Receiving collection calls or threatening messages for an online loan you never applied for can be frightening, especially when the lender has your name, ID details, phone number, or photograph. The important point is that the use of your identity does not automatically make you responsible for the loan. Act quickly, however, because delays can make it harder to preserve evidence, stop harassment, correct credit records, and identify where the loan proceeds went.

First, Confirm What Actually Happened

Not every message from an online lender means that someone successfully borrowed money in your name. You may be:

The victim of an actual fraudulent loan application.
Listed only as a character reference.
Mistaken for another borrower because of a recycled phone number.
Contacted because your number appeared in someone else’s phone contacts.
Falsely identified as a co-maker or guarantor.
Targeted by a fake collection or phishing scheme that is not connected to a real loan.

Ask the collector or lender for the following information in writing:

The complete legal name of the lending or financing company.
Its Securities and Exchange Commission registration number and Certificate of Authority number.
The loan account or reference number.
The date and amount of the alleged loan.
The name, phone number, email address, and identification documents used in the application.
The bank account, e-wallet, or other destination to which the proceeds were released.
A copy of the loan agreement, application, electronic consent record, and identity-verification materials.
The name of any collection agency handling the account.

Do not rely only on the mobile application’s brand name. An app may operate under a different corporate name. Check the company against the SEC’s official information and lists for lending and financing companies. A missing app name does not automatically prove illegality because the app may be a brand used by a registered corporation. (SEC Appointment System)

Are You Legally Liable for a Loan Taken Using Your Identity?

As a general rule, you are not liable for a loan you did not apply for, authorize, receive, or ratify.

Under Articles 1311, 1317, and 1318 of the Civil Code:

Contracts generally bind only the parties who entered into them.
A person cannot validly contract in another person’s name without authority.
A valid contract requires the parties’ consent.
An unauthorized contract entered into in another person’s name is unenforceable against that person unless it is later ratified.

A lender therefore cannot establish your liability merely by showing that an application contained your name or a photograph of your ID. It must be able to establish that you consented to the loan or validly authorized someone to act for you. (Lawphil)

Do not accidentally ratify or acknowledge the loan

Avoid actions that could complicate your denial, such as:

Paying a “small amount” merely to stop collection calls.
Signing a restructuring, settlement, or payment agreement.
Saying in writing that you will “pay later.”
Asking for a lower interest rate as though you were the borrower.
Accepting a refund or account benefit connected with the loan without explaining your objection.
Giving the lender a new promissory note.

Payment does not automatically prove that the original loan was yours, but the lender may argue that your conduct amounts to an admission or implied ratification. State consistently that you dispute the entire obligation because you never applied for or authorized it.

A character reference is not automatically a guarantor

Some lenders contact relatives, friends, co-workers, or employers and claim that they are liable because the borrower listed them as references. That is generally incorrect.

Article 2055 of the Civil Code provides that a guaranty is not presumed; it must be express. A person does not become responsible for another person’s debt merely because the borrower entered that person’s name or phone number as a reference. (Lawphil)

The National Privacy Commission has likewise clarified that a character reference may be contacted for limited identity or information-verification purposes but is not automatically a guarantor. A guarantor must expressly agree to assume responsibility for the loan. (National Privacy Commission)

What to Do Immediately

1. Secure your accounts and devices

Assume that the person may have more than your name. Change the passwords for your:

Primary email account.
Online banking accounts.
E-wallets.
Social media accounts.
Government service accounts.
Cloud storage.
Mobile carrier account.

Use unique passwords and enable multi-factor authentication. Sign out unknown devices and revoke unfamiliar app permissions.

If your phone or SIM was lost, report it immediately to your telecommunications provider. If an ID was lost or stolen, report the loss to the issuing agency and ask whether replacement, cancellation, or annotation procedures are available.

Never give an alleged lender your one-time password, PIN, password, card security code, or full account credentials. The Bangko Sentral ng Pilipinas specifically warns consumers not to submit passwords, PINs, full card details, or similar security information in complaints because these are not needed to investigate the case.

2. Preserve evidence before blocking or deleting anything

Create an evidence folder containing:

Screenshots of messages, app pages, emails, and collection notices.
Full phone numbers and email addresses used by collectors.
Call logs showing dates, times, and duration.
Voice recordings or voicemails lawfully obtained.
Copies of demand letters and envelopes.
Screenshots of social media posts or messages sent to relatives.
The app’s name, developer, download page, and privacy policy.
Copies of IDs or documents believed to have been misused.
Bank or e-wallet records showing that you never received the proceeds.
Statements from relatives, co-workers, or employers contacted by collectors.

Capture the full screen whenever possible, including the date, time, sender, web address, and account name. Keep the original files instead of retaining only cropped images. Export important emails as PDF or original message files.

Do not immediately uninstall the loan app if it is installed on your device. First document its screens, permissions, account information, and messages. You may then remove its permissions and uninstall it after preserving the evidence.

3. Send the lender a formal written dispute

Do not rely only on calls with customer service. Send a written notice through the company’s official email address, in-app support channel, and registered business address when available.

Your notice should:

State that you did not apply for, authorize, sign, or receive the loan.
Clearly dispute the entire debt.
Ask the lender to suspend collection while investigating.
Demand that it stop reporting the account as yours.
Ask it to preserve all application, verification, disbursement, device, and communication records.
Request information about the personal data used and where it came from.
Ask where the loan proceeds were sent.
Require written confirmation of the investigation result.
Require correction of any information submitted to the Credit Information Corporation or another credit bureau.
State that further collection communications should be in writing.

Under the Data Privacy Act of 2012, Republic Act No. 10173, personal data must be processed lawfully, fairly, transparently, and only for legitimate and proportionate purposes. A data subject also has rights concerning access, correction, objection, blocking, erasure where legally appropriate, complaints, and damages. Certain information may be withheld when a lawful exception applies, but a lender should not simply ignore a properly documented identity-theft dispute. (Lawphil)

Sample identity-theft dispute notice

I formally dispute Loan Account No. ________. I did not apply for, authorize, sign, receive, or benefit from this loan. I believe that my personal information was used without my knowledge or consent.

Please immediately suspend collection activity and any negative credit reporting while the matter is investigated. Preserve all records connected with the application, including the submitted identification documents, photographs, electronic signatures, consent records, device and login information, phone numbers, email addresses, verification recordings, disbursement records, and communications.

Please provide the date and amount of the loan, the destination of the released funds, the personal data used, the source of that data, and a copy or meaningful account of the application and verification records, subject to lawful limitations.

Please confirm in writing that I am not being treated as the borrower unless you can establish that I personally consented to the transaction. If this account has been reported to the Credit Information Corporation or another credit bureau, please place it under dispute and submit the necessary correction.

All further communications concerning this disputed account should be sent to me in writing at ________.

Attach only the documents reasonably necessary to establish your identity and dispute. Watermark copies with wording such as “For identity-theft dispute with [company] only — [date]” so they cannot easily be reused for another application.

4. Report the identity theft to law enforcement

Using another person’s identifying information through a computer system may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012, Republic Act No. 10175. The law covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right. (Lawphil)

Depending on the evidence, the acts may also involve estafa or falsification under Articles 171, 172, or 315 of the Revised Penal Code. Where account numbers, codes, cards, or similar means of account access are involved, the Access Devices Regulation Act, Republic Act No. 8484, may also be relevant. The prosecutor determines the proper offense based on how the application was made, what documents were falsified, who received the proceeds, and whether the lender suffered damage. (Lawphil)

Reports may be made to:

The NBI Cybercrime Division or NBI online complaint facility.
The Philippine National Police Anti-Cybercrime Group.
The Cybercrime Investigation and Coordinating Center or DICT Cyber Hotline 1326.
A local police station, which may endorse the case to the proper cybercrime unit.

The March 18, 2026 joint advisory of the DICT, NPC, and SEC lists the NBI Cybercrime Division at ccd@nbi.gov.ph, the PNP Anti-Cybercrime Group at acg@pnp.gov.ph, and the DICT cyber hotline at 1326@dict.gov.ph. Contact details can change, so confirm them on the agency’s official website before filing.

Bring or submit:

A government-issued ID.
A signed chronology of events.
The lender’s name and account number.
Screenshots and communication records.
Copies of the documents allegedly used.
Bank or e-wallet records relevant to the disbursement.
Your written dispute and the lender’s response.
Names and statements of witnesses who were contacted.

A barangay blotter can help create a dated record, particularly if local collectors visited your home or threatened your family. It is not a substitute for a police, NBI, regulatory, or prosecutorial complaint, and it does not by itself cancel a loan account.

5. Complain to the correct regulator

The correct agency depends on the institution involved.

Where to complain	When it is appropriate	Important first step
SEC	Lending companies, financing companies, and most online lending platforms	Identify the corporation behind the app and first send it a written complaint
BSP	Banks, digital banks, e-money issuers, payment providers, and other BSP-supervised institutions	Use the institution’s Financial Consumer Protection Assistance Mechanism first
NPC	Misuse of personal data, excessive app permissions, contact-list harvesting, unauthorized disclosure, or failure to correct data	Send the company a privacy-related complaint and preserve its response
NBI, PNP-ACG, or CICC	Identity theft, fraudulent applications, falsified documents, account takeover, or cyber-enabled threats	Preserve digital evidence and prepare a chronology
CIC	An unauthorized loan appears in your Philippine credit report	Obtain a recent CIC credit report and its transaction reference number

Complaints involving an SEC-regulated lender

File through the SEC iMessage portal, which issues a trackable ticket for inquiries and complaints. Attach your dispute, evidence, collection messages, police or NBI report if available, and proof that you first contacted the lender. (iMessage)

The SEC also regulates unfair debt-collection practices by lending and financing companies. A complaint becomes stronger when it identifies the registered corporation, not only the app or collector’s nickname. (SEC Appointment System)

Complaints involving a BSP-supervised institution

First complain through the institution’s own customer-assistance or Financial Consumer Protection Assistance Mechanism. If the matter remains unresolved, escalate it through the BSP’s official consumer channels, including the BSP Online Buddy or the Consumer Assistance Mechanism described on the BSP consumer-assistance page.

The BSP describes its process as a second-level remedy and states that escalated cases may take approximately 55 to 65 days, depending on the issues and the institution’s response. A lawyer is not required for the consumer-assistance process.

6. File a National Privacy Commission complaint when personal data was misused

The NPC rules for online loan transactions require lenders to process only information that is adequate, relevant, necessary, and not excessive. Loan applications should not obtain device permissions or personal information unrelated to legitimate loan processing.

The joint DICT-NPC-SEC advisory dated March 18, 2026 reiterates that online lenders must not:

Process unnecessary personal data.
obtain excessive or disproportionate access to a borrower’s contact list;
contact people in the borrower’s contact list for collection unless they are named guarantors;
treat character references as guarantors without express consent; or
retain personal data longer than necessary.

A complaint may be filed through the NPC’s official complaint process. The NPC currently requires its prescribed, notarized complaint-affidavit or a properly verified complaint, together with supporting evidence and relevant communications. The NPC states that its Complaints and Investigation Division generally determines within 30 calendar days whether to give the complaint due course or dismiss it without prejudice. Its published estimate for the entire administrative process is approximately 10 to 12 months, although actual duration varies. (National Privacy Commission)

7. Check and dispute your CIC credit report

An unauthorized online loan may affect future applications for credit, housing, postpaid services, or business financing if it is submitted to the Credit Information Corporation.

Obtain your report through the CIC’s authorized credit-report channels. If the fraudulent account appears, use the CIC Online Dispute Resolution Process.

The CIC generally requires:

A credit report issued within the previous 30 days.
The report’s 14-digit transaction reference number.
Identity verification and a liveness check.
Details of each disputed account.
Supporting documents such as your identity-theft report and lender dispute.

Filing a CIC dispute is free. Republic Act No. 9510 gives borrowers the right to dispute information that is erroneous, incomplete, outdated, or misleading. The law provides for investigation and verification within five working days from receipt of the complaint, but the lender’s correction and the appearance of the update in later reports may take longer. (Credit Information Corporation (CIC))

What Documents Should You Prepare?

Create one organized file containing the following:

Document	Why it helps
Government-issued ID	Confirms your identity as the complainant
Affidavit of denial or identity theft	Gives a sworn, chronological account of what happened
Screenshots and call logs	Shows collection activity, threats, and account details
Written lender dispute	Proves that the company was notified
Lender’s acknowledgment or response	Shows how the dispute was handled
Police, NBI, or PNP report	Supports the allegation of identity misuse
Bank and e-wallet statements	Helps show that you did not receive the proceeds
CIC credit report	Identifies any inaccurate reported account
Statements from contacted relatives or employers	Supports harassment or unauthorized-disclosure allegations
Proof of lost ID, SIM, or device	Helps explain how the information may have been compromised

An affidavit is particularly useful when the lender, regulator, or investigator requires a sworn statement. It should identify the alleged account, explain how you learned about it, state that you gave no authority or consent, and describe the steps you took after discovery.

If You Are Abroad or Are a Foreigner

You can dispute a Philippine online loan even if you are outside the Philippines. Use email and official online portals first, and retain proof of every submission.

When an agency requires a Philippine representative, prepare a Special Power of Attorney, or SPA, stating the specific acts the representative may perform, such as submitting complaints, receiving records, and following up with agencies.

A document signed abroad may generally be:

Notarized before a Philippine embassy or consulate; or
Notarized locally and apostilled by the competent authority when the country is a member of the Apostille Convention.

Requirements differ by country. Philippine consular guidance confirms that private documents such as affidavits and SPAs may be notarized at a Philippine embassy or processed through the apostille system for use in the Philippines. (Philippine Embassy)

Foreign nationals who have existing or previous Philippine credit transactions may also request a CIC credit report, subject to the CIC’s identification and verification requirements. (Credit Information Corporation (CIC))

What If Collectors Contact Your Family, Friends, or Employer?

Keep screenshots and ask each contacted person to preserve the message, sender details, and date.

Under current NPC rules and the March 2026 joint advisory, a lender may not indiscriminately use a borrower’s entire contact list for debt collection. People who were not named guarantors should not be contacted merely because their numbers appeared in the phone’s address book. A character reference may be contacted for limited verification purposes, but that does not make the reference responsible for the debt. (National Privacy Commission)

In your complaint, identify:

Each person contacted.
The person’s relationship to you.
Whether the collector disclosed the alleged debt.
Any threats, insults, public posts, or pressure directed at that person.
Whether the person was ever expressly named as a reference or guarantor.
How the lender may have obtained the number.

Submit the evidence to the lender, SEC, and NPC as appropriate. Serious threats or fraudulent impersonation should also be reported to law enforcement.

Common Mistakes to Avoid

Paying just to make the messages stop

A token payment may be treated as an acknowledgment and can weaken the clarity of your denial. Dispute the account instead.

Sending another unprotected copy of your ID

A fraudulent collector may be trying to obtain a clearer ID image. Verify the company, redact unnecessary information, and watermark every copy.

Giving an OTP or installing a “verification” app

A legitimate investigation should not require your password, OTP, PIN, or remote access to your phone.

Deleting all messages or uninstalling the app immediately

Preserve the evidence first. Deleted messages and application data may be difficult to recover.

Filing only a barangay blotter

A barangay record can support your chronology, but the lender, regulator, CIC, and cybercrime authorities must still be notified.

Complaining only about the app name

Find the legal corporation, SEC registration, official address, and Certificate of Authority. Regulators need to identify the responsible entity.

Publicly accusing a specific person without sufficient proof

You may strongly suspect a relative, former partner, employee, or acquaintance, but avoid making unsupported public accusations. Give the evidence privately to investigators.

Ignoring a summons or official court document

A collection message or demand letter is not a court order. However, a summons bearing the name of a Philippine court must not be ignored. Verify it directly with the court named in the document and respond within the period stated in the applicable rules. Failure to respond can result in adverse procedural consequences even when the underlying debt is fraudulent.

Can You Claim Damages?

Depending on the evidence, a victim may have a civil claim against the person who misused the identity and, in some cases, against an entity that unlawfully processed or disclosed personal information.

Articles 19, 20, 21, and 26 of the Civil Code recognize duties to act with justice, honesty, and good faith and allow relief for wrongful acts that cause damage or violate another person’s dignity, privacy, or peace of mind. The Data Privacy Act also recognizes a data subject’s right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (Lawphil)

A damages claim requires evidence of the wrongful act, the responsible person or entity, the injury suffered, and the connection between the act and the injury. Useful proof may include lost employment opportunities, rejected credit applications, expenses, medical records, reputational harm, and documented harassment.

Frequently Asked Questions

Am I required to pay an online loan applied for using my stolen ID?

Generally, no. The lender must establish that you consented to or authorized the loan. Your name, ID image, or phone number alone does not prove that you entered into the contract.

Should I pay a small amount while the lender investigates?

It is safer not to pay or sign any settlement while denying the loan. A payment may be used to argue that you acknowledged or ratified the obligation.

What if the loan proceeds went to somebody else’s e-wallet?

Ask the lender to preserve and disclose the disbursement destination to investigators. The destination account can be important evidence that you did not receive or benefit from the loan.

Can the lender make my character reference pay?

Not merely because the person was listed as a reference. A guaranty must be express, and a character reference is not automatically a guarantor.

Can collectors contact everyone in my phone contacts?

Current NPC rules prohibit unauthorized, excessive, or disproportionate contact-list processing. Contacting people other than named guarantors for collection may support complaints before the SEC and NPC.

Will a fraudulent online loan damage my credit record?

It can if the lender reports the account under your identity. Obtain your CIC credit report, file a formal dispute, and require the lender to correct any inaccurate submission.

Is a police or barangay report enough to remove the loan?

No single report automatically removes the account. Send the report to the lender, complain to the appropriate regulator, and separately dispute inaccurate CIC information.

What if I receive a demand letter from a lawyer?

Reply in writing that you dispute the debt, attach your identity-theft report if available, and ask for the application and disbursement records. A demand letter is not a court judgment.

What if I receive an actual court summons?

Verify the case directly with the court and respond within the stated deadline. Do not assume that telling the collector about the fraud automatically stops court proceedings.

Key Takeaways

You are generally not liable for an online loan you never applied for, authorized, received, or ratified.
Preserve evidence before blocking numbers, deleting messages, or uninstalling an app.
Dispute the account in writing and ask the lender to freeze collection and credit reporting.
Do not make token payments, sign restructuring documents, or acknowledge the debt.
Report identity misuse to the NBI, PNP Anti-Cybercrime Group, or other appropriate cybercrime authority.
File with the SEC or BSP depending on the type of lender and with the NPC when personal data was misused.
Obtain your CIC credit report and dispute any unauthorized account.
A character reference is not automatically a guarantor.
Never ignore an authentic court summons, even when the debt is fraudulent.