Quick answer

If a loan, credit line, credit card, “buy now, pay later” account, or online-lending account was opened using your identity without your knowledge or authority, report it immediately and in writing to the lender. Clearly state that you dispute the entire account, did not apply for or authorize it, received no proceeds, and are requesting an investigation, suspension of collection, preservation of records, and correction of any credit information.

Also secure your compromised accounts and identification documents, obtain your CIC credit report, and report suspected identity theft to law enforcement. Escalate the complaint to the regulator that supervises the lender:

BSP for banks, digital banks, e-wallet issuers, credit card issuers, and other BSP-supervised institutions;
SEC for financing companies, lending companies, online lending platforms, and their collection agencies;
CDA if the disputed lender is a cooperative; and
NPC when your personal data was collected, used, disclosed, or retained unlawfully.

A police, NBI, or CICC report supports your position, but it does not automatically erase the account. Likewise, reporting the account to a regulator does not by itself determine criminal guilt or civil liability. The lender and any credit-information provider must still investigate and correct substantiated errors.

Do not ignore the account or simply start paying it

An unauthorized application does not become yours merely because it carries your name or identification details. A valid loan generally requires your consent or authority. However, identity theft is a factual claim that may need supporting evidence, especially if the application contains your signature, selfie, device information, one-time password, bank account, or other details apparently linked to you.

Do not make a “small payment” merely to stop calls before obtaining advice. A payment, restructuring request, promise to pay, or settlement proposal may later be presented as evidence that you acknowledged the account. Do not sign documents saying that you are the borrower unless that is true.

At the same time, do not make false statements. If you applied for the loan, authorized another person to apply, knowingly lent your identity or account, received or used the proceeds, acted as a co-borrower or guarantor, or later adopted the transaction, the analysis may be different. Give the lender and investigators a complete and accurate account of what happened.

Act immediately if funds can still be moved

Contact the lender through a verified number, branch, website, or in-app support channel—not through a link or number supplied by a suspicious caller or text message.

Ask the lender to:

Mark the account as formally disputed for identity theft or impersonation.
Stop any undisbursed loan proceeds or unused credit facility.
Restrict further transactions and prevent changes to contact or payout details.
Suspend collection activity and adverse credit reporting while the claim is investigated, if permitted by its procedures.
Preserve the complete application, authentication, disbursement, transaction, and communication records.
Give you a complaint reference number and written acknowledgment.

If proceeds were recently transferred through financial accounts, tell every involved bank or e-wallet that the transaction is disputed and may involve fraud. Republic Act No. 12010, the Anti-Financial Account Scamming Act, and BSP Circular No. 1215 establish mechanisms for temporarily holding and coordinating the verification of disputed transactions in covered circumstances. A hold is not automatic, so speed and complete transaction details matter.

Secure your identity and access points

Change the passwords of the email address, mobile wallet, online banking account, and cloud-storage account connected to your identity. Use unique passwords and enable multi-factor authentication.

Also consider these steps:

Ask your mobile network whether your SIM was replaced, ported, or subjected to an unauthorized account change.
Sign out unknown devices and revoke unfamiliar app permissions.
Check email-forwarding rules, recovery addresses, and saved sessions.
Lock or replace compromised cards and report lost identification documents to the issuing agency.
Review bank and e-wallet histories for an unfamiliar disbursement followed by an immediate transfer.
Warn trusted contacts if the impostor may contact them or misuse information taken from your phone.
Do not send an unredacted ID, selfie, password, PIN, CVV, or one-time password to an unverified collector or “investigator.”

Replacing an ID does not remove copies already obtained by an impostor. It should therefore accompany—not replace—written disputes, account security changes, and monitoring.

Send a precise written dispute to the lender

Use the lender’s official complaint or Financial Consumer Protection Assistance Mechanism. Email is useful because it creates a dated record, but retain proof of actual delivery.

Your notice should identify the account only as far as necessary and state:

I dispute this account in full. I did not apply for, sign, authorize, or receive the proceeds of this loan or credit account. I believe my identity or personal data was used without authority. Please flag the account as disputed, prevent further use or disbursement, suspend collection and adverse reporting while you investigate, preserve all relevant records, and provide the documents and findings listed below. Nothing in this notice is an acknowledgment of the alleged debt.

Request copies or a meaningful account of the following, subject to lawful identity verification and any legitimate restriction:

The application and alleged contract, including all pages and attachments;
The date, time, channel, branch, agent, merchant, or application used;
The phone number, email address, residential address, and employer submitted;
The identification documents, photograph, selfie, video, signature, or biometric-verification result relied upon;
Authentication and consent records, including relevant OTP and electronic-signature records;
Relevant IP address, device, session, and audit information;
The approval and verification records;
The amount, date, destination account, card, wallet, cheque, merchant, or recipient of the proceeds;
Recordings, chat logs, emails, text messages, and collection notes;
The name of each entity to which the account was reported; and
The lender’s final written findings and the basis for them.

A lender may redact information belonging to another person or withhold material protected by law. It should not use privacy as a blanket reason to deny you access to your own personal data or to refuse a meaningful investigation.

If a signature is disputed, preserve the best available copy of the questioned document and several genuine signatures made around the same period. The Supreme Court has repeatedly cautioned that forgery is not presumed and requires evidence; the original questioned instrument can be important for a reliable comparison. See, for example, Rivera v. Spouses Chua.

Preserve evidence before accounts or messages disappear

Keep original files whenever possible. Screenshots are useful, but they should not be your only copies.

Preserve:

The first bill, collection message, credit-report entry, or verification alert that revealed the account;
Complete emails with headers and complete chat conversations;
Text messages showing sender details, timestamps, links, and phone numbers;
Call logs, voicemails, and lawful recordings;
Account numbers, application numbers, complaint references, and collector identities;
Copies of the application and contract supplied by the lender;
Bank or wallet statements showing that you did not receive the proceeds—or showing an unauthorized credit and immediate transfer;
Proof of your whereabouts when an in-person application allegedly occurred;
Device-security alerts, SIM-replacement notices, and account-login histories;
Reports for lost IDs or devices;
Specimen signatures and copies of genuine documents from the relevant period;
Written complaints and proof of receipt; and
A dated chronology of every contact and response.

Do not edit original files. Export or back them up, and record where each item came from. If an app permits disappearing messages, preserve them promptly without clicking suspicious links.

Check whether other accounts were opened

Obtain your own credit report from a CIC-authorized channel listed by the Credit Information Corporation. Review the personal details, lender names, account dates, balances, payment status, and inquiries.

If the disputed account appears, use the CIC’s Online Dispute Resolution System. You must first obtain the credit report because the dispute process requires its transaction reference number and the email used to obtain it.

The CIC cannot simply delete a lender’s submission on request. It sends the dispute to the submitting entity, tracks the process, and relies on the parties’ records and supporting documents. Submit the lender dispute, identity-theft report, relevant statements, and other evidence. Continue pursuing the lender because it ordinarily must correct the data it submitted.

The CIC dispute corrects information in the CIC database. It may not correct a separate database maintained by a private credit bureau, lender, merchant, or collection agency, so send written correction requests to each relevant holder of the false information.

Report suspected identity theft to law enforcement

Using another person’s identifying information without right may constitute computer-related identity theft when committed through a computer system under Section 4(b)(3) of the Cybercrime Prevention Act, Republic Act No. 10175. Depending on the evidence, other laws concerning fraud, falsification, access devices, or unauthorized processing of personal data may also apply. The correct offense and responsible persons must be determined by investigators and prosecutors.

You may report to:

The PNP Anti-Cybercrime Group, through the official contact details identified in current BSP complaint guidance;
The NBI Cybercrime Division, including the NBI’s investigative-assistance service or online complaint page; or
The Cybercrime Investigation and Coordinating Center, using contact information published by the government.

Bring a valid ID that remains available, your chronology, the disputed account details, the lender’s documents and responses, transaction records, original electronic evidence, and information about any suspected person. Ask for proof that your complaint or request for investigation was received.

A barangay blotter may help document when you reported an incident, but it is not a substitute for notifying the lender, correcting credit information, or seeking investigation by an agency with jurisdiction.

Escalate to the correct financial regulator

If the lender is supervised by the BSP

Complain first to the institution’s own Financial Consumer Protection Assistance Mechanism or official customer-service channel. This first-level complaint is required before using the BSP Consumer Assistance Mechanism.

If the institution’s response is unsatisfactory, escalate through the BSP Online Buddy (BOB) on the BSP website or its official Facebook page. If BOB is inaccessible, the BSP’s September 2025 guidance permits submission of a completed Complaint/Inquiry/Reply form to consumeraffairs@bsp.gov.ph, together with proof that you first used the institution’s complaint mechanism.

The BSP-CAM process under BSP Circular No. 1169 is a second-level remedy. In the formal CAM exchange, a BSP-supervised institution directed to answer generally has 15 days from receipt of the BSP directive; the consumer may then file a reply within 30 days after receiving the answer. These procedural periods do not excuse delay in making the initial fraud report.

The BSP’s consumer process facilitates and, where applicable, provides mediation or adjudication mechanisms. It does not replace a criminal investigation.

If it is a lending or financing company

Complaints about lending companies, financing companies, online lending platforms, and their collection agencies should generally be directed to the Securities and Exchange Commission through the SEC I-Message Mo Portal.

Before submitting sensitive documents, verify that you are using the official SEC portal. Include the company’s legal name, app or platform name, account number, your written dispute, proof of receipt, the response or non-response, collection messages, and evidence that the account was unauthorized.

You can also use the SEC’s Check with SEC service to investigate whether the company appears authorized to operate. An unfamiliar app name may differ from the registered company name stated in its terms, privacy notice, demand letter, or payment instructions.

If the lender is a cooperative

Use the cooperative’s own Financial Consumer Protection Assistance Management System and then seek guidance or relief from the Cooperative Development Authority. Keep the cooperative’s registration details, membership records, disputed loan documents, and proof of your internal complaint.

Use the National Privacy Commission process when personal data was misused

The Data Privacy Act of 2012 gives data subjects rights that include access, correction, objection in appropriate circumstances, and remedies for unlawful processing. An impostor’s use of your ID is not necessarily the lender’s fault, but the lender’s collection, verification, security, disclosure, retention, and response may still need examination.

First inform the lender, its data protection officer, or other responsible entity in writing of the privacy violation and allow it to act. Under the amended NPC Rules of Procedure, an NPC complaint ordinarily will not be given due course unless the respondent failed to take timely or appropriate action, or failed to respond within 15 calendar days after receiving your written notice. The NPC may waive exhaustion in limited serious or urgent circumstances specified in its rules, but a complainant should not assume that a waiver will be granted.

If escalation is necessary, follow the NPC’s complaint mechanics. The complaint must comply with the current formal requirements. The NPC states that a completed and notarized complaint-assisted form or a properly verified complaint should be accompanied by supporting evidence and, where applicable, witness affidavits. Attach proof that the respondent received your earlier written notice.

Do not confuse an individual complaint with an organization’s mandatory personal-data-breach notification. The 72-hour breach-notification rule applicable in qualifying cases concerns duties of personal information controllers; it is not the ordinary deadline for an affected person to file an NPC complaint.

If collectors contact you

Tell the collector in writing that:

You dispute the entire account because it was opened without authority;
The alleged lender has been asked to investigate;
You want the collector’s complete legal name, address, authority, and the name of the creditor it represents;
You require the basis and documents for the claim; and
Future communications must accurately reflect that the account is disputed.

Save every threat, public post, message to relatives or employers, contact-list disclosure, or misleading representation. Report abusive conduct to the lender and the regulator. If personal data is being disclosed or used disproportionately for collection, include that evidence in any NPC complaint.

Do not threaten collectors, publish their private information, or fabricate evidence. Do not send money to a personal account merely because someone threatens arrest. Ordinary nonpayment of a debt is not, by itself, proof of a crime; identity theft and fraud allegations nevertheless require proper investigation.

If you receive a demand letter, summons, or court papers

A collection demand is not the same as a court judgment, but it should receive a prompt written dispute.

Court papers are urgent. Record the exact date, time, and manner of service; preserve the envelope and every attachment; verify the case directly with the named court; and consult a Philippine lawyer or the Public Attorney’s Office if eligible. Do not rely on a pending lender, BSP, SEC, CIC, police, or NPC complaint to stop a court deadline.

If the lawsuit relies on a document allegedly signed by you, the Rules of Court may require a specific denial under oath in the proper pleading. A general statement that “this is fraud” may be inadequate. Missing the response deadline or failing to deny an actionable document correctly can seriously prejudice your defense.

Common mistakes to avoid

Reporting only by telephone and keeping no proof;
Paying or restructuring the alleged debt before understanding the legal effect;
Giving an alleged collector another complete ID set, selfie, OTP, PIN, or password;
Disputing only with the CIC and not with the lender that supplied the data;
Assuming that a police report automatically cancels the account;
Deleting messages, resetting a phone, or discarding a SIM before preserving evidence;
Clicking links in collection messages to “view the contract” without checking the domain;
Accusing a particular person publicly without reliable evidence;
Ignoring formal demands or court papers because an agency complaint is pending;
Claiming identity theft when the account was actually authorized; and
Using the wrong regulator because an app’s brand name conceals the lender’s legal identity.

When legal help is urgent

Seek prompt legal assistance if:

You have received a summons, subpoena, prosecutor’s notice, demand to answer under oath, or notice of garnishment;
A vehicle, salary, deposit, or property is being seized or threatened;
The lender presents a signed, biometric, OTP-authenticated, or notarized document that appears to implicate you;
Loan proceeds passed through an account you own;
You previously gave another person authority to transact for you;
A family member, employee, agent, or business partner may be involved;
Multiple fraudulent accounts or substantial losses are appearing;
Collectors are threatening violence, exposing private information, or contacting your workplace;
Your SIM, email, bank account, or government identity records remain compromised; or
The lender rejects your dispute and continues reporting the account as yours.

Frequently asked questions

Am I required to pay a loan I never applied for?

Not merely because it appears under your name. The lender must have a legal basis for holding you liable. But whether an application was truly unauthorized depends on the documents, authentication records, disbursement trail, and your conduct. Formally dispute the account and obtain the evidence instead of relying on a verbal denial.

Should I file a police report before contacting the lender?

Contact the lender immediately; do not delay an account restriction while waiting for a police report. You may make the law-enforcement report in parallel and send the reference or report to the lender afterward.

Can the lender require an affidavit of denial?

It may reasonably ask for information and a sworn statement as part of its investigation. Read the affidavit carefully and state only facts you know to be true. Do not sign language acknowledging the debt, waiving claims, or accepting liability unless you understand and intend that result.

Will the CIC delete the loan as soon as I dispute it?

No. The CIC explains that it cannot unilaterally change a submitting entity’s data. Its dispute system refers the matter to that entity and uses the records and submissions made during the process. Continue the direct lender dispute and provide supporting documents.

What if the account is not yet on my CIC report?

Still dispute it with the lender and ask whether it has reported or intends to report the account to the CIC or another credit-information provider. Monitor later reports because submissions and corrections may not appear immediately.

What if the lender says the OTP proves I applied?

An OTP record is relevant but not necessarily conclusive. Ask where it was sent, when it was generated, what transaction it authorized, and what device and session were involved. A compromised SIM, email account, device, or social-engineering incident may require further investigation.

Can I demand deletion of every record?

Not automatically. The lender may have legal, regulatory, evidentiary, anti-fraud, and records-retention obligations. Ask for correction, blocking or restriction where legally appropriate, cessation of unlawful use, and accurate notation of the dispute. Necessary evidence should also be preserved while the matter is investigated.

What if someone I know used my identity?

Report the facts accurately. Family relationship, friendship, or employment does not itself create authority to borrow in your name. However, prior consent, shared proceeds, agency, ratification, or knowingly supplying credentials can materially affect both civil and criminal issues.

Is an affidavit of loss enough?

No. It may support the chronology when an ID or device was lost, but it does not establish everything about the disputed application. Combine it with the application records, disbursement trail, account-security evidence, written lender dispute, and law-enforcement report where appropriate.

Can I report anonymously?

You can provide intelligence or warnings through some channels, but an account correction or formal complaint normally requires the agency and lender to verify your identity and connect you to the disputed record. Use official channels and disclose only what is reasonably required.

Official references

This article provides general Philippine legal information, not legal advice for a particular case. Liability, available remedies, and filing requirements depend on the documents and facts. Official sources and procedures were checked as of August 1, 2026.