Quick answer

Treat an unfamiliar Pag-IBIG loan or loan application as suspected identity theft and fraud. Immediately secure your accounts, verify the transaction through Pag-IBIG Fund’s official channels, and submit a dated written dispute stating that you did not apply for, authorize, sign, receive, or benefit from the loan. Ask Pag-IBIG to stop any pending approval or release, flag the account, suspend collection while it investigates, preserve all application and authentication evidence, and correct any false records.

Do not sign a restructuring, acknowledgment, promissory note, waiver, or settlement that could imply you accepted the debt. If deductions continue, object in writing and describe them as being made under protest.

A loan is not validly yours merely because it appears under your name or Pag-IBIG Membership Identification Number. Consent is an essential requirement of a contract under Article 1318 of the Civil Code. The Supreme Court has also held that consent cannot simply be presumed from another person’s representations, especially when those representations create obligations for someone else. However, an allegation of forgery or impersonation is not self-proving. The documents, signatures, disbursement trail, electronic logs, OTP records and surrounding circumstances must be examined.

Confirm what happened without exposing more personal data

Use only the official Virtual Pag-IBIG portal or visit an official Pag-IBIG branch. The portal lists the Fund’s contact email, branch locator and other official channels. Pag-IBIG’s published customer-service contact is (02) 8-724-4244, and its email is contactus@pagibigfund.gov.ph.

Find out whether the transaction is:

A pending application that has not yet been approved or released;
An approved loan awaiting disbursement;
A released Multi-Purpose Loan, calamity loan or other short-term loan;
A housing loan involving a developer, seller, property title, mortgage or loan takeout;
An old loan discovered through deductions, collection notices or a credit report; or
Merely a phishing message that does not correspond to an actual Pag-IBIG record.

Record or request the following information:

Loan type, account or application number;
Amount applied for, approved and released;
Application, approval and release dates;
Branch, online channel, developer or employer involved;
Copies of the application, promissory note, disclosure statement and supporting documents;
Identification documents, photograph, signature or biometric information used;
Mobile number and email address used for authentication;
OTP, login, IP-address, device and timestamp records, if the application was electronic;
Bank, cash card, Loyalty Card Plus or e-wallet destination of the proceeds;
Employer certifications and payroll-deduction instructions;
Property, developer, seller, title and mortgage details for a housing loan; and
Payments, deductions, penalties, collection actions or credit reports already made under your name.

Take screenshots showing the date, page address and relevant details. Do not post your MID number, IDs, signature, loan number or screenshots publicly.

Secure your accounts immediately

If the transaction involved an online account, act from a device you believe is safe:

Change the password for Virtual Pag-IBIG and for the email account connected to it.
End other logged-in sessions where that option is available.
Change any reused passwords on banking, e-wallet and government-service accounts.
Check whether the registered mobile number or email address was changed.
Contact your mobile provider if your SIM unexpectedly lost service or you suspect a SIM swap.
Notify the bank, e-wallet or card issuer if an account connected to you was used.
Preserve suspicious messages, email headers, call logs, links and OTP notifications before blocking senders.

Do not click a “verification” link supplied by the person who first alerted you. Open the official portal yourself or type the official address into the browser.

File a written dispute with Pag-IBIG

A phone call is useful for immediate containment, but it does not replace a written complaint. Submit your notice through an official Pag-IBIG channel and retain proof of receipt. If filing at a branch, bring two copies and ask the receiving officer to date-stamp your copy. If filing electronically, keep the sent message, attachments and acknowledgment.

Address the notice to the branch manager or appropriate Pag-IBIG complaints officer and ask that it also be referred to the Fund’s fraud, legal, information-security and data-protection personnel as appropriate.

Your notice should contain:

Your full name and contact details;
Your MID number, disclosed only through the official channel;
The disputed loan or application number;
A clear statement that you did not apply for or authorize the transaction;
Whether you signed any document, received any proceeds, owned or selected the disbursement account, or authorized another person to act;
When and how you discovered the transaction;
Any suspected compromise of your account, email, SIM, ID or employment records;
The deductions, notices, credit effects or other harm already experienced;
The actions you want Pag-IBIG to take; and
A list of the evidence attached.

Ask Pag-IBIG in writing to:

Stop processing or disbursement if the loan is still pending;
Place a fraud or dispute flag on the loan and membership account;
Prevent unauthorized changes to your contact and membership information;
Suspend collection, payroll deductions, penalties and adverse credit reporting while the dispute is investigated, subject to applicable rules;
Preserve the complete physical and electronic application file;
Preserve authentication logs, OTP records, IP and device data, call recordings, CCTV footage and audit trails before routine deletion or overwriting;
Identify the channel through which the application was received and the method used to authenticate the applicant;
Preserve and trace the disbursement destination;
Provide reasonable access to your processed personal data and relevant transaction documents, subject to lawful restrictions protecting third parties or an investigation;
Correct false personal and loan data and notify recipients of the correction where legally required;
Explain whether Pag-IBIG identified a personal-data breach and what containment measures were taken; and
Issue a written resolution stating the investigation’s findings and the resulting account corrections.

You may execute a notarized affidavit describing the unauthorized transaction and denying the signature or application. An affidavit is useful evidence, but it does not by itself conclusively prove identity theft.

When Pag-IBIG asks for another copy of your ID, request a secure submission method. Consider watermarking the copy with “For Pag-IBIG fraud dispute only,” the date and the reference number, without obscuring information Pag-IBIG needs to verify.

Use your data-privacy rights carefully

Pag-IBIG membership numbers, government-issued identifiers, financial information, signatures and account credentials are personal data, and some are sensitive personal information. Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, a data subject may request reasonable access to information such as:

The personal data processed;
The sources from which it was obtained;
The recipients to whom it was disclosed;
How and why it was processed;
The date it was last accessed or modified; and
The identity and contact details of the responsible personal information controller.

You may also dispute inaccurate data and request rectification. Blocking or erasure may be available when information is false, unlawfully obtained or unlawfully processed, but it is not absolute. Pag-IBIG may need to retain the disputed application, audit logs and other evidence because of legal, regulatory, records-retention or investigative duties. Ask that false information be blocked from being treated as valid without demanding premature destruction of evidence.

A fraudulent loan does not automatically prove that Pag-IBIG suffered a data breach. The information may have come from phishing, stolen IDs, an employer, a developer, a relative, an agent or another institution. A privacy complaint against Pag-IBIG, an employer or another organization should be based on evidence that it improperly processed or disclosed data, failed to provide appropriate safeguards, or refused to respect applicable data-subject rights.

Where a qualifying breach involves identity-enabling information, unauthorized acquisition and a real risk of serious harm, the responsible personal information controller—not the victim—has notification duties. NPC Circular No. 2016-03 generally requires notification to the National Privacy Commission and affected data subjects within 72 hours after knowledge or reasonable belief of a reportable breach, subject to its conditions and limited provisions on delay, exemption or postponement.

Notify the employer and the disbursement provider

If payments are being deducted through payroll, notify your employer’s payroll or human-resources office in writing. State that the loan is disputed and unauthorized, attach Pag-IBIG’s acknowledgment, and ask the employer to preserve:

The certification or loan documents it received;
The deduction authority;
Relevant emails, portal records and audit logs;
The name of each employee who processed the transaction; and
Records of amounts already deducted and remitted.

Ask the employer to coordinate with Pag-IBIG before making further deductions. Do not assume that a verbal request alone authorizes payroll personnel to disregard an existing Pag-IBIG instruction. If deductions continue, renew your written objection and keep every payslip.

If the proceeds went to a bank, e-wallet or payment account, immediately report the transaction to that institution’s fraud unit. Provide the Pag-IBIG and law-enforcement reference numbers when available. Ask the institution to preserve the account-opening records and transaction trail and to treat the transfer as disputed under applicable rules. The Anti-Financial Account Scamming Act provides mechanisms for BSP-supervised institutions to hold qualifying disputed funds and conduct coordinated verification, but it does not guarantee that money already withdrawn or transferred can be recovered.

Pag-IBIG or law enforcement may have to obtain the recipient’s protected account information. Do not impersonate an account holder or attempt unauthorized access to obtain it yourself.

Report suspected criminal conduct

If personal information, documents, signatures or online accounts were used without authority, bring the evidence to the NBI, the PNP or the proper prosecutor’s office. For computer-enabled conduct, the NBI’s official service page explains its process for investigative assistance to victims of computer crimes. The NBI also maintains an online complaint page.

Possible offenses may include, depending on the proven acts and documents:

Computer-related identity theft under the Cybercrime Prevention Act;
Unauthorized processing, access or disclosure under the Data Privacy Act;
Falsification or use of falsified documents;
Estafa or another form of fraud under the Revised Penal Code;
Access-device fraud if a bank, card, e-wallet or similar access device was involved; or
Financial-account scamming under Republic Act No. 12010.

These offenses have different elements. Computer-related identity theft, for example, requires intentional acquisition, use, misuse, transfer, possession, alteration or deletion of another person’s identifying information without right. A purely paper-based impersonation may instead fall under other laws. Let investigators or a lawyer identify the charges supported by the evidence rather than choosing an offense based only on its name.

Bring:

Government-issued identification;
Your chronology of events;
Pag-IBIG’s acknowledgment and any response;
Screenshots and loan records;
Original electronic messages and email headers;
Payslips and deduction records;
Bank or e-wallet records;
Specimen signatures and the disputed document;
Names and contact details of witnesses; and
Information identifying the suspected person, if known.

Request the complaint or blotter reference number and a copy of any sworn statement you sign. A police blotter documents that a report was made; it does not, by itself, establish that the loan was fraudulent.

Check and correct your credit record

Pag-IBIG appears as a submitting entity in the Credit Information Corporation’s dispute system. Obtain your CIC credit report through the CIC’s official Direct-to-Consumer channels. If the unauthorized loan appears, use the CIC Online Dispute Resolution System and attach supporting records.

Under the Credit Information System Act, a borrower may dispute erroneous, incomplete, outdated or misleading credit information. The law directs the CIC to investigate and verify disputed information within five working days from receipt of the complaint. If accuracy cannot be verified or proven, the disputed information must be deleted, and affected recipients must be informed of the correction or removal within five working days. In practice, respond promptly to CIC and submitting-entity requests because the resolution depends on the documents and verification process.

A CIC dispute corrects the credit database; it does not replace the Pag-IBIG investigation or criminal complaint.

Evidence to preserve

Keep an organized folder containing:

A dated timeline written while events are fresh;
Original notices, envelopes and collection letters;
Screenshots and downloaded statements;
Full emails, including headers, not merely forwarded text;
Text messages, OTP notifications and call logs;
Account-security alerts and password-reset notices;
Pag-IBIG, employer, bank and e-wallet correspondence;
Complaint acknowledgment and reference numbers;
Payslips and proof of disputed deductions;
Credit reports before and after correction;
Copies of every affidavit and attachment submitted;
Proof of expenses, lost income and other measurable damage; and
Written confirmation of any eventual correction, refund or closure.

Keep original electronic files in their original format. Make backup copies, but do not edit or annotate the originals. Avoid confronting the suspected person if doing so could create a safety risk or lead to destruction of evidence.

Common mistakes to avoid

Relying only on a call-center conversation;
Waiting for another deduction or demand letter before objecting;
Paying or restructuring the loan without clearly reserving rights;
Signing a document containing an inaccurate admission;
Sending IDs or OTPs to unverified callers or social-media accounts;
Deleting phishing messages or resetting a device before preserving evidence;
Publicly accusing someone without adequate proof;
Assuming a relative, spouse, employer or agent could legally consent for you without authority;
Demanding immediate deletion of logs that may prove the fraud;
Treating an NPC complaint as a substitute for a criminal complaint; or
Ignoring a summons, subpoena, foreclosure notice or formal demand while an internal dispute is pending.

When legal help is urgent

Consult a Philippine lawyer promptly if:

A housing-loan release or takeout is still pending;
A title, mortgage, deed, special power of attorney or notarized document appears forged;
A property you own has been mortgaged or placed at risk;
You receive a foreclosure notice, court summons, subpoena or prosecutor’s notice;
Pag-IBIG refuses to flag or investigate the account;
Collection or deductions continue despite documented evidence;
The transaction involves a substantial amount or several institutions;
An employee, developer, notary or other insider may be involved;
You are being threatened or pressured to sign a settlement; or
You may previously have authorized someone, received part of the proceeds or taken an action that could be argued as ratification.

Qualified indigent clients may seek assistance from the Public Attorney’s Office, subject to its merit and eligibility requirements.

Filing a privacy complaint with the NPC

First notify the organization concerned in writing and allow it an opportunity to act. Under the 2021 NPC Rules of Procedure, as amended in 2024, a formal complaint ordinarily must show that:

The complainant informed the respondent in writing of the privacy violation or breach; and
The respondent failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive exhaustion for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy or patently illegal action.

A formal complaint must comply with the prescribed form and generally be written, signed, verified and supported by evidence, correspondence, requested relief and a certification against forum shopping. Follow the NPC’s current complaint-filing instructions for notarization, copies, filing methods and applicable fees.

Frequently asked questions

Am I automatically liable because the loan appears under my MID number?

No. A database entry does not by itself establish your consent. If you genuinely did not apply, authorize another person, sign the documents, receive the proceeds or ratify the transaction, dispute it immediately. The final outcome will depend on the authentication evidence and surrounding facts.

What if the signature is forged?

A forged signature ordinarily indicates an absence of consent, but forgery must be proved; it is not presumed. Obtain the disputed document and preserve genuine specimen signatures from the same general period. A qualified document examiner may be needed if the signature is contested.

What if a family member or co-worker obtained the loan?

Family or employment relationships do not automatically create authority to borrow in your name. The result may differ if you gave written or apparent authority, knowingly supplied documents for that transaction, accepted the proceeds or later ratified it.

Should I stop paying immediately?

Do not voluntarily sign or pay in a way that falsely acknowledges the debt. If payroll deductions or an automatic debit are already occurring, object immediately in writing and request suspension. Obtain legal advice before taking steps that could affect a property, co-borrower, guarantor or loan from which you actually received a benefit.

Can I recover deductions or damages?

You may request reversal, refund or credit of wrongful deductions. The Data Privacy Act recognizes a right to indemnification for damage caused by inaccurate, false, unlawfully obtained or unauthorized use of personal data. Recovery is not automatic: liability, causation and the amount of damage must be proved, and the proper remedy depends on the respondent and facts.

Do I need to know who committed the fraud before reporting it?

No. Report the unauthorized transaction and provide every available lead. Pag-IBIG, the receiving financial institution and law enforcement may be able to identify the applicant, device, account or person involved.

How long will the investigation take?

There is no single statutory period governing every Pag-IBIG identity-fraud dispute. A pending electronic application may be contained quickly, while a released housing loan involving banks, developers, titles and questioned documents can take much longer. The absence of a universal investigation deadline is a reason to report immediately, not to wait.

Official legal and government references

This article provides general Philippine legal information, not legal advice for a particular case. Loan validity, criminal liability, privacy remedies and recovery depend on the actual documents and evidence. Laws, rules and official procedures were source-checked as of 6 August 2026.