Seeing an online loan under your name or inside an app account when you never borrowed money is alarming. It can mean a simple app error, a mistaken account match, or something more serious: identity theft, unauthorized use of your ID, compromised mobile number, hacked e-wallet, or a fraudulent loan application made using your personal data. The safest response is not to panic, not to pay immediately, and not to ignore it. You need to secure your accounts, preserve evidence, dispute the loan in writing, and report the matter to the right Philippine regulator or law-enforcement office depending on what happened.

What “unauthorized online loan under your account” usually means

In practice, people discover unauthorized online loans in several ways:

A lending app shows an approved or overdue loan you did not apply for.
A collection agent texts or calls you about a loan you never received.
Your credit report shows a loan account from a lending or financing company.
Your e-wallet or bank account was used to receive or repay a loan.
Someone used your ID, selfie, mobile number, email, or contact list to apply.
A loan app accessed your phone contacts and is now harassing relatives or co-workers.

The first legal question is simple: did you consent to the loan?

Under the Civil Code of the Philippines, Article 1318, there is no valid contract unless there is consent, a certain object, and a cause of obligation. A loan made using your name without your consent should not be treated as your valid contractual debt merely because your name, ID, mobile number, or photo appears in the lender’s system.

At the same time, you still need to act quickly. Many online lenders rely on automated collection systems, uploaded Know-Your-Customer documents, and third-party collection agents. If you do not dispute the account early, the supposed loan may be reported, sold to a collector, or included in credit data submitted to the Credit Information Corporation.

Your basic legal position if you did not borrow the money

If you never applied for, accepted, or received the loan proceeds, your position is usually:

You did not give valid consent to the loan contract.
You deny liability for the principal, interest, penalties, and collection charges.
The lender must produce proof that you actually applied, accepted the terms, and received the proceeds.
If your personal data was used without authority, there may be a data privacy violation.
If another person used your identity or account credentials, there may be cybercrime or fraud.
If the lender or collector harasses you or contacts your phone contacts, that may be an unfair debt collection practice and a privacy violation.

A lender cannot simply say, “Your ID is in our system, therefore you must pay.” For online loans, useful proof may include the signed or electronically accepted loan agreement, selfie or liveness verification, device information, IP logs, mobile number used, disbursement account, bank or e-wallet transaction reference, OTP verification records, and customer-service history.

Legal bases in the Philippines

Civil Code: no valid loan contract without consent

The Civil Code is important because a loan is still a contract.

Relevant provisions include:

Article 1159: obligations from contracts have the force of law between the contracting parties and must be complied with in good faith.
Article 1318: a contract requires consent, object, and cause.
Article 1311: contracts generally bind only the parties, their assigns, and heirs.
Articles 19, 20, and 21: persons who abuse rights, act contrary to law, or willfully cause damage contrary to morals, good customs, or public policy may be liable for damages.

If the account was opened or the loan was processed without your consent, the lender should investigate instead of treating you as an ordinary delinquent borrower.

Data Privacy Act: unauthorized use of your personal information

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information and sensitive personal information. For online loan cases, sensitive information may include government IDs, images of IDs, selfies, biometrics, financial account details, and contact information.

The National Privacy Commission has specifically dealt with online lending apps that harvested contact lists and used personal data for harassment. The NPC has also issued orders against online lending apps for excessive collection and use of borrower data, including access to contact lists and social media data.

Under the Data Privacy Act, you may demand that the lender or app explain:

what personal data it has about you;
where it obtained the data;
the purpose and legal basis for processing it;
whether it disclosed the data to collectors, affiliates, or credit databases;
how it will correct, block, delete, or stop using wrong or unlawfully processed data.

Lending Company Regulation Act: lenders must be authorized

Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, lending companies are regulated by the Securities and Exchange Commission. A lending company generally needs SEC registration and authority to operate as a lending company.

If the online lender is not properly registered or is using a different app name from its SEC-registered corporate name, that is a red flag. You can check the company through official SEC tools such as Check with SEC and file complaints through the SEC iMessage portal.

SEC rules on unfair debt collection

The SEC issued Memorandum Circular No. 18, Series of 2019, prohibiting unfair debt collection practices by financing and lending companies. Common prohibited practices include threats, use of obscene or insulting language, false representations, and public disclosure or shaming of borrowers.

In an unauthorized-loan case, the problem is worse: collectors may be pressuring someone who may not be the borrower at all. Even if the lender claims there is a loan, collection must still be lawful, fair, and respectful.

Financial Consumer Protection Act

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, strengthens protection for financial consumers. It applies broadly to financial products and services and supports complaint-handling duties of regulated financial service providers.

If a bank, e-wallet, payment service provider, or other BSP-supervised financial institution is involved, you may first file with the institution’s consumer assistance channel. If unresolved, the matter may be escalated to the Bangko Sentral ng Pilipinas through the BSP Online Buddy consumer assistance channel.

Cybercrime, fraud, and identity misuse

If someone used your identity, hacked your account, intercepted your OTP, or submitted fake documents, possible laws include:

Cybercrime Prevention Act of 2012, Republic Act No. 10175, especially computer-related identity theft, computer-related fraud, illegal access, and computer-related forgery;
Revised Penal Code provisions on estafa under Article 315;
Revised Penal Code provisions on falsification of documents, including Article 172 in relation to Article 171;
Anti-Financial Account Scamming Act, Republic Act No. 12010, where financial accounts, e-wallets, sensitive identifying information, or another person’s identity documents are used in financial account scamming.

A loan made using another person’s ID or financial account should be treated as a possible identity and financial fraud incident, not just a collection issue.

What to do immediately

1. Do not pay just to make the calls stop

Paying even a small “settlement” may be interpreted by the lender or collector as an acknowledgment of the debt. If you truly did not borrow the money, your first response should be a written dispute, not payment.

A safe message is:

I dispute this loan. I did not apply for, authorize, receive, or benefit from this loan. Please stop collection activity while this is under investigation and provide the loan documents, application records, KYC records, disbursement details, and the basis for linking this account to me.

Do not admit liability. Do not say “I will pay later.” Do not negotiate interest unless you have decided, based on evidence, that the loan is actually yours.

2. Secure your phone, email, bank, and e-wallet accounts

Do this before arguing with collectors:

Change passwords for your email, lending apps, bank apps, and e-wallets.
Turn on multi-factor authentication where available.
Remove unknown devices logged into your email or e-wallet.
Revoke suspicious app permissions, especially contacts, SMS, camera, storage, microphone, and location.
Call your bank or e-wallet provider if a linked account may have been compromised.
Ask your telco for help if there are signs of SIM swap, lost SIM, unauthorized SIM registration, or sudden loss of signal.
Run a malware scan or consider resetting the phone after preserving evidence.

If the loan proceeds were actually credited to your account without your request, do not spend the money. Notify the institution in writing and ask for official reversal instructions. Return funds only through traceable official channels, not to a personal GCash number or an “agent.”

3. Preserve evidence before deleting anything

Evidence is often lost because victims block callers, uninstall apps, or reset phones too early.

Save:

screenshots of the loan account, loan ID, due date, amount, and app name;
SMS, emails, chat messages, and call logs from collectors;
screenshots showing threats, insults, or messages sent to your contacts;
app permissions shown in your phone settings;
the Google Play or App Store page of the lending app;
bank or e-wallet transaction history;
proof that you never received the loan proceeds;
IDs or documents you previously uploaded, if any;
written complaint tickets and reference numbers.

For serious cases, make a simple evidence folder arranged by date. Use filenames like 2026-07-07_SMS_from_collector.png or 2026-07-07_GCash_transaction_history.pdf. This makes it easier for SEC, NPC, NBI, PNP, or a prosecutor to understand the timeline.

Step-by-step guide to dispute the unauthorized online loan

Step 1: Identify the lender, not just the app name

Many apps use a brand name different from the SEC-registered company name. Look for:

app name;
company name;
SEC registration number;
certificate of authority number, if shown;
office address;
email address;
privacy policy;
customer service channel;
name of collection agency, if any.

Check the entity through Check with SEC or SEC records. If the app refuses to identify the lending company, treat that as a serious red flag.

Step 2: Send a written dispute to the lender

Send your dispute by email, in-app support ticket, registered mail, or any channel that gives proof of receipt.

Your dispute should state:

your full name and contact details;
the loan account number or reference number;
that you deny applying for or authorizing the loan;
that you deny receiving or benefiting from the loan proceeds;
that collection must be paused while under investigation;
that the lender must preserve all records;
that you request copies of documents and verification logs;
that any credit reporting must be corrected or blocked if the loan is unverified.

Ask for these specific records:

Record to request	Why it matters
Loan agreement or promissory note	Shows whether there was supposed consent
Electronic acceptance logs	Shows date, device, IP address, and mobile number used
KYC documents	Shows what ID, selfie, or verification was used
Disbursement record	Shows where the money was sent
Bank/e-wallet reference number	Helps trace whether you received the proceeds
Collection notes	Shows whether collectors were told the loan is disputed
Data source	Shows where they obtained your personal information
Credit reporting record	Shows whether the loan was submitted to CIC or another database

Step 3: Demand temporary suspension of collection

While the loan is under identity verification, demand that the lender:

stop automated collection calls and texts;
stop contacting your relatives, employer, co-workers, or phone contacts;
stop threatening legal action unless it has verified the debt;
stop adding interest and penalties until the dispute is resolved;
stop reporting or update any report to credit databases as disputed.

This is important because many victims are harmed not only by the loan entry itself but by reputational damage, workplace embarrassment, and credit record problems.

Step 4: File with the SEC if the lender is a financing or lending company

File with the SEC if:

the company is a lending or financing company;
the app appears unregistered or unauthorized;
the lender uses unfair collection practices;
collectors threaten, shame, or insult you;
the lender refuses to investigate an unauthorized loan;
the app name and corporate identity are unclear.

Use the SEC iMessage portal and select the complaint category related to financing and lending companies. Attach your evidence folder, screenshots, written dispute, and proof of submission to the lender.

Step 5: File with the NPC if your personal data was misused

File with the National Privacy Commission if:

your ID, selfie, contacts, or financial details were used without consent;
the app accessed your contact list excessively;
collectors contacted people who were not co-makers or guarantors;
your name, photo, or loan information was posted or threatened to be posted;
the lender refused to correct or delete wrong personal data;
your personal data was disclosed to collection agents without proper basis.

The NPC generally expects complainants to first inform the respondent in writing and give it a chance to act. Under the NPC complaint mechanics, proof of this written notice is important, and lack of response within 15 calendar days may support filing. Formal complaints are usually verified, notarized, and filed with evidence through the methods allowed by the NPC. Use the official NPC complaint filing page and NPC complaint mechanics.

Step 6: Report cybercrime or fraud to law enforcement

Report to the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or cybercrime reporting channels if there is identity theft, account hacking, phishing, fake documents, OTP compromise, SIM swap, or use of your financial account.

The NBI Cybercrime Division citizen’s charter provides for investigative assistance to victims of computer crimes. For urgent online scams, the government also promotes reporting through the cybercrime and anti-scam hotline 1326.

Prepare:

a complaint-affidavit or sworn statement;
valid government ID;
screenshots and exported messages;
bank or e-wallet statements;
disputed loan details;
proof that you reported to the lender, bank, e-wallet, or telco;
names, numbers, links, and accounts used by the suspected fraudster or collector.

A barangay blotter may help document harassment, but cybercrime investigation is usually handled better by NBI Cybercrime, PNP ACG, or prosecutors because they can deal with digital evidence, account tracing, and subpoenas.

Step 7: If it appears on your credit report, dispute with CIC

If the unauthorized loan appears in your credit report, use the Credit Information Corporation process.

Under the Credit Information System Act, Republic Act No. 9510, the CIC receives and consolidates credit data from submitting entities. The CIC has an Online Dispute Resolution System for discrepancies found in a CIC credit report.

The CIC generally cannot simply erase data because you say it is wrong. It needs the submitting entity to verify, correct, or update the record. This is why your dispute package should include both:

proof that the loan is unauthorized; and
proof that you already disputed the account with the lender.

Where to file depending on your problem

Problem	Best office or channel	Main purpose
Lending app or financing company refuses to investigate	SEC	Regulatory complaint against lending/financing company
Harassment, threats, public shaming, abusive collection	SEC, NPC, and possibly PNP/NBI	Stop unfair collection and preserve evidence
Contact list harvesting or disclosure of personal data	NPC	Data privacy complaint
Hacked account, phishing, fake ID, OTP compromise	NBI Cybercrime or PNP ACG	Criminal investigation
Bank or e-wallet account was used	Bank/e-wallet first, then BSP if unresolved	Financial consumer complaint and account protection
Wrong loan appears in credit report	CIC ODRS	Correction of credit data
Collector comes to your house or workplace	Police blotter if threatening; SEC/NPC complaint if lender-related	Document harassment and threats
You are abroad and cannot personally appear	SPA to a representative; notarized/apostilled or consularized documents	Allow someone in the Philippines to file and follow up

Common mistakes to avoid

Ignoring the loan because “it is not mine”

Ignoring it may allow the lender’s system to continue adding charges and sending collection notices. Send a written dispute as early as possible.

Paying a small amount to stop harassment

This may create confusion later. If you pay, the lender may argue you acknowledged the debt. If you must transfer funds because money was wrongly credited to you, do it only through official reversal channels and keep proof.

Deleting the app before saving evidence

Deleting the app may remove account screens, chat history, loan IDs, or app permissions. Capture evidence first.

Talking only by phone

Phone calls are hard to prove. After any call, send an email or message summarizing what was discussed: “As stated in my call today, I dispute this loan because…”

Letting collectors scare your family

Collectors sometimes say, “Your barangay will arrest you,” “You will be jailed today,” or “We will post you online.” A person is not jailed merely for inability to pay a civil debt. However, fraud and falsification are separate criminal matters. In an unauthorized-loan case, the suspected fraudster, not the victim, should be investigated.

Sending IDs to random collectors

Do not send a fresh copy of your passport, driver’s license, UMID, PhilID, or selfie to a collector through Messenger, Viber, or SMS. Use the official lender channel and watermark documents if possible, such as: “For dispute of unauthorized loan with [Company], [Date].”

Special situations

The loan proceeds were sent to your bank or e-wallet

If money entered your account, do not spend it. Even if you did not ask for the loan, keeping money that clearly does not belong to you can create a separate legal issue. Notify the bank, e-wallet, and lender in writing. Ask for a traceable reversal. Do not return the money to an individual collector’s personal account.

You shared an OTP or clicked a phishing link

Still dispute the loan. Sharing an OTP may complicate the investigation, but it does not automatically mean you intended to borrow. Explain clearly what happened, when it happened, what message you received, and what account was affected.

A relative used your ID or phone

This is common in household or workplace cases. The lender may still need to prove your consent. If a family member impersonated you, the matter may involve criminal liability, but many families choose to resolve the money issue privately. Be careful: if the loan has already affected your credit record or collectors are harassing you, a written dispute and correction request may still be necessary.

You are an OFW or foreigner outside the Philippines

You can still dispute the loan by email and online portals. If someone in the Philippines will file for you, prepare a Special Power of Attorney. If signed abroad, Philippine agencies may require consular notarization or an apostille, depending on the country where the document is executed. Attach a copy of your passport, proof of overseas residence, and proof that you were abroad when the loan was supposedly made if that fact helps disprove the application.

The lender says the matter is “already endorsed to legal”

Ask for the name of the law office or collection agency, written authority to collect, and the basis of the claim. A true legal endorsement does not remove your right to dispute the debt. It also does not allow threats, shaming, or disclosure of your alleged debt to unrelated people.

Documents to prepare

Document	Notes
Valid government ID	Use for identity verification with agencies; watermark copies when sending to private companies
Screenshots of the loan account	Include loan ID, app name, amount, due date, and account profile
Collection messages and call logs	Keep numbers, dates, times, and message content
Written dispute to lender	Must clearly deny consent and request investigation
Proof of receipt	Email sent status, ticket number, courier receipt, or registered mail proof
Bank/e-wallet statements	Show whether you received or did not receive loan proceeds
Credit report	Needed if disputing credit data with CIC
Complaint-affidavit	Needed for police, NBI, PNP, or prosecutor-level complaints
SPA	Needed if a representative files for you
Proof of being abroad or unavailable	Useful in impersonation cases involving OFWs or foreigners

Practical timeline

Timeframe	What usually happens
First 24 hours	Secure accounts, preserve evidence, notify bank/e-wallet/telco if compromised
1–3 days	Send written dispute to lender and demand suspension of collection
Within 15 calendar days	Wait for lender response if preparing an NPC complaint based on exhaustion of remedies
After no action or bad response	File SEC, NPC, BSP, CIC, NBI, or PNP complaint depending on the issue
Several weeks to months	Agency evaluation, mediation, investigation, or referral may proceed
Longer period	Criminal complaints, subpoenas, prosecution, or civil damages claims may take more time

Timelines vary heavily depending on evidence quality, whether the company is traceable, whether the account was reported to credit databases, and whether law enforcement needs data from banks, telcos, platforms, or payment providers.

Frequently Asked Questions

Can I be forced to pay an online loan I never applied for?

Not simply because your name appears in an app. A loan is a contract, and a contract requires consent. The lender should prove that you applied, accepted the terms, and received or benefited from the proceeds.

Should I pay first and dispute later?

Usually no. Paying may look like acknowledgment of the debt. If the money was credited to your account by mistake, do not spend it; request an official reversal through traceable channels.

Can an online lending app contact my contacts?

Online lending apps should not harvest or use contact lists for harassment or shaming. Excessive access to contacts and disclosure of debt information to unrelated people may raise issues under the Data Privacy Act and SEC rules on unfair debt collection.

What if the lender has my selfie and ID?

A selfie and ID are not conclusive proof that you validly borrowed. Ask for the full KYC record, liveness verification, device logs, IP address, mobile number used, OTP verification, loan agreement, and disbursement details. Fraudsters can obtain or reuse personal documents.

Can I be jailed for not paying an online loan?

A person is not jailed merely for non-payment of a civil debt. However, fraud, falsification, identity theft, or use of fake documents may be criminal. If you did not borrow the money, your focus should be proving unauthorized use and reporting the possible fraud.

Where should I complain first: SEC, NPC, BSP, or police?

It depends on the main issue. For lending company misconduct, file with SEC. For misuse of personal data, file with NPC. For bank or e-wallet issues, complain first to the institution, then BSP if unresolved. For hacking, phishing, fake IDs, or identity theft, report to NBI Cybercrime or PNP ACG.

What if the lender is not registered with the SEC?

That is a serious red flag. Preserve evidence, avoid further payments to personal accounts, check the company through SEC tools, and report the app or entity to the SEC. If there is fraud or identity theft, report to cybercrime authorities as well.

How do I remove the unauthorized loan from my credit report?

Get your credit report, identify the submitting entity, dispute directly with the lender, and use the CIC Online Dispute Resolution System if the wrong record appears in your CIC credit report. Attach proof that the loan is unauthorized.

Can a foreigner file a complaint in the Philippines?

Yes, if the unauthorized loan, data processing, lender, app, bank, e-wallet, or harmful act has a Philippine connection. A foreigner outside the Philippines may need a properly notarized, apostilled, or consularized Special Power of Attorney if a representative will file locally.

What if collectors are threatening to post me online?

Save the threats immediately. Do not respond with insults. File complaints with the SEC and NPC, and consider a police or cybercrime report if there are threats, extortion, or public posting of your personal information.

Key Takeaways

An unauthorized online loan should be disputed in writing immediately.
A valid loan contract requires consent; your name or ID in an app is not enough by itself.
Do not pay just to stop harassment unless you have verified the debt or are officially reversing funds wrongly credited to you.
Preserve screenshots, call logs, app details, disbursement records, and complaint tickets.
File with the SEC for lending company misconduct, NPC for personal data misuse, BSP for unresolved bank or e-wallet issues, CIC for credit report disputes, and NBI or PNP for cybercrime or identity theft.
If collectors contact your family, employer, or phone contacts, document it carefully because it may support unfair collection and data privacy complaints.
The strongest cases are organized by timeline, supported by documents, and filed with the correct agency.