your consent/signature/authority, not the mere use of your likeness.
“I allowed a friend to use my ID but I didn’t sign.” You’re usually not bound, but estoppel risk rises if you appeared, vouched, or benefited.
“It was an e-signature—am I stuck?” Not automatically. Attribution can be rebutted with credible evidence of compromise (device logs, travel records, SIM swap proof).
“Can they contact my employer or family?” Mass-messaging and shaming are unlawful. Demand they stop; document; complain.
“They threatened estafa if I don’t pay.” Debt ≠ estafa. Estafa needs deceit at the start (or abuse of confidence). Ask them to put the alleged offense in writing—they rarely will.

12) Templates you can adapt

(A) Dispute + Data-Access / Cease-and-Desist (email + courier)

Subject: Identity Fraud Dispute – Account No. [____] I did not apply for, authorize, or benefit from the above loan. Any signature/e-signature attributed to me is unauthorized. Requests: (1) Place the account in dispute and cease collection against me; (2) Provide, within 7 days, copies of the application, promissory note/contract, and all KYC artifacts (ID images, selfie/liveness outputs, device/IP/OTP logs, voice records); (3) Treat my personal data under data-minimization—stop contacting third parties. I reserve all rights and will file with the proper authorities if harassment continues.

(B) Affidavit of Non-Involvement (key paragraphs)

I, [Name], of legal age… state: (1) I did not apply for nor authorize any person to obtain a loan from [Lender] under Account [____]; (2) Any use of my identification [ID Type/No.] was without my knowledge/consent; (3) I did not sign any document nor receive any proceeds; (4) I request copies of any records purportedly linking me to the loan and consent to forensic comparison of signatures/biometrics; (5) I execute this to assert non-involvement and support complaints with authorities.

(C) For lenders – Re-KYC demand to alleged borrower

We received an identity-fraud dispute from [Name]. Please complete re-KYC within 5 days (live selfie, valid ID, and device check). Pending verification, we have paused collection from the disputing party.

(D) Settlement (actual borrower using borrowed ID)

Without prejudice, I offer ₱[amount] / [plan] to settle Account [____] obtained using [ID owner’s name]’s ID. Upon completion, lender shall (1) issue a Release & Waiver in favor of [ID owner] and me; (2) correct credit reporting to remove the tradeline from [ID owner]’s file.

13) Red flags & precautions (for everyone)

Never send unredacted ID images over chat; mask signatures/ID numbers unless the recipient is the lender’s official channel.
Do not “lend” your ID. It risks criminal complicity and credit contamination.
Store copies of anything you sign; for e-loans, screenshot consent screens and payment pages.
Freeze/report immediately if your wallet/phone/ID is lost (telco SIM, bank apps, and lenders you have accounts with).

Bottom line

ID owners are not automatically liable for loans taken in their name—liability hinges on consent, signature, or valid authority. Move fast to dispute, document, and protect your credit and privacy if your ID was misused.
Actual borrowers who use another’s ID (even “borrowed”) risk criminal charges; fix the account through structured settlement and get written releases.
Lenders must prove attribution and keep collections lawful; weak KYC can lose the civil case and invite regulatory heat.
In every path, paper beats talk: insist on copies, logs, releases, and clear written terms.

This guide is general information, not legal advice. For high-stakes exposure (forgery allegations, criminal complaints, or court summons), consult counsel immediately to calibrate defenses and filings.