Quick answer

An unauthorized loan or credit account should not automatically become your debt simply because it carries your name, ID details, phone number, or an electronic signature. A valid contract generally requires your consent under Article 1318 of the Civil Code. However, the lender must investigate, and the result may depend on application records, identity-verification data, electronic-signature evidence, and where the proceeds went.

Act immediately:

Dispute the account in writing with the lender.
Request preservation and disclosure of the application and verification records.
Secure your email, mobile number, devices, IDs, bank accounts, and e-wallets.
Report suspected identity theft or fraud to the NBI Cybercrime Division or PNP cybercrime authorities.
Check and dispute your Credit Information Corporation credit report.
Escalate to the correct financial regulator and, where personal data was misused, the National Privacy Commission.

Do not pay, restructure, promise to pay, or sign a settlement merely to stop collection calls without first obtaining legal advice. Those actions may complicate your position. A police report or affidavit is important evidence, but it does not by itself cancel the account or correct your credit record.

Send the lender a written identity-theft dispute immediately

Use only contact details published on the lender’s official website, mobile application, statement, or regulator record. Do not send IDs or selfies to a collector using an unverified personal number or social-media account.

Address the dispute to the lender’s fraud unit, customer-assistance unit, and Data Protection Officer. State clearly that:

You did not apply for, authorize, sign, or consent to the loan or credit account.
You did not receive or benefit from its proceeds.
You dispute the entire account, balance, interest, fees, and collection activity.
You request that the account be flagged as disputed for suspected identity theft.
You request suspension of collection and adverse credit reporting while the investigation is pending.
You request preservation of all physical and electronic evidence.
You are exercising your rights of access and rectification under the Data Privacy Act.
You want a written acknowledgment, complaint reference number, investigation timeline, and final written decision.

A concise notice may read:

I dispute account [account number or reference] in full. I did not apply for, authorize, sign, or consent to this account, and I did not receive or benefit from its proceeds. Please treat this as a suspected identity-theft and fraud report. Preserve all application, identity-verification, authentication, device, communications, approval, and disbursement records. Please provide the records concerning me, mark the account as disputed, suspend collection and adverse credit reporting while the matter is investigated, and correct any inaccurate personal and credit information. Kindly acknowledge this report in writing and provide a case reference number.

Do not describe the account as “my loan” or ask to “cancel my loan.” Use neutral wording such as “the disputed account opened using my identity.”

Ask for the records that can show what happened

Request copies of, or reasonable access to, the following records concerning you:

The complete application, contract, promissory note, disclosure statement, and attachments
Copies of IDs, selfies, facial-recognition results, video verification, specimen signatures, and other KYC records
The phone number, email address, residential address, employer, references, and bank or e-wallet details used
OTP, authentication, login, IP-address, device, browser, timestamp, and account-creation records
Call recordings, chat transcripts, emails, uploaded documents, and agent or branch notes
The lender’s approval and fraud-screening records concerning the transaction
The date, amount, method, and destination of disbursement
The name and account details of the recipient of the proceeds, to the extent disclosure is legally permitted
Credit information submitted to the CIC or another credit bureau
The identity or contact details of any collection agency handling the account

The Data Privacy Act and its Implementing Rules recognize rights of access and rectification. If data is false, incomplete, outdated, or unlawfully obtained, erasure or blocking may also be available. These rights are not absolute: an organization may lawfully retain some records for regulatory duties, fraud investigation, or legal claims. For that reason, ask for correction and restriction of disputed processing—not immediate destruction of evidence.

Send a separate preservation request even if the lender will not yet release the records. Electronic evidence can be overwritten under ordinary retention schedules. Under the Cybercrime Prevention Act, certain traffic data and subscriber information must be preserved for a minimum period of six months, and law enforcement can pursue preservation, disclosure, and cybercrime warrants when the legal requirements are met.

Preserve your own evidence

Create a dated incident file and keep original electronic copies. Preserve:

The first text, email, bill, collection call, app notification, or credit report that revealed the account
Screenshots showing the full screen, sender, number, URL, date, and time
Original emails with headers and original message files where possible
Collection letters and their envelopes
Your written disputes, delivery receipts, email acknowledgments, ticket numbers, and replies
Bank and e-wallet statements showing that you did not receive the proceeds
Proof of where you were or what number, device, email, or address you used when the application was allegedly made
Notices about a lost ID, stolen phone, SIM replacement, email compromise, phishing incident, or data breach
Samples of your genuine signature from reliable documents
A chronological account written while events are fresh
Names and contact information of relevant witnesses

Do not factory-reset a possibly compromised phone or delete suspicious messages before consulting investigators. Change passwords from a trusted device, but preserve the affected device and account history. Avoid secretly recording private calls without legal advice; save voicemails and recordings lawfully provided to you.

An affidavit of loss, police blotter entry, or sworn denial can support your position, but none is conclusive on its own. Evidence linking the application, authentication, and disbursement to someone else is usually more useful.

Secure your identity and connected accounts

After preserving evidence:

Change the password of your primary email first, then financial and social-media accounts.
Sign out unknown sessions and remove unfamiliar recovery emails, numbers, devices, and app permissions.
Enable strong multi-factor authentication that does not rely solely on a potentially compromised SIM.
Ask your telecommunications provider to secure or replace a compromised SIM and check for unauthorized replacement activity.
Notify the issuing agency if a physical government ID was lost or stolen.
Review bank, card, e-wallet, and online-shopping accounts for unauthorized transactions or new beneficiaries.
Ask financial institutions whether they can add a fraud warning or heightened-verification note to your profile.
Never send an OTP, PIN, password, CVV, or remote-access code to someone claiming to “investigate” the account.

If money was also taken from one of your existing accounts, report that unauthorized transaction separately and immediately. Different transaction-dispute rules and deadlines may apply.

Report the suspected crime

If a computer, phone, app, website, email, social-media account, or electronic document was used, the conduct may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act. Depending on the evidence, investigators may also consider fraud, falsification, or other offenses. The proper charge is determined by investigators and prosecutors, not by the label used in your initial report.

You may report to:

The NBI Cybercrime Division or an NBI regional office
The PNP Anti-Cybercrime Group or an appropriate PNP cybercrime unit
The NBI Online Complaint portal for initial reporting, while following any instruction to appear and execute a sworn statement

Bring a valid ID, your chronology, the lender’s account details, complaint correspondence, credit report, affected device if requested, and copies of available evidence. The NBI’s published process includes a preliminary interview, a sworn complaint sheet or affidavit, submission of supporting documents, witness statements, and possible examination of a relevant device.

Ask for a complaint, blotter, or investigation reference number. Give that number to the lender and regulators, but retain the original document. Prompt reporting matters because investigators may need time-sensitive subscriber, device, communications, and disbursement records.

Do not publicly accuse a suspected person unless advised by counsel. Public allegations can expose you to separate legal risk and may alert the offender or compromise evidence.

Escalate to the correct financial regulator

Identify the creditor’s legal entity—not merely the app, brand, collector, or marketplace name.

Type of provider	First report	Government escalation
Bank or other BSP-supervised institution	Provider’s Financial Consumer Protection Assistance Mechanism or official customer-service channel	BSP Consumer Assistance Mechanism
SEC-registered lending or financing company	Company’s customer-service or complaints unit	SEC iMessage complaint for financing and lending companies
Cooperative	Cooperative’s financial-consumer complaints mechanism	CDA Consumer Assistance Mechanism or appropriate CDA Extension Office
Unknown, impersonated, or apparently unregistered lender	Preserve the communications; do not send more personal data	Law enforcement and the regulator that appears to cover the claimed business

For banks and other BSP-supervised institutions

You must generally complain first through the institution’s Financial Consumer Protection Assistance Mechanism. If the institution does not act within a reasonable period or its response is unsatisfactory, escalate through the BSP Online Buddy or BSP Consumer Assistance Mechanism. If BOB is inaccessible, the BSP guidance permits submission of its complaint form by email, with proof that you first used the institution’s complaint mechanism.

Under BSP Circular No. 1169, after the BSP directs the institution to answer, the institution generally has 15 calendar days to answer, and the complainant may reply within 30 calendar days after receiving that answer.

The BSP Consumer Assistance Mechanism is primarily facilitative. BSP formal adjudication is narrower: it generally covers purely civil claims for payment or reimbursement not exceeding ₱10 million. The rules exclude, among other matters, formal adjudication whose requested relief is merely to avoid payment or to nullify a financial product. A court action may therefore be necessary if the lender refuses to recognize that no valid loan was formed.

The Financial Products and Services Consumer Protection Act protects consumers’ rights to fair treatment, protection from fraud and misuse, data privacy, and timely complaint handling. Claims specifically arising under that law generally prescribe five years from consummation of the transaction or discovery of deceit or nondisclosure, and in all events within ten years of the violation. Other civil, criminal, privacy, or procedural deadlines may differ, so do not treat this as permission to delay.

For lending and financing companies

File through the SEC iMessage system and select the service for complaints on financing and lending companies. Attach your written dispute, proof of delivery, lender response, police or NBI reference, credit report, collection communications, and available identity-theft evidence.

If the operator is not the legal entity named as lender, identify both the platform and actual lender. Report an apparently unregistered operator, but do not assume that an unfamiliar brand is unregistered until the SEC confirms the entity’s status.

Harassment is a separate issue from whether the debt exists. SEC-regulated lending and financing companies are subject to rules against unfair debt-collection practices. BSP-supervised institutions and their agents are likewise prohibited from abusive collection or debt recovery practices under BSP Circular No. 1160. Preserve threats, deceptive statements, improper disclosures, and communications to relatives, employers, or unrelated contacts.

For cooperatives

Complain first through the cooperative’s own financial-consumer complaints mechanism. Current CDA guidance describes the cooperative-level mechanism as the first recourse and the CDA mechanism as the escalation route when the response is unsatisfactory. Use the CDA website and Extension Office directory for the current filing channel.

Check and correct your CIC credit report

Obtain your CIC credit report through the CIC Direct-to-Consumer program. Review personal information, open and closed contracts, lender names, balances, dates, payment status, and inquiries.

For an erroneous unauthorized account, use the CIC Online Dispute Resolution System. The current process requires:

A CIC credit report issued no more than 30 days before the dispute
The report’s 14-digit Transaction Reference Number
The email address used to obtain the report
Identity verification and the disputed contract details
Supporting records when requested

One TRN may cover disputes involving multiple lenders, but it may be used only once, so list every error found in that report before submitting. CIC’s published service standard states that the lender’s response period may be 3, 7, or 20 days depending on the dispute category. If the lender recommends a resolution, monitor the case closely because the process gives the disputer five days to accept or reject the recommendation.

CIC cannot simply replace the lender’s submitted data on demand. It sends the dispute to the submitting entity, monitors the exchange, and processes corrections based on the entity’s submission and the evidence. A police report supports the dispute but does not automatically remove the entry.

Keep the corrected report, dispute resolution, and lender’s written confirmation. Recheck later to ensure the account was not resubmitted.

Consider an NPC complaint for misuse of personal data

A privacy complaint may be appropriate if the lender, platform, collector, data broker, employee, or another person:

Obtained or used your personal data without a lawful basis
Failed to use reasonable security measures
Refused a proper access or rectification request
Continued using false data after receiving substantial proof
Improperly disclosed your alleged debt or personal information
Failed to take appropriate action after being notified of a privacy violation

The NPC does not ordinarily decide whether you owe the loan; its role concerns personal-data processing and data-subject rights.

Under the 2021 NPC Rules of Procedure, you generally must first notify the organization in writing and allow it to act. You may proceed when it fails to take timely or appropriate action or gives no response within 15 calendar days after receiving your notice. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, no adequate remedy, or patently illegal conduct.

Use the current notarized complaint-affidavit and follow the filing and fee instructions on the NPC formal-complaint page. Attach your correspondence, evidence, requested relief, witness affidavits if any, and the required certification against forum shopping. Filing an incomplete complaint can lead to dismissal.

What not to do

Do not ignore the matter because you did not borrow the money.
Do not rely only on telephone calls; create a written record.
Do not pay a “small amount” or enter a restructuring agreement merely to stop collection.
Do not give additional IDs, selfies, OTPs, or signatures to an unverified collector.
Do not delete messages, reset devices, or discard envelopes before preserving evidence.
Do not assume a police report automatically clears the debt or credit entry.
Do not file inconsistent versions of events with different agencies.
Do not identify the lender solely by its app name; find the legal creditor.
Do not confuse a rejected loan application with an opened and disbursed account; request the actual records.
Do not ignore a summons, subpoena, foreclosure notice, payroll-deduction notice, or other official process.

When legal help is urgent

Consult a Philippine lawyer immediately if:

You receive court summons or a small-claims notice. Ordinary civil rules generally require an answer within 30 calendar days after service of summons unless the court fixes another period, but expedited and small-claims procedures have different requirements.
The account is secured by land, a vehicle, payroll deductions, deposits, or other property.
A mortgage, lien, encumbrance, or transfer document appears to have been forged.
The lender refuses to stop collection despite strong evidence that you did not apply or receive the proceeds.
Your employer, family, clients, or public contacts are being threatened or told about the alleged debt.
Several accounts were opened, a large amount is involved, or an insider may be involved.
Your SIM, email, bank account, e-wallet, or government credentials remain compromised.
You are asked to sign an admission, compromise, waiver, quitclaim, or repayment plan.
A regulator dismisses the matter because the requested relief requires a court ruling.

Initial reports do not require a lawyer. If cost is a concern, inquire with the Public Attorney’s Office about current eligibility requirements or seek assistance from a legal-aid clinic.

Frequently asked questions

Am I liable if the lender has my ID and an OTP record?

Not necessarily. A contract requires consent, and an electronic signature must be attributed and authenticated under the Electronic Commerce Act and the Rules on Electronic Evidence. Authenticated electronic signatures can carry disputable presumptions, but an ID copy, OTP, selfie, or device log is not automatically conclusive when identity theft, SIM compromise, account takeover, or unreliable verification is credibly shown.

Should I pay while the investigation is pending?

If you genuinely deny applying for or authorizing the account, do not make a payment or promise without legal advice. Instead, dispute the account in writing and request suspension of collection and adverse reporting. If you make any payment because of an immediate and unavoidable risk, obtain advice about documenting that it is made under protest and without admitting liability.

Do I need an affidavit of loss?

Use one if an ID, SIM, phone, or document was actually lost. Do not execute a false affidavit simply because a lender requests one. If the data was copied while the original remained with you, describe that accurately in your sworn statement.

Is an NBI or police report enough to remove the loan?

No. It documents the report and may begin an investigation, but the lender and CIC still need to process the account dispute. A court or regulator may ultimately be required if the lender refuses correction.

Can I demand deletion of all application records?

Usually, preservation is safer at the start. Those records may prove the fraud. Ask the lender to restrict disputed processing, stop collection uses, correct false data, and preserve evidence. Erasure may be requested later where legally available, but regulatory retention duties and legal claims can justify keeping certain records.

What if the loan does not appear on my CIC report?

Continue disputing directly with the lender. The CIC process applies to data appearing in the CIC report; absence from that report does not resolve the lender’s separate records or collection activity.

Can a collector contact me about the disputed account?

A collector may attempt lawful communication, but abusive, deceptive, threatening, or privacy-invasive collection can be reported separately. Respond once in writing that the account is disputed because of identity theft, request the original creditor’s details and complaint channel, and preserve further communications.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any investigation or case. The correct remedy depends on the documents, type of creditor, transaction method, and relief requested. Laws, procedures, and official filing channels were checked as of 6 August 2026.