Someone who uses your Pag-IBIG Membership ID number, contribution records, identification documents, or Virtual Pag-IBIG account to obtain a loan may leave you facing payroll deductions, collection notices, a reduced loan entitlement, or even a housing loan attached to property you have never seen. Act quickly, but do not treat the problem as only an account correction. You may need to pursue three tracks at the same time: dispute the loan with Pag-IBIG Fund or the actual lender, preserve evidence of identity theft, and file the appropriate privacy or criminal complaint.

First Confirm What Kind of Unauthorized Loan Was Obtained

“Someone used my Pag-IBIG records for a loan” can describe several different situations. Identifying the creditor and loan type determines where you must file your dispute.

Situation	What may have happened	Primary office to contact
Unauthorized Pag-IBIG Multi-Purpose Loan or Calamity Loan	Someone used your MID number, Virtual Pag-IBIG account, ID, selfie, employer certification, or disbursement account	Pag-IBIG Fund
Fraudulent Pag-IBIG housing loan	Someone used your identity as borrower, co-borrower, buyer, or property owner	Pag-IBIG Fund branch handling the housing account
Private loan supported by Pag-IBIG records	A bank, financing company, online lender, employer cooperative, or individual lender accepted falsified contribution or employment records	The private lender, plus Pag-IBIG if its records were accessed or altered
Withdrawal from a legitimate Pag-IBIG loan	You applied for the loan, but another person took the proceeds from your card, bank account, or e-wallet	Pag-IBIG, the disbursement institution, and law-enforcement authorities
Mistaken or mixed record	A duplicate MID, similar name, employer encoding error, or wrongly linked loan caused another member’s account to appear under yours	Pag-IBIG Fund membership and loan servicing units

Check your account through the official Virtual Pag-IBIG portal and, when available, the official loan status verification facility. Virtual Pag-IBIG permits members to view and manage savings and loan records, while loan-status verification covers housing and short-term loan applications. (Pag-IBIG Fund Services)

Do not rely only on the borrower’s name. Ask Pag-IBIG or the lender to confirm the loan number, application date, MID number, contact details, application channel, disbursement destination, and documents used.

Are You Legally Responsible for a Loan You Did Not Authorize?

A loan normally requires your consent. Article 1318 of the Civil Code requires the consent of the contracting parties, a definite subject matter, and a lawful cause before a contract exists.

If your signature was forged and you did not authorize anyone to sign or apply for you, there was no genuine consent from you. In M.Y. Intercontinental Trading Corporation v. St. Mary’s Publishing Corporation, G.R. No. 249715, April 12, 2023, the Supreme Court explained that a contract bearing a forged signature is fictitious and void because the supposed signatory never gave consent. (Lawphil)

This does not mean an unauthorized loan will disappear automatically from the computer system. Until Pag-IBIG or the lender completes its investigation, the account may continue generating notices, deductions, interest, or arrears. You must place your denial and request for correction on record immediately.

Avoid signing a restructuring agreement, acknowledgment of debt, promissory note, settlement, or payment arrangement while denying the loan. Even when the original application was fraudulent, later conduct may complicate the factual record and make the dispute harder to explain.

Philippine Laws That May Apply

Civil Code: No Consent and Liability for Damages

Apart from Article 1318, Articles 19, 20, and 21 of the Civil Code require people to act with justice, honesty, and good faith and impose liability on those who unlawfully or wrongfully cause injury. Article 26 also protects a person’s privacy, dignity, and peace of mind.

These provisions may support a civil claim for actual losses, emotional harm, reputational injury, legal expenses, and other proven damage caused by identity misuse. The exact damages recoverable will depend on the evidence and the defendant’s participation. (Lawphil)

Data Privacy Act of 2012

A Pag-IBIG MID number and government-issued information connected to an identifiable member are personal data. Government-issued identifiers peculiar to an individual may also qualify as sensitive personal information under Republic Act No. 10173, the Data Privacy Act of 2012.

Section 16 gives a data subject important rights, including the right to:

Know whether and how personal information has been processed;
Obtain reasonable access to the information, its source, recipients, processing method, and dates of access or modification;
Dispute inaccurate information and require its correction;
Request blocking, removal, or destruction when data is false, unlawfully obtained, or used without authority; and
Seek indemnity for damage caused by false, inaccurate, or unauthorized processing.

Sections 11 and 20 also require accurate information and reasonable organizational, physical, and technical safeguards against unlawful access and fraudulent misuse. Depending on the evidence, unauthorized processing, processing for an unauthorized purpose, intentional breach, or unlawful disclosure may be punishable under Sections 25 to 32. (National Privacy Commission)

Cybercrime Prevention Act of 2012

If the offender used Virtual Pag-IBIG, email, mobile applications, an online lender, a computer system, digital documents, or electronic account credentials, Republic Act No. 10175 may apply.

Section 4(b) covers offenses such as:

Computer-related fraud, involving unauthorized input, alteration, deletion, or interference that causes damage with fraudulent intent; and
Computer-related identity theft, involving the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right.

Ordinary crimes committed through information and communications technology may also fall under Section 6 of RA 10175, subject to the specific facts and charging rules. (Lawphil)

Estafa and Falsification

The person responsible may also be investigated for:

Estafa by false pretenses or fraudulent acts under Article 315 of the Revised Penal Code, when deceit caused Pag-IBIG or another lender to release money or property;
Falsification of public, official, or commercial documents under Articles 171 and 172, such as falsified loan applications, employer certifications, notarized documents, identification records, deeds, or mortgage papers; and
Use of falsified documents, depending on the offender’s knowledge and participation.

The final offense cannot be determined from the appearance of one document alone. Investigators and prosecutors examine who prepared the document, who submitted it, who received the proceeds, and whether the lender suffered damage. (Lawphil)

If the scheme also involved a bank card, account number, PIN, OTP, or another payment credential, the Access Devices Regulation Act of 1998, RA 8484 as amended by RA 11449, may also be considered. (Lawphil)

What to Do Immediately

1. Secure Your Virtual Pag-IBIG and Related Accounts

Change the passwords for:

Virtual Pag-IBIG;
The email address connected to it;
Your mobile account or SIM-linked services;
Any bank, e-wallet, or Loyalty Card Plus account associated with Pag-IBIG; and
Your employer’s human resources or payroll portal, where applicable.

Enable available multi-factor authentication and review whether your registered mobile number, email address, mailing address, or disbursement account was changed.

Do not delete suspicious messages. Preserve them before changing settings.

2. Obtain the Exact Loan Details

Request the following in writing:

Loan type and loan account number;
Application and approval dates;
Amount approved and released;
Outstanding balance and payment history;
Application channel and servicing branch;
Mobile number, email, and address used;
Destination bank, card, or e-wallet account;
Copies of the application, IDs, selfies, signatures, employer certifications, and supporting records;
OTP or verification destination;
Names of the approving or processing units;
For online applications, available audit logs, timestamps, device information, and IP records; and
For branch applications, available CCTV, transaction logs, and identity-verification records.

You may invoke your right of access under Section 16 of the Data Privacy Act. Pag-IBIG may redact information belonging exclusively to another person or withhold data protected by an investigation, but it should still address your request according to law.

3. File a Formal Written Dispute With Pag-IBIG

Submit a signed letter to the branch handling the loan or to the appropriate Pag-IBIG servicing office. You may also notify Pag-IBIG through its official hotline at (02) 8724-4244 or contactus@pagibigfund.gov.ph, but a phone call should be followed by a written submission with proof of receipt. These contact channels appear in Pag-IBIG Fund’s official privacy statement. (Pag-IBIG Fund Services)

Your letter should clearly state:

That you dispute and deny applying for, authorizing, signing, or receiving the loan;
The date you discovered it;
Which information, signature, ID, account, or record appears to have been misused;
Whether you know or suspect who was involved;
Whether salary deductions, collection notices, or foreclosure-related action have begun;
That you request the account to be flagged as disputed and under possible identity theft;
That you request preservation of all physical and electronic evidence;
That you request copies of the documents and audit trail;
That you request correction or blocking of false information;
That you request suspension of collection, payroll deduction, adverse reporting, or foreclosure action while the dispute is investigated, where legally and operationally possible; and
That the investigation result and record correction be confirmed in writing.

Ask the receiving officer to stamp your copy with the date, branch, and name or position of the recipient. For email submissions, retain the sent message, attachments, delivery confirmation, and reference number.

4. Notify Your Employer Without Destroying the Payroll Trail

If deductions are being taken from your salary, provide HR or payroll with a copy of your Pag-IBIG dispute.

Ask the employer to:

Preserve the loan application, payroll instructions, HR certifications, emails, and access logs;
Identify who approved or transmitted the loan documents;
Confirm whether an employer-authorized representative validated the application;
Avoid deleting or replacing the original records; and
Seek written Pag-IBIG instructions regarding disputed deductions.

Do not simply ask payroll personnel to erase the deduction entry. The original entry, instruction, and approval trail may identify how the fraud occurred.

5. Notify the Disbursement Bank, Card Issuer, or E-Wallet

If the proceeds were sent to an account you do not own, request confirmation of the destination account and preservation of the account-opening, KYC, transaction, withdrawal, and transfer records.

If the proceeds entered your own account but were withdrawn by another person, report the unauthorized transaction immediately. The lender may consider the loan application and the withdrawal as two related but legally distinct events.

6. Preserve Evidence Before Confronting the Suspect

Keep:

Full-page screenshots showing dates, URLs, account names, and transaction numbers;
Original emails and message files, not only screenshots;
Text messages, call logs, and recorded voicemail;
Loan statements and collection notices;
Payslips showing deductions;
Bank or e-wallet statements;
Genuine signature samples from the relevant period;
Copies of IDs believed to have been copied;
Employer communications;
CCTV availability information; and
A written chronology of events.

Where possible, export electronic records instead of repeatedly forwarding them, which may remove metadata. Keep an untouched copy and a separate working copy.

7. Execute an Affidavit of Denial or Complaint-Affidavit

A notarized affidavit is often useful even when Pag-IBIG initially accepts a signed complaint letter. It should state facts within your personal knowledge, including:

Your identity and MID number;
How and when you discovered the loan;
Why you could not have applied for it;
Which signatures or documents are not yours;
Whether you received any proceeds;
Who had access to your IDs, phone, email, payroll records, or account;
What steps you took after discovery; and
The harm already caused.

Do not speculate or identify someone as the offender without explaining the factual basis. Distinguish what you personally know from what another person told you.

8. Report the Identity Theft to the NBI or PNP

You may approach the NBI Cybercrime Division, NBI Fraud and Financial Crimes Division, a regional NBI office, the PNP Anti-Cybercrime Group, or the police office with jurisdiction over relevant events.

The NBI’s published procedure for victims of computer crimes includes an interview, preparation of a sworn complaint sheet, submission of sworn statements and supporting documents, and examination of relevant devices when necessary. (National Bureau of Investigation)

An NBI or police report does not automatically cancel the loan. Its purposes include identifying the offender, preserving evidence, obtaining records through lawful processes, and preparing the matter for prosecution.

9. File a Criminal Complaint With the Prosecutor’s Office

A criminal case is generally initiated by filing a complaint with the proper city or provincial prosecutor, usually supported by:

An Investigation Data Form;
Your complaint-affidavit or sworn statement;
Witness affidavits;
Documentary and electronic evidence;
Identification documents; and
Copies for the respondents and the prosecutor’s file.

The DOJ’s official filing checklist currently identifies the NPS Investigation Data Form and complaint-affidavit or sworn statement among the core requirements. Local prosecutor offices may require additional copies, proof of service, or electronic submissions. (Department of Justice)

Investigators may help gather evidence, but the prosecutor determines whether the evidence is sufficient to file charges in court. Under the 2024 DOJ-NPS Rules, the evidence must be capable of supporting a reasonable certainty of conviction, making specific documents and verified transaction trails especially important. The Supreme Court has upheld the validity of these prosecution rules. (Lawphil)

Barangay conciliation is ordinarily not required where one party is a government instrumentality or where the offense carries a maximum penalty exceeding one year or a fine exceeding ₱5,000. Estafa, falsification, and cybercrime allegations commonly fall within these exceptions. A separate private civil dispute may still require barangay proceedings when the parties and subject matter fall within the Katarungang Pambarangay rules. (Lawphil)

10. File a Data Privacy Complaint When Appropriate

A National Privacy Commission complaint may be appropriate when:

Pag-IBIG, an employer, lender, processor, or another entity unlawfully disclosed your records;
Security failures allowed unauthorized access;
False information is not corrected despite adequate proof;
Your data continues to be used for collection after you have raised the identity-theft issue; or
The entity refuses to explain how your data was obtained and processed.

Before filing with the NPC, you generally must notify the concerned entity in writing and allow it to address the violation. The NPC’s exhaustion rule usually requires proof that the entity failed to take timely or appropriate action or did not respond within 15 calendar days from receipt. The formal complaint is ordinarily verified or notarized and accompanied by evidence and witness affidavits. (National Privacy Commission)

The official NPC complaint page provides the current complaint form and submission options. A privacy complaint is not a substitute for disputing the debt directly or filing a criminal complaint; each proceeding has a different purpose.

Documents Commonly Needed

Document	Why it matters
Valid government-issued IDs	Establishes your identity
Pag-IBIG MID number and member record	Identifies the affected membership account
Loan statement or status printout	Shows the disputed obligation
Application, ID, selfie, and signature copies	Allows comparison with genuine documents
Affidavit of denial or complaint-affidavit	Places your sworn version on record
Genuine signature specimens	Helps establish forgery
Payslips and employer certification	Shows deductions and employment history
Bank, card, or e-wallet records	Traces where the proceeds went
Emails, texts, and screenshots	Preserves the digital trail
Pag-IBIG complaint acknowledgment	Proves timely notice
Police or NBI report	Supports the identity-theft investigation
Proof of actual expenses and losses	Supports claims for reimbursement or damages

Keep originals unless an authorized investigator, prosecutor, or court formally requires them. When submitting originals, obtain a detailed receipt identifying every item.

Realistic Timelines and Common Bottlenecks

Stage	Practical expectation
Account security and initial notification	Same day
Formal dispute and evidence-preservation request	Ideally within one to three business days
Initial retrieval of loan documents	May take days or several weeks
Pag-IBIG or lender investigation	Often several weeks or longer, especially for housing loans
NPC waiting period after written notice	Usually 15 calendar days before filing, subject to exceptions
NBI or police investigation	Depends on document access, digital forensics, and suspect identification
Prosecutor’s preliminary investigation	Commonly several months, particularly when respondents seek extensions or records must be subpoenaed
Civil or criminal court proceedings	Frequently longer than administrative correction

Common delays include missing application documents, old CCTV already overwritten, unresponsive employers, incomplete bank information, multiple branches handling one transaction, and the need to compare signatures or examine devices.

This is why the evidence-preservation request should be made immediately, even before every fact is known.

Special Situations

A Relative or Co-Worker Used Your Information

Being related to the offender does not make the loan yours. A spouse, sibling, child, employer, payroll officer, or co-worker cannot create your consent merely because that person had access to your records.

Avoid signing a vague family settlement that only promises reimbursement while leaving the loan under your name. Any settlement should address the lender’s records, remaining balance, release of liability, deductions, and withdrawal of false documents.

A Housing Loan Was Opened Under Your Name

A fraudulent housing loan requires urgent attention because it may involve a developer, seller, title, deed of sale, loan and mortgage agreement, appraisal, insurance, and property registration.

Request:

The property address and title details;
Names of the seller, developer, broker, and co-borrower;
The loan takeout date;
The person or entity paid;
The deed of sale and mortgage documents;
Notarial details;
Appraisal and inspection records; and
Any foreclosure or collection schedule.

Forgery involving notarized documents or real property may require separate action involving the Register of Deeds, notary public, developer, seller, and courts. Do not wait for foreclosure notices before disputing the account.

Pag-IBIG Records Were Used for a Private Loan

Pag-IBIG cannot cancel a debt owed to a separate lender. Send the lender its own written dispute demanding the application, verification records, disbursement trail, and correction of its database.

Pag-IBIG’s role may be limited to confirming whether the submitted contribution record was authentic, how the information was accessed, or whether its own files were compromised.

You Are an OFW or Live Abroad

You may begin by securing the account, emailing the dispute, and sending scanned evidence. Ask the receiving branch whether it requires an original affidavit or Special Power of Attorney.

An affidavit or SPA executed abroad may generally be:

Signed before a Philippine embassy or consulate providing notarial services; or
Notarized locally and apostilled in a country that is a party to the Apostille Convention.

Documents from non-Apostille countries may require authentication or legalization. Philippine foreign posts confirm that consular officers may notarize affidavits and that apostilled foreign public documents are generally accepted in the Philippines without further embassy authentication, subject to the receiving office’s requirements. (Philippine Embassy in New Delhi)

An SPA should authorize specific acts, such as obtaining records, filing the Pag-IBIG dispute, submitting evidence, and receiving communications. It should not broadly authorize the representative to admit, restructure, or settle the disputed debt unless you deliberately intend to grant that authority.

The Affected Member Is a Foreigner

Foreign nationals who have valid Pag-IBIG membership or records are entitled to dispute unauthorized processing and a loan made without consent. A foreign complainant abroad may also need a consularly notarized or apostilled affidavit, passport copies, and proof connecting the foreign identity documents to the Pag-IBIG record.

Under the Data Privacy Act, an alien offender convicted of covered privacy offenses may also face deportation after serving the prescribed penalty. (National Privacy Commission)

Common Mistakes That Weaken an Identity-Theft Case

Reporting only by telephone and keeping no reference number;
Paying the loan without a written protest;
Signing a restructuring or compromise document before reviewing the application;
Submitting screenshots that omit dates, URLs, or account identifiers;
Accusing a person based only on suspicion;
Giving investigators edited or cropped records while deleting the originals;
Posting the fraudulent application publicly with visible IDs and MID numbers;
Failing to ask Pag-IBIG, the employer, and the disbursement institution to preserve logs;
Filing with the NPC before giving the concerned entity written notice, without a valid reason for bypassing that requirement;
Assuming that an NBI or police report automatically corrects the Pag-IBIG account; and
Waiting for the internal investigation to finish before preserving evidence or reporting an active fraud.

Frequently Asked Questions

Can Pag-IBIG deduct an unauthorized loan from my salary?

Deductions may continue while the system still identifies you as the borrower. Submit a written dispute to Pag-IBIG and your employer immediately, request that the account be flagged, and seek written instructions regarding suspension or treatment of the deductions.

Should I pay the loan while Pag-IBIG investigates?

Do not make a payment that could be misunderstood as acceptance without documenting that the loan is disputed. If payment is necessary to prevent an urgent consequence, such as an imminent housing-related action, the payment and written protest should clearly state that you do not admit liability.

Can I demand a copy of the fraudulent loan application?

Yes. Section 16 of the Data Privacy Act gives you a right to reasonable access to personal information processed about you, including its source, recipients, and manner of processing. Some information may be redacted to protect third parties or an investigation.

What if the signature looks similar to mine?

Forgery is not decided by visual impression alone. Preserve the original disputed document and collect genuine signatures from around the same period. The NBI or PNP questioned-document specialists may examine the signatures when formally requested during an investigation.

What if the offender knew my MID number but did not hack my account?

Computer-related identity theft may still apply when identifying information is intentionally acquired, possessed, or used without right through a computer-related transaction. Falsification, estafa, and Data Privacy Act violations may also be considered depending on how the information was obtained and used.

Can I file against an employer who released my records?

An employer may be liable if it unlawfully disclosed personal data, failed to implement reasonable safeguards, knowingly certified false information, or participated in the fraudulent application. Evidence of mere access is not enough; determine who disclosed or approved what information and under what authority.

Is an affidavit of loss enough?

Usually not. An affidavit of loss merely explains that a document or ID was lost. An identity-theft dispute should describe the fraudulent loan, your denial, the documents misused, the proceeds, and the harm caused. A detailed complaint-affidavit is generally more useful.

Can Pag-IBIG require me to prove that I did not receive the money?

You should submit all reasonably available evidence, but the lender should also examine its own application, authentication, and disbursement records. The destination account, withdrawal trail, selfie, OTP destination, and audit logs may establish who actually controlled the transaction.

Can I recover salary deductions already taken?

If the loan is confirmed to be unauthorized, request a written accounting and refund or restoration of amounts wrongly deducted or applied. The method and timing will depend on Pag-IBIG’s findings, the employer’s remittances, and whether the funds can be recovered from the offender.

What happens if Pag-IBIG does not respond?

Send a follow-up referencing the original complaint and proof of receipt, escalate it through Pag-IBIG’s official complaint channels, and preserve every communication. For unresolved privacy violations, an NPC complaint may be filed after satisfying the written-notice and 15-calendar-day exhaustion requirement, unless an applicable exception exists.

Key Takeaways

Immediately determine whether the loan is a Pag-IBIG loan or a private loan that merely used Pag-IBIG records.
A forged application does not create genuine consent, but the false account must still be formally disputed and corrected.
Secure your Virtual Pag-IBIG, email, mobile, bank, card, and e-wallet accounts.
Demand the full application, verification trail, disbursement details, and preservation of electronic and physical evidence.
File a written Pag-IBIG dispute and keep proof of receipt; do not rely only on calls or chat messages.
Notify your employer and the institution that received or released the proceeds.
Consider parallel NBI or PNP, prosecutor, and National Privacy Commission proceedings because they address different parts of the problem.
Do not sign acknowledgments, restructuring agreements, or settlements that leave the fraudulent debt under your name.
Act before logs, CCTV, messages, or transaction records are deleted or overwritten.