Quick answer

You generally do not become legally liable for a bank loan merely because someone used your name, identification documents, mobile number, email address, or other personal information to obtain it. A valid contract requires your consent. If you neither applied for, authorized, received, nor later adopted the loan, you should dispute it immediately and require the bank to investigate and correct its records.

Do not ignore collection notices or make a “small payment” simply to stop calls. Payment, a restructuring request, or language admitting the debt may later be presented as evidence that you recognized the obligation. Instead:

Notify the bank in writing that the loan is unauthorized.
Ask it to stop collection, suspend interest and charges while investigating, preserve all application records, and correct any adverse credit reporting.
Secure your accounts, SIM, email, and identification credentials.
Report suspected identity theft to law enforcement.
Check and dispute your Credit Information Corporation record.
Escalate unresolved banking, privacy, or credit-reporting issues to the proper regulator.

The bank must still examine the evidence. A criminal complaint against the impersonator, a regulatory complaint against the bank, and a civil dispute over the alleged debt are separate remedies; one does not automatically resolve the others.

Why an unauthorized loan is not automatically your debt

Under Articles 1159 and 1315 of the Civil Code of the Philippines, contractual obligations arise from a valid agreement and bind the parties who made it. Article 1318 requires consent, a definite object, and a lawful cause.

A loan application bearing your details is not conclusive proof that you consented. The bank may need to establish, depending on how the application was made:

who submitted the application;
how the applicant’s identity was verified;
what device, IP address, phone number, email, biometric data, or branch records were used;
whether an electronic signature or one-time password was properly attributed to you;
where the proceeds were released;
who controlled the receiving account;
who withdrew or transferred the funds; and
whether you later confirmed, used, paid, or otherwise adopted the transaction.

Electronic documents and signatures can be legally effective, but they are not automatically attributable to the person whose name appears on them. The Electronic Commerce Act requires reliability and permits attribution to be examined through the circumstances, including agreed security procedures.

Where a handwritten signature is disputed, forgery is not presumed. Courts generally require clear, positive, and convincing proof assessed with the entire record. The Supreme Court has nevertheless recognized that the supposed signer’s own testimony denying a signature has probative value and, in an appropriate case, held loan and mortgage documents void for lack of consent after finding the signatures false. See Strong Fort Warehousing Corporation v. Banta, G.R. Nos. 222369 and 222502, November 16, 2020.

This means neither side should rely only on an assertion. Preserve the original questioned documents, genuine comparison signatures, digital records, proof of your location, and evidence showing where the proceeds went.

Act immediately

1. Secure the accounts and devices that may have been compromised

Change passwords for your email, online banking, e-wallets, cloud storage, and government-related accounts. Use unique passwords and enable multi-factor authentication. Sign out unknown sessions and remove unfamiliar recovery addresses, devices, and forwarding rules.

If your mobile service suddenly stopped or you suspect SIM replacement, contact your telecommunications provider immediately. Ask whether a SIM replacement, porting request, or account change occurred and request preservation of the records.

Contact the issuers of any IDs or credentials believed to have been lost, copied, or altered. Follow their official replacement or fraud-reporting procedures. Do not send unredacted IDs through social media or unofficial messaging accounts.

Review your bank and e-wallet statements for unfamiliar deposits, withdrawals, transfers, new payees, or account changes. A fraudster may route loan proceeds through an account in your name.

2. File a written dispute with the bank

Send the dispute through the bank’s official Financial Consumer Protection Assistance Mechanism, fraud unit, or customer-service channel. Use a channel that generates proof of delivery and a reference number.

State clearly:

“I did not apply for, authorize, sign, receive, use, or benefit from this loan,” if all are true;
the loan or account number, amount, approval date, and discovery date;
which personal details, signatures, devices, or accounts appear unfamiliar;
whether your ID, SIM, email, device, or account was lost or compromised;
that the debt is formally disputed and must not be treated as admitted;
that collection communications should identify the complaint reference number; and
the specific remedies you require.

Ask the bank to:

mark the account as disputed for identity theft;
stop disbursement immediately if the proceeds have not yet been released;
freeze or trace remaining proceeds where legally and operationally possible;
suspend interest, fees, charges, and adverse collection action during the investigation;
stop or correct inaccurate reporting to the Credit Information Corporation and other lawful credit bureaus;
preserve all paper and electronic records;
provide a written investigation result and the basis for its decision; and
issue written confirmation if it determines that you are not the borrower.

Under Section 8(f) of the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, a financial service provider must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, it must suspend interest, fees, and charges pending its final investigation report, or provide a similar reasonable accommodation.

Avoid including full passwords, PINs, one-time passwords, or complete card details. The BSP’s current complaint guidance expressly says these are not required for a BSP complaint.

3. Request the underlying records

Ask for copies of, or lawful access to, relevant records such as:

the application and loan agreement;
signature pages and uploaded identification documents;
selfie, liveness, facial-comparison, or video-verification records;
recorded confirmation calls and call logs;
consent and disclosure records;
device identifiers, login timestamps, IP logs, and geolocation records, if collected;
email addresses and phone numbers used;
one-time-password delivery and verification logs;
branch CCTV, visitor logs, and employee notes, if applicable;
the account into which proceeds were disbursed;
transfer, withdrawal, payee, and cash-out records;
internal fraud alerts and investigation findings; and
information reported to the CIC or another credit bureau.

A request is subject to lawful limitations, including the rights of other people, bank-secrecy restrictions, security concerns, and records needed for an investigation. Ask the bank to explain any denial rather than accepting a bare statement that the documents are “confidential.”

Under Section 16 of the Data Privacy Act of 2012, Republic Act No. 10173, a data subject has rights that include access to personal data, correction of inaccuracies, and—under the conditions provided by law—suspension, withdrawal, blocking, removal, or destruction of unlawfully processed data.

4. Preserve your own evidence

Keep original files and create read-only backups of:

collection texts, emails, letters, call logs, and voicemail;
screenshots showing the sender, date, time, URL, and complete conversation;
the bank’s complaint acknowledgments and reference numbers;
credit reports showing the disputed loan;
proof that an ID, SIM, phone, or account was lost or compromised;
telecommunications-provider notices;
genuine signatures from reliable, dated documents;
proof of your location when the application or branch transaction occurred;
account statements showing you did not receive or use the proceeds;
names, dates, and summaries of conversations with bank personnel; and
police, NBI, CICC, or barangay reports and affidavits.

Do not edit original screenshots or crop out dates and sender information. Export emails with headers where possible. Preserve the original phone or device if it may contain important evidence. If substantial property, a mortgage, or a large loan is involved, consult counsel before surrendering an original document or device.

5. Report the suspected crime

Computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act, Republic Act No. 10175, includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another. Depending on the evidence, computer-related forgery or fraud may also be relevant.

The Access Devices Regulation Act, Republic Act No. 8484, as amended by Republic Act No. 11449, may apply when an access device, fraudulently applied-for device, account credential, online banking account, or similar means was used. Whether a particular loan scheme falls within each offense depends on the actual method and evidence.

Report promptly to an appropriate law-enforcement office, such as:

the Philippine National Police Anti-Cybercrime Group;
the National Bureau of Investigation Cybercrime Division; or
the Cybercrime Investigation and Coordinating Center.

Current addresses, email channels, and telephone numbers are collected in the BSP’s official guide for victims of scams or fraud.

Bring identification, a chronology, the bank’s loan details, proof of your dispute, credit reports, messages, and evidence of compromised credentials. A police blotter or incident report helps document when you first denied the transaction, but it does not by itself cancel the loan or prove every element of a crime.

Escalating a complaint against the bank

Complaint to the Bangko Sentral ng Pilipinas

For a bank or another BSP-supervised institution, complain to the institution first. Its consumer-assistance mechanism is the first-level recourse.

If the institution does not act within a reasonable period or you are dissatisfied with its response, elevate the matter to the BSP Consumer Assistance Mechanism. The current BSP channels are:

the BSP Online Buddy chatbot on the BSP website or BSP’s official Facebook page; or
if BOB is inaccessible, the BSP Complaint/Inquiry/Reply form sent to consumeraffairs@bsp.gov.ph, with proof that you first complained to the institution.

Obtain and preserve the BSP reference number. BSP-CAM facilitates communication and is a prerequisite to BSP mediation or adjudication. The detailed procedure is in BSP Circular No. 1169.

BSP adjudication has jurisdictional and remedial limits. Eligibility can depend on the amount claimed, the date the cause of action arose, prior proceedings, and the particular relief requested. Do not assume that every identity-theft dispute can be finally decided through BSP-CAM. Ask the BSP about mediation or adjudication if facilitation fails.

If the lender is not a bank

Financing companies, lending companies, online lending platforms, and their collection agencies are generally regulated by the Securities and Exchange Commission rather than the BSP. The BSP’s official guide directs such concerns to the SEC I-Message Mo Portal.

Cooperatives and other financial providers may fall under a different regulator. Confirm the lender’s exact legal name and license before filing. A mobile app’s brand name may differ from the company that owns or operates it.

Correcting your credit record

Obtain your own CIC credit report. If the unauthorized loan appears, use the Credit Information Corporation’s Online Dispute Resolution System.

The CIC requires the consumer first to obtain a credit report and identify the erroneous, misleading, incomplete, or outdated entry. The CIC sends the dispute to the submitting entity, such as the bank or lender. It cannot simply change the entry unilaterally; the submitting entity must participate in the correction process.

Upload useful evidence, including:

the questioned credit-report entry;
your written fraud dispute;
the bank’s acknowledgment or finding;
the law-enforcement report;
proof that the proceeds went elsewhere; and
evidence of compromised identity credentials.

Disputing the CIC entry does not itself void the alleged loan. Continue the direct dispute with the lender and any necessary regulatory or court proceedings.

Privacy complaint to the National Privacy Commission

A privacy complaint may be appropriate if your personal data was unlawfully obtained, disclosed, used, retained, or inaccurately maintained, or if the institution failed to respond properly to a valid data-subject request.

Ordinarily, you must first inform the bank, lender, or other responsible entity in writing of the privacy violation and allow it to address the issue. Under the NPC’s current complaint rules, exhaustion is generally shown when the entity takes no timely or appropriate action or gives no response within 15 calendar days after receiving your written notice. Keep proof of receipt.

A formal NPC complaint must comply with the required form and contents and be supported by documents and affidavits. Insufficient complaints may be dismissed. Follow the NPC’s official complaint mechanics and filing instructions.

The NPC may waive exhaustion in limited circumstances provided by its rules, including where immediate action is necessary to prevent serious harm or where another recognized exception applies. Do not rely on an exception without clearly documenting why it applies.

A privacy complaint is not a substitute for directly disputing the debt, correcting the credit report, or reporting the crime.

Collection calls and demands

Tell the collector in writing that:

the loan resulted from alleged identity theft;
you dispute being the borrower;
the bank or lender’s investigation reference number is available;
no admission or promise to pay is being made; and
all future communications should be documented.

Ask for the collector’s full legal name, the creditor it represents, the account reference, and written authority to collect. Verify those details directly with the lender using official contact information.

Do not:

pay an unfamiliar personal bank or e-wallet account;
send a selfie holding your ID to an unverified collector;
disclose an OTP, PIN, password, or account-recovery code;
install a remote-access application;
click a shortened or unfamiliar payment link; or
sign a restructuring, compromise, acknowledgment, or waiver without understanding its legal effect.

Recordings are legally sensitive. Do not secretly record calls based only on general internet advice; seek case-specific legal guidance on the Anti-Wiretapping Act and the circumstances of the proposed recording. Written communication is often safer.

Threats, public shaming, unauthorized contact with unrelated persons, disclosure of the alleged debt, or misuse of contact-list data may raise separate regulatory, privacy, civil, or criminal issues. Preserve the exact messages and recipient details.

If the bank sues or threatens foreclosure

Do not ignore a summons, subpoena, demand to surrender property, notice of extrajudicial foreclosure, attachment, or court order.

A collection complaint requires a timely formal response under procedural rules. Informal discussions with the bank do not extend a court deadline. Immediately give counsel:

the summons and entire complaint;
the envelope and date of service;
all loan and security documents;
your genuine signature samples;
proof of non-receipt of proceeds;
bank, CIC, police, NBI, CICC, BSP, and NPC records; and
any title, mortgage, guaranty, or suretyship documents involved.

Forgery and lack of consent are evidence-dependent defenses. If a document was notarized, it may carry evidentiary presumptions that require substantial proof to overcome. Original documents and qualified forensic examination may become important.

If real property was mortgaged without authority, urgent legal action may be necessary before an auction, transfer, or annotation causes further complications. A regulatory complaint alone may not stop foreclosure or suspend a court case.

Possible civil remedies

Depending on the documents, parties, and harm, a lawyer may consider an action or counterclaim seeking:

a declaration that the alleged loan or security document does not bind you;
cancellation or correction of related records;
an injunction or other provisional relief where legal requirements are met;
damages caused by negligence, unlawful data processing, abusive collection, or wrongful reporting; and
attorney’s fees where recoverable under law.

Damages are not automatic. The claimant must establish a legal basis, causation, and competent proof of loss. Keep receipts for transportation, notarization, professional services, replacement credentials, and other expenses, as well as proof of rejected applications or other claimed financial harm.

Which party should be sued—and whether the bank, an employee, a third-party verifier, a collector, the impostor, or another entity bears responsibility—depends on evidence. Identity theft does not establish that the bank itself committed a privacy or criminal violation.

Common mistakes to avoid

Ignoring the debt because “the signature is obviously fake.”
Disputing only by telephone and keeping no reference number.
Paying a token amount or asking for restructuring before obtaining advice.
Signing the bank’s standard affidavit without correcting inaccurate wording.
Giving investigators only screenshots while deleting original messages or files.
Posting full loan documents, IDs, signatures, or account numbers publicly.
Filing against the app’s brand instead of identifying the licensed legal entity.
Assuming a police report automatically removes the debt from credit records.
Waiting for the criminal case before disputing the loan with the bank and CIC.
Missing a summons, foreclosure notice, or regulatory deadline.
Accusing a particular person publicly without adequate evidence.
Using a “fixer” who promises to erase a credit record for a fee.

When legal help is urgent

Consult a Philippine lawyer immediately if:

you received court papers or a subpoena;
real property, a vehicle, a deposit, or another asset is being foreclosed, repossessed, frozen, or offset;
the loan is secured by a mortgage, guaranty, or suretyship;
the bank claims that biometrics, an OTP, a video call, or a notarized document proves your consent;
funds passed through an account you own or control;
you previously made a payment or signed an acknowledgment;
the incident involves an employee, relative, business partner, or authorized representative;
several lenders or large amounts are involved;
your genuine documents may have been altered;
collection activity threatens employment, safety, or reputation; or
the bank has issued a final finding holding you liable.

The Public Attorney’s Office may be available to persons who meet its legal and indigency requirements. Integrated Bar of the Philippines chapters and law-school legal-aid offices may also offer assistance, subject to their intake rules and capacity.

Frequently asked questions

Must I pay while the bank investigates?

Do not voluntarily pay a debt you genuinely did not authorize merely to stop collection pressure. Formally dispute it. For disputed amounts or unauthorized transactions, Section 8(f) of Republic Act No. 11765 requires suspension of interest, fees, and charges pending the provider’s final investigation report, or a similar reasonable accommodation. Obtain the bank’s position in writing.

Is an OTP enough to prove that I borrowed the money?

Not necessarily. An OTP is relevant evidence, but the full circumstances matter: where it was sent, who controlled the SIM or email, whether there was a SIM swap or account takeover, the device used, the bank’s security procedures, and where the proceeds went.

What if the proceeds entered my bank account?

That complicates the dispute but does not automatically prove that you applied for or knowingly accepted the loan. Preserve statements showing what happened next. Notify the bank immediately and do not move or spend unfamiliar funds except under documented instructions from the responsible institution or lawful authority.

Can I demand that the bank delete every record?

You may request correction, blocking, or deletion where the Data Privacy Act permits it, but deletion is not absolute. A bank may lawfully retain records for regulatory, evidentiary, anti-money-laundering, fraud-investigation, or litigation purposes. Focus on stopping inaccurate treatment of you as the borrower while preserving evidence of the fraud.

Should I file with the BSP, NPC, CIC, or police?

They perform different functions:

the bank or lender investigates and corrects its own loan records;
the BSP or appropriate financial regulator handles consumer-protection issues;
the NPC addresses violations involving personal-data processing;
the CIC facilitates disputes over credit-report information; and
law enforcement investigates possible crimes.

More than one route may be necessary.

Can the bank keep calling while the loan is disputed?

The bank may communicate about its investigation or position, but a dispute should be accurately recorded and collection conduct must remain lawful. Repeated threats, misrepresentation, public disclosure, or harassment should be documented and reported to the appropriate regulator.

Does an affidavit of denial cancel the loan?

No. It is useful evidence and creates a formal record, but it does not by itself cancel the account. Require a written bank determination, CIC correction where necessary, and appropriate regulatory or judicial relief if the dispute remains unresolved.

How long should I keep the records?

Keep them while the account, credit entry, investigation, collection effort, or any related case remains open—and longer if litigation or enforcement is reasonably possible. Preserve originals rather than relying only on cloud links or temporary message histories.

This article provides general Philippine legal information, not legal advice or a prediction of any case. Rights and remedies depend on the loan documents, disbursement trail, authentication evidence, lender type, and procedural history. Official sources and procedures were checked as of September 7, 2026.