Finding out that your name, ID, selfie, phone number, or contacts were used to apply for loans through online lending apps in the Philippines is frightening. You may be receiving collection calls for money you never borrowed, threats sent to your relatives or employer, or notices that a loan has been reported under your name. The most important thing to know is this: treat it as a fraud and identity misuse incident, not as an ordinary unpaid loan. Your goal is to preserve evidence, deny the debt in writing, stop further data misuse, report the lending app or collector to the right agencies, and protect your credit record.

First: Are You Legally Required to Pay a Loan You Never Applied For?

A person generally cannot be bound by a loan contract they did not consent to. Under the Civil Code, a valid contract requires consent, object, and cause. Consent happens when there is a meeting of offer and acceptance. A person also cannot make a contract in another person’s name without authority, unless the person later ratifies it. (Lawphil)

In practical terms, this means:

If you did not apply for the loan,
did not authorize anyone to apply for you,
did not receive the loan proceeds,
did not sign or electronically agree to the loan, and
did not later confirm or ratify the transaction,

then the lending company should not simply treat you as a valid borrower just because your name or ID appears in their system.

Be careful not to accidentally make the situation worse. Do not say “I will pay later,” request a restructuring, or make partial payment just to stop the harassment without first making it clear in writing that you deny the loan and are disputing it as fraud. A desperate payment may later be used by a collector as proof that you recognized the debt.

What Laws Protect You in the Philippines?

Identity misuse in online lending cases can involve several overlapping areas of Philippine law: contract law, cybercrime, data privacy, lending regulation, consumer protection, criminal fraud, and civil damages.

Issue	Legal basis	What it means in real life
No valid loan without your consent	Civil Code Articles 1317, 1318, and 1319	A loan made in your name without your authority may be disputed because there was no valid consent. (Lawphil)
Use of your identity online	Cybercrime Prevention Act, RA 10175 of 2012	Computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. (Supreme Court E-Library)
Fake documents or fraudulent application	Revised Penal Code provisions on estafa and falsification	Estafa may involve false pretenses, fictitious names, or fraudulent acts; falsification may apply when a document is falsified to cause damage or support fraud. (Supreme Court E-Library) (Supreme Court E-Library)
Misuse of your personal data	Data Privacy Act, RA 10173 of 2012	Unauthorized processing, access, disclosure, or malicious disclosure of personal information may carry administrative and criminal consequences. (National Privacy Commission)
Harassment of contacts or relatives	SEC rules, NPC rules, and the 2026 DICT-NPC-SEC advisory on online lending platforms	Online lenders and collectors cannot use threats, violence, or illegal collection methods. Contacting people in your contact list for collection, unless they are actual guarantors, is prohibited.
Lending company regulation	Lending Company Regulation Act, RA 9474 of 2007	Lending companies are regulated to prevent practices prejudicial to the public and to set minimum operating standards. (Lawphil)
Financial consumer rights	Financial Products and Services Consumer Protection Act, RA 11765 of 2022	Financial consumers are protected through transparency, fair market conduct, and fair handling of complaints. (Supreme Court E-Library)
Disclosure of loan charges	Truth in Lending Act, RA 3765	Creditors must disclose finance charges and the true cost of credit so borrowers are not misled. (Bureau of Small Enterprises)
Use of bank, e-wallet, or account details	Anti-Financial Account Scamming Act, RA 12010 of 2024	Using another person’s identity or ID documents to open or use a financial account can fall under money mule or related financial account fraud rules. (Lawphil)
Damage to your reputation, privacy, or peace of mind	Civil Code Articles 19, 20, 21, 26, and 378	Civil liability may arise from bad faith, acts contrary to law, invasion of privacy, or unauthorized use of a person’s name. (Lawphil) (Supreme Court E-Library)

What to Do Immediately If an Online Loan Was Made in Your Name

1. Preserve evidence before blocking, deleting, or replying emotionally

Before you block numbers or delete messages, collect evidence. In online lending fraud cases, screenshots alone are useful but often not enough. Try to preserve the surrounding details.

Save:

SMS, Viber, Messenger, WhatsApp, Telegram, email, and app notifications
caller numbers, call logs, dates, and times
screenshots of threats, insults, or messages sent to your contacts
the name of the online lending app, app developer, website, and social media pages
Google Play or App Store listing screenshots
loan account number, amount, alleged date of loan, and due date
any disbursement details, such as GCash, Maya, bank account, or mobile number
collection letters, demand notices, or emails
names of collectors, agents, or company representatives, if shown
proof that you did not receive the money, such as bank or e-wallet history

For messages, take screenshots that show the sender, phone number or username, date, time, and full message thread. For long chats, screen-record while slowly scrolling. Do not edit or crop the original files. Keep copies in cloud storage and on a separate device.

2. Send a written denial and fraud dispute to the lender or app

Do not argue over the phone. Send a clear written dispute through email, in-app support, registered mail, or any official complaint channel of the lending company.

Use firm but neutral wording:

I deny applying for, authorizing, receiving, or benefiting from the alleged loan under my name. I am formally disputing this account as identity theft and unauthorized use of my personal information.

Please mark the account as disputed and fraudulent, immediately stop collection activity against me and my contacts, preserve all records related to the application, and provide copies of the application data, KYC records, e-signature records, device information, IP logs, disbursement details, consent records, and the basis for processing my personal data.

I do not admit liability for this alleged loan.

Ask for a ticket number or written acknowledgment. Keep proof that the message was sent.

3. Secure your identity and financial accounts

Identity misuse in loan apps often means someone may have access to your ID photos, phone number, SIM, email, e-wallet, or social media account.

Do these as soon as possible:

Change passwords for your email, banking apps, e-wallets, and social media.
Turn on two-factor authentication.
Check your email for suspicious forwarding rules or unknown recovery emails.
Review GCash, Maya, bank, and credit card transaction history.
Report a lost or compromised SIM to your telco if needed.
Report a lost or compromised government ID to the issuing agency when applicable.
Revoke suspicious app permissions on your phone.
Do not send a full unredacted ID again through chat to an unknown collector.

If you must submit an ID to an official agency or regulated company, use the official channel and consider marking the copy with a purpose, such as: “For identity theft complaint verification only, date: ___.”

4. File a complaint with the SEC if the lender or online lending app is involved

The Securities and Exchange Commission regulates lending companies and financing companies. For online lending harassment, abusive collection, unauthorized lending activity, or possible unregistered online lending operations, the SEC is usually one of the key agencies.

The SEC’s iMessage Portal is its official web-based platform for public complaints and inquiries. It provides electronic ticketing, and the service list includes complaints involving financing and lending companies. (imessage.sec.gov.ph)

In your SEC complaint, include:

your full name and contact details
name of the lending company or online lending app
app screenshots and website links
SEC registration details, if available
screenshots of collection messages
proof that you denied the loan
proof of harassment of your contacts
explanation that your identity was used without consent
request for investigation, cessation of collection, and correction of records

You can also check whether the online lending platform appears in the SEC’s list of recorded online lending platforms. If the app is not listed, state that in your complaint and attach screenshots of the app listing or website. (www.foi.gov.ph)

5. File a complaint with the National Privacy Commission for misuse of personal data

The National Privacy Commission handles complaints involving violations of the Data Privacy Act, including unauthorized processing of your personal data, excessive app permissions, misuse of contact lists, unlawful disclosure, and failure to honor data subject rights.

Under the Data Privacy Act’s implementing rules, a data subject has rights such as the right to be informed, the right to object, the right to access personal data, and the right to rectification, erasure, or blocking of inaccurate or unlawfully processed personal data. A data subject may also lodge a complaint and claim damages when appropriate. (National Privacy Commission)

For online lending apps, this is especially important when:

the app accessed your contact list without a lawful basis;
collectors messaged your relatives, friends, co-workers, or employer;
your photo, ID, or personal information was shared in group chats;
the app refuses to provide records about the alleged loan;
the lender keeps processing your data despite your fraud dispute;
your data appears to have been obtained from a leak, fake account, or unauthorized source.

The NPC’s complaint process requires a formal complaint in the prescribed format. The complaint form must be filled out, notarized, and submitted through the allowed channels stated by the NPC, such as personal filing, courier, or email depending on current NPC instructions. (National Privacy Commission)

6. Report the criminal aspect to the PNP Anti-Cybercrime Group or NBI Cybercrime Division

If someone used your identity, ID, selfie, email, SIM, or e-wallet to apply for a loan, there may be criminal liability. Depending on the facts, the case may involve computer-related identity theft, estafa, falsification, threats, coercion, libel, unjust vexation, or other offenses.

The NBI has a Cybercrime Division for investigative assistance involving computer crimes, and the PNP Anti-Cybercrime Group also receives cybercrime complaints. (National Bureau of Investigation) (www.foi.gov.ph)

Bring or prepare:

a notarized complaint-affidavit
government-issued ID
screenshots and digital files
phone numbers, URLs, emails, and usernames used by collectors
proof that you did not receive the loan proceeds
bank or e-wallet statements
copy of your written dispute to the lender
witness statements from people who received threats or collection messages
proof of compromised ID, SIM, or account, if available

A criminal complaint is different from an SEC or NPC complaint. SEC action focuses on lending regulation. NPC action focuses on personal data misuse. PNP, NBI, and prosecutors deal with criminal liability.

7. Check your credit report and dispute false loan information with the CIC

Do not assume the issue ends when the calls stop. Some lenders submit credit information to the Credit Information Corporation or other credit-related systems.

The CIC maintains a central registry of credit data. If a fraudulent loan appears in your credit report, you can dispute it through the CIC’s Online Dispute Resolution System. The CIC explains that the ODRS is for discrepancies between data submitted to the CIC and what appears in a borrower’s CIC credit report. (Credit Information Corporation)

Important CIC points:

You usually need to obtain your CIC credit report first.
The dispute must use the Transaction Reference Number and the same email used to obtain the report.
The CIC states that the credit report must have been obtained within 30 days; otherwise, you may need to get a new report.
The CIC does not simply change the record on its own. The submitting entity must verify and correct the data through the proper process. (Credit Information Corporation)

This step is crucial if you plan to apply for a bank loan, credit card, housing loan, car loan, visa, or employment requiring financial background checks.

8. If a bank account or e-wallet was used, report it immediately

If the alleged loan was disbursed to an e-wallet, bank account, or financial account that is not yours, report that to the lender, bank, e-wallet provider, PNP/NBI, and SEC. Ask for the receiving account details to be preserved and investigated.

RA 12010, the Anti-Financial Account Scamming Act, covers several forms of financial account abuse, including opening or using accounts with another person’s identity or identification documents. It also allows temporary holding of disputed transactions in appropriate cases under the law. (Lawphil) (Lawphil)

Evidence Checklist for Online Lending Identity Theft

Evidence	Why it matters	Practical tip
Screenshots of collection messages	Shows harassment, threats, false claims, and dates	Capture the full number, sender name, date, and time
Call logs and recordings where lawful	Shows frequency and source of collection calls	Do not secretly manipulate or edit files
Messages sent to relatives, employer, or contacts	Proves third-party collection and possible data misuse	Ask contacts to send original screenshots and short statements
App name, developer, website, and package name	Identifies the platform and operator	Screenshot the app store listing before it disappears
Loan account number and alleged amount	Helps agencies trace the specific transaction	Ask the lender for the complete loan record
Disbursement account details	Shows whether money went to someone else	Request bank, e-wallet, or transfer reference numbers
Proof you did not receive funds	Supports your denial	Download bank and e-wallet statements covering the alleged loan date
Copy of written dispute	Shows you denied the debt early	Use email or channels that generate timestamps
Credit report	Shows whether the fake loan affected your record	Use CIC dispute channels if false data appears
Witness statements	Supports claims of harassment or reputational harm	Have witnesses identify the number, message, and date

Which Office Should Handle Your Complaint?

Many victims file in the wrong place or file with only one office. Online lending identity theft often needs parallel action because different agencies have different powers.

Office or channel	Best for	What to prepare
Lending company or online lending app	Immediate dispute, account tagging, record preservation, stopping collection	Written denial, ID for verification, screenshots, proof you did not receive funds
SEC	Abusive collection, lending company misconduct, unregistered or unrecorded online lending platform	SEC iMessage complaint, app details, collection evidence, dispute letter
National Privacy Commission	Unauthorized use of personal data, contact list misuse, disclosure of your ID or photo, refusal to honor data rights	Notarized NPC complaint, evidence of data misuse, screenshots, identity documents
PNP Anti-Cybercrime Group or NBI Cybercrime Division	Identity theft, fake application, cybercrime, threats, fraud, falsification	Complaint-affidavit, digital evidence, IDs, account records, witness screenshots
Credit Information Corporation	False loan appearing in your credit report	CIC credit report, TRN, dispute details, proof of fraud
Bank, e-wallet, or payment provider	Unauthorized receiving account, suspicious disbursement, account takeover	Transaction reference, account details, police/NBI report if available

A barangay blotter may help create an incident record, especially if collectors visit your home or threaten you locally. But for cyber identity theft, abusive online lending, and data privacy violations, barangay reporting is usually not enough. The matter should still be elevated to SEC, NPC, PNP/NBI, CIC, or the relevant financial institution.

Common Online Lending App Identity Theft Scenarios

The collector says, “Your ID and selfie are in our system”

That is not conclusive proof that you borrowed money. A stolen ID photo, edited selfie, compromised phone, or fake account may have been used. Ask for the complete application record, including:

date and time of application
device ID or device information
IP address or location data, if recorded
e-signature or clickwrap consent logs
phone number and email used
KYC verification records
disbursement account
bank or e-wallet transfer reference
copy of the privacy notice and consent records relied upon

If the lender refuses to provide the basis for processing your personal data, that refusal may become relevant in an NPC complaint.

Your contacts, relatives, or employer are being harassed

This is common in abusive online lending cases. Some collectors shame the alleged borrower by messaging contacts, sending threats, or claiming the person is a criminal.

The 2026 joint advisory from DICT, NPC, and SEC states that threats, violence, and illegal collection actions are prohibited. It also states that contacting people in a borrower’s contact list for collection purposes is prohibited unless those people are guarantors, and that a guarantor must expressly consent.

A character reference is not the same as a guarantor. A character reference may be contacted for verification within lawful limits. A guarantor is someone who clearly agreed to be responsible under specific terms. Collectors cannot simply treat everyone in your phonebook as liable or available for harassment.

The app is not registered or has disappeared from the app store

Still file complaints. Unregistered, delisted, or renamed apps may leave digital traces such as package names, developer accounts, websites, phone numbers, payment channels, collection numbers, and bank or e-wallet accounts. The SEC, NPC, PNP/NBI, and financial institutions may use those details to investigate.

The loan proceeds went to someone else’s GCash, Maya, or bank account

This is a strong sign of fraud. Do not focus only on the lending app. Report the receiving account as part of the fraud trail. Ask the lender and the financial institution to preserve transaction records. If the account was opened or used with false identity documents, RA 12010 may be relevant. (Lawphil)

You are an OFW or foreigner outside the Philippines

You can still prepare a complaint from abroad. Common practical requirements include:

a notarized complaint-affidavit;
a Special Power of Attorney if someone in the Philippines will file or follow up for you;
notarization before a Philippine Embassy or Consulate, or notarization abroad with apostille if applicable;
passport pages, visa records, boarding passes, or employment records showing where you were when the loan was supposedly made;
Philippine phone, email, bank, or e-wallet records showing non-receipt of funds.

Foreigners dealing with Philippine online lending apps should include passport, ACR I-Card if any, local address records, Philippine SIM records, and proof of the Philippine connection of the transaction.

Practical Timeline: What Usually Happens

Step	Typical sequence	Practical reality
Evidence preservation	Same day	Do this before blocking numbers or uninstalling apps
Written dispute to lender	Same day or next day	Ask for acknowledgment and account freeze while under investigation
SEC complaint	After evidence is organized	The SEC portal may generate an electronic ticket, but investigation time depends on the case and agency workload
NPC complaint	After preparing notarized complaint	NPC complaints require proper form and supporting evidence; processing may take weeks or months depending on complexity
PNP/NBI complaint	As soon as criminal identity misuse is clear	Investigators may ask for a complaint-affidavit, original files, device details, and additional evidence
CIC dispute	After getting your credit report	CIC ODRS requires a recent credit report and supporting proof
Bank/e-wallet dispute	Immediately if funds passed through an account	Transaction records may be time-sensitive, so report quickly

Mistakes That Can Hurt Your Case

Avoid these common mistakes:

Paying the alleged loan without a written dispute. This may be treated as acknowledgment of the debt.
Deleting messages before saving evidence. Harassment evidence is often lost because victims block too early.
Sending your full ID again to random collectors. You may expose yourself to more misuse.
Only filing a barangay blotter. It may help document the incident, but it does not replace SEC, NPC, PNP/NBI, CIC, or bank action.
Ignoring your credit report. The calls may stop, but the false loan may remain in credit data.
Posting accusations online without evidence. Preserve evidence and use official complaint channels to reduce defamation risk.
Using inconsistent explanations. Keep one clear timeline: when you learned of the loan, what you received, what you denied, and what records prove it.
Letting collectors force you into “settlement.” If you did not borrow, your first position should be denial and fraud dispute, not negotiation.

Frequently Asked Questions

Do I have to pay an online loan I never applied for?

No, not just because a lending app or collector says the loan is under your name. A valid loan generally requires your consent. If your identity was used without permission, dispute the account in writing and ask the lender to provide proof of application, consent, verification, and disbursement. (Lawphil)

Can an online lending app contact my contacts in the Philippines?

Not for abusive collection. The 2026 DICT-NPC-SEC advisory states that contacting people in the borrower’s contact list for collection purposes is prohibited unless they are guarantors, and guarantors must expressly consent. Character references and phone contacts should not be treated as people responsible for the loan.

What if the loan app has my ID, selfie, or signature?

That does not automatically prove you borrowed money. IDs, selfies, and signatures can be stolen, copied, edited, or submitted by someone else. Ask for the full KYC trail, device logs, IP records, consent records, e-signature records, and disbursement details. If the company cannot show that you personally applied and received the proceeds, your fraud dispute becomes stronger.

Should I file with the SEC, NPC, PNP, NBI, or CIC?

It depends on the problem, and many cases require more than one filing. File with the SEC for lending company misconduct or abusive online lending practices. File with the NPC for misuse of personal data. File with PNP-ACG or NBI for identity theft, fraud, threats, or cybercrime. File with CIC if the fake loan appears in your credit report.

Can I file a complaint if I am abroad?

Yes. OFWs and foreigners can prepare sworn statements abroad, usually through a Philippine Consulate or through notarization and apostille procedures depending on the country. A representative in the Philippines may need a Special Power of Attorney. Include proof showing you were abroad or did not have access to the device, SIM, or account supposedly used for the loan.

Will a fake online loan affect my credit record?

It can, especially if the lender reports the account as delinquent. Get your CIC credit report and dispute any false entry through the CIC Online Dispute Resolution System. The CIC explains that disputes are based on discrepancies in the credit report and that corrections involve the concerned submitting entity. (Credit Information Corporation)

Should I change my phone number immediately?

Not before preserving evidence. Your phone number may be important proof because it shows who contacted you, when they contacted you, and what they said. First save the messages and call logs. After reporting and securing your accounts, changing your number may help reduce harassment.

Can collectors be criminally liable for threats or public shaming?

Depending on the facts, yes. Threats, coercion, libel, unjust vexation, identity theft, falsification, or fraud-related offenses may apply. The Revised Penal Code includes provisions on threats, coercion, libel, and estafa, while RA 10175 covers computer-related identity theft. (Supreme Court E-Library) (Supreme Court E-Library) (Supreme Court E-Library)

What if the online lending app refuses to give me records?

Put the request in writing and keep proof. Under data privacy rules, a data subject has rights to access, rectification, erasure, blocking, and complaint mechanisms in appropriate cases. Refusal to provide the basis for processing your data may be relevant in an NPC complaint. (National Privacy Commission)

Key Takeaways

A loan made through an online lending app using your identity is not automatically your legal debt.
Do not admit liability, promise payment, or settle before making a written fraud dispute.
Preserve screenshots, call logs, app details, loan details, disbursement records, and witness messages.
File with the SEC for lending company misconduct or abusive collection.
File with the NPC for unauthorized use, disclosure, or processing of your personal data.
File with PNP-ACG or NBI if there is identity theft, cybercrime, fraud, threats, or falsification.
Check your CIC credit report and dispute false loan entries quickly.
Contact list harassment is not normal collection. References are not automatically guarantors.
If a bank or e-wallet account was used, report the account trail immediately because transaction records may be time-sensitive.
Keep one clear timeline and all proof organized; identity theft cases are often won or lost on documentation.