Being told by an online lending app that you owe money for a loan you never applied for is frightening, especially when collectors start texting your contacts, threatening “legal action,” or posting shame messages online. In the Philippines, a lending app cannot simply create a valid debt by putting your name, number, ID, or photo in its system. A loan still needs consent, proper identification, lawful data processing, and fair collection practices. This guide explains what the law says, what evidence to save, which agencies to report to, and how to respond without accidentally making the fake loan look real.
First: Do Not Pay Just to “Stop the Harassment”
Many victims are pressured to pay a small “settlement,” “extension fee,” or “processing fee” even when they never borrowed money. Be careful.
Paying can create practical problems because the app may treat the payment as an admission that the account is yours. It may also encourage more collection demands.
Instead, your first response should be:
“I dispute this debt. I did not apply for or receive this loan. Please provide proof of application, loan agreement, disbursement record, consent, and identity verification. Do not contact my relatives, employer, friends, or phone contacts about this disputed account.”
Keep the message short. Do not argue endlessly with collectors. Your goal is to create a clear record that you disputed the debt immediately.
Is a Loan Valid If You Never Applied for It?
Usually, no.
Under the Civil Code, a contract does not exist unless three essential elements are present: consent, a definite object, and a lawful cause. For a loan, consent means you agreed to borrow under specific terms and to repay the amount. Article 1318 of the Civil Code states that there is no contract unless these requisites concur, and Article 1319 explains that consent requires a meeting of the offer and acceptance. (LawPhil)
If someone else used your name, phone number, ID, selfie, SIM, email, or e-wallet without authority, there is no true consent from you. The lender’s possible claim is against the fraudster, not automatically against you.
The situation can become more complicated if:
- the loan proceeds were sent to your own GCash, Maya, bank, or e-wallet account;
- you knowingly gave your OTP, password, account access, or ID to another person;
- you previously installed the app and gave broad permissions;
- you paid part of the alleged loan after receiving collection threats;
- a family member or employee used your phone or ID.
Even then, the app must still prove that you actually applied, consented, received the proceeds, and agreed to the terms. A screenshot from their own system is not enough by itself.
Your Key Rights Under Philippine Law
1. The lender must prove the debt
A collection message is not proof of a valid loan.
Ask for:
- the loan agreement or electronic contract;
- the date and time of application;
- the mobile number, email, device ID, IP address, or account used;
- the ID, selfie, biometric, or KYC record allegedly submitted;
- the disbursement record showing where the money was sent;
- the Truth in Lending disclosure showing interest, fees, deductions, maturity date, and total amount payable.
The Truth in Lending Act, Republic Act No. 3765, requires disclosure of finance charges in credit transactions. It was enacted to protect borrowers from lack of awareness of the true cost of credit. (LawPhil)
2. The app cannot freely use your personal data
The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information and sensitive personal information. Consent must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. (National Privacy Commission)
You also have the right to dispute inaccurate personal information and have it corrected, and to ask for blocking, removal, or destruction of personal data that is false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)
For online lending, the National Privacy Commission has issued special rules. NPC Circular No. 2020-01, amended by NPC Circular No. 2022-02, covers personal data processing for evaluating loan applications, granting loans, collecting loans, and closing loan accounts. The NPC has specifically emphasized that lending apps must not conduct unnecessary processing or require unnecessary permissions involving personal and sensitive personal information. (National Privacy Commission)
3. Contacting your phonebook is restricted
One of the most common abuses is when an online lending app texts your relatives, coworkers, employer, or random contacts to say you are a “scammer” or “runner.”
The 2026 joint advisory of the DICT, NPC, and SEC states that online lending platforms are prohibited from unnecessary, excessive, or disproportionate processing of personal data, especially access to borrowers’ contact lists. It also states that contacting persons in a borrower’s contact list, other than named guarantors, is prohibited for debt collection.
A character reference is not the same as a guarantor. A character reference is only used to verify identity or information. A guarantor is someone who expressly agreed to answer for the debt if the borrower defaults. The NPC has clarified that character references are not automatically guarantors, and guarantors must give separate consent. (National Privacy Commission)
4. Harassment and public shaming are prohibited
SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing companies, lending companies, and their third-party service providers. Prohibited acts include threats of violence or criminal means, threats to take actions that cannot legally be taken, insults or profane language, false representations, disclosure or publication of borrower information, and contacting persons in the borrower’s contact list other than guarantors or co-makers.
The SEC’s current iMessage system is its web-based platform for public inquiries, complaints, incidents, and requests, and it generates an electronic ticket for tracking. (imessage.sec.gov.ph) (imessage.sec.gov.ph)
5. Identity theft may be a cybercrime
If someone used your identity to create a loan account, submit documents, or obtain money through an app, the conduct may fall under the Cybercrime Prevention Act of 2012, Republic Act No. 10175.
Section 4(b)(3) penalizes computer-related identity theft, which includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another person without right. Section 4(b)(2) also covers computer-related fraud involving unauthorized input, alteration, or deletion of computer data causing damage with fraudulent intent. (Supreme Court E-Library)
The NBI and PNP are the law enforcement authorities responsible for cybercrime enforcement under RA 10175. (Supreme Court E-Library)
Step-by-Step: What to Do Immediately
1. Preserve evidence before blocking anyone
Before you block the collector, save everything.
Take screenshots showing:
- the sender’s number, username, profile, or email;
- the full message, including dates and timestamps;
- threats, insults, accusations, or public shaming;
- messages sent to your relatives, employer, or friends;
- call logs showing frequency and timing;
- the app name, website, Facebook page, or Play Store/App Store page;
- any claimed loan number or account number;
- any QR code or payment instruction.
Also save screen recordings where possible. If the collector deletes messages later, your screenshots may be the only practical proof.
2. Check whether money actually entered any account you control
Look at your:
- GCash, Maya, ShopeePay, LazPay, GrabPay, Coins, or other e-wallet history;
- bank statements;
- remittance accounts;
- SMS transaction alerts;
- email transaction confirmations.
If money entered your account without your knowledge, do not spend it. Keep it traceable. Report it as an unauthorized transaction to the bank or e-wallet and ask for a case reference number.
3. Send a written debt dispute
Use one calm written message:
I dispute this alleged loan. I did not apply for it, did not authorize anyone to apply for it, and do not admit liability. Please send proof of application, identity verification, loan agreement, disclosure statement, and disbursement record. Pending proof, stop collection and stop contacting third parties about this disputed account.
Send this through the app, email, SMS, or official customer service channel if available. Screenshot your sent message.
4. Demand deletion or correction of false data
Because the app is processing data about you, you may also invoke your data privacy rights:
I request correction, blocking, removal, or destruction of false and unlawfully processed personal data relating to this alleged loan. I also request the identity and contact details of your Data Protection Officer.
This is important because some apps recycle personal data across multiple lending brands.
5. Report to the correct agency
Use the right office depending on the problem.
| Problem | Where to report | What to attach |
|---|---|---|
| Harassment, threats, unfair collection, illegal collection from contacts | SEC | Screenshots, call logs, app name, company name if known, collector numbers, dispute message |
| Unauthorized use of your personal data, contact list abuse, fake account using your identity | National Privacy Commission | Notarized complaint form, screenshots, IDs, proof you disputed the account |
| Identity theft, fake online loan account, threats, extortion, cyberlibel, account takeover | PNP Anti-Cybercrime Group or NBI Cybercrime Division | Affidavit, screenshots, device/app details, transaction records, ID copies |
| Unauthorized e-wallet or bank transaction | Bank/e-wallet provider, then BSP if regulated institution fails to act | Transaction history, ticket number, affidavit, ID |
| Fake SIM, number misuse, phishing, OTP scam | Telco, PNP/NBI if fraud occurred | SIM number, messages, call logs, fraud narrative |
For NPC complaints, the official process requires using the complaint form, printing and filling it out, having it notarized, and submitting it in person, by courier, or by scanned email to the NPC. (National Privacy Commission)
6. Prepare a simple affidavit
For agencies, a clear affidavit is often more useful than a long emotional narrative.
Include:
- your full name, address, contact number, and email;
- the date you first learned about the alleged loan;
- the app or company name, if known;
- why you deny applying for the loan;
- whether you received any loan proceeds;
- what threats or collection acts happened;
- who among your contacts was messaged;
- a list of screenshots and documents attached;
- a request for investigation, correction/deletion of false data, and cessation of collection.
If you are abroad, documents signed outside the Philippines may need consular notarization or apostille, depending on where they were executed and where they will be submitted. Philippine embassies and consulates can usually notarize or acknowledge documents for use in the Philippines, while apostilles are commonly used for documents issued in countries that are parties to the Apostille Convention.
What If the App Says You Are a Guarantor?
A guarantor is not created by being listed as a contact.
Under the Civil Code, a person cannot simply be bound to a contract without consent. Article 1317 provides that no one may contract in the name of another without authority, unless legally authorized to represent that person. (LawPhil)
If an app says you are liable because a friend or relative listed you, ask for:
- the guaranty agreement;
- your separate consent;
- the date, time, and method you supposedly agreed;
- the exact loan obligation you allegedly guaranteed.
If they cannot show that you expressly agreed to be a guarantor, you should dispute liability immediately.
What If They Threaten a Court Case or Barangay Complaint?
Collectors often say:
- “May warrant ka na.”
- “Ipapa-barangay ka namin.”
- “May subpoena na.”
- “Pupunta kami sa employer mo.”
- “Makukulong ka sa utang.”
Ordinary unpaid debt is generally a civil matter. A person is not jailed simply for being unable to pay a private loan. However, fraud, identity theft, falsification, or cybercrime allegations are different. That is why you should keep your dispute focused: you are not refusing to pay a real debt; you are denying that a valid debt exists.
A legitimate civil claim normally requires proper demand, filing in the correct court, payment of filing fees, service of summons, and an opportunity for you to answer. A text message from a collector is not a court order.
Common Scenarios and What They Mean
Someone used your ID and selfie
This may happen after a phishing link, fake job application, SIM registration scam, fake raffle, or “verification” request. Report it as possible identity theft and ask the app for the KYC record. If the photo was manipulated or stolen, say so clearly in your affidavit.
Your phone was borrowed by a relative
If a relative used your phone, SIM, or e-wallet, agencies may look at device access and transaction history. You may still dispute unauthorized use, but be prepared to explain who had access, when, and whether any money was received.
You installed the app but never completed a loan
Some users explore an app, upload an ID, then abandon the application. The app should not treat an incomplete application as a disbursed loan unless there was approval, disclosure, consent, and actual release of proceeds. Ask for the loan agreement and disbursement proof.
They sent money to your e-wallet without clear consent
Do not spend it. Report the unauthorized credit to your e-wallet provider and the app. Spending the money can weaken your position because the lender may argue that you accepted the benefit.
They are messaging your employer or relatives
Save the messages. Under SEC and NPC rules, public shaming, threats, false statements, and contact-list harassment may be reportable. Tell your contacts not to argue with the collector. They should screenshot the message, note the number, and send the evidence to you.
Documents to Prepare
| Document | Why it helps |
|---|---|
| Government ID | Establishes your identity when filing complaints |
| Screenshots and call logs | Shows harassment, threats, and disputed collection |
| Written dispute message | Proves you denied the debt early |
| Bank/e-wallet transaction history | Shows whether you received loan proceeds |
| Affidavit of denial and narration | Useful for SEC, NPC, PNP, NBI, and prosecutors |
| Statements from contacted relatives/employer | Shows third-party harassment |
| App screenshots or Play Store/App Store listing | Helps identify the platform |
| Police blotter or cybercrime report, if available | Supports identity theft documentation |
| Notarized NPC complaint form | Required for formal NPC complaint filing |
Practical Timeline
| Step | Typical timeline |
|---|---|
| Evidence gathering | Same day to 3 days |
| Written dispute to app | Immediately |
| E-wallet/bank unauthorized transaction report | Within 24–48 hours if money moved |
| SEC complaint via iMessage | Same day once evidence is complete |
| NPC formal complaint | Usually after preparing notarized form and attachments |
| PNP/NBI cybercrime complaint | Same day for urgent threats; longer if affidavit and documents are incomplete |
| Agency action | Varies widely; follow up using ticket or docket numbers |
The most common bottlenecks are incomplete screenshots, missing timestamps, failure to identify the app/company, and lack of a clear written denial.
Frequently Asked Questions
Can an online lending app force me to pay a loan I never applied for?
Not without proving that you applied, consented, received the proceeds, and agreed to the terms. Under the Civil Code, consent is essential to a valid contract. A fake account or unauthorized application should be disputed immediately.
Should I pay a small amount just to stop the texts?
Avoid paying if you genuinely deny the loan. Payment may be treated by the app as acknowledgment of the account. Instead, send a written dispute and file complaints with the SEC, NPC, or cybercrime authorities as appropriate.
What if the collector says I will be jailed?
A private unpaid loan is generally a civil matter. You are not jailed simply for being unable to pay a debt. But if there is identity theft, fraud, falsification, threats, or cybercrime, those are separate issues that should be reported and investigated.
Can they message my contacts?
They should not use your contact list for harassment or debt collection outside lawful limits. Current NPC and SEC guidance restricts excessive contact-list processing, and contacting persons other than proper guarantors for debt collection is prohibited.
Am I liable if I was listed as a character reference?
No, being a character reference does not make you a guarantor. A guarantor must separately and expressly consent to answer for the debt. (National Privacy Commission)
What if they used my stolen ID?
Report it as possible identity theft. Ask the lender for the KYC record, loan agreement, and disbursement proof. File with the NPC for misuse of personal data and with PNP/NBI if there is cybercrime or fraud.
Can I ask the app to delete my data?
Yes. Under the Data Privacy Act, you may dispute inaccurate personal data and request blocking, removal, or destruction of personal data that is false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. (National Privacy Commission)
What if the app is not registered with the SEC?
That is a serious red flag. Lending companies must operate under the regulatory framework for lending companies, and RA 9474 declares the State policy of regulating lending companies and preventing practices prejudicial to the public interest. (Supreme Court E-Library) Report the app to the SEC and include screenshots of its name, website, app listing, and collection messages.
What if I am an OFW or foreigner outside the Philippines?
You can still preserve screenshots, send a written dispute, and file online or by email where accepted. For sworn statements to be used in Philippine proceedings, you may need consular notarization or apostille, depending on the document and country where it is signed.
Key Takeaways
- A loan you never applied for is not automatically your legal debt.
- Consent is essential to a valid loan contract under the Civil Code.
- Do not pay a disputed fake loan just to stop harassment.
- Preserve screenshots, call logs, transaction records, and third-party messages.
- Ask for the loan agreement, KYC record, Truth in Lending disclosure, and disbursement proof.
- Report unfair collection to the SEC, data misuse to the NPC, and identity theft or cybercrime to PNP/NBI.
- Character references are not guarantors.
- Contact-list harassment, public shaming, threats, false representations, and excessive data processing are legally risky for lending apps in the Philippines.