If you suddenly receive OTPs, rider calls, receipts, or “your order is arriving” messages from a food delivery app you did not sign up for, take it seriously but do not panic. In the Philippines, your mobile number is not just a random set of digits; when connected to your name, address, account, device, or order history, it can be personal information under the Data Privacy Act. The right response is to secure your number, document what happened, ask the platform to remove or block the unauthorized account, and escalate only when there is evidence of fraud, harassment, identity theft, or repeated misuse.

Why This Happens

Someone may use your phone number in a food delivery account for different reasons. The legal response depends on which situation applies.

Common scenarios include:

Wrong number or typo. A user may have accidentally entered your number.
Old number recycling. If your SIM number used to belong to someone else, their old account may still be linked to it.
Harassment or prank ordering. Someone may intentionally use your number so riders call you, COD orders are sent to your address, or you are bothered repeatedly.
Attempted account takeover. If you receive OTPs or password-reset codes, someone may be trying to access an account using your number.
Identity misuse. The account may use your phone number together with your name, address, photo, email, or payment details.
Fraud involving payments, vouchers, or delivery riders. A person may use your number to avoid detection, abuse promos, charge a payment method, or mislead restaurants and riders.

A one-time wrong-number order is usually handled through customer support. Repeated use, suspicious OTPs, unauthorized payments, use of your name or address, or threats from the person using the account should be treated as a possible privacy, cybercrime, or civil-liability issue.

Is Using Someone Else’s Phone Number Illegal in the Philippines?

It can be, depending on intent, the data used, and the harm caused.

A food delivery account normally processes personal data such as name, email address, telephone number, delivery address, order details, payment data, customer support messages, and sometimes device or location-related data. Foodpanda’s Philippine privacy policy, for example, identifies telephone number, account data, order and delivery data, payment data, and customer support data as categories of personal data processed on its platform. Its terms also state that registration may require full name, valid email address, mobile phone number, password, and sometimes an OTP. (foodpanda)

Under the Data Privacy Act of 2012, or Republic Act No. 10173, personal information means information from which a person’s identity is apparent, can be reasonably and directly ascertained, or can be directly and certainly identified when combined with other information. Processing includes collection, recording, use, storage, modification, blocking, erasure, or destruction of data. (National Privacy Commission)

So, a phone number may become legally significant when it is used to identify you, contact you, verify an account, connect you to orders, or combine with your address or payment details.

Your Key Rights Under Philippine Law

Your data privacy rights

If your phone number is being used in a food delivery account without your authority, you may assert your rights as a data subject. A data subject is the person whose personal data is being processed.

Under RA 10173, you may generally ask the platform to:

confirm whether your number is being processed;
give reasonable access to personal information connected to your number;
identify the source of the information, where appropriate;
correct inaccurate data;
block, remove, or destroy personal information that is false, unlawfully obtained, used for unauthorized purposes, or no longer necessary;
recognize your right to complain before the National Privacy Commission; and
indemnify you for damages caused by inaccurate, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

Food delivery platforms also have security obligations. RA 10173 requires personal information controllers to implement reasonable and appropriate organizational, physical, and technical measures to protect personal information against unlawful processing, fraudulent misuse, unauthorized access, alteration, disclosure, or destruction. (National Privacy Commission)

Possible cybercrime issue

If someone intentionally uses your identifying information without authority, especially to create or operate an online account, this may fall under computer-related identity theft under the Cybercrime Prevention Act of 2012, or Republic Act No. 10175.

Section 4(b)(3) of RA 10175 penalizes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another, without right. The same law also covers computer-related forgery and computer-related fraud where unauthorized computer data acts cause damage or are done with fraudulent intent. (Supreme Court E-Library)

The Supreme Court discussed RA 10175 in Disini v. Secretary of Justice, G.R. No. 203335, the landmark Cybercrime Prevention Act case, where the law’s computer-related identity theft provision was among the provisions considered by the Court. (Supreme Court E-Library)

This does not mean every wrong-number food order is automatically a cybercrime. Evidence matters. Cybercrime concerns become stronger when there is:

repeated unauthorized use after you objected;
use of your name, address, email, card, wallet, or ID;
fake accounts pretending to be you;
voucher abuse or payment fraud;
harassment through repeated orders or rider calls;
threats, blackmail, or coercive messages;
attempts to obtain OTPs or reset passwords; or
evidence that someone intentionally used your number to hide their identity.

Civil liability for harassment or damage

Even if the act does not become a criminal case, it may still create civil liability.

The Civil Code of the Philippines provides general rules on responsible conduct. Article 19 requires every person to act with justice, give everyone their due, and observe honesty and good faith. Article 20 says a person who, contrary to law, wilfully or negligently causes damage to another shall indemnify the injured person. Article 21 covers wilful acts contrary to morals, good customs, or public policy that cause loss or injury. (Lawphil)

Article 26 is also important because it protects a person’s dignity, personality, privacy, and peace of mind. The Supreme Court has repeatedly recognized Article 26 as a civil-law basis for damages involving privacy, dignity, and peace of mind. (Lawphil)

For example, if someone repeatedly uses your number to send riders to your home at night, embarrass you at work, or make restaurants and riders call you aggressively, the issue may be more than an app-support problem. It may involve harassment, privacy invasion, or damages.

What To Do Immediately

1. Do not give anyone the OTP

If you receive a food delivery OTP, password-reset code, or verification link, do not share it with anyone, including a caller claiming to be from the platform, a rider, a merchant, or “support.”

An OTP is often the practical key to the account. If someone is trying to register or take over an account using your number, giving the OTP may allow the account creation or login to succeed.

2. Screenshot everything

Take clear screenshots before deleting anything. Capture:

OTP messages;
app notifications;
rider calls;
order receipts;
text messages from riders or restaurants;
emails connected to the account;
delivery tracking pages;
account profile pages showing your number;
customer support chat history;
payment notifications;
dates and times;
phone numbers that called or messaged you; and
any name, address, or order ID shown.

For calls, keep your phone’s call log. If a rider calls, calmly ask for the order ID, platform, merchant, delivery address, and account name shown on their end. Do not argue with the rider; they are usually not the person who created the account.

3. Check whether your own account is affected

Open the official app only through your phone’s app store or the platform’s official website. Do not use links from suspicious SMS messages.

Check:

whether your number is already linked to an account;
whether your name, email, address, or payment method appears;
whether there are orders you did not place;
whether saved cards, e-wallets, or vouchers were used;
whether your address book, location, or profile details are exposed; and
whether someone changed your email, password, or recovery details.

If you can access the account because it is linked to your number, do not place orders or change details just to “test” it. Your goal is preservation of evidence and removal of unauthorized use, not taking over another person’s account.

4. Secure your SIM and phone

Because Philippine delivery apps often use mobile numbers and OTPs, secure the number itself.

Do these immediately:

change your email and app passwords if you reuse passwords;
enable app-based two-factor authentication where available;
check whether your SIM still receives calls and texts normally;
contact your telco if you suspect SIM swap, duplicate SIM, or unauthorized SIM replacement;
remove unknown devices from your Google, Apple, email, and e-wallet accounts;
scan your phone for suspicious apps;
update your phone operating system; and
block suspicious callers only after saving evidence.

If your SIM was lost, stolen, or replaced without your authority, the issue may also involve the SIM Registration Act, Republic Act No. 11934, telco procedures, and possible law-enforcement reporting. RA 11934 regulates SIM registration and recognizes confidentiality of subscriber information subject to lawful exceptions such as court orders, legal process, and written subscriber consent. (Lawphil)

5. Report it to the food delivery platform

Report through the official support channel. Use short, specific language.

Include:

“My phone number is being used in an account I did not create or authorize.”
“Please block, unlink, or delete my number from the unauthorized account.”
“Please preserve logs, order IDs, account details, and verification records for investigation.”
“Please confirm whether my name, address, email, payment data, or other personal information is attached to this account.”
“Please escalate this to your Data Protection Officer or privacy team.”

For foodpanda Philippines, its terms identify customer support through email and in-app support chat, including Help Centre > Get Help with My Orders. (foodpanda) Grab’s privacy notice also describes customer support channels and identity-verification processes as part of its data handling. (Grab)

Keep the ticket number. If support gives only template replies, reply in the same thread so the record shows that you objected and asked for removal.

Message Template to Send to the Platform

Use a clear written request so there is a paper trail.

I am the owner/user of mobile number [insert number]. I received notices/OTPs/calls/orders connected to your platform, but I did not create or authorize any account or order using this number.

Please investigate and immediately prevent further use of my phone number in any unauthorized account. Please also confirm whether my name, email address, delivery address, payment information, order history, device data, or other personal information is connected to the account.

I am requesting access, correction, blocking, removal, or deletion of any personal information unlawfully or inaccurately associated with me, consistent with my rights as a data subject under the Data Privacy Act of 2012. Please preserve relevant account logs, verification records, order IDs, support tickets, IP/device records, and delivery records in case this matter must be escalated to the proper authorities.

Attached are screenshots and call logs showing the incident.

When To Escalate Beyond Customer Support

Escalation is usually appropriate when:

the platform refuses to remove your number;
the unauthorized use continues after you reported it;
your address, name, payment details, or ID were used;
your card, e-wallet, or bank account was charged;
you receive repeated COD deliveries you did not order;
the person is harassing or threatening you;
you suspect SIM swapping or account takeover;
a rider or merchant is being misled into contacting you; or
you need official records for a bank, employer, landlord, school, immigration matter, or future case.

Where To Report in the Philippines

Problem	Where to report	Practical notes
Unauthorized use of your number in a delivery account	Food delivery platform support and privacy/DPO channel	Ask for unlinking, blocking, deletion, and preservation of records.
Misuse of personal data or refusal to act on your data request	National Privacy Commission	The NPC recognizes the right to file a complaint when personal information is misused or privacy rights are violated. (National Privacy Commission)
Possible identity theft, cyber fraud, account takeover, or harassment through an app	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or DOJ Office of Cybercrime	Bring screenshots, account details, order IDs, call logs, and your IDs. The DOJ Office of Cybercrime was created under RA 10175 and functions in cybercrime matters. (doj.gov.ph)
Online scam or cyber incident needing centralized reporting	CICC / Inter-Agency Response Center	The government’s anti-scam reporting channels include Hotline 1326 through the CICC-led Inter-Agency Response Center. (ScamWatch Pilipinas)
Local harassment by someone you know in the same city or barangay	Barangay, if covered by Katarungang Pambarangay	Barangay conciliation may apply to minor local disputes, but serious cybercrime, urgent action, or offenses above barangay coverage may go directly to proper authorities. (Lawphil)
SIM swap, telco failure, or unauthorized SIM replacement	Your telco, then NTC if unresolved	Ask for SIM registration/account records, SIM replacement history, and incident reference number.
Unauthorized card or e-wallet charge	Bank, card issuer, or e-wallet provider	Freeze the card or wallet, dispute the transaction, and request a replacement if needed.

Filing a Complaint with the National Privacy Commission

If the platform ignores you or continues processing your number without authority, the NPC is the proper privacy regulator.

The NPC says a formal complaint must be filed in a specific format. Its procedure includes downloading the complaint form, printing and filling it out, having it notarized, and submitting it to the NPC in person, by courier, or by scanned email. (National Privacy Commission)

Prepare:

notarized complaint form or verified complaint;
copy of one valid government ID;
screenshots of OTPs, orders, chats, and account records;
call logs and rider/merchant messages;
proof that the mobile number belongs to you;
support tickets and platform replies;
a timeline of incidents;
proof of financial loss, if any; and
authorization or Special Power of Attorney if someone files for you.

For Filipinos abroad, a Special Power of Attorney may need notarization and, depending on the country, apostille or consular acknowledgment before use in the Philippines. Foreigners should prepare passport copies, Philippine contact details if any, proof of number ownership, and screenshots showing how the Philippine platform processed the number.

Reporting to PNP, NBI, or DOJ for Cybercrime

For suspected cybercrime, prepare an evidence packet before going to law enforcement. A practical packet includes:

Chronology. One page listing dates, times, what happened, and what evidence supports each event.
Screenshots. Full-screen screenshots showing date, number, order ID, app name, and URL if available.
Device and account details. Your phone model, SIM provider, email used, app account status, and whether any payment account was linked.
Platform support history. Ticket numbers, chat transcripts, emails, and responses.
Financial documents. Bank or e-wallet notifications if money was charged.
Identity documents. Valid IDs and proof that the mobile number is yours.
Affidavit. Some offices may require a sworn statement describing what happened.

In practice, investigators often ask for printed screenshots and digital copies. Keep originals on your phone and back them up in cloud storage. Do not edit screenshots except to make separate redacted copies for non-law-enforcement use.

Should You Go to the Barangay?

Barangay conciliation is useful only in some cases.

It may help when:

you know the person who used your number;
the person lives in the same barangay or nearby barangay within the same city or municipality;
the issue is mainly harassment, nuisance, or a minor local dispute; and
you want the person to stop and sign a settlement.

Barangay conciliation is usually not the right first step when:

you do not know the person;
the conduct involves cybercrime or identity theft;
urgent action is needed to stop continuing harm;
a company or platform is the main respondent;
the suspect is in another city or abroad; or
the offense is beyond barangay coverage.

Supreme Court guidelines on Katarungang Pambarangay exclude, among others, offenses punishable by imprisonment exceeding one year or a fine over ₱5,000, offenses with no private offended party, and disputes where urgent legal action is necessary to prevent injustice. (Lawphil)

What If You Are a Foreigner in the Philippines?

Foreigners have data privacy rights when their personal data is processed in the Philippines or by a platform operating in the Philippines. RA 10173 applies to natural and juridical persons involved in personal information processing, including certain entities not established in the Philippines but using equipment located in the Philippines or maintaining an office, branch, or agency in the Philippines. (National Privacy Commission)

Practical points for foreigners:

Use your passport and local proof of number ownership when reporting.
If you are only temporarily in the Philippines, save copies of evidence before leaving.
If you need someone to file or follow up locally, execute an SPA with proper notarization, consular acknowledgment, or apostille as applicable.
If your foreign card was charged, dispute it with your foreign bank immediately while also preserving Philippine platform records.
If the misuse affects immigration, employment, or housing, request written confirmation from the platform that the account or order was unauthorized.

What If You Are a Filipino Abroad?

OFWs and Filipinos abroad often keep Philippine SIMs for OTPs. That makes unauthorized number use especially stressful.

Take these steps:

ask a trusted person in the Philippines to help preserve delivery notices or physical receipts if orders are sent to a local address;
contact your telco through official overseas support channels;
preserve screenshots showing your time zone and local time;
use email support so there is a written record;
prepare an SPA if a representative must report to a barangay, police office, telco, or government agency; and
if your Philippine SIM is inactive or lost, ask the telco about replacement and account-security procedures.

Common Mistakes To Avoid

Ignoring repeated OTPs

One OTP may be a mistake. Repeated OTPs may mean someone keeps trying to register, log in, or reset access using your number.

Sharing the OTP to “make the messages stop”

Do not do this. It may complete the unauthorized registration.

Deleting messages before saving evidence

Support teams and investigators work best with dates, order IDs, screenshots, phone numbers, and written reports.

Harassing the rider or restaurant

The rider or restaurant usually sees only the order details given by the platform. Stay calm and ask for the order ID and account name shown.

Posting the suspected person’s information online

Publicly posting names, numbers, addresses, or accusations can create defamation, privacy, or harassment issues of your own. Preserve evidence and report through proper channels.

Using the unauthorized account

Even if the account is linked to your number, avoid ordering, redeeming vouchers, or changing details unrelated to stopping the misuse. Keep your actions limited to securing your rights and reporting the incident.

Documents and Evidence Checklist

Item	Why it matters
Screenshots of OTPs and app messages	Shows attempted registration, login, or verification.
Order ID, merchant name, delivery address, and rider messages	Helps the platform locate the account and preserve records.
Call logs	Shows frequency and timing of rider or merchant calls.
Proof of number ownership	Telco account, SIM registration confirmation, billing statement, or screenshots from telco app.
Platform support tickets	Shows you reported the issue and asked for action.
Bank, card, or e-wallet records	Needed if there are unauthorized charges.
Valid ID	Required for most formal complaints.
Affidavit or sworn statement	Often needed for police, NBI, prosecutor, or NPC filings.
SPA or authorization	Needed if someone else files or follows up for you.

Practical Timeline

Step	Typical timing	What can delay it
Screenshot and secure accounts	Same day	Lost messages, deleted call logs, inaccessible phone
Platform support report	Same day to a few days	Chatbot loops, incomplete order/account details
Telco SIM-security check	Same day to several days	Need for store visit or proof of identity
NPC complaint preparation	Several days to weeks	Notarization, evidence organization, incomplete platform replies
Cybercrime report	Same day to several weeks	Need for affidavit, printed evidence, technical logs from platform
Prosecutor-level action	Weeks to months	Identification of suspect, subpoenaed records, coordination with platform/telco

These are practical estimates, not guaranteed deadlines. The biggest bottleneck is usually identifying the person behind the account because platforms and telcos generally do not release subscriber or account logs directly to private individuals without lawful process.

Frequently Asked Questions

Can someone create a food delivery account with my phone number?

Sometimes, yes, especially if the platform’s verification process is weak, the number was previously used by someone else, or the person has access to your OTP. Some platforms require OTP verification, but users may still enter a wrong number, keep old numbers on file, or trigger messages to numbers they do not own.

Is my phone number protected by the Data Privacy Act?

Yes, when it can identify you or is linked with other information that identifies you. Under RA 10173, personal information includes information from which identity is apparent, reasonably ascertainable, or identifiable when combined with other information. (National Privacy Commission)

Can I force the app to remove my number from someone else’s account?

You can formally request correction, blocking, removal, or deletion if your personal information is inaccurate, unlawfully obtained, used for unauthorized purposes, or no longer necessary. RA 10173 recognizes these data subject rights, subject to lawful limitations. (National Privacy Commission)

What if the app says it cannot disclose the account holder?

That is common. The platform may refuse to reveal another user’s personal data directly to you because that person also has privacy rights. Instead, ask the platform to investigate, unlink your number, stop further processing, preserve records, and release information only through lawful process if required by authorities.

Should I report to the police immediately?

Report to cybercrime authorities if there is fraud, identity theft, unauthorized payment, repeated harassment, threats, account takeover, or use of your name/address/payment details. For a single typo or wrong-number order, start with platform support and evidence preservation.

What if a rider keeps calling me about orders I did not make?

Ask for the order ID, merchant, delivery address, and account name shown. Tell the rider calmly that the number is being used without your authority. Screenshot the call log and report the order ID to the platform. If the calls continue, escalate to the platform’s privacy or fraud team.

Can I sue the person who used my number?

Possibly, if you can identify the person and prove unlawful conduct, damage, or harassment. Depending on the facts, remedies may involve civil damages under the Civil Code, a criminal complaint for cybercrime or other offenses, or a privacy complaint. The evidence must show more than suspicion.

What if my credit card or e-wallet was charged?

Freeze or lock the card or wallet immediately, dispute the transaction with the bank or e-wallet provider, and report the unauthorized order to the platform. Save transaction IDs, timestamps, receipts, and support replies. Unauthorized payment changes the matter from mere number misuse into possible fraud.

What if the number used to belong to someone else?

Ask the platform to unlink the number from the old account and verify your current ownership of the number. You may need proof from your telco or screenshots from your telco account. Do not access or use the old owner’s account.

Can the platform be liable if it ignores my report?

It may face privacy or regulatory consequences if it continues unauthorized processing, fails to implement reasonable security, ignores valid data subject rights, or mishandles personal data. RA 10173 requires reasonable security measures and recognizes the right to complain before the NPC. (National Privacy Commission)

Key Takeaways

A phone number can be personal information under Philippine law when it identifies you or is connected to your account, address, payment, or order history.
Do not share OTPs, even if someone says it will “fix” the problem.
Preserve screenshots, call logs, order IDs, support tickets, and proof that the number belongs to you.
Report first to the food delivery platform and ask for unlinking, blocking, deletion, investigation, and preservation of records.
Escalate to the NPC for privacy violations, and to cybercrime authorities for identity theft, fraud, threats, account takeover, or repeated harassment.
Barangay conciliation may help only for local, minor disputes involving a known person; serious cybercrime or platform-related issues usually require other channels.
The most practical goal is to stop further use of your number, protect your accounts and payments, and create a clear evidence trail in case the matter becomes a formal complaint.