Seeing a loan balance in a lending app that you never applied for is not something to brush aside. In the Philippines, you should treat it as three problems at once: a disputed debt, a possible identity theft or account-takeover incident, and a possible data privacy violation. Your first goals are to preserve evidence, stop further unauthorized access, formally dispute the loan, prevent wrongful collection or credit reporting, and escalate to the correct government office if the app or lender does not act properly.

Is an Unauthorized Loan Legally Binding in the Philippines?

A loan is still a contract. Under the Civil Code, a contract requires a “meeting of minds” between the parties, and the essential requisites are consent, a certain object, and cause or consideration. Consent is shown by a valid offer and acceptance. A person generally cannot bind another person to a contract without authority, and a contract entered into in another person’s name without authority may be unenforceable unless properly ratified. (Lawphil)

In practical terms, this means a lending app or collection agent should not simply say, “It is in your account, so you must pay.” They should be able to show how the loan was applied for, who accepted the terms, what identity verification was used, where the money was disbursed, and what proof shows that you actually consented.

An unauthorized loan may happen because:

Someone accessed your lending app account using your mobile number, email, password, OTP, or SIM.
Someone used your ID, selfie, or personal details to create or verify an account.
The app processed a loan after confusing or misleading screens.
A prior borrower entered your number or details by mistake.
A debt collector is using false or incomplete information.
A legitimate account exists, but the specific loan transaction was not authorized.

The most important point: do not admit the debt casually. Avoid messages like “I will pay later” or “I just need more time” if your position is that you never borrowed the money. Say clearly and consistently that the loan is unauthorized and disputed.

Your Key Rights Under Philippine Law

You Have the Right to Dispute a Loan You Did Not Authorize

Lending companies are regulated under the Lending Company Regulation Act of 2007, or Republic Act No. 9474, which recognizes the State’s power to regulate lending companies and prevent unfair or prejudicial practices against borrowers. (Supreme Court E-Library)

Digital lending also falls within broader financial consumer protection rules. The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, covers financial products and services accessed through digital channels, and gives financial regulators such as the SEC and BSP authority to act against unfair, unreasonable, abusive, or deceptive practices. It also recognizes that financial service providers may be responsible for acts or omissions of their agents and representatives. (Supreme Court E-Library)

If you did not authorize the loan, your dispute should focus on facts:

You did not apply for the loan.
You did not consent to the loan terms.
You did not receive or benefit from the money, or if money was sent to your account, you did not request it and have not used it.
You are requesting investigation, suspension of collection, and correction of records.

You Have Data Privacy Rights

Unauthorized lending app loans often involve personal data: names, phone numbers, IDs, selfies, contacts, device information, or location data. The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information in both government and private information systems, and data subjects have rights over the processing of their personal data. (National Privacy Commission)

A March 2026 public advisory by the DICT, National Privacy Commission, and SEC specifically warned online lending platforms against excessive data processing, unnecessary app permissions, and abusive use of contact lists. It stated that online lending platforms should not contact persons in a borrower’s contact list except legitimate guarantors, and guarantors must separately and expressly consent.

This matters because many victims of unauthorized lending app loans are harassed not only personally, but through family members, coworkers, employers, or random phone contacts. That conduct may become both a debt-collection issue and a data privacy issue.

Debt Collectors Cannot Use Harassment, Public Shaming, or False Threats

SEC Memorandum Circular No. 18, Series of 2019, prohibits unfair debt collection practices by financing and lending companies. These include threats, insults, obscene or profane language, false representations, disclosure or publication of borrower information, contacting people other than guarantors or co-makers, and communicating false loan information, including failing to say that a debt is disputed. The circular also provides penalties, which may include fines, suspension, or revocation of authority depending on the violation.

If collectors call your contacts, post your name online, threaten to report you to your employer, send edited photos, or say you will be arrested for a disputed app loan, preserve those messages. Those details are often more useful in a complaint than a general statement that you were “harassed.”

Identity Theft, Account Takeover, and Financial Account Scams May Be Criminal Issues

If someone used your identity, phone, bank account, e-wallet, access credentials, or OTP to obtain a loan, the issue may go beyond civil debt. Depending on the facts, it may involve cybercrime, misuse of access devices, fraud, or financial account scamming.

The Access Devices Regulation Act of 1998, Republic Act No. 8484, covers access devices such as account numbers, cards, codes, PINs, or other means of account access used to obtain money, goods, services, or transfer funds. It also recognizes unauthorized or fraudulently applied-for access devices. (Lawphil)

The Anti-Financial Account Scamming Act, Republic Act No. 12010, covers financial accounts such as deposits, transaction accounts, e-wallets, and other accounts used for financial products or services. It penalizes acts such as social engineering schemes and opening or using accounts under another person’s identity, and it allows temporary holding of disputed funds in certain circumstances. (Lawphil)

What to Do Immediately If an Unauthorized Loan Appears

1. Preserve Evidence Before Deleting the App

Do not uninstall the app until you have captured the evidence. Deleting the app too early can make it harder to prove what appeared in your account.

Take screenshots or screen recordings showing:

The app name and account profile.
Loan amount, loan ID, reference number, and date of loan release.
Repayment schedule, interest, penalties, and charges.
Any digital contract, disclosure statement, or terms and conditions.
Disbursement details, including bank, e-wallet, or recipient account if visible.
Collection messages, call logs, SMS, emails, in-app notices, and push notifications.
App permissions requested or granted, especially contacts, camera, gallery, SMS, phone, and location.
App store page, developer name, website, and customer service details.
SEC registration, certificate of authority, or lending company name shown in the app.

Save copies in more than one place, such as cloud storage and an external drive. If harassment is happening, keep the original messages and call logs. Do not rely only on screenshots if the actual message thread can still be preserved.

2. Secure Your Phone, Email, SIM, E-Wallets, and Bank Accounts

An unauthorized lending app loan may be a symptom of a wider compromise.

Do these immediately:

Change the password of the lending app account, email account, e-wallet, online banking, and social media accounts connected to your phone number.
Enable multi-factor authentication where available.
Log out of other devices.
Check whether your SIM recently lost signal, which may suggest SIM swap or unauthorized SIM activity.
Call your telco if you suspect SIM replacement, lost SIM access, or OTP interception.
Review bank and e-wallet transaction histories for unfamiliar transfers.
Revoke unnecessary app permissions, especially contacts and SMS access.
Scan your phone for suspicious apps or malware.

If loan proceeds were deposited into your bank or e-wallet account without your request, do not spend the money. Spending it can make the dispute harder. Report it immediately to the lender and the bank or e-wallet provider, and ask for a documented process to reverse, hold, or return the funds.

3. Send a Formal Written Dispute to the Lending App or Company

Do not rely only on phone calls. Send a written complaint through the app, official email, website form, and any customer support channel available. Use a clear subject line:

Formal Dispute: Unauthorized Loan in My Account — Request for Investigation and Suspension of Collection

Your message should include:

Your full name, registered mobile number, and email address.
Loan ID, amount, and date appearing in the app.
A clear statement that you did not apply for or authorize the loan.
A request to suspend collection, penalties, interest accrual, and credit reporting while the dispute is investigated.
A request for the full loan documents and digital transaction records.
A request for proof of consent, KYC records, OTP logs, device logs, IP address logs, and disbursement details.
A request to preserve all records and recordings.
A request to stop contacting your references, contacts, employer, relatives, or coworkers unless they are lawful guarantors who separately consented.
A request for the name, SEC registration details, certificate of authority, and data protection officer or privacy contact of the company.

Keep the ticket number, email headers, automated replies, and screenshots showing when the complaint was submitted.

4. Ask the Lender to Mark the Account as Disputed

This is important because a disputed loan should not be treated as an ordinary overdue account. Ask the lender to:

Mark the account as formally disputed.
Stop automated collection messages.
Stop referring the account to third-party collectors while under investigation.
Stop adding interest, penalties, and collection fees.
Stop reporting the account as delinquent to credit bureaus or the Credit Information Corporation while the issue is unresolved.
Correct or delete any inaccurate record if the loan is confirmed unauthorized.

If a collector continues to pressure you, reply once in writing: “This loan is formally disputed as unauthorized. Please communicate only in writing and provide proof of my consent and the disbursement trail.”

5. File a Complaint With the Proper Government Office

Different agencies handle different parts of the problem. Filing with the wrong office may delay the case, so match your complaint to the issue.

Problem	Where to Report	What to Prepare
Unauthorized loan by a lending or financing company	SEC Financing and Lending Companies Division / SEC iMessage	Screenshots, loan ID, company or app name, complaint letter, collection messages, proof of dispute
Harassment, public shaming, contact-list blasting, threats, abusive collection	SEC	Messages, call logs, names or numbers of collectors, screenshots sent to contacts
Misuse of personal data, excessive app permissions, use of contacts, disclosure of your information	National Privacy Commission	Complaint-assisted form or verified complaint, evidence, witness affidavits if available
Unauthorized bank, e-wallet, payment, or BSP-supervised financial account transaction	Bank/e-wallet provider first, then BSP Consumer Assistance	Transaction details, complaint reference number, screenshots, account statements
Incorrect credit record or wrongful reporting	Credit Information Corporation or relevant credit bureau	Credit report, dispute letter, proof that the loan is unauthorized or under dispute
Hacking, identity theft, extortion, threats, fake accounts, or use of your ID	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Screenshots, device details, account logs, IDs used, transaction trail

The SEC iMessage portal receives reports, feedback, and complaints involving SEC-regulated entities. (Securities and Exchange Commission) The NPC complaint process may require a filled-out and notarized complaint-assisted form or a verified complaint with evidence and affidavits, filed personally, by mail, courier, or authorized email process. (National Privacy Commission) For BSP-supervised institutions, the BSP Online Buddy system issues a case reference number for complaints and provides response channels for financial consumer concerns. (Bureau of Small and Medium Enterprises)

6. Check Whether the Loan Was Reported to the Credit Information Corporation

A wrongful lending app loan can damage your credit record if it is reported as unpaid. The Credit Information System Act, Republic Act No. 9510, gives borrowers the right to access their credit information and dispute erroneous, incomplete, outdated, or misleading credit information. The law provides a verification process and requires correction or deletion if information cannot be verified. (Supreme Court E-Library)

If the unauthorized loan appears in your credit report, file a dispute and attach:

Your written dispute to the lender.
The lender’s acknowledgment or ticket number.
Screenshots showing the unauthorized loan.
Police, SEC, NPC, BSP, or bank complaint references, if already filed.
Any proof that you did not receive the proceeds or did not authorize the transaction.

Evidence Checklist for an Unauthorized Lending App Loan

Good evidence is often the difference between a complaint that moves forward and one that gets dismissed as incomplete.

Prepare a folder with the following:

Government ID used in the app, if known.
Your own valid ID for identity verification.
Screenshots of the loan account.
Loan agreement, disclosure statement, amortization, and repayment schedule.
Date and time you first discovered the loan.
All SMS, emails, push notifications, and in-app messages.
Call logs and recordings, if lawfully available.
Names, phone numbers, and account names of collectors.
Screenshots from relatives, coworkers, or contacts who were messaged.
Bank or e-wallet statements showing whether money was received.
Proof that you were abroad, offline, hospitalized, at work, or otherwise unable to make the transaction, if relevant.
Telco reports if you lost SIM access or suspect SIM swap.
Police blotter or cybercrime complaint reference, if already filed.
Your formal dispute letter and proof of submission.

For OFWs, foreigners, and Filipinos abroad, evidence may include passport stamps, visa records, overseas employment documents, foreign phone records, or foreign bank statements. If an affidavit is needed for a Philippine proceeding, expect that it may need consular notarization, apostille, or other authentication depending on where it is executed and where it will be submitted.

What to Say in Your Dispute Letter

Keep the letter factual and firm. Avoid emotional accusations unless you can support them with evidence.

You can use wording like this:

I am formally disputing the loan appearing in my account because I did not apply for, authorize, consent to, or benefit from this loan. Please immediately suspend collection activity, interest, penalties, and any reporting to credit bureaus or the Credit Information Corporation while this dispute is under investigation. Please provide the complete loan documents, proof of consent, KYC records, OTP logs, device and IP logs, disbursement details, and the name and authority of the lending company and any collection agency handling the account.

Add this if collectors are contacting others:

Please also stop contacting my relatives, coworkers, employer, phone contacts, or any third person regarding this disputed loan, unless that person is a lawful guarantor who separately and expressly consented. I am preserving all messages, call logs, and screenshots for submission to the proper regulators.

Send the complaint to every official channel you can document: in-app helpdesk, official email, website contact form, and registered business address if available.

Common Mistakes That Make the Problem Worse

Paying “Just to Stop the Calls”

Many people pay because they are embarrassed or afraid. But if you truly did not authorize the loan, payment may create confusion later. The lender may argue that your payment shows acknowledgment or ratification. At minimum, it weakens the clarity of your position.

If money was deposited into your account without your consent, the safer approach is to report it in writing, avoid using it, and request an official reversal or documented return process.

Deleting the App Too Early

Deleting the app may remove access to loan details, transaction IDs, chat support, and notices. Capture evidence first. After preserving the evidence, you can secure the device and revoke permissions.

Arguing With Collectors by Phone

Collectors may pressure you into saying things you do not mean. Keep communications in writing. If you receive a call, ask for the caller’s name, company, authority to collect, and email address. Then say the debt is disputed and request written communication.

Giving New OTPs, IDs, or Selfies

A real investigator does not need your OTP. Never give OTPs, passwords, remote access, or live selfies to anyone claiming they will “verify” or “delete” the loan. Send documents only through official channels after confirming the company identity.

Ignoring Messages Sent to Your Contacts

If the app or collector messages your contacts, ask those people to send you screenshots showing the number, message, date, and time. Do not just tell them to delete the message. Those screenshots may support an SEC or NPC complaint.

Filing Only a Police Report

A police or cybercrime complaint may be necessary, especially for identity theft or hacking, but it does not automatically fix the lending app record, stop collection, or correct credit reporting. You may still need to file with the lender, SEC, NPC, BSP, or CIC depending on the issue.

What If the App Says You Consented Through OTP?

An OTP is evidence, but it is not always conclusive. Ask for the full context:

What number received the OTP?
What device submitted the OTP?
What IP address was used?
Was the device previously linked to your account?
Was there a recent password reset?
Was there a SIM replacement or loss of signal?
Was the OTP entered after a phishing message?
Was the loan accepted through clear and separate consent, or through a confusing interface?

For lending apps, consent should be specific, informed, and connected to the actual transaction. A prior account registration does not automatically mean every future loan is authorized.

What If the Loan Proceeds Were Sent to Your Bank or E-Wallet?

If the money entered your account, act quickly and carefully.

Do not withdraw, transfer, spend, or gamble with the funds. Report the transaction to the lender and to the bank or e-wallet provider. Ask them to place the amount on hold or provide an official return process.

If the transaction involves a bank, e-wallet, payment provider, or other financial account, it may also fall under banking, electronic money, consumer protection, or financial account scam rules. RA 12010 recognizes temporary holding of disputed funds in certain cases and requires covered institutions to maintain security measures such as fraud monitoring and multi-factor authentication. (Lawphil)

Your written report should say:

You did not request the loan.
You are not using the funds.
You are requesting investigation and documented reversal.
You want the account protected from further unauthorized transactions.

What If Collectors Threaten Barangay, Police, Employer, or Social Media Exposure?

Preserve the threat. Do not panic.

Collectors often use words like “legal action,” “field visit,” “barangay report,” “police report,” or “posting” to scare people into paying. Some legal remedies may exist for real debts, but collectors cannot use false threats, insults, public shaming, unauthorized disclosure, or contact-list harassment to collect.

Under SEC rules, unfair collection practices include threats, insults, false representations, disclosure of borrower information, and contacting persons other than guarantors or co-makers.

If they message your employer or coworkers, save:

The exact message.
Sender number or account.
Date and time.
Name of the person who received it.
Any screenshot showing your name, photo, loan amount, or accusation.

This evidence can support both an SEC complaint and a data privacy complaint.

If the Lender Actually Files a Case

Most collection threats never become court cases, but do not ignore real court documents.

If you receive an actual summons, subpoena, or court notice, check:

The name of the court.
Case number.
Names of parties.
Deadline to respond.
Whether the document was served officially.
Whether the claim is for a civil debt, fraud allegation, or something else.

Small claims procedures in the Philippines cover certain money claims, including loans and credit accommodations, and the Supreme Court has recognized a small claims threshold of up to ₱1,000,000 under the Rules on Expedited Procedures. (Supreme Court of the Philippines)

Your defense should be evidence-based:

No consent to the loan.
No receipt or benefit from the proceeds.
Account takeover or identity theft.
Prior written dispute.
Failure of the lender to produce reliable digital records.
Abusive or unlawful collection conduct, if relevant.

The important distinction is this: a collector does not decide whether you owe the money; a proper court or regulator evaluates the evidence.

Frequently Asked Questions

Should I pay an unauthorized lending app loan?

If you did not apply for or authorize the loan, do not immediately pay just to stop harassment. First, formally dispute the loan in writing, preserve evidence, ask for proof of consent and disbursement, and request suspension of collection and credit reporting. If funds were deposited into your account, do not spend them; report the transaction and ask for an official reversal process.

Can a lending app contact my phone contacts?

Online lending platforms should not contact people in your contact list except legitimate guarantors who separately consented. The 2026 DICT-NPC-SEC advisory specifically warns against excessive contact-list processing and improper contacting of third persons, and SEC rules also prohibit unfair collection practices involving third parties.

Can I be arrested for not paying a lending app loan?

A disputed app loan is usually a civil collection issue, not something a collector can turn into an arrest by sending threats. However, separate criminal issues may exist if there was actual fraud, identity theft, hacking, falsification, or misuse of financial accounts. If the loan is unauthorized, your focus should be to document that you are the victim or disputed account holder, not the borrower who intentionally refused to pay.

What if I previously borrowed from the same app?

A previous loan does not automatically prove that a later loan was authorized. Each loan transaction should have its own consent, terms, amount, release date, and disbursement record. In your dispute, be specific: you may acknowledge prior legitimate transactions while clearly denying the specific unauthorized loan.

What if the app says my ID and selfie were used?

Ask for copies of the KYC records, timestamps, device information, IP logs, and the method used to capture or upload the ID and selfie. If your ID was used without permission, report possible identity theft and data misuse. If the selfie appears edited, old, AI-generated, or taken from another source, mention that clearly in your complaint.

Can an unauthorized loan affect my credit record?

Yes, if the lender reports it as unpaid. Under RA 9510, borrowers have the right to access and dispute erroneous, incomplete, outdated, or misleading credit information. If the loan appears in your credit report, file a dispute and attach proof that the loan was unauthorized or already formally disputed. (Supreme Court E-Library)

Where should I complain first: SEC, NPC, BSP, or police?

Start with the lender’s written dispute because you need a record that the account is contested. Then file with the agency that matches the issue. Use SEC for lending companies, financing companies, online lending apps, and unfair collection. Use NPC for personal data misuse and contact-list harassment. Use BSP if a bank, e-wallet, or BSP-supervised financial institution is involved. Use PNP-ACG or NBI Cybercrime for hacking, identity theft, extortion, or threats.

What if I am an OFW or foreigner outside the Philippines?

You can still preserve digital evidence, email the lender, and file complaints through official online channels where available. Use your passport, Philippine ID if any, ACR I-Card if applicable, overseas phone records, travel records, and bank or e-wallet statements. If a sworn statement is required, check whether the receiving office needs consular notarization, apostille, or another form of authentication.

How long does it take to resolve an unauthorized lending app loan?

Timelines vary. Some lenders respond within days, while SEC, NPC, BSP, police, or credit-report disputes can take weeks or longer depending on evidence and workload. BSP’s complaint channel provides a case reference for complaints submitted through its system, while RA 9510 provides a verification process for disputed credit information. (Bureau of Small and Medium Enterprises)

Key Takeaways

An unauthorized lending app loan should be treated as a formal disputed debt, not an ordinary overdue loan.
Under Philippine contract law, a valid loan requires consent; the lender should be able to prove that you authorized the transaction.
Preserve screenshots, messages, call logs, loan IDs, app permissions, disbursement records, and complaint tickets before deleting anything.
Send a written dispute asking the lender to suspend collection, penalties, interest, and credit reporting while investigating.
Do not pay casually, admit the debt, give OTPs, or spend loan proceeds deposited without your consent.
Report lending app abuse and unfair collection to the SEC, data misuse to the NPC, bank or e-wallet issues to the provider and BSP, credit-report errors to the CIC, and cybercrime or identity theft to PNP-ACG or NBI Cybercrime.
Contact-list harassment, public shaming, false threats, and disclosure of borrower information may violate SEC rules and data privacy principles.
If real court papers arrive, respond based on evidence: no consent, no benefit, prior dispute, identity theft, account takeover, or lack of reliable proof from the lender.