Quick answer

If a loan, credit card, credit line, or other credit account was opened using your identity without your knowledge or consent, report it immediately and in writing to the lender or account issuer. State clearly that you did not apply for, authorize, receive, or benefit from the account; ask the institution to block further use and collection while it investigates; request copies of the application and verification records; and demand correction of any records wrongly attributed to you.

Also consider filing:

A criminal complaint with the Philippine National Police or National Bureau of Investigation, especially if forged documents, stolen credentials, account takeovers, or online impersonation were involved.
A complaint with the proper financial regulator if the institution does not respond appropriately.
A dispute with the Credit Information Corporation if the account appears in your CIC credit report.
A privacy complaint with the National Privacy Commission if your personal data was unlawfully obtained, used, disclosed, or left uncorrected.

An account created by an impostor is not automatically your debt merely because it carries your name or personal details. A creditor asserting that you borrowed the money must still establish a valid agreement attributable to you. However, the result can depend on the documents, authentication records, destination of the proceeds, and whether you or someone acting with your authority participated in the transaction. Do not ignore collection notices or court papers.

Act immediately

Speed matters because the impostor may still have access to your phone number, email, bank account, identification documents, or online accounts.

1. Contact the lender through an official channel

Use the institution’s fraud hotline, branch, official app, website, or published consumer-assistance channel. Do not rely on a telephone number or link contained only in a suspicious message.

Tell the lender that the account is disputed as identity fraud—not merely that you cannot pay. Ask it to:

Mark the account as disputed due to suspected identity theft.
Block further borrowing, cash advances, card use, disbursements, or changes to the account.
Suspend collection activity and adverse credit reporting while the dispute is investigated, to the extent required by applicable law and regulation.
Preserve the complete application, approval, disbursement, authentication, and communication records.
Stop disclosing or processing inaccurate information about you.
Correct or remove information that the investigation establishes was wrongly attributed to you.
Give you a complaint reference number and a written explanation of its findings.

Follow every telephone report with an email, secure message, or letter. A written record is important for regulatory escalation and for proving when the institution received notice.

2. Send a formal identity-fraud dispute

Your written notice should identify the account without unnecessarily exposing full account numbers in an insecure email. Include:

Your complete name and reliable contact details.
The disputed account’s masked number, product type, and lender.
When and how you discovered it.
A direct statement that you did not apply for or authorize the account.
Whether you received any loan proceeds, card, goods, or benefit.
Which personal details, ID, phone number, email address, signature, selfie, or bank account do not belong to you.
The action you want: blocking, investigation, document access, correction, cessation of collection, and correction of credit reporting.
A list of supporting documents.
A request for acknowledgment, a case number, and a written final response.

Sign only as needed to authenticate your complaint. If an institution requests additional identity verification, confirm through an official channel that the request is genuine and ask how the information will be protected.

3. Secure the accounts that may have been compromised

Change passwords for your email, mobile banking, e-wallets, social-media accounts, and other services that could be used for identity verification. Use unique passwords and enable multi-factor authentication.

Contact your mobile network if your SIM unexpectedly lost service, you received unexplained one-time-password messages, or you suspect a SIM replacement. Check whether unauthorized email forwarding rules, recovery addresses, devices, or app permissions were added.

If loan proceeds passed through an account or wallet in your name, notify that provider immediately. Ask it to preserve transaction and device records and to restrict unauthorized access. Do not transfer or return money in response to instructions from an unverified caller; coordinate through the provider’s official fraud team.

Ask for the records behind the account

Under the Data Privacy Act, a data subject generally has rights to be informed about processing, obtain reasonable access to personal data, dispute inaccuracies, and have erroneous data corrected, subject to lawful limitations and the rights of others.

Ask the lender or its data protection officer for the records necessary to understand how the account was created, such as:

The application form and purported agreement.
IDs, photographs, selfies, signatures, and supporting documents submitted.
Phone numbers, email addresses, residential or employment details, and references used.
Date and time stamps, device or session information, and available authentication logs.
One-time-password or verification records.
Call recordings, chat logs, emails, and delivery records.
Approval and know-your-customer records.
The account to which proceeds were released.
Transfers, withdrawals, purchases, or other use of the credit.
Credit-information submissions made under your identity.
The identity of collection agencies or service providers that received your data.

An institution may redact information belonging to other people or withhold material protected by law. That does not prevent you from requesting the personal data and transaction information needed to challenge the account.

Ask the institution to preserve unredacted originals even if it cannot immediately give you every item. Electronic logs and surveillance footage may be retained only for limited periods.

Preserve evidence

Keep original electronic files whenever possible—not just cropped screenshots. Create a dated timeline and preserve:

Collection messages, emails, letters, call logs, and voicemail.
Screenshots showing sender details, URLs, account numbers, dates, and times.
The envelope and delivery information for any physical card or notice.
Your credit report and the transaction reference number used to obtain it.
Bank or e-wallet statements showing that you did not receive the proceeds—or showing an unauthorized receipt and transfer.
Proof of your location or activity when the application or transaction occurred, if relevant.
Examples of your genuine signature, with appropriate privacy precautions.
Police or NBI reports, affidavits, acknowledgment emails, and complaint numbers.
Every submission to the lender and proof that it was received.
The lender’s responses and investigation findings.
Evidence of a lost ID, compromised email, SIM problem, phishing message, or data breach.

Do not alter files, manufacture conversations, or publicly accuse a suspected person without reliable evidence. Give investigators facts and records rather than speculation.

Report suspected identity theft to law enforcement

Where digital systems were used, the conduct may fall within computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act. That provision covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another. Depending on what happened, access-device fraud, falsification, estafa, illegal access, or other offenses may also be relevant. The investigating authorities and prosecutors determine the proper charge based on evidence.

You may approach:

The PNP Anti-Cybercrime Group or an appropriate police station.
The National Bureau of Investigation, including its cybercrime investigators where applicable.

Bring government identification, the lender’s notice, your written dispute, account details, preserved electronic evidence, and a concise timeline. Ask for the official record or reference number.

A police blotter or complaint does not by itself erase the account, establish the offender’s guilt, or conclusively prove that you did not borrow. It is nevertheless useful evidence that you promptly reported the fraud and can support requests to preserve records.

Escalate to the correct regulator

The proper regulator depends on the kind of institution. Regulatory escalation ordinarily follows an initial written complaint to the institution.

For banks and other BSP-supervised institutions

First use the institution’s consumer-assistance mechanism. If the matter remains unresolved or its response is inadequate, escalate through the BSP Consumer Assistance Mechanism.

The BSP identifies its Online Buddy, or BOB, as a complaint channel. It also publishes a Complaints, Inquiries and Requests form and the email address consumeraffairs@bsp.gov.ph. Attach your complaint to the institution, proof of receipt, its response if any, and supporting evidence.

BSP-supervised institutions include banks and certain non-bank financial institutions. Confirm the institution’s regulatory status rather than assuming that every lending app is BSP-supervised.

For lending or financing companies regulated by the SEC

If the provider is a lending company, financing company, or online lending platform under SEC supervision, submit the matter through the SEC iMessage portal. Identify the registered company behind the brand or app if possible and attach the prior written complaint and supporting records.

The SEC complaint does not replace a direct identity-fraud dispute with the lender, a CIC credit-report dispute, or a criminal complaint.

For privacy violations

Contact the lender or other organization’s data protection officer in writing. Explain the suspected unauthorized use of your data and request access, correction, restriction or other appropriate relief.

Under the National Privacy Commission’s complaint rules, a complainant generally must first inform the respondent in writing and allow it to address the alleged privacy violation or personal-data breach. The NPC states that this requirement is ordinarily satisfied when the respondent fails to take timely or appropriate action, or gives no response within 15 calendar days after receiving the written notice. Exceptions may apply under the NPC’s rules, but should not be assumed without examining the facts.

Use the current NPC complaint mechanics and forms. NPC complaints have formal requirements, including verification, supporting documents, and a certification against forum shopping. A request for correction sent to a lender is not automatically the same as a properly filed NPC complaint.

Check and dispute your CIC credit report

A lender’s internal records and your CIC credit report are separate. Correcting one does not guarantee that the other has been corrected.

Obtain and review your credit report through a channel identified by the Credit Information Corporation. Check the lender’s name, account type, dates, balances, status, and other unfamiliar entries.

If the unauthorized account appears, use the CIC Online Dispute Resolution System. CIC states that filing a dispute is free. Its process requires the 14-digit Transaction Reference Number associated with the CIC credit report.

The CIC dispute process addresses alleged discrepancies in information submitted to the CIC. The submitting lender investigates or acts on the disputed entry through that process. Keep the dispute number and final result, and obtain a new report later to confirm that the correction actually appears.

The statutory basis is the Credit Information System Act, which gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information.

What the lender should investigate

A proper investigation should consider more than whether the application displays your name and ID number. Relevant questions include:

Who controlled the phone number and email used?
What authentication steps were completed, and from which device or session?
Was the submitted ID genuine, altered, expired, or stolen?
Does the selfie or video identify you?
Where were proceeds delivered, and who controlled that destination?
Who received or activated a physical card?
Were signatures or documents forged?
Did the institution receive warning signs or conflicting information?
Did you ever authorize an agent, relative, employee, or co-borrower?
Did you later confirm, use, or benefit from the account?

The absence of a handwritten signature does not by itself decide the issue because Philippine law recognizes electronic documents and electronic signatures when legal requirements are met. Conversely, an electronic record bearing your personal details does not necessarily prove that you personally created or authorized it. Authentication and the surrounding evidence matter.

Do you have to pay the unauthorized account?

Not merely because a collector says the account is yours. A valid contract ordinarily requires consent, an object, and a cause. If an impostor acted without your authority and you neither entered into nor adopted the transaction, the lender must address that fundamental defect rather than treating matching identity details as conclusive.

Still, avoid absolute assumptions. Liability may become fact-sensitive if, for example:

You authorized someone to apply or transact for you.
You knowingly gave the person credentials or control for that purpose.
You received and retained or used the proceeds.
You later expressly confirmed the obligation.
The disputed charges arose on a genuine account rather than an entirely fabricated account.
The account involves a co-borrower, guarantor, supplementary cardholder, business, or agency relationship.

Do not make a token payment, sign a restructuring agreement, or promise to pay simply to stop calls before obtaining advice. Such conduct may complicate the factual and legal dispute. At the same time, do not disregard a genuine summons, subpoena, demand with a deadline, or notice of adverse action.

If collectors contact you

Tell the collector in writing that the account is disputed as identity fraud and that the matter has been reported to the lender. Give the lender’s case number if appropriate, but do not provide unnecessary personal data.

Ask the collector to identify:

Its complete legal and business name.
The original creditor.
The disputed account reference.
Its authority to collect.
The current balance and basis of the claim.
The address or email for formal disputes and privacy requests.

Save all communications. Threats, harassment, deceptive representations, disclosure of the alleged debt to unrelated persons, or misuse of contacts and personal information may raise separate consumer-protection or privacy issues. Report the conduct to the creditor and the regulator with jurisdiction.

Do not click unfamiliar payment links or disclose one-time passwords. A scammer may pose as a collector for the fraudulent account.

A practical written notice

You can adapt the following:

I dispute the account ending in [last digits] as an account opened through identity fraud. I did not apply for, authorize, sign, activate, use, or receive the benefit of this account. Please immediately block further activity, mark the account as disputed, suspend collection and adverse reporting while you investigate, and preserve all application, identity-verification, authentication, disbursement, communication, and transaction records.

Please provide the personal data and records used to create and approve the account, subject to lawful redactions; identify where any proceeds or card were delivered; and confirm whether information was submitted to the Credit Information Corporation or any credit bureau. Correct or remove information shown by your investigation to have been wrongly attributed to me, notify recipients of the correction where required, and send me your written findings and complaint reference number.

Attached are [list of documents]. This notice is not an acknowledgment, ratification, or promise to pay the disputed obligation.

Keep the language accurate. Do not state that you received no proceeds if money actually entered an account you control; instead, explain precisely whether the transfer was unauthorized and what happened next.

Common mistakes to avoid

Reporting only by telephone

A call may stop immediate activity, but it creates a weak record. Send a written notice and keep proof of receipt.

Calling it a billing error when the whole account is fraudulent

Say expressly that the account was opened without your authority. This helps route the matter to fraud, identity-verification, privacy, and credit-reporting teams.

Sending IDs to an unverified address

Confirm the lender’s official contact information. Mask irrelevant numbers where accepted and watermark copies for the stated purpose without obscuring information the investigator genuinely needs.

Assuming a police report automatically clears the debt

The lender and credit-information records still need to be disputed and corrected.

Disputing only with the lender

Check the CIC report and dispute any inaccurate entry separately.

Deleting messages or resetting devices before preserving evidence

Secure accounts, but first retain relevant messages, headers, logs, and screenshots where safe to do so.

Paying solely to stop harassment

Payment or restructuring can create additional factual issues. Obtain individualized advice before taking a step that could be characterized as recognizing the account.

Publicly naming a suspected offender without proof

Report evidence to the proper institutions and authorities. Public accusations may create avoidable legal risks and can alert the offender.

Ignoring official legal papers

A fraud complaint does not stop a court deadline. Seek legal assistance immediately.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a summons, subpoena, prosecutor’s notice, or demand with a stated deadline.
The lender has sued or is threatening foreclosure, repossession, setoff, or action against collateral.
A large amount or several institutions are involved.
Loan proceeds entered an account in your name and were moved or withdrawn.
The institution claims that biometric, video, electronic-signature, or device evidence proves you applied.
You know the suspected person and issues of authority, family property, employment, or business agency may arise.
You made a payment, signed a settlement, or acknowledged the account before discovering the fraud.
The lender refuses to provide essential records or continues reporting the debt after substantiated notice.
Your identity is being used repeatedly or government IDs and accounts have been compromised.
You are being harassed, threatened, or publicly shamed.

If cost is a barrier, inquire about eligibility for assistance from the Public Attorney’s Office or a recognized legal-aid organization.

Frequently asked questions

Is an affidavit of denial required?

A lender may request a sworn affidavit as part of its fraud investigation, and an affidavit can help organize your account of events. It is not a substitute for evidence and does not by itself decide liability. Read it carefully, state only facts you know to be true, and keep a copy.

Should I report the person I suspect?

You may give investigators the person’s identity and the factual basis for your suspicion. Separate what you personally know from what you inferred. Avoid confronting the person if doing so could destroy evidence or put anyone at risk.

What if the lender says the OTP proves I applied?

An OTP record is relevant but may not be conclusive. Ask which number received it, who controlled that number, what other verification occurred, and whether there was a SIM replacement, device compromise, phishing event, or account takeover.

What if the proceeds went to an account in my name?

Report both the loan and the receiving account immediately. Explain whether you controlled the account and whether any onward transfer was authorized. Preserve statements and device records. This situation warrants prompt legal advice because the transaction trail may initially appear to connect you to the proceeds.

Can I demand immediate deletion of every record?

Not necessarily. An institution may need to retain certain records for fraud investigation, legal claims, regulatory duties, or other lawful purposes. Focus on blocking misuse, correcting inaccurate attribution, restricting inappropriate processing, and ensuring that retained records clearly reflect the dispute and its outcome.

Will an NPC complaint remove the account from my credit report?

Not automatically. The NPC addresses personal-data processing and privacy rights. Use the lender’s correction process and the CIC dispute system for the credit entry, while pursuing an NPC complaint when the privacy requirements are met.

How long should I keep the evidence?

Keep it for as long as the account, investigation, credit entry, collection effort, or related proceeding may remain active, and longer if counsel advises it. There is no single safe retention period for every case because different claims and proceedings can have different deadlines.

What if I discovered the account only after a loan application was rejected?

Ask the rejecting institution what information influenced its decision, subject to applicable disclosure rules. Obtain your CIC credit report, dispute the unauthorized entry, and separately notify the lender that furnished it. Keep the rejection notice and proof of any resulting loss.

Official legal and procedural sources

This article provides general Philippine legal information, not legal advice or a prediction of any investigation or case. The correct response may depend on the account documents, authentication evidence, movement of funds, and communications. Official sources and procedures were checked as of 30 August 2026.