Quick answer

If an online loan was applied for in your name without your knowledge or permission, dispute it immediately in writing. Ask the lender to stop collection, preserve its records, investigate the fraud, remove the account from your name, and correct any credit information it reported.

A loan does not become your valid contractual obligation merely because someone used your name, ID, mobile number, selfie, OTP, or other personal data. Under the Civil Code, consent is essential to a contract, and a person generally cannot contract for someone else without authority. However, the result can depend on the evidence—particularly who controlled the device and account, where the money went, and whether the supposed borrower later accepted or used the proceeds.

Do not ignore the problem, but do not admit the debt or pay a “small amount” simply to stop collection. Preserve the evidence, secure your accounts, notify the lender, and report identity theft or unlawful data processing to the proper authorities.

What counts as an unauthorized online loan application?

The problem may involve:

An application submitted entirely without your knowledge;
A fraudster using a stolen or copied ID, selfie, signature, mobile number, email address, or bank or e-wallet account;
Someone with access to your phone intercepting an OTP or opening a lending app in your name;
A person falsely claiming authority to borrow for you;
A lender creating or approving an account despite identity details that do not match;
An application you started but did not submit or approve; or
A legitimate application whose amount, fees, repayment terms, disbursement account, or electronic acceptance was altered.

These situations are not identical. If you personally applied but dispute only the charges or collection methods, that is generally a loan-term or consumer-protection dispute—not necessarily identity theft. If you knowingly received and used the loan proceeds, the lender may also argue that you accepted or ratified the transaction. The documents and digital records matter.

Are you legally required to pay?

Not automatically.

Under Articles 1317 to 1319 of the Civil Code of the Philippines, no one may contract in another person’s name without authority, and consent is an essential requirement of a contract. The Supreme Court has also explained that a contract bearing a forged signature is fictitious because the supposed party did not consent.

An electronic contract is not invalid merely because it was made online. The Electronic Commerce Act recognizes electronic documents and signatures, while the Rules on Electronic Evidence govern their authentication. But electronic form does not cure identity theft. A lender relying on a digital application may still have to establish that the electronic act is properly attributable to you.

Your position may be more complicated if:

The proceeds entered an account or e-wallet you controlled;
You withdrew, transferred, or spent the money after learning where it came from;
You made payments or signed a restructuring agreement;
You gave another person authority to transact for you;
Your device, SIM, email, or OTP was voluntarily shared; or
Some parts of the application are genuine while others are disputed.

If unexpected loan proceeds reach your account, do not spend or transfer them to a person claiming to be the lender or its “agent.” Notify the lender through a verified official channel and ask for secure written instructions. Fraudsters sometimes send money and then direct victims to return it to a different account.

What to do immediately

1. Preserve the evidence before deleting anything

Save copies of:

Text messages, emails, app notifications, and collection messages;
The lender’s name, app name, website, phone numbers, email addresses, and social-media accounts;
Application, account, loan, and transaction reference numbers;
The alleged loan agreement, disclosure statement, repayment schedule, and

Quick answer

If an online loan was applied for in your name without your knowledge or permission, dispute it immediately in writing. Ask the lender to stop collection, preserve its records, investigate the identity theft, remove the account from your name, and correct any credit information it submitted.

As a general rule, you are not bound by a loan contract you did not enter into or authorize. Consent is essential to a contract, and a person cannot validly contract in another’s name without authority. However, the outcome can depend on evidence—especially where the money was sent, whether you used or retained it, and whether your phone, account, OTP, selfie, signature, or identification documents were involved.

Do not ignore the problem, but do not admit the debt or make a “token payment” merely to stop collection. Secure your accounts, preserve evidence, notify the lender and relevant financial institutions, and report suspected identity theft to law enforcement. If your personal data was misused, you may also complain to the National Privacy Commission (NPC).

What counts as an unauthorized online loan application?

This may happen when someone:

Uses your name, ID, selfie, signature, mobile number, email address, employment details, or address to apply for a loan;
Gains access to your phone, email, SIM, e-wallet, bank account, or lending-app account;
Intercepts or tricks you into disclosing an OTP or verification code;
Uses information previously submitted to another app or business;
Falsifies electronic records or impersonates you during identity verification;
Applies through your device without your informed permission; or
Claims to be your authorized representative when you never gave authority.

An unexpected marketing message or rejected application is different from a loan that was approved, disbursed, or reported as your obligation. First establish exactly what occurred.

Are you legally required to pay?

Not simply because the lender’s system displays your name.

Under Articles 1317 to 1319 of the Civil Code of the Philippines, consent is essential to a contract. A contract made in another person’s name without authority is generally unenforceable against that person unless properly ratified. The Supreme Court has also explained that a contract bearing a forged signature is fictitious and lacks consent.

Electronic loan agreements are not automatically invalid merely because they are digital. The Electronic Commerce Act recognizes electronic documents and signatures, but their existence does not by itself prove that you created or authorized them. Electronic evidence must still be properly attributed and authenticated.

The lender should therefore investigate evidence such as:

The application form and alleged agreement;
The exact date and time of application;
The mobile number and email address used;
Device, browser, IP-address, and account-access logs;
OTP and identity-verification records;
Uploaded IDs, selfies, videos, signatures, and facial-matching results;
The destination bank or e-wallet account;
Disbursement and withdrawal records;
Recorded calls, chats, and collection notes; and
Any later conduct the lender claims confirmed or ratified the transaction.

Important exceptions and complications

Your position may require closer legal analysis if:

The proceeds entered an account you control;
You spent, transferred, withdrew, or knowingly kept the proceeds;
You disclosed an OTP or allowed another person to use your account;
You signed or accepted a later restructuring, settlement, or acknowledgment;
A family member or employee claims you authorized the transaction;
Part of the transaction was genuine but the amount or terms were altered; or
The lender can produce credible evidence that you personally completed the application.

Receiving money unexpectedly is not permission to use it. Notify the lender and the receiving bank or e-wallet immediately, leave the funds untouched, and ask for documented instructions. Do not send the money to an account supplied only through an unsolicited call or message; independently verify the lender’s official contact details first.

What to do immediately

1. Preserve the evidence before deleting anything

Take screenshots or export copies of:

The loan notice, demand letter, app screen, and account details;
SMS messages, emails, chats, call logs, and voice messages;
The sender’s phone number, email address, social-media profile, and payment instructions;
The lender and app names shown to you;
The claimed principal, charges, disbursement date, and due dates;
Any transaction showing where the proceeds were sent;
Security alerts, password-reset notices, and OTP messages;
App permissions and the list of installed lending apps;
Your bank or e-wallet statement for the relevant period; and
Messages sent to your relatives, employer, or contacts.

Preserve the original electronic files when possible. Record dates, times, URLs, usernames, reference numbers, and the names of representatives you speak with. Keep proof that your written disputes were delivered.

Do not alter screenshots or impersonate the suspected offender to obtain evidence.

2. Secure your phone and accounts

From a trusted device:

Change passwords for your email, bank, e-wallet, cloud storage, and social-media accounts;
Use unique passwords and enable multi-factor authentication;
Sign out unknown devices and review recent account activity;
Remove unknown apps and revoke unnecessary permissions;
Ask your mobile provider about an unexpected SIM replacement or loss of service;
Tell your bank or e-wallet provider to secure affected accounts and investigate unauthorized transactions; and
Preserve the device if it may contain evidence. A full reset can destroy useful logs.

Never give a supposed investigator, lender, or collector your OTP, password, PIN, recovery code, or remote access to your device.

3. Send the lender a formal written dispute

Use the lender’s verified customer-service or complaints channel. Your notice should state that:

You did not apply for, sign, authorize, receive, or benefit from the loan, except for any facts you must accurately disclose;
You dispute the account and all collection activity;
You request an immediate investigation and a temporary hold on collection and adverse credit reporting;
You request copies of the application, agreement, disclosures, identity-verification materials, consent records, disbursement details, and relevant system logs;
You request preservation of all evidence;
You request correction or removal of inaccurate records and notice to every credit bureau or recipient to which the account was reported; and
Future communications should be in writing.

Do not make statements you cannot prove. If money reached your account, say so accurately and explain whether it remains untouched or what happened to it.

The Financial Products and Services Consumer Protection Act protects financial consumers’ rights to fair treatment, protection against fraud and misuse, data privacy, and timely complaint handling. A regulated financial service provider must maintain a consumer-assistance mechanism and remains responsible for relevant acts of its employees and agents. It may also be solidarily liable with an accredited third-party service provider involved in transactions or debt collection.

4. Identify the actual lender and regulator

An app name may be different from the corporation that issued the loan. Look for the company’s legal name, SEC registration number, Certificate of Authority, office address, privacy notice, and complaints contact.

For lending and financing companies, verify the operator through the SEC’s official records and advisories. Registration as a corporation alone does not necessarily authorize a company to operate as a lending or financing company.

The appropriate financial regulator generally depends on the provider:

SEC: lending companies and financing companies;
BSP: banks, electronic-money issuers, and other BSP-supervised institutions;
CDA: credit cooperatives, subject to statutory exceptions; or
Insurance Commission: entities under its jurisdiction.

Complain first to the provider when practicable, then escalate to its regulator with your dispute, evidence, and the provider’s response or failure to respond. The SEC’s current public ticketing channel is iMessage SEC.

5. Report suspected identity theft or cybercrime

Computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right under the Cybercrime Prevention Act. Depending on the facts, computer-related forgery, computer-related fraud, falsification, estafa, or access-device fraud may also be relevant.

Report the incident promptly to:

The Philippine National Police Anti-Cybercrime Group or the nearest police station; or
The National Bureau of Investigation Cybercrime Division or the nearest NBI office.

Bring identification, a clear timeline, the lender’s information, transaction records, screenshots, messages, and copies of your written disputes. Ask for a complaint or incident reference number. Filing a report does not itself cancel the loan, so continue disputing the account with the lender and regulators.

The Access Devices Regulation Act, as amended, may apply when access devices or accounts are fraudulently applied for or used. The exact criminal charge is for investigators and prosecutors to determine from the evidence.

6. Address misuse of your personal data

The Data Privacy Act of 2012 requires lawful, fair, and proportionate processing of personal information. As a data subject, you may request access to information about the processing of your data and seek correction of inaccurate information. Erasure or blocking may be available where data is false, unlawfully obtained, used for an unauthorized purpose, or no longer necessary, subject to lawful retention and legal-claim exceptions.

Ask the lender or app’s data protection officer to explain:

What personal data it holds about you;
Where the data came from;
The purpose and legal basis for processing it;
The recipients to whom it was disclosed;
How long it will be retained;
What automated identity or credit assessment occurred; and
What corrective action it will take.

For loan-related processing, NPC Circular No. 2020-01, as amended by Circular No. 2022-02, prohibits unbridled processing of contact lists. Lending apps may have only limited access needed to let a borrower choose character references or guarantors. A character reference may be contacted to verify identity and information, but cannot automatically be treated as a guarantor.

How to file a complaint with the National Privacy Commission

Ordinarily, first notify the lender, app operator, data protection officer, or other concerned entity in writing and give it an opportunity to act. Under the 2021 NPC Rules of Procedure, as amended, an NPC complaint generally will not be given due course unless the entity failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your written notice. The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm or a patently illegal act.

Use the NPC’s current complaint form. As of July 2025, the NPC uses a new Complaint-Affidavit template. A formal complaint must ordinarily be written, signed, verified, properly notarized, supported by evidence, and accompanied by a certification against forum shopping. Filing fees may apply unless an exemption or waiver is available.

The NPC currently permits submission in person, by registered mail, courier, or authorized electronic mail. Check the NPC complaint page immediately before filing for the current template, fees, address, email channel, and submission instructions.

Attach:

Your written notice to the lender and proof of receipt;
The lender’s response, if any;
Screenshots, messages, call logs, and transaction records;
The disputed application or agreement, if obtained;
Evidence of disclosure to contacts or third parties;
Witness affidavits, where useful; and
The specific relief you request.

Do not delay. Different civil, criminal, administrative, and privacy claims may have different prescriptive periods. Obtain legal advice promptly if a deadline may be approaching.

Correcting your credit record

Ask the lender in writing to stop furnishing the disputed account as yours while it investigates and to correct every inaccurate submission already made.

You may also obtain your CIC credit report through the Credit Information Corporation’s Direct-to-Consumer program. If it contains an unauthorized loan, use the CIC’s Online Dispute Resolution Process.

The CIC currently requires the 14-digit Transaction Reference Number from a credit report that is not more than 30 days old for an online dispute. Preserve the report, dispute reference number, supporting documents, and final result. A CIC dispute corrects credit data; it does not replace complaints to the lender, regulator, NPC, or law enforcement.

If another private credit bureau carries the entry, separately follow that bureau’s correction process and send it the lender’s written confirmation or investigation result when available.

If collectors contact or threaten you

Tell the collector in writing that the debt is disputed because of identity theft. Request the creditor’s legal name, authority to collect, account reference, and written basis for claiming you owe the debt.

For SEC-regulated lending and financing companies, SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair collection practices. Prohibited conduct includes threats of violence or criminal means, threats to take action that cannot legally be taken, insults, disclosure of borrowers’ personal information, false representations, and contacting persons in the borrower’s contact list other than permitted guarantors or co-makers, subject to the circular’s specific rules and exceptions.

Preserve every threat or disclosure. Do not meet an aggressive collector alone. Call emergency services or seek immediate police assistance if there is a credible threat of violence, extortion, stalking, or danger at your home or workplace.

A genuine creditor may use lawful collection methods or file a civil case. Harassment, public shaming, and unlawful disclosure are not made legal by the existence of a real debt—and an unauthorized loan must still be proven against you.

Evidence that can strengthen your dispute

Useful evidence may include:

Proof that the mobile number, email, device, bank account, or e-wallet used was not yours;
Employment, travel, medical, or location records showing you could not have completed the verification;
A different signature or photograph from the one submitted;
Proof that the disbursement account belongs to another person;
Security alerts showing unauthorized access;
A mobile provider’s record of a SIM replacement;
An affidavit explaining when an ID or device was lost or compromised;
Statements from persons contacted by collectors;
The police or NBI report; and
The lender’s admissions, inconsistencies, or inability to produce authentication records.

No single item is automatically decisive. The documents and surrounding circumstances must be assessed together.

Common mistakes to avoid

Ignoring notices until collection or credit reporting has escalated;
Disputing only by phone and keeping no proof;
Paying a small amount without legal advice, which may complicate the issue;
Spending money unexpectedly deposited into your account;
Sending disputed funds to an unverified “recovery” account;
Deleting the app, messages, or device data before preserving evidence;
Publicly posting IDs, loan documents, or screenshots containing sensitive information;
Giving investigators or collectors your OTP, PIN, or password;
Assuming a character reference is legally responsible for the debt;
Filing a privacy complaint without first notifying the entity, unless a waiver is justified;
Naming only the app and not identifying its corporate operator; and
Assuming a police report alone automatically removes the account.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A summons, subpoena, complaint, or court paper has been served;
Your bank, salary, property, or other assets are threatened with legal process;
The lender insists its biometric, OTP, or device records prove you applied;
You received or used any part of the proceeds;
A collector demands that you sign a settlement or acknowledgment;
Your identity was used for several loans or financial accounts;
Your employer, relatives, or customers are being contacted or publicly shamed;
Intimate images, threats, blackmail, or violence are involved;
A substantial amount or significant credit damage is at stake; or
You may be near a filing or prescription deadline.

Do not ignore actual court papers. A written dispute sent to the lender does not suspend a court deadline.

Frequently asked questions

Can a lender make me pay merely because my ID was used?

No. An ID copy is evidence of identity, not conclusive proof that you consented to the loan. The lender must rely on properly attributable application and authentication evidence. The final result remains fact-dependent.

What if the loan proceeds entered my e-wallet?

Freeze or secure the account, do not use the money, and immediately notify both the lender and e-wallet provider in writing. Ask them to preserve transaction and device records. Obtain legal advice before returning funds through any channel you cannot independently verify.

Am I liable because I shared an OTP?

Sharing an OTP can make the investigation more difficult, but it does not automatically answer every issue of consent, fraud, negligence, or liability. Explain exactly how it happened and preserve the messages or calls that induced you to disclose it.

Can collectors contact my relatives or employer?

They cannot lawfully use your contact list for harassment or public shaming. A character reference is not automatically a guarantor and may be contacted only for permitted verification purposes. A collector’s rights may differ for a genuine guarantor, co-maker, or person you expressly authorized.

Should I uninstall the lending app?

First preserve screenshots, account details, permissions, messages, and other evidence. Then revoke unnecessary permissions and secure the device. If the phone may be important evidence, seek technical or legal advice before resetting it.

Can I demand immediate deletion of all my information?

You may request correction, erasure, or blocking where legally justified, but deletion is not absolute. A lender may retain limited records needed to investigate fraud, comply with law, establish legal claims, or document how the dispute was resolved. It should not continue using inaccurate data as though the loan were yours.

Does filing with the NPC cancel the debt?

Not automatically. An NPC complaint addresses personal-data processing and privacy violations. Dispute the alleged contract directly with the lender and pursue the appropriate financial-regulatory, credit-reporting, law-enforcement, or court remedies as needed.

What if the lender is unregistered or cannot be identified?

Preserve the app-store page, website, payment instructions, phone numbers, account names, and messages. Report the operator to the SEC and law enforcement. Do not send money or additional identification to an entity whose identity and authority you cannot verify.

This article provides general legal information, not advice for a particular case, and does not create an attorney-client relationship. The legal result depends on the documents, authentication records, movement of funds, and surrounding facts. Official sources and procedures were checked as of 24 July 2026; confirm current forms and filing instructions with the relevant agency before acting.