Quick answer

If a loan, credit card, credit line, or similar account was opened using your identity without your consent, immediately dispute it in writing with the lender. State clearly that you did not apply for, authorize, receive, or benefit from the account. Ask the lender to freeze collection activity, investigate the application, preserve its records, and correct any credit reporting.

Also secure your phone, email, IDs, and financial accounts. Obtain your Credit Information Corporation (CIC) credit report and dispute any incorrect entry. Escalate unresolved complaints to the lender’s regulator—usually the Bangko Sentral ng Pilipinas (BSP) for BSP-supervised institutions or the Securities and Exchange Commission (SEC) for lending and financing companies. Report suspected identity theft or fraud to the NBI or PNP, and consider a National Privacy Commission (NPC) complaint if personal data was unlawfully obtained, disclosed, or processed.

Do not ignore collection notices, but do not admit the debt, promise payment, or sign a restructuring agreement merely to stop the calls. Whether you are legally liable ultimately depends on the evidence, including the application, authentication records, disbursement trail, and whether you authorized or later ratified the transaction.

Why an unauthorized account is disputable

A valid contract generally requires consent. The Civil Code also provides that a person cannot contract in another’s name without authority; an unauthorized contract is generally unenforceable against that person unless it is expressly or impliedly ratified. See Civil Code Articles 1317–1319.

This does not mean that merely saying “identity theft” automatically closes an account. The lender may investigate whether:

You submitted or authorized the application.
A family member, employee, agent, or other person acted with authority.
Your phone, email, device, biometric check, electronic signature, or one-time password was used.
The proceeds entered an account or wallet you controlled.
You used the credit or later acknowledged, paid, renewed, or restructured it.
The application resulted from impersonation, forged documents, account takeover, or a failure in the lender’s verification process.

If you genuinely did not authorize the transaction, make that position consistent from the beginning and support it with documents.

What to do immediately

1. Contact the lender through a verified channel

Use contact details on the lender’s official website, app, billing statement, or regulator record—not a telephone number or link supplied in a suspicious message.

Tell its fraud, security, or consumer-assistance unit that:

The account was opened using your identity without your knowledge or consent.
You dispute the entire account and all related charges, interest, fees, and collection activity.
You did not authorize anyone to apply in your name.
You want the account restricted from further use while it is investigated.
You request written confirmation and a complaint reference number.

If money was disbursed, ask the lender to trace and preserve the receiving bank account, e-wallet, cash-out location, device, IP address, telephone number, and other available transaction records. Do not contact or threaten the suspected impostor in a way that could cause evidence to be deleted.

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, a financial service provider must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, it must, pending its final investigation report, suspend the imposition of interest, fees, and charges or provide a similar reasonable accommodation.

Ask for this protection expressly. The statute does not necessarily require the lender to erase the account before completing its investigation.

2. Send a formal written dispute

A telephone report is useful for speed, but follow it with an email, letter, support ticket, or in-app complaint that creates a durable record.

Include:

Your full name and safe contact details.
The disputed account number, masked where appropriate.
When and how you discovered the account.
A direct statement that you did not apply, consent, authorize another person, receive the proceeds, or use the account—provided each statement is true.
Any differences between your actual details and those in the application.
Your requested remedies.
A list of attachments.
A request for acknowledgment and a written investigation result.

Request copies of, or reasonable access to, records concerning you, including the application, contract, submitted identification, disclosed contact details, authentication records, electronic signature or consent record, disbursement details, and the source of the personal data, subject to lawful limits and the protection of other people’s information.

Under Section 16 of the Data Privacy Act of 2012, a data subject may request access to personal information being processed, dispute inaccurate data, and seek correction. Upon substantial proof, the data subject may also seek blocking, removal, or destruction of information that is false, unlawfully obtained, or used for unauthorized purposes. These rights have statutory exceptions, including certain information processed for investigations or legal claims.

3. Secure the accounts and identifiers that may have been compromised

Change passwords for your primary email, financial apps, cloud storage, and government-service accounts. Use unique passwords and enable multi-factor authentication. Sign out unknown sessions and review recovery email addresses, telephone numbers, forwarding rules, and trusted devices.

Also consider:

Asking your mobile provider whether a replacement SIM, eSIM, or account change was recently made.
Setting a SIM PIN and account-level security controls where available.
Reviewing bank and e-wallet histories for unfamiliar transfers or linked devices.
Blocking lost or stolen IDs through the issuing agency’s available process.
Replacing an ID if its issuer recommends replacement after compromise.
Warning your bank or e-wallet provider if an account was used to receive fraudulent proceeds.
Checking whether other applications, cards, or accounts were created in your name.

Preserve evidence before deleting suspicious messages, apps, or device data.

4. Check and dispute your CIC credit information

Obtain your own credit report through an official CIC access channel. If the unauthorized account appears, use the CIC’s Online Dispute Resolution System.

The CIC requires the consumer first to obtain a CIC credit report and identify the erroneous, misleading, incomplete, or outdated entry. CIC then refers the dispute to the entity that submitted the information. The CIC cannot simply rewrite a lender’s data without the dispute process and supporting verification.

Section 4(o) of the Credit Information System Act, Republic Act No. 9510, gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information. It directs CIC to investigate and verify disputed information within five working days from receipt of the complaint. If accuracy cannot be verified or proven, the information must be deleted; recipients must be informed of the correction or removal within the statutory period.

A CIC dispute addresses the credit-report entry. It does not replace your complaint to the lender, determine criminal guilt, or resolve every contractual issue.

5. Report suspected identity theft or fraud

If someone intentionally used your identity, forged an application, diverted proceeds, or took over your digital account, report the incident promptly to law enforcement. Possible offenses depend on the facts.

The Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another. Computer-related fraud, forgery, estafa, falsification, access-device offenses, or other laws may also be relevant, but law enforcement and prosecutors must determine the proper charge from the evidence.

You may seek assistance from:

The NBI online complaint facility or an NBI Cybercrime Division or regional office.
The PNP Anti-Cybercrime Group or the nearest police cybercrime unit or station.

Bring your identification, written chronology, lender correspondence, disputed documents, messages, call logs, transaction records, and original electronic evidence if available. Ask for a copy or reference number for your report.

A police blotter, affidavit, or NBI complaint is useful evidence that you promptly denied the transaction, but it does not by itself compel the lender to cancel the account or conclusively establish identity theft.

6. Escalate to the proper financial regulator

First use the lender’s own consumer-assistance mechanism and retain proof of submission and its response.

For a BSP-supervised institution

Banks, digital banks, credit-card issuers, many non-bank financial institutions, and other BSP-supervised entities fall under BSP consumer-assistance channels. If the institution does not resolve the matter satisfactorily, escalate it through the BSP Consumer Assistance Mechanism.

BSP currently accepts complaints through BSP Online Buddy and through its Complaints, Inquiries and Requests form at consumeraffairs@bsp.gov.ph, among other official channels. Attach:

Your complaint to the institution.
Its reply, if any.
The account information and chronology.
Supporting documents.
The exact remedy you request.

BSP’s mechanism is an escalation channel; it is not a substitute for immediately notifying the institution.

For a lending or financing company regulated by the SEC

If the lender is a lending or financing company under SEC supervision, submit the complaint through the SEC iMessage portal. Identify the company’s full legal and trade names, if known, and attach your prior written dispute and supporting evidence.

If you cannot identify the supposed lender, do not send additional personal documents to an unverified collector. Preserve the message, number, payment instructions, app name, website, and receiving account, then report those details to law enforcement and the relevant regulator.

7. Consider a privacy complaint

A fraudulent loan may involve unlawful collection, disclosure, alteration, or use of personal information. Write first to the lender or other organization responsible for processing the data, preferably through its Data Protection Officer. Ask it to investigate the source and use of your information, restrict disputed processing where legally appropriate, and correct false records.

If the organization fails to take timely or appropriate action, you may file a complaint with the National Privacy Commission.

Under the NPC’s complaint mechanics, a complainant ordinarily must first notify the respondent in writing and allow it to address the privacy violation or personal data breach. Proof must accompany the NPC complaint if the respondent took no timely or appropriate action or gave no response within 15 calendar days from receipt. The formal complaint must comply with the NPC’s prescribed form, verification or notarization, evidence, and filing requirements.

A report to the NPC concerns data-privacy rights and violations. It does not replace a lender dispute, CIC correction request, regulatory complaint, or criminal report.

What to ask the lender to do

Your requested resolution should be precise. Depending on the facts, ask the lender to:

Block further use or disbursement.
Mark the account as formally disputed during investigation.
Suspend interest, fees, charges, and collection activity as legally required or reasonably appropriate.
Stop communicating the alleged debt to unrelated third parties.
Provide the application, contract, authentication, and disbursement records.
Explain what identity checks were performed.
Correct inaccurate personal and account information.
Instruct its collectors and service providers about the dispute.
Correct or withdraw erroneous submissions to CIC and other lawful recipients.
Confirm in writing whether it considers you liable and why.
Provide its final investigation report or a clear written disposition.

A request to preserve records is important. Some electronic records may be routinely overwritten, and investigators may later need information that is not visible on an ordinary account statement.

Evidence to preserve

Keep original files whenever possible, together with a separate working copy. Useful evidence includes:

Collection letters, statements, emails, texts, and messaging-app conversations.
Screenshots showing the full screen, sender, date, time, and relevant URL.
Call logs and notes identifying the caller, number, time, and statements made.
The lender’s complaint reference numbers and acknowledgments.
The disputed application, contract, IDs, selfie, signature, or biometric result.
OTP and login alerts, password-reset messages, and new-device notifications.
Bank or e-wallet records showing where proceeds were sent.
Proof that the receiving account does not belong to or was not controlled by you.
Travel, work, location, device, or telecommunications records relevant to the application time.
Proof of a lost ID, stolen phone, SIM replacement, hacked email, or prior data exposure.
Your CIC report and ODRS records.
Police, NBI, regulator, and NPC submissions.
Affidavits from witnesses with direct personal knowledge.

Do not edit original screenshots or message exports. Record a chronology while events are fresh. If you surrender a device or original document, ask for an acknowledgment or inventory.

Handling collectors and payment demands

Tell each collector in writing that the account resulted from alleged identity theft and is disputed with the lender. Give the complaint reference number, but share only documents reasonably necessary through a verified channel.

Ask for:

The collector’s full name and company.
The creditor it represents.
The account reference and claimed amount.
The authority and contact details of the lender.
Written confirmation that your dispute was forwarded to the lender.

Do not pay a “verification fee,” send an OTP, install a remote-access app, or transfer money to a personal account. Do not sign a promissory note, settlement, restructuring, or waiver without understanding its effect. Even a small payment or written acknowledgment may complicate the factual question of whether you adopted or ratified the obligation.

Collectors may pursue legitimate debts, but financial service providers are prohibited from abusive collection or debt-recovery practices under Republic Act No. 11765. Preserve threats, public shaming, disclosure to unrelated contacts, impersonation, or other improper conduct and report it to the lender and appropriate regulator.

Common mistakes to avoid

Reporting only by telephone and keeping no written record.
Ignoring demand letters or court papers.
Saying merely “not mine” without identifying the account and requested remedy.
Paying part of the debt solely to stop collection pressure.
Sending selfies, full IDs, or personal data to an unverified caller.
Deleting suspicious emails, texts, app data, or login alerts.
Posting unredacted IDs, account numbers, or evidence publicly.
Assuming a police report automatically clears the credit record.
Filing only with CIC while leaving the lender’s underlying records undisputed.
Filing an NPC complaint without proof that the respondent was first notified, unless a recognized exception applies.
Accusing a particular person publicly before evidence has been verified.
Missing a summons, subpoena, or court deadline while waiting for a lender’s investigation.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A collection case has been filed or you received a summons, subpoena, demand with a legal deadline, or notice of garnishment or attachment.
The lender rejects your dispute despite evidence of impersonation.
A forged mortgage, security agreement, postdated check, or notarized document is involved.
The proceeds passed through an account you own or control.
A relative, employee, business partner, or authorized agent made the application.
You previously paid, acknowledged, renewed, or restructured the account.
Your signature, biometrics, or OTP appears in the lender’s records and requires technical examination.
Multiple institutions or substantial losses are involved.
Collectors are threatening violence, disclosing the alleged debt publicly, or contacting your workplace or family abusively.
Law enforcement treats you as a suspect, account owner, or money-mule participant rather than only as a complainant.

If there is an immediate threat to personal safety, contact emergency services or the nearest police station. If court papers have been served, follow the deadline stated in the papers and obtain counsel; a pending complaint with the lender or regulator ordinarily does not stop a court deadline.

FAQ

Am I required to pay a loan I never applied for?

Not merely because the account bears your name. Consent and authority are central contractual issues. However, liability cannot be resolved from the name alone; the lender, regulator, or court may examine authentication, disbursement, use of proceeds, authority, and any later ratification. Dispute the account promptly and avoid statements or payments that inaccurately suggest acceptance.

Should I file a police report before contacting the lender?

Contact the lender immediately; do not delay the fraud restriction while obtaining a police report. You may pursue the lender complaint and law-enforcement report in parallel. The lender may reasonably request an affidavit or police or NBI record as part of its investigation.

What if the loan proceeds entered my bank account?

Report this fact accurately and seek legal advice before moving or returning the funds. Preserve the complete transaction trail. The circumstances may range from an unauthorized transfer to misuse of an account or credentials, and transferring the funds without guidance can complicate tracing.

Can I demand that the lender delete all my information?

You may request correction, blocking, removal, or destruction when the statutory grounds are present, but the right is not absolute. A lender may need to preserve certain records for an investigation, legal claim, regulatory duty, fraud prevention, or another lawful purpose. Ask it to restrict disputed processing, correct false operational and credit records, and explain any information it must retain.

Will a CIC dispute remove the debt immediately?

Not automatically. CIC refers the dispute to the submitting entity and verifies the reported information through its prescribed process. Provide documents showing why the entry is erroneous or misleading. Continue the separate dispute with the lender.

What if I discovered the account only after a loan rejection?

Obtain the credit report used, identify every inaccurate entry, and ask the rejecting institution for the reason if CIC basic credit data was the basis. Republic Act No. 9510 recognizes a borrower’s right to know the cause of a credit refusal based on such data and to dispute erroneous credit information.

What if the lender or collector cannot be identified?

Do not pay or submit more identity documents. Preserve the caller’s number, message headers, app or website, account number, payment destination, and claimed creditor. Report the incident to law enforcement and provide the available details to BSP or SEC so the responsible or possibly unauthorized operator can be assessed.

Is an affidavit of denial enough?

It is useful evidence, particularly when detailed, truthful, and supported by contemporaneous records. It is not conclusive by itself. The outcome may depend on the lender’s application, authentication, device, communication, and disbursement evidence.

Can a family member validly borrow in my name?

Only if legally authorized to act for you. Family relationship by itself does not ordinarily create authority to enter a loan in another person’s name. The result may differ if you gave authority or later ratified the transaction, so obtain advice before making admissions or informal arrangements.

Official resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and rights may depend on the institution, regulator, documents, and specific facts. Official sources and filing information were checked on September 2, 2026.