Quick answer

A loan taken out through your lost phone is not automatically your debt. If you did not apply for the loan, authorize another person to apply, receive or use the proceeds, or later adopt the transaction, there may be no valid consent binding you. Under the Civil Code, a person generally cannot contract in another person’s name without authority, and an unauthorized contract is unenforceable against the person whose name was used unless that person ratifies it. (Lawphil)

Act immediately:

Report the lost phone and SIM to your telco and request barring, deactivation, and SIM replacement.
Secure your email, bank, e-wallet, social-media, cloud, and loan-app accounts from a safe device.
Send the lender a written identity-theft dispute stating that you did not apply for or authorize the loan.
Ask the lender to stop collection activity while investigating, preserve its electronic records, identify where the proceeds went, and correct any inaccurate credit reporting.
Report the incident to the police, the National Bureau of Investigation, or another competent cybercrime unit.
Escalate unresolved complaints to the regulator responsible for the lender.
Obtain and monitor your Credit Information Corporation credit report and dispute any false entry.

Do not make a “small payment,” sign a restructuring agreement, or tell a collector that you will pay merely to stop the calls without first obtaining legal advice. Depending on the circumstances, the lender may try to treat such conduct as an admission or ratification of the unauthorized transaction.

Why possession of your phone does not automatically prove that you borrowed money

A valid contract requires consent, a definite object, and a lawful cause. Consent requires a meeting of the offer and acceptance. A thief’s use of your name, phone, SIM, saved identification documents, or accounts does not by itself establish that you agreed to borrow. (Lawphil)

Philippine law recognizes electronic documents and electronic signatures. That does not mean every transaction completed from a person’s phone is conclusively theirs. The Electronic Commerce Act requires attention to how the purported signer was identified, whether the authentication method was reliable and appropriate, and whether reliance on it was reasonable under the circumstances. A party introducing an electronic document in a legal proceeding must also prove that it is what the party claims it to be. (Lawphil)

An OTP, device match, account login, selfie, electronic signature, or app confirmation can therefore be relevant evidence, but it must be considered together with facts such as:

when and where the phone was lost;
when the loss was reported;
whether the SIM was replaced or deactivated;
whether the device, IP address, location, selfie, identification document, and payout account matched your normal information;
whether the lender received fraud warnings or detected unusual activity;
who received, transferred, withdrew, or benefited from the loan proceeds; and
whether you later accepted the proceeds or adopted the transaction.

Prompt written notice is especially important. Under the Electronic Commerce Act, circumstances affecting the reliability or attribution of an electronic message can matter, including notice that the message did not come from the supposed originator. (Lawphil)

Important exceptions

Your position may become more complicated when evidence shows that you:

authorized another person to use your identity or accounts;
knowingly gave the person your OTP, PIN, password, unlocked device, or identification documents for the loan;
personally received, transferred, withdrew, or spent the proceeds;
signed a payment plan, compromise, acknowledgment, or restructuring agreement after learning the facts;
made payments without clearly disputing the loan; or
were in fact a co-borrower, guarantor, accommodation party, or authorized account user.

None of these facts should be assessed in isolation. For example, disclosing an OTP because of deception does not necessarily prove that you knowingly consented to a loan. Likewise, a payment made under pressure and expressly under protest may be treated differently from a voluntary payment recognizing the debt. Preserve the documents and obtain legal advice rather than assuming the result.

What to do immediately

1. Have the SIM and phone access blocked

Report the loss to your public telecommunications entity immediately. The SIM Registration Act’s implementing rules require an end-user to report a lost or stolen SIM and provide identifying information reasonably requested by the telco. Upon receipt of the report, the telco must immediately bar the SIM from incoming and outgoing calls, messages, and mobile data and deactivate it within 24 hours. (Lawphil)

Ask for written or electronic confirmation showing:

the date and exact time you reported the loss;
the mobile number involved;
the case or reference number;
the date and time the SIM was barred or deactivated; and
the date a replacement SIM was issued.

The timing can be important because it helps establish which transactions occurred before and after your report.

Use the phone manufacturer’s official lost-device service to lock the device, remove payment capabilities, display a return message, or erase it when appropriate. Preserve essential evidence first when doing so is safe, but do not delay security measures when accounts or money remain exposed.

2. Secure every account connected to the phone

From a different, trusted device:

change the password of your primary email account first;
sign out all other sessions and remove the lost phone from trusted devices;
change bank, e-wallet, shopping, social-media, cloud-storage, and loan-app passwords;
reset PINs and recovery questions;
replace reused passwords with unique ones;
enable multi-factor authentication that does not rely solely on the lost SIM;
review email forwarding rules, recovery addresses, passkeys, linked devices, and authorized apps; and
alert banks and e-wallet providers that the phone and SIM were compromised.

Do not rely on SIM deactivation alone. A thief may still have access through an unlocked device, saved passwords, an active app session, email access, authentication apps, or downloaded identification documents.

3. Notify the lender in writing

Do not deal only with a collector by telephone. Send the dispute through the lender’s verified customer-service, fraud, complaints, or data-protection channel. Save the sent email, web-form confirmation, ticket number, attachments, and replies.

Your notice should state:

your full name and reliable contact details;
the disputed loan or account number, if known;
the date and approximate time the phone was lost or stolen;
when you reported the SIM loss;
that you did not apply for, consent to, authorize, or benefit from the loan;
whether you know where the proceeds were sent;
any police, NBI, telco, bank, or e-wallet reference numbers; and
the specific action you want the lender to take.

Request that the lender:

classify the account as a disputed identity-theft or fraud case;
suspend collection communications and escalation while the investigation is pending;
avoid furnishing new adverse information, or clearly mark the account as disputed, while the facts are being verified;
preserve all application, authentication, device, transaction, payout, and collection records;
investigate the beneficiary account and trace the proceeds;
provide the application, contract, disclosure statement, and personal data attributed to you, subject to lawful limitations;
provide a written case reference, investigation status, and final decision;
remove the account and correct records if the application was unauthorized; and
notify any collection agency, credit-information provider, or other recipient to which inaccurate information was sent.

A concise notice may read:

I formally dispute the loan/account identified above. I did not apply for, consent to, authorize, receive, or benefit from this loan. My phone was lost or stolen on [date and time], and I reported the SIM loss to [telco] on [date and time] under reference number [number].

Please place the account under fraud investigation, suspend collection activity, preserve all relevant electronic and KYC records, identify and trace the payout account, and provide me with the application, contract, transaction details, and written investigation result. Please also prevent or correct any inaccurate credit reporting and confirm these actions in writing. Nothing in this notice is an acknowledgment or ratification of the alleged debt.

Submit truthful information only. Do not claim that the phone was stolen if it was merely misplaced, and do not identify a suspected offender as fact unless you have reliable evidence.

Evidence to preserve

Create a chronological incident file. Keep original electronic files whenever possible rather than relying only on cropped screenshots.

Preserve:

proof of purchase, serial number, and IMEI of the phone;
the date, time, place, and circumstances of the loss;
CCTV availability, transport receipts, location history, or witnesses;
telco loss reports, reference numbers, emails, and SIM-replacement records;
lost-device lock or erase confirmations;
security alerts, login notices, OTP messages, password-reset emails, and device-session records;
loan advertisements, application notifications, approval messages, disclosure statements, contracts, and statements of account;
bank or e-wallet notifications showing where proceeds were sent;
screenshots and exports of collection texts, emails, chats, calls, threats, and contact-list messages;
your written dispute and every response from the lender;
credit reports and dispute records;
police, NBI, or cybercrime complaint documents; and
proof showing where you were when the application, approval, payout, or withdrawal occurred.

Record dates and times precisely. Keep an untouched copy of relevant messages and export complete conversations where possible. Back up the evidence in at least two secure locations.

Records the lender should examine

Ask the lender to investigate and preserve, as applicable:

the complete application and every version of it;
the electronic contract and disclosure statement;
identification documents uploaded by the applicant;
selfie, liveness-check, facial-comparison, or video-verification records;
the mobile number and email address used;
OTP generation, delivery, entry, and validation records;
IP addresses, device identifiers, operating-system data, app-instance data, and timestamps;
stated and detected location data;
changes to profile, password, phone number, or payout instructions;
the destination bank or e-wallet account and transaction references;
communications, recorded calls, support tickets, and collection notes;
fraud-management alerts and manual-review records; and
information furnished to the Credit Information Corporation or other recipients.

You may not be entitled to unrestricted access to another person’s confidential information, proprietary security systems, or records protected by law. You may, however, request access to personal data about you, correction of inaccurate data, and a meaningful written explanation of the lender’s findings. The Data Privacy Act gives data subjects rights that include access, correction, and, in qualifying circumstances, erasure or blocking of personal data. (National Privacy Commission)

Ask whether the proceeds can still be traced or held

When the proceeds or related transfers passed through BSP-supervised institutions, immediately ask the lender, bank, or e-wallet provider whether the Anti-Financial Account Scamming Act and BSP fraud-handling procedures apply.

AFASA covers specified financial accounts and prohibits, among other conduct, opening a financial account using another person’s identity or identification documents. It authorizes temporary holding and coordinated verification of qualifying disputed transactions involving BSP-supervised institutions. (Lawphil)

Under current BSP rules, qualifying disputed funds may initially be held for no more than five calendar days. The initial period may be extended by up to 25 additional calendar days when the requirements are met, consistent with AFASA’s overall 30-day statutory maximum unless a competent court extends it. The rules also contemplate tracing, verification, case references, status updates, and supporting documents such as an affidavit or police report. (Bangko Sentral ng Pilipinas)

These provisions do not guarantee that funds will be frozen or recovered. Their application depends on matters such as:

whether a qualifying disputed transfer occurred;
whether the institution is BSP-supervised;
whether the complainant and accounts fall within the applicable procedure;
whether the funds remain traceable;
whether the complaint was made promptly; and
what the institutions’ verification establishes.

Even when you cannot personally initiate a particular hold as the “source account owner,” ask the lender or involved institution to determine whether it can trigger the proper fraud-reporting and coordinated-verification process.

Report the incident to law enforcement

Using another person’s identifying information through a computer system may constitute computer-related identity theft under the Cybercrime Prevention Act, depending on the evidence and statutory elements. Conduct involving a lost or fraudulently obtained access device may also fall under the Access Devices Regulation Act. That Act broadly defines access devices to include codes, account numbers, PINs, telecommunications equipment, and other means of obtaining money, services, value, or fund transfers. (Lawphil)

Report the incident to one or more of the following:

the nearest police station or appropriate PNP cybercrime unit;
the NBI Cybercrime Division or an NBI regional or district office; or
another competent government cybercrime or financial-fraud unit.

Bring or upload a clear chronology and copies of your initial evidence. Obtain the complaint, blotter, or case-reference number and the investigating officer’s contact details.

A law-enforcement report does not by itself erase the loan. Send a copy to the lender and relevant regulator because it supports your account of the loss and allows investigators to seek records through lawful processes. BSP’s current consumer guidance also directs scam and fraud victims to law-enforcement agencies such as the PNP, NBI, and Cybercrime Investigation and Coordinating Center. (Bangko Sentral ng Pilipinas)

Escalate to the correct regulator

For banks, e-wallet issuers, and other BSP-supervised institutions

First complain through the institution’s Financial Consumer Protection Assistance Mechanism or official customer-service channel. This is the required first-level recourse.

If the response is unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. BSP currently directs consumers to its Online Buddy chatbot or, when that is unavailable, to submit its Complaint/Inquiry/Reply form with proof of the prior complaint and supporting documents. BSP warns consumers not to disclose PINs, passwords, full account or card numbers, passbooks, passports, or identification cards to BSP for complaint processing. (Bangko Sentral ng Pilipinas)

The BSP route applies only when the respondent or financial product is within BSP supervision. It does not replace a police or NBI complaint where criminal conduct is alleged.

For SEC-regulated lending and financing companies

Complaints concerning lending companies, financing companies, their online lending platforms, and their collection agencies are generally directed to the Securities and Exchange Commission. The SEC’s current iMessage system permits users to open and track a complaint ticket. (Securities and Exchange Commission)

Use the lender’s complete corporate name, not merely the app’s brand name. Include its SEC registration details if available, the loan or account number, your prior written dispute, the lender’s response, and evidence of any collection conduct.

SEC Memorandum Circular No. 18, series of 2019, addresses unfair debt-collection practices by lending and financing companies. Preserve threats, insults, deceptive statements, repeated harassment, public shaming, and disclosures to relatives, employers, co-workers, or unrelated contacts for evaluation under the applicable collection and privacy rules. (SEC Appointment System)

For misuse or inaccurate processing of personal data

Write first to the lender or its data-protection officer. Exercise your rights to obtain reasonable access to personal data attributed to you and to dispute and correct inaccurate information. Where the legal requirements are met, you may also request blocking, removal, or destruction of unlawfully processed or false data. (National Privacy Commission)

A National Privacy Commission complaint may be appropriate when, for example, a company:

refuses to address demonstrably inaccurate identity or loan data;
continues unauthorized processing after receiving adequate proof;
discloses your alleged debt or personal data improperly;
fails to act on a valid data-subject request; or
appears to have processed identification information without an appropriate lawful basis.

The NPC’s current formal process uses a complaint-affidavit. Its filing page instructs complainants to complete the form, have it notarized, and submit it through the listed in-person, courier, or scanned-email options. The current form asks whether the complainant first contacted the respondent in writing and requires supporting evidence; failure to attach evidence may result in outright dismissal. (National Privacy Commission)

A privacy complaint is separate from disputing contractual liability. It does not automatically cancel the alleged loan.

For an inaccurate credit record

Obtain your CIC credit report and check whether the fake loan has been reported. CIC’s Online Dispute Resolution System is available for erroneous, incomplete, outdated, or misleading credit information.

CIC requires the person disputing information to obtain a CIC credit report first. CIC does not simply rewrite the lender’s submitted data on its own; the dispute process involves the submitting entity and supporting documents. (Credit Information Corporation (CIC))

Keep monitoring after an initial correction because the lender, its collection agency, or another reporting participant may send an update later.

Lost access devices and the importance of prompt notice

The Access Devices Regulation Act requires a holder who loses an access device to notify its issuer of the details and circumstances upon learning of the loss. Where the device or compromised credential falls within the Act and the holder fully complies with the issuer’s procedure, Section 15 provides protection from financial liability arising from fraudulent use from the time the loss or theft was reported. (Lawphil)

Whether this provision applies to a particular phone, SIM, app credential, loan facility, or transaction depends on the nature of the device and the financial product. Do not assume it resolves every fake-loan dispute, but preserve proof of every report because the time of notice may materially affect your rights.

How to handle collectors

Tell each collector, in writing, that:

the loan is disputed as identity theft or an unauthorized transaction;
you did not consent to or benefit from it;
the lender has been asked to investigate;
documents should be sent to you in writing; and
collection communications and inaccurate disclosures are being preserved.

Ask for the collector’s:

full name;
company and office address;
authority from the lender;
lender’s complete corporate name;
account number;
amount and itemized computation claimed; and
complaint channel.

Do not disclose OTPs, passwords, PINs, recovery codes, or unnecessary identification details to an incoming caller. End the call and contact the lender through a number or website independently verified from an official source.

If collectors threaten violence, impersonate government officers, publish accusations, contact unrelated people, or use your contact list to shame you, preserve the exact message, number, account, URL, date, and time. Report urgent threats to law enforcement and include the conduct in your SEC, BSP, or NPC complaint as appropriate.

Common mistakes to avoid

Making a payment just to stop the calls

A token payment may be presented as evidence that you recognized the obligation. Do not pay, restructure, or compromise an unauthorized loan without advice tailored to the documents and circumstances.

Relying only on telephone conversations

A verbal report is difficult to prove. Follow every call with an email or ticket stating what was reported, when it was reported, and what the representative said.

Deleting messages or immediately wiping everything

Security is urgent, but evidence is also important. Preserve critical alerts, messages, account-session details, and reference numbers when safely possible. Then lock or erase the compromised device as circumstances require.

Assuming that blocking the SIM solved the problem

Email sessions, financial apps, cloud accounts, password managers, authentication apps, and downloaded identification files may remain accessible.

Sending identification documents through unofficial channels

Use only a verified complaints portal, official corporate email domain, or branch. Add a purpose-specific watermark to copies when appropriate, such as “For identity-theft dispute with [company], [date],” without covering essential details.

Ignoring a demand letter, subpoena, or summons

A disputed or fraudulent debt can still lead to formal proceedings. Court and agency deadlines may be short and depend on the document served. Obtain legal advice immediately rather than assuming the fraud report will stop the case automatically.

Publicly accusing a suspected person without adequate proof

Give suspicions and evidence to investigators. Public accusations can create separate legal risks, especially when the facts are incomplete.

When legal help is urgent

Consult a lawyer promptly when:

you receive a court summons, subpoena, formal demand, or notice of legal action;
the lender insists that its electronic records conclusively prove you applied;
multiple loans or accounts were opened using your identity;
the proceeds entered or passed through one of your own accounts;
you disclosed credentials because of phishing, impersonation, coercion, or manipulation;
you made a payment or signed a document after discovering the loan;
the lender refuses to provide or preserve essential records;
a false loan is affecting employment, housing, insurance, or access to credit;
collectors threaten you or disclose information to other people;
substantial funds remain in motion; or
the facts involve a family member, employee, agent, shared device, or previously authorized account user.

Qualified persons may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines also maintains legal-aid services and a chapter directory. PAO assistance is subject to its eligibility and merit requirements. (pao.gov.ph)

Frequently asked questions

Am I liable because the lender sent an OTP to my registered number?

Not necessarily. An OTP is evidence that a code was sent to or entered through a number, but it does not conclusively establish who possessed the phone, who entered the code, whether the device was compromised, or whether you intended to borrow. The lender’s authentication process, your prior arrangements, the loss report, and the full electronic record must be examined. Electronic signatures and documents remain subject to reliability, attribution, and authentication requirements. (Lawphil)

Should I pay while the investigation is pending?

Ordinarily, a person disputing the entire loan as unauthorized should not voluntarily pay or sign a restructuring agreement merely to stop collection pressure without legal advice. Send a clear written dispute instead. Different advice may be necessary if you received part of the proceeds, previously authorized the user, or have already signed or paid.

Can the lender keep calling while I dispute the loan?

A dispute may not immediately stop all communications. Ask the lender to place the account on a fraud hold and communicate in writing. Preserve abusive or unfair collection conduct and escalate it to the appropriate regulator.

Can a police or NBI report cancel the loan?

No. It documents the complaint and may support an investigation, but the lender must still correct its records or a competent authority must resolve the dispute. Give the lender and regulator copies of the report.

What if the person who used the phone was a relative or someone who knew my PIN?

The rule against unauthorized contracting still matters, but shared access, prior permission, household relationships, benefit from the proceeds, and later conduct can complicate the evidence. Report the facts accurately and avoid withholding information from your lawyer or investigators.

What if the lender says its facial recognition matched me?

Request preservation and review of the original selfie or video, liveness results, comparison data, timestamps, device details, and manual-review records. A match score or automated result is evidence, not a substitute for examining whether the image was stolen, replayed, manipulated, taken earlier, or processed inaccurately.

Can I demand damages from the lender?

Possibly, but not automatically. A claim may depend on proof of negligence, inadequate security controls, unlawful personal-data processing, unfair conduct, actual loss, and causation. AFASA provides for possible restitution in specified circumstances involving failures by BSP-supervised institutions, but its application requires findings under the law and BSP rules. (Lawphil)

How long will the dispute take?

There is no single resolution period covering every lender, regulator, police investigation, privacy complaint, and credit dispute. The urgent statutory and regulatory periods discussed above—such as the telco’s 24-hour SIM-deactivation requirement and the five-day plus possible 25-day AFASA holding periods—do not establish a universal deadline for deciding whether the loan is yours. Continue following up in writing and preserve each status update. (Lawphil)

Official sources and complaint channels

General-information disclaimer

This article provides general Philippine legal information, not legal advice or a prediction of how a lender, regulator, prosecutor, or court will decide a particular case. Liability depends on the complete application, authentication records, fund trail, communications, prior authority, and conduct of the parties. Procedures and online channels can change; verify instructions on the agency’s official website before filing. Sources last checked: July 23, 2026.