Discovering that an online lender used your name, identification document, phone number, or personal information for a loan you never applied for is alarming enough. It becomes more distressing when collectors begin calling your family, co-workers, friends, or employer and accuse you of refusing to pay. The most important points are these: you are not automatically responsible for a loan created without your consent, your contacts are not automatically guarantors, and lenders cannot lawfully use harassment or public shaming to collect a disputed debt. Your immediate priorities are to preserve evidence, formally dispute the loan, secure your accounts, stop further misuse of your data, and report the matter to the proper Philippine authorities.

Determine What Actually Happened

Cases involving online lenders and stolen identities usually fall into one or more of these situations:

Someone used your identity to obtain a loan. The fraudster may have submitted a photograph of your government ID, copied your personal details, used a SIM registered in your name, or gained access to your email, phone, or financial account.
A borrower uploaded your number as a contact or character reference. You may never have agreed to guarantee the loan, but the lender or collection agency is treating you as if you were responsible.
The lender obtained your number from a borrower’s contact list. Some lending apps request access to phone contacts and later message people who were never identified as references or guarantors.
The lender is contacting the wrong person. Recycled mobile numbers, incorrect encoding, duplicate names, and unreliable identity-verification procedures can cause collectors to pursue someone unrelated to the loan.

The correct response depends on which situation applies, but the lender should be told immediately and in writing that the debt is disputed.

A Loan Made Without Your Consent Is Not Automatically Your Debt

Under Article 1318 of the Civil Code of the Philippines, a valid contract requires consent, a definite object, and a lawful cause. A lender cannot establish a valid loan against you merely by presenting your name, an image of your ID, or information entered into an app. It must be able to show that you knowingly consented to the transaction. (Lawphil)

Useful questions to demand answers to include:

What mobile number and email address were used?
What date and time was the application submitted?
What device, IP address, or account was used?
What identity-verification steps were performed?
Was there a video, live selfie, biometric check, electronic signature, or one-time password?
Where were the loan proceeds released?
Who owned the bank or e-wallet account that received the money?
What document supposedly proves that you accepted the loan agreement?

Under the Rules on Evidence, the party asserting a claim ordinarily bears the burden of proving the facts necessary to establish that claim. A lender therefore cannot simply insist that you disprove a transaction while refusing to provide its records. (Lawphil)

Do not make a small “good faith” payment simply to stop the calls. Although payment does not automatically settle whether identity theft occurred, it can complicate the factual record and may later be presented as evidence that you recognized the account.

A Contact or Character Reference Is Not Automatically a Guarantor

Being listed as a contact person or character reference does not make someone legally liable for another person’s debt.

A character reference is generally contacted only to help verify a borrower’s identity or the truthfulness of information in the application. A guarantor, in contrast, expressly agrees to answer for the borrower’s obligation under the Civil Code rules on guaranty. That responsibility cannot ordinarily be imposed merely because someone’s phone number appeared in a contact list.

The National Privacy Commission’s amended loan-processing rules require lenders to distinguish character references from guarantors. For collection purposes, a lender may contact a person who separately and expressly consented to act as guarantor, but it may not freely pursue other people taken from the borrower’s phone contacts.

The 2026 joint advisory of the Department of Information and Communications Technology, National Privacy Commission, and Securities and Exchange Commission likewise emphasizes that only a guarantor who expressly accepted responsibility may be contacted about the borrower’s loan obligation.

This means your relatives, friends, co-workers, and employer do not become liable simply because a lending app obtained their numbers.

Harassment and Public Shaming Are Prohibited

The SEC’s Memorandum Circular No. 18, series of 2019, prohibits unfair debt-collection practices by lending and financing companies. Prohibited conduct includes:

Threatening violence, injury, criminal acts, or damage to property or reputation
Using obscene, insulting, or abusive language
Threatening legal action that cannot lawfully be taken
Misrepresenting the amount, status, or legal consequences of a debt
Publishing or disclosing the names and personal information of alleged delinquent borrowers
Using deceptive collection methods
Contacting people in the borrower’s phone contacts who are not guarantors or co-makers
Communicating at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., subject to limited exceptions

A lender remains responsible for collection practices even when it hires a third-party collection agency. It cannot avoid liability by saying that the messages came from an outsourced collector. The SEC may impose administrative sanctions, including fines, suspension, or revocation of the company’s authority, depending on the circumstances and prior violations.

The Financial Products and Services Consumer Protection Act or RA 11765 also protects financial consumers against abusive debt-collection and recovery practices and requires covered financial service providers to safeguard client information. (Lawphil)

Unauthorized Use of Your Personal Data May Violate the Data Privacy Act

The Data Privacy Act of 2012 or RA 10173 requires personal information to be processed for a lawful, declared, and proportionate purpose. Collecting an entire phone contact list and using it to pressure, shame, or threaten people may violate the principles of transparency, legitimate purpose, and proportionality. (Lawphil)

Depending on the evidence, possible violations may include:

Unauthorized processing of personal information
Processing data for unauthorized purposes
Unauthorized or malicious disclosure
Improper access caused by negligence
Failure to respect a person’s rights over inaccurate or unlawfully processed data

As the affected data subject, you may demand:

Confirmation of whether the lender holds your personal data
Access to the information and records associated with the loan
Identification of the source from which the information was obtained
Correction of inaccurate information
Blocking, deletion, or removal of unlawfully processed information
An explanation of who received or accessed your data
Compensation where unlawful processing caused damage, subject to proof

NPC Circular No. 20-01, as amended in 2022, expressly prohibits unrestrained processing of a borrower’s contact list, including processing that leads to harassment, unfair collection, or contacting people other than properly designated guarantors. The rule applies to persons acting as lenders even when they are not properly authorized by the SEC.

Identity Theft May Be a Cybercrime

Section 4(b)(3) of the Cybercrime Prevention Act of 2012 or RA 10175 penalizes computer-related identity theft. This covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right when done through an information and communications technology system. (Lawphil)

Depending on what the fraudster or collectors actually did, other offenses may also be investigated, such as falsification, estafa, grave threats, unjust vexation, coercion, or unlawful online publication. The police, National Bureau of Investigation, prosecutor, or court determines the appropriate offense based on the available evidence.

What to Do Immediately

1. Preserve all evidence before blocking numbers or uninstalling the app

Save evidence in its original form whenever possible:

Screenshots showing the full sender number, date, and time
Screen recordings of message threads, call logs, app pages, and account details
Voicemail or call recordings lawfully obtained from conversations in which you participated
Emails with complete headers
Collection letters and envelopes
Social media posts, comments, profile URLs, and account names
The app’s name, developer, download page, privacy notice, and company information
Copies of the ID or personal information allegedly used
Bank or e-wallet records showing that you never received the proceeds
Messages received by your relatives, friends, co-workers, or employer

Ask affected contacts to preserve their own original messages. A screenshot forwarded to you is useful, but the original recipient may later need to authenticate it or execute an affidavit.

Do not crop or edit your only copy. Keep the original files and create separate working copies for highlighting or redaction.

2. Identify the company behind the lending app

An app’s brand name may be different from the registered corporate entity. Check:

The app’s privacy policy and terms
The lender named in the loan agreement or collection message
SEC registration and authority to operate
The name of any collection agency
Payment-account or e-wallet recipient details

Use the SEC’s Check with SEC verification system to see whether the company is registered and has the proper secondary license or authority. Registration as a corporation alone does not necessarily mean it is authorized to operate as a lending or financing company.

3. Send a formal written fraud and data-privacy dispute

Send your notice through every verifiable channel available: the lender’s official email, privacy officer, customer-support system, registered office, and SEC-listed contact details. Avoid relying only on phone conversations.

Your notice should state:

I dispute the alleged loan account in my name. I did not apply for, authorize, receive, or benefit from this loan. My identity and personal information appear to have been used without my consent.

Please place the account under fraud investigation, suspend collection activity, and stop contacting me and third parties while the dispute is being investigated. Please preserve and provide the application records, identity-verification records, electronic consent records, device and access data, disbursement details, and the name of the account that received the proceeds.

I also request access to, correction of, and where legally appropriate, blocking or deletion of inaccurate or unlawfully processed personal data under RA 10173. Please identify the source of my information and every person or organization to whom it was disclosed.

Include only the documents reasonably needed to identify the disputed account. When sending a copy of an ID, consider placing a visible watermark such as:

“For identity-theft dispute with [company] only — [date]”

Redact information that is not necessary, unless the verified agency or lender explains why it is required.

4. Secure your digital and financial accounts

If an app was installed on your device:

Record its name, permissions, and account details.
Revoke access to contacts, SMS, storage, camera, microphone, location, and call logs.
Preserve necessary evidence.
Uninstall the app.
Change passwords for your email, e-wallets, online banking, cloud storage, and social media.
Enable multi-factor authentication.
Review account-recovery emails and phone numbers.
Check for unfamiliar SIM registrations, transactions, devices, or account logins.

If a physical ID was lost, report the loss and ask the issuing agency about replacement or available fraud-reporting procedures. If the ID was merely copied, ask whether the issuer can note the compromise or issue a replacement.

5. Give your contacts a short factual warning

Do not engage in long arguments with collectors. Tell affected contacts:

My identity was used for a loan I did not authorize. I am formally disputing the account and reporting it to the authorities. Please do not pay, provide personal information, click links, or communicate further with the collector. Preserve the complete message, sender number, date, and time before blocking or reporting it.

Your contacts may file their own privacy complaints if their personal information was unlawfully obtained or used.

6. File a complaint with the SEC

For a lending company, financing company, or online lending app, file through the SEC’s iMessage complaint and inquiry portal. You may also verify the applicable SEC department through the agency’s official memorandum-circular and contact pages. (SEC Appointment System)

Attach:

Your signed complaint narrative
The disputed account or reference number
Screenshots and message exports
The lender’s app and corporate names
Your written dispute and proof that it was sent
The lender’s response, if any
Statements from contacts who were harassed
Proof that the proceeds went elsewhere, when available
A police, NBI, or cybercrime report, if already filed

State clearly that this is an identity-theft dispute, not simply a request for payment restructuring.

7. File a complaint with the National Privacy Commission

Before filing an ordinary NPC complaint, the current rules generally require you to notify the respondent in writing and allow it an opportunity to act. This requirement is normally satisfied when the respondent fails to respond or take appropriate action within 15 calendar days. The NPC may waive prior exhaustion for good cause, including situations involving serious or potentially irreparable harm.

Use the NPC’s official complaint-filing page and current complaint-affidavit form. The complaint is ordinarily:

Written, signed, and verified
Supported by relevant evidence
Accompanied by the correspondence sent to the respondent
Filed with a certification against forum shopping
Notarized as required
Submitted personally, by authorized courier or mail, or through an authorized electronic filing method

The NPC states that the initial determination on whether to give due course or dismiss a complaint may take about 30 calendar days. Its published estimate for the entire adjudication process is approximately 10 to 12 months, although actual duration depends on service, submissions, hearings, evidence, and case volume. (National Privacy Commission)

8. Report the identity theft to the NBI or PNP

You may report cyber-enabled identity theft to:

The NBI Cybercrime Division
The Philippine National Police Anti-Cybercrime Group
The local police, particularly when threats create an immediate safety risk

The NBI’s published citizen’s charter lists a complaint sheet, sworn complaint or interview, and supporting evidence as part of the intake process. It does not list a filing fee for investigative assistance, although the full investigation will normally take longer than the initial intake. (National Bureau of Investigation)

Bring printed and electronic copies of:

Your government ID
Chronological incident summary
Screenshots and original files
Fraudulent application or loan details
Affidavits or statements from affected contacts
Proof of account compromise
Evidence showing where the money was released
Copies of reports already submitted to the lender, SEC, or NPC

A barangay complaint is not generally a prerequisite to filing a cybercrime, SEC, or NPC complaint. Barangay assistance may nevertheless be useful when a known local person is involved and the matter falls within barangay authority.

9. Check whether the fraudulent account affected your credit record

Request your credit report through the Credit Information Corporation’s official channels. If the loan appears under your name, use the CIC’s credit-report dispute process and submit proof that the account resulted from identity theft.

Under the Credit Information System Act or RA 9510, borrowers and data subjects may dispute inaccurate, incomplete, outdated, or misleading credit information. The law directs the CIC to investigate and verify disputed information within five working days from receipt of the complaint, although correction by the submitting financial institution may require additional operational processing. (Credit Information Corporation (CIC))

10. Use the BSP process when the lender is BSP-supervised

If the entity is a bank, digital bank, electronic-money issuer, or another BSP-supervised financial institution, first use the institution’s own Financial Consumer Protection Assistance Mechanism.

If the institution does not resolve the matter, elevate it through the BSP’s Consumer Assistance Mechanism and BOB chatbot. Ordinary SEC-regulated lending and financing companies are generally handled by the SEC rather than the BSP. (Bureau of the Treasury)

Documents and Evidence Checklist

Document or evidence	Why it matters	Practical note
Government ID	Establishes your identity	Watermark copies sent to private companies
Chronological incident statement	Helps agencies understand the case	List exact dates, numbers, names, and events
Screenshots and screen recordings	Proves harassment and disclosure	Show full sender details, date, and time
Original messages and emails	Preserves electronic evidence	Export chats and retain email headers
Fraudulent loan information	Identifies the account being disputed	Include account, application, and reference numbers
Written dispute to the lender	Shows notice and exhaustion	Keep delivery receipts and automated acknowledgments
Messages received by contacts	Proves third-party harassment	Ask each recipient to preserve originals
Affidavits of affected contacts	Strengthens formal complaints	Notarization may be needed for proceedings
Bank and e-wallet statements	Helps show you did not receive proceeds	Highlight relevant dates without altering originals
App details and privacy policy	Identifies the controller and permissions	Save copies before the app or page disappears
SEC verification results	Shows the lender’s regulatory status	Record both company registration and lending authority
Police or NBI report	Supports identity-theft allegations	Obtain a receiving stamp or reference number
CIC credit report and dispute	Addresses credit-record damage	Preserve both the original report and corrected version

Where to File and What Each Agency Handles

Office	Appropriate issue	Typical first step
Securities and Exchange Commission	Unfair collection by lending or financing companies; unauthorized lending activity	Submit through SEC iMessage with evidence
National Privacy Commission	Contact-list misuse, unauthorized disclosure, inaccurate data, failure to honor data rights	Send written notice to the lender, wait up to 15 calendar days when required, then file a verified complaint
NBI Cybercrime Division or PNP Anti-Cybercrime Group	Stolen identity, fake electronic application, account compromise, threats, fraudulent disbursement	File a sworn complaint with original digital evidence
Credit Information Corporation	Fraudulent loan appearing in a credit report	Obtain the report and submit a formal dispute
Bangko Sentral ng Pilipinas	Bank, digital-bank, e-money, or BSP-supervised provider complaint	Complain to the institution first, then elevate through BSP CAM
Local police or emergency authorities	Immediate threats of violence, stalking, or danger	Preserve the threat and seek immediate assistance

Administrative, privacy, credit-report, and criminal complaints serve different purposes. They may generally proceed at the same time because an SEC complaint does not by itself investigate identity theft, while an NBI report does not automatically correct a credit record or decide a privacy complaint.

Common Mistakes That Can Weaken Your Position

Deleting everything too quickly

Blocking a collector may protect your peace, but preserve the full conversation first. Once an app, account, or message is deleted, recovering the evidence may be difficult.

Arguing only by phone

Telephone conversations leave an incomplete record. Follow every important call with an email summarizing what was discussed.

Sending more personal information to an unverified collector

Fraudsters sometimes pretend to “verify” a dispute by demanding another ID, selfie, signature, or one-time password. Send sensitive documents only through a verified official channel.

Treating the app’s brand as the legal company name

Complaints can be delayed when they identify only a marketing name. Include the corporate operator, app developer, lender, collection agency, website, and payment recipient whenever available.

Paying to make the harassment stop

A collector may promise to remove your contacts or clear your name after a small payment. Payment does not guarantee correction and can create additional confusion about whether you accepted the account.

Posting unredacted evidence publicly

Publicly posting phone numbers, IDs, account details, or names may expose you and other victims to further misuse. Submit complete evidence privately to authorities and redact public copies.

Ignoring a summons or formal court notice

A threatening text saying “a case has been filed” is not the same as a genuine summons. However, if you receive an authentic summons or subpoena from a court, prosecutor, or government agency, do not ignore it. Verify it through the issuing office and respond within the stated period, raising identity theft, lack of consent, and any supporting evidence.

What If Collectors Threaten Arrest?

The 1987 Constitution provides that no person shall be imprisoned merely for debt. A legitimate unpaid loan is generally a civil obligation, not an automatic ground for arrest. (Lawphil)

This does not mean that no criminal case can ever arise from a loan-related incident. Separate fraudulent acts—such as falsifying documents, issuing a worthless check under circumstances covered by law, or obtaining money through deliberate deceit—may be investigated independently. But a collector cannot lawfully order your arrest, issue a warrant, or declare you guilty.

Warning signs of a deceptive threat include:

A demand to pay within minutes to “cancel” an arrest warrant
A claimed warrant sent only through text or social media
A “police officer” asking for payment through a personal e-wallet
A collector claiming that a barangay, police station, or private law office has already convicted you
A document containing no verifiable court, prosecutor, docket, or official contact information

Verify any supposed court or government document directly with the named office using independently obtained contact information.

Possible Civil Remedies for Serious Harm

Where unlawful data use or harassment causes measurable injury, civil damages may be pursued under the Data Privacy Act and, depending on the facts, Articles 19, 20, 21, and 26 of the Civil Code.

These Civil Code provisions require people to act with justice, honesty, and good faith; impose liability for damage caused contrary to law; and protect privacy, dignity, family relations, and peace of mind. (Lawphil)

Evidence of damage may include:

Medical or psychological treatment records
Lost employment or disciplinary records
Statements from clients, supervisors, or co-workers
Business losses
Costs incurred in correcting records
Reputational damage supported by witnesses or publications
Evidence of repeated conduct after the lender was formally notified

Keep receipts and records of every expense related to the incident.

Filipinos Abroad and Foreign Nationals

A victim abroad may authorize a representative in the Philippines through a special power of attorney when physical appearance or local follow-up is necessary.

Under the NPC’s amended procedural rules, a Philippine citizen residing abroad who has no Philippine representative may have the complaint notarized through a Philippine embassy or consulate, or apostilled in the country of origin where applicable. Requirements may differ depending on the country, the type of document, and whether it is a party to the Apostille Convention.

Foreign nationals whose identities were used for a Philippine online loan should generally provide:

A copy of the passport or foreign ID involved
Proof of address and nationality
Evidence that the person did not control the Philippine number or receiving account
Apostilled or consularized affidavits when required
A special power of attorney if using a Philippine representative

Foreign victims may also report the identity theft to authorities in their country of residence, particularly when the compromised device, email, bank account, or identity document is located there.

Frequently Asked Questions

Am I required to pay an online loan that someone obtained using my identity?

Not merely because the account carries your name. The lender must establish that you consented to the loan and received or authorized the benefit. Dispute the account in writing and demand the application, verification, consent, and disbursement records.

Can an online lender call my family, friends, or employer?

It may communicate with a properly designated guarantor under lawful and proportionate conditions. It should not use unrelated contacts to shame, threaten, or pressure you. Contact-list harvesting and third-party harassment may violate SEC and NPC rules.

Is a character reference legally responsible for the borrower’s debt?

No, not simply by being named as a reference. A guaranty requires separate and express consent. A reference does not become a guarantor merely because a borrower entered the person’s phone number.

Can I be arrested because of the fraudulent loan?

You cannot be imprisoned merely for debt. Identity theft should be reported as a fraud dispute. Take genuine court, prosecutor, police, or NBI documents seriously, but verify them directly with the issuing office.

Should I change my mobile number?

Changing your number may reduce harassment but should usually come after preserving evidence, securing linked accounts, checking SIM and account access, and notifying essential contacts. Changing the number alone does not correct the fraudulent loan or credit record.

Can my contacts also file complaints?

Yes. A contact whose number or personal information was unlawfully obtained, disclosed, or used may have an independent privacy complaint. The person should preserve the original message and identify how the harassment affected them.

Can I file with the SEC, NPC, NBI, and CIC at the same time?

Generally, yes. They handle different issues: regulatory misconduct, privacy violations, criminal identity theft, and credit-report correction. Include the reference numbers of related complaints so agencies can understand the full history.

What if the lender refuses to provide the application records?

Document the refusal. Include it in your SEC and NPC complaints and specifically invoke your right to access personal data under RA 10173. The lender may lawfully redact information belonging to other people, but it should not simply ignore a legitimate access and correction request.

What should I do if the harassment continues after I dispute the account?

Continue preserving evidence, send a final written cease-contact notice, update your existing complaints, and report any new threats. Seek immediate police assistance when messages threaten violence, disclose your address, involve stalking, or create an immediate safety risk.

What if I receive a real court summons?

Verify the summons with the court named on the document and respond within the required period. Gather your identity-theft report, account statements, device records, written disputes, and evidence that you did not receive the proceeds. Failure to respond can allow the case to proceed without your side being properly presented.

Key Takeaways

A loan obtained through stolen identity is not automatically enforceable against the person whose identity was used.
A contact or character reference is not a guarantor without separate, express consent.
Preserve complete evidence before blocking numbers, deleting messages, or uninstalling an app.
Dispute the loan in writing and demand the application, consent, verification, device, and disbursement records.
Report unfair collection to the SEC, data misuse to the NPC, identity theft to the NBI or PNP, and inaccurate credit information to the CIC.
Use the BSP complaint process when the provider is a BSP-supervised institution.
Do not pay simply to stop harassment, provide one-time passwords, or send additional sensitive documents to unverified collectors.
Verify genuine government or court documents, but do not be intimidated by fabricated arrest threats.