Quick answer

If you did not apply for, authorize, or receive an online loan, dispute it immediately in writing. Do not admit the debt, promise to pay, or send money merely to stop collection calls. Ask the lender to suspend collection and adverse credit reporting while it investigates, preserve all account records, and provide the application and verification data used to approve the loan.

A loan ordinarily requires your consent. Article 1318 of the Civil Code provides that there is no contract unless consent, a certain object, and a cause concur. The Supreme Court has likewise explained that an absence of consent generally means there is no contract. Whether a particular document or electronic record proves consent, however, depends on its authenticity and the surrounding evidence. A lender’s possession of your name, ID image, selfie, or one-time password record does not by itself settle whether you personally authorized the transaction. See the Civil Code of the Philippines and the Supreme Court’s discussion in Development Bank of the Philippines v. Commission on Audit.

Treat the matter as both a disputed financial account and possible identity theft. Notify the lender first, secure your accounts, preserve evidence, check your credit report, and report the incident to the correct regulator and law-enforcement agency.

What to do immediately

1. Preserve the evidence before blocking or deleting anything

Save complete, unedited copies of:

Collection texts, emails, chat messages, call logs, voicemails, and social-media messages
The lender’s name, app name, website, phone numbers, email addresses, account or loan number, and collection agency
Screenshots showing dates, times, URLs, usernames, and the full conversation
Any demand letter, disclosure statement, promissory note, repayment schedule, or alleged electronic contract
Details of any bank, e-wallet, or mobile number said to have received the loan proceeds
Notices of password resets, new-device logins, SIM changes, OTP requests, or account recovery
Evidence showing where you were and what devices or accounts you controlled when the alleged application occurred
Copies of IDs that may have been lost, stolen, photographed, or previously submitted to another organization
Reference numbers and delivery receipts for every complaint you make

Export electronic messages where possible instead of relying only on cropped screenshots. Do not alter files or annotate the only copy. Keep a backup in a secure location.

2. Send the lender a written identity-theft dispute

Use an official address or in-app support channel that you independently verify. Do not rely on a link supplied by an aggressive collector.

State clearly that:

You did not apply for, consent to, authorize, or receive the loan;
You dispute the account and every related balance;
The account appears to have resulted from identity theft or unauthorized use of personal data;
Collection, disclosure to third parties, and negative credit reporting should be suspended while the dispute is investigated;
The lender must preserve the original application and all relevant electronic records;
Your communication is not an acknowledgment, ratification, or promise to pay.

Request copies of the records needed to determine what happened, including:

The complete loan application and alleged agreement
The date and time of application and disbursement
The phone number, email address, device information, and IP or access logs used
ID, selfie, liveness-check, signature, OTP, call-recording, and verification records
The destination bank or e-wallet account, transaction reference, and proof of receipt
The source from which the lender obtained your personal information
The names or categories of parties to whom the account or your data was disclosed
The investigation result and written confirmation of any correction, closure, or deletion

Under Section 16 of the Data Privacy Act, a data subject may request reasonable access to personal information being processed, dispute inaccuracies, seek correction, and—in appropriate cases supported by substantial proof—seek blocking, removal, or destruction of false, unlawfully obtained, or unauthorized data. Some rights have statutory limitations, including for data used in investigations. See the Data Privacy Act of 2012 and the NPC’s data-subject rights guidance.

Do not email an unredacted ID unless the recipient and channel are verified and the full document is genuinely required. Watermark a copy when appropriate—for example, “For identity-theft dispute with [company], [date] only”—without covering information needed for verification.

3. Secure the accounts that could have been used

Change the passwords of your primary email, banking, e-wallet, shopping, government-service, and social-media accounts. Use unique passwords and enable multi-factor authentication.

Also:

Sign out unknown devices and revoke unfamiliar app access;
Change security questions and account-recovery details;
Ask your mobile provider about an unauthorized SIM replacement or account change;
Tell your bank or e-wallet provider if an account was compromised or used to receive or move funds;
Freeze or replace affected cards and credentials when the issuer recommends it;
Remove suspicious apps and review their permissions;
Update your phone and applications; and
Run a security scan before changing passwords from a device that may be compromised.

Never give a collector or supposed investigator your password, PIN, CVV, OTP, or account-recovery code.

4. Determine who regulates the lender

The proper complaint route depends on the institution—not simply on the app’s branding.

Lending or financing company, online lending app, platform, or collection agency: complain to the Securities and Exchange Commission.
Bank, e-money issuer, or another BSP-supervised institution: use the institution’s own Financial Consumer Protection Assistance Mechanism first, then escalate to the Bangko Sentral ng Pilipinas if unresolved.
Unauthorized processing, disclosure, inadequate protection, or refusal to correct personal data: complain to the National Privacy Commission.
Identity theft, forgery, fraud, account intrusion, threats, or extortion: report to the PNP, NBI, or another appropriate law-enforcement office.
Wrong loan appearing in a CIC credit report: use the Credit Information Corporation’s dispute process.

These remedies serve different purposes and may be pursued in parallel when appropriate. A police report does not automatically correct a credit record, and a regulator’s administrative complaint is not a substitute for reporting a possible crime.

Filing with the Securities and Exchange Commission

The SEC supervises lending and financing companies and their online lending platforms. Its complaint page instructs consumers to complete the prescribed form, attach a valid government-issued ID and supporting evidence, and submit one complaint form for each respondent company. The SEC may require the company to answer and may begin administrative proceedings when sufficient grounds exist.

Use the SEC’s current complaint instructions for lending and financing companies or its I-Message Mo portal.

Attach your dispute letter, proof of delivery, collection messages, alleged loan documents, and any police or cybercrime report. Identify both the app and the legal company behind it if known.

The SEC expressly notes that its complaint process cannot itself declare a loan contract void or cancel an obligation. A binding dispute over contractual liability may ultimately require judicial determination. Still, an SEC complaint can address regulatory violations, unauthorized operations, and prohibited collection conduct.

Harassment is not acceptable even when a debt is genuine. SEC Memorandum Circular No. 18, series of 2019 prohibits unfair debt-collection practices by financing and lending companies. Preserve proof of threats, insults, deceptive representations, public shaming, or improper contact with people who are not responsible for the debt. See the SEC’s official page for Memorandum Circular No. 18.

Filing with the Bangko Sentral ng Pilipinas

If the disputed loan or related account belongs to a BSP-supervised institution, first complain through that institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel. Keep its acknowledgment and reference number.

If its response is missing or unsatisfactory, escalate through the BSP Consumer Assistance Mechanism. The BSP identifies this as a second-level remedy and currently accepts complaints through BSP Online Buddy or, when BOB is unavailable, through its prescribed form and email channel. Follow the current instructions in the BSP’s guide for complaints against supervised institutions.

The BSP also cautions complainants not to include passwords, PINs, full account or card numbers, passbooks, passports, or identification cards that its process does not require.

Filing with the National Privacy Commission

First notify the lender or other organization in writing of the privacy violation and give it an opportunity to act. Under the NPC’s amended rules, a complaint ordinarily will not be given due course unless the complainant shows that the organization failed to take timely and appropriate action or gave no response within 15 calendar days after receiving the written notice.

The NPC may waive that prior-notice requirement for good cause or a serious violation or breach, including circumstances involving grave and irreparable harm, the absence of a plain and adequate remedy, or patently illegal conduct. Do not wait if ongoing disclosure or harassment is creating immediate danger; explain the urgency and request appropriate interim relief.

An NPC complaint generally must be verified or made using the notarized complaint-assisted form and must include evidence, relevant correspondence, requested relief, and a certification against forum shopping. Filing fees may apply, subject to the rules on indigent complainants and discretionary waiver.

Consult the NPC’s:

Possible privacy issues depend on the evidence. They may include unauthorized processing, failure to use reasonable security measures, disclosure to unrelated contacts, failure to correct inaccurate data, or continued use of information for an unauthorized purpose. Do not assume that every identity-theft incident proves the lender itself violated the Data Privacy Act; the NPC will examine how the data was obtained, verified, secured, used, and disclosed.

Report possible identity theft or fraud

Computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act includes intentionally acquiring, using, misusing, transferring, possessing, altering, or deleting another person’s identifying information without right. Depending on the method and evidence, computer-related forgery, computer-related fraud, access-device fraud, falsification, or other offenses may also be relevant. The investigating authority or prosecutor—not the victim or lender—determines the proper charge.

Official references include:

You may approach the NBI Cybercrime Division or PNP Anti-Cybercrime Group. Bring a valid ID, a clear chronology, copies of the disputed loan records, proof that you denied the transaction, and the preserved electronic evidence. Ask for a complaint or reference number.

Report promptly. Service providers may retain technical records for limited periods, and delay can make account, device, or transaction evidence harder to obtain. Do not impersonate the offender, attempt to hack an account, or secretly access another person’s records to gather proof.

Check and correct your credit information

Obtain your own credit report through a CIC-authorized access channel. If the unauthorized loan appears, use the CIC’s Online Dispute Resolution Process.

Republic Act No. 9510 gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information. A CIC dispute is important because correcting the lender’s internal system does not necessarily guarantee that data already submitted to the credit-information system has been corrected. See the Credit Information System Act.

Identify the specific institution and contract entry being disputed. Attach the lender dispute, investigation result if available, and law-enforcement report. Keep checking until the correction is reflected, and retain the final written outcome.

What your dispute letter should accomplish

A concise letter can say:

I dispute the alleged loan under account or reference number [number]. I did not apply for, authorize, sign, receive, or benefit from this loan. The account appears to involve identity theft or unauthorized use of my personal information.

Please suspend collection and adverse reporting while you investigate; preserve the complete application, verification, device, access, communications, and disbursement records; provide the records concerning me that I am entitled to access; correct or block inaccurate information as required by law; notify recipients of any correction where applicable; and confirm your findings in writing.

This notice is not an acknowledgment, ratification, or promise to pay. Please communicate with me in writing through [verified contact channel].

Adapt the statement to the truth. Do not say that you never received the proceeds if money actually entered an account you controlled. Instead, explain precisely what happened—for example, that an unknown person accessed the account or immediately transferred the funds.

If money entered your account

Do not spend, transfer, or “return” it to an account supplied by an unsolicited caller. Contact the lender and your bank or e-wallet through independently verified channels. Ask them to trace, restrict, or reverse the transaction using their formal fraud procedures.

Receipt into an account bearing your name may complicate the facts but does not automatically prove that you knowingly applied for the loan. Conversely, keeping or using funds after learning of the transaction may weaken your position. Obtain legal advice before signing a settlement, waiver, acknowledgment, or repayment arrangement.

If collectors contact your family, employer, or phone contacts

Tell the collector in writing that the account is disputed because of identity theft and require future communications to use an appropriate direct channel. Ask contacted persons to preserve screenshots and provide short factual statements describing what was communicated.

A lender may have legitimate reasons to verify or pursue an account, but public shaming, threats, deceptive tactics, and unnecessary disclosure of personal data can raise separate regulatory and privacy issues. Include each incident, date, number, recipient, and exact wording in your SEC or NPC complaint.

If a message threatens immediate arrest solely for nonpayment, remember that the Constitution prohibits imprisonment for debt. That protection does not prevent investigation or prosecution of an independently proven crime such as fraud. A collector cannot decide guilt or lawfully arrest you.

Do not ignore formal legal papers

A threatening text is not the same as a summons, subpoena, prosecutor’s notice, or court order. If you receive an official document:

Record the date and manner of receipt.
Verify it directly with the issuing court, prosecutor’s office, barangay, regulator, or agency using independently obtained contact details.
Do not rely on the collector’s phone number for verification.
Obtain legal help immediately because a response period or hearing date may apply.
Bring your evidence showing the identity-theft dispute and earlier reports.

Do not assume that reporting the fraud automatically stops a civil case, criminal investigation, collection process, or deadline.

Common mistakes to avoid

Paying a “small amount” or signing a restructuring agreement just to stop the calls
Writing “I will pay when this is fixed,” which may be portrayed as an admission
Deleting the app, texts, email, or account before preserving evidence
Sending complaints only by phone and keeping no written record
Giving additional IDs, selfies, OTPs, passwords, or banking credentials to an unverified collector
Clicking links in collection messages instead of locating the institution’s official channel
Publicly accusing a named person without reliable evidence
Assuming an SEC, NPC, BSP, CIC, or police report automatically resolves every other aspect of the case
Ignoring genuine notices because earlier collection messages were fraudulent
Submitting heavily cropped screenshots that omit the sender, date, time, or context
Filing an NPC complaint without first notifying the organization in writing, unless facts support a waiver
Disputing only with the lender and failing to check whether the false account reached your credit report

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office promptly if:

You receive a summons, subpoena, prosecutor’s notice, or formal demand with a deadline;
A case has been filed, a judgment is claimed, or property or wages are threatened;
The lender produces a signature, selfie, recording, OTP log, or account record that appears authentic but was not created by you;
Loan proceeds entered an account you own;
You previously shared an OTP, lent a SIM or device, allowed another person to use your account, or signed documents without understanding their purpose;
A family member or employee may have acted using your details;
The lender refuses to stop reporting a clearly disputed account;
Your identification documents or several financial accounts have been compromised;
There are threats of violence, extortion, stalking, or publication of intimate or sensitive material; or
You are considering a settlement, affidavit of desistance, waiver, or acknowledgment of debt.

Call emergency services or approach the nearest police station if there is an immediate threat to safety.

Frequently asked questions

Am I required to pay a loan I never authorized?

Generally, a person who did not consent to a loan should dispute liability because consent is an essential element of a contract. The final answer may depend on the authenticity of the electronic records, whether the person later ratified the transaction, who received or used the proceeds, and other facts. Do not make a payment or admission before obtaining advice where the evidence is disputed.

Does an electronic signature or OTP automatically prove I borrowed the money?

No single item automatically decides every case. Electronic documents and signatures can have legal effect, but their authenticity, reliability, attribution, and connection to the alleged borrower may still be contested. Request the complete verification and audit trail rather than only a screenshot of an alleged agreement.

Should I file a police blotter or an NBI cybercrime complaint?

A contemporaneous official report can document your denial and help begin an investigation. It is useful evidence, but it does not by itself cancel the account or conclusively prove who committed the offense. Continue the lender, regulator, privacy, and credit-report disputes as applicable.

Can I demand deletion of all my data immediately?

You may seek correction, blocking, removal, or destruction when the statutory requirements are met, but the right is not absolute. The lender may need to retain relevant records for legal compliance, fraud investigation, evidence preservation, or the defense of claims. Ask it to stop unauthorized use, restrict disputed processing, correct false information, and explain the legal basis and retention period for anything it keeps.

What if the app is unregistered or the company cannot be identified?

Preserve the app-store page, website, package name, payment instructions, phone numbers, and messages. Report the operation to the SEC and possible fraud to cybercrime authorities. Do not send money merely because an anonymous operator threatens you.

What if the collector offers to close the account if I pay a reduced amount?

Payment or a signed compromise may create arguments about acknowledgment or settlement. Ask for the investigation result and proposed terms in writing, and obtain legal advice before accepting—especially where you deny the entire transaction.

Can I complain to more than one agency?

Yes, when the facts fall within different agencies’ authority. For example, identity theft may be reported to law enforcement, lender conduct to the SEC or BSP, misuse of personal data to the NPC, and an inaccurate credit entry to the CIC. Disclose related proceedings when a form or rule requires it, particularly in an NPC certification against forum shopping.

How quickly should I act?

Immediately. There is no advantage in waiting: collection and credit reporting may continue, further accounts may be opened, and technical records may become unavailable. Specific legal deadlines depend on the proceeding and document received, so obtain advice promptly if any formal notice has been served.

Official-source checklist

This article provides general legal information, not advice for a particular case. Liability and the correct remedy depend on the documents, electronic records, movement of funds, parties involved, and notices received. Consult a qualified Philippine lawyer for case-specific advice. Laws, procedures, and official filing channels were checked against primary and official government sources as of September 4, 2026.