If an online lending app, collector, or unknown person is demanding payment for a loan you never applied for, treat it as both a fraud problem and a data privacy problem. In the Philippines, your name, ID, selfie, phone number, contacts, e-wallet, or bank details may have been used to create a fake loan account. Your immediate goals are to preserve evidence, deny the debt in writing, stop unlawful collection, report the incident to the right agency, and protect your credit record.

What identity misuse in online loans usually looks like

Identity misuse in online loans happens when someone uses another person’s personal information to apply for credit, receive loan proceeds, or make it appear that the victim agreed to a loan. In practice, this often involves:

A stolen or photographed government ID
A leaked selfie, screenshot, or uploaded KYC document
A SIM card, e-wallet, email, or phone number controlled by someone else
A fake emergency contact or guarantor entry
A lending app that scraped contacts and began messaging relatives, co-workers, or friends
A collector claiming you owe money even though you never signed, tapped, confirmed, received, or benefited from the loan

Legally, the key point is simple: a loan is a contract, and a contract generally requires consent. Article 1318 of the Civil Code says there is no contract unless there is consent of the contracting parties, a certain object, and a cause of the obligation. If you never applied, never authorized anyone, and never received the proceeds, you should not casually admit liability just because someone is threatening you. (Supreme Court E-Library)

Legal basis: your rights under Philippine law

Identity theft and cybercrime

Republic Act No. 10175, or the Cybercrime Prevention Act of 2012, specifically punishes computer-related identity theft. Section 4(b)(3) covers the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. The same law also covers computer-related forgery and computer-related fraud, which may apply when false digital loan data, fake accounts, forged electronic documents, or fraudulent app submissions are involved. (Supreme Court E-Library)

RA 10175 also states that crimes under the Revised Penal Code and special laws committed through information and communications technology may be covered by the Cybercrime Prevention Act, and prosecution under RA 10175 is without prejudice to liability under other laws. (Supreme Court E-Library)

Depending on the facts, the incident may also involve:

Falsification under Article 172 of the Revised Penal Code, if a person used falsified documents, signatures, or application records to create the loan. (Lawphil)
Estafa or swindling under Article 315 of the Revised Penal Code, if deceit was used to obtain money or credit. (Lawphil)
Access device fraud under RA 8484, especially if account numbers, access codes, cards, e-wallet credentials, or other access devices were used to obtain money or initiate transfers. RA 8484 includes “access device fraudulently applied for” where an access device is issued using falsified documents, false information, fictitious identities, or misrepresentation. (Lawphil)

Data privacy rights

Republic Act No. 10173, or the Data Privacy Act of 2012, gives you rights as a data subject. These include the right to be informed, the right to access your personal data, the right to dispute inaccurate information, the right to have false or unlawfully obtained data corrected, blocked, removed, or destroyed, and the right to damages for inaccurate, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

The National Privacy Commission also lists the rights of data subjects, including the right to file a complaint, right to rectify, right to erasure or blocking, and right to damages. (National Privacy Commission)

This matters because many online loan identity cases are not just about money. They also involve unlawful processing of personal data, unauthorized use of IDs and selfies, excessive app permissions, public shaming, or messaging people in the victim’s contact list.

Rules on online lending collection

A 2026 public advisory from the DICT, NPC, and SEC on online lending platforms states that processing resulting in unfair collection practices may include threats of violence, criminal means, harm to reputation or property, and threats to take action that cannot legally be taken. The advisory also states that, for debt collection, lending companies, financing companies, or persons acting as such may contact only the guarantor, and contacting people on the borrower’s contact list other than named guarantors is prohibited.

This is important when collectors message your family, employer, barangay, Facebook friends, or phone contacts even though they are not guarantors.

Financial consumer protection

RA 11765, or the Financial Products and Services Consumer Protection Act, strengthens protection for financial consumers. Its implementing rules recognize rights to fair treatment, clear disclosure, protection against fraud and misuse, and privacy and protection of client data. (Supreme Court E-Library)

Regulator jurisdiction depends on the lender:

Entity involved	Usual regulator	Where complaints usually go
Lending company, financing company, or online lending platform	SEC	SEC iMessage / SEC complaints
Bank, e-wallet issuer, money service business, payment operator, or other BSP-supervised financial institution	BSP	First to the institution’s complaint channel, then BSP CAM
Data privacy violation, unauthorized use of ID/selfie/contact list, harassment through contacts	NPC	NPC complaint
Cyber identity theft, fake account, scam, threats, forged digital application	PNP-ACG, NBI Cybercrime Division, CICC/DOJ channels	Law enforcement / cybercrime report
Wrong credit record	CIC and/or credit bureau	CIC Online Dispute Resolution System

The BSP says unresolved complaints against BSP-supervised financial institutions may be escalated through BSP Online Buddy or by submitting a CIR Form to BSP, and the concern should first be raised with the institution’s Financial Consumer Protection Assistance Mechanism. (Bureau of Soils and Water Management)

For SEC-regulated lenders, the SEC iMessage portal is the SEC’s public ticketing platform for inquiries, complaints, incidents, and requests, with options to open a new ticket and check ticket status. (iMessage)

What to do immediately if your identity was used for an online loan

1. Do not admit the debt just to stop the harassment

Do not say “I will pay,” “I borrowed,” or “I will settle” if you never applied for the loan. Do not make a “small payment” just to silence collectors unless you understand the risk: it may later be used to argue that you recognized the account.

A safer first response is:

“I deny this loan. I did not apply for, authorize, sign, receive, or benefit from this transaction. Please send all application records, KYC documents, disbursement details, consent records, IP/device logs, and the legal name and SEC registration details of the lending or financing company. Suspend collection and credit reporting while this identity theft dispute is under investigation.”

Keep your message calm and factual. Avoid threats, insults, or social media posts accusing named persons of crimes unless you have verified evidence.

2. Preserve evidence before blocking or deleting anything

Before uninstalling the app, deleting messages, or blocking numbers, save proof. This is often the difference between a weak complaint and a usable case file.

Collect:

Screenshots of SMS, chat messages, emails, app notifications, and call logs
Screen recordings showing the app name, account number, loan amount, due date, and collector messages
Phone numbers, email addresses, URLs, Facebook pages, Viber/Telegram accounts, and payment instructions
The name of the lending app and the company name shown in the app, if any
Proof that your contacts were messaged, such as screenshots from relatives or co-workers
Proof that you did not receive the proceeds, such as bank or e-wallet transaction history
Copies of any ID that may have been lost, stolen, or previously submitted to an app or merchant
Your written denial and the lender’s replies

For digital evidence, keep the original files where possible. Screenshots are useful, but original messages, metadata, email headers, transaction references, and device logs can be more helpful in an investigation.

3. Secure your phone, SIM, email, e-wallet, and bank accounts

Identity theft often spreads. Someone who used your name for a loan may also have access to your OTPs, email, old SIM, cloud storage, or e-wallet.

Do these as soon as possible:

Change passwords for your email, e-wallets, banking apps, and social media accounts.
Turn on two-factor authentication using an authenticator app where possible.
Review logged-in devices and remove unfamiliar sessions.
Call your bank or e-wallet provider if you see suspicious activity.
Report a lost SIM or request SIM replacement if your number may have been compromised.
Revoke app permissions for suspicious apps, especially contacts, SMS, camera, files, and location.
Update your phone software and run a security scan.
Avoid clicking “settlement,” “payment,” or “verification” links from collectors.

If your government ID was lost or stolen, make a written incident report or affidavit of loss. If you later need to dispute a loan, this helps show when and how your identity documents may have been exposed.

4. Send a written dispute to the lender or collector

Even if the lender is harassing you, send a formal written dispute. You want a paper trail showing that you denied the account promptly.

Your dispute should ask for:

The complete loan application file
The signed or electronically accepted loan agreement
The ID, selfie, KYC, liveness check, and consent records used
The phone number, email, device ID, IP address, date, and time of application
The account or e-wallet where proceeds were released
Proof that you personally received or controlled the proceeds
The legal name, SEC registration number, certificate of authority, business address, and data protection officer contact details of the lender
Immediate suspension of collection and credit reporting
Blocking, correction, or deletion of false personal data
Written confirmation that your contacts, employer, family, or references will not be contacted unless they are actual guarantors

Use email, registered mail, courier, or the lender’s official complaint channel. Save proof of sending.

5. File a cybercrime report

If someone used your identity online, filed a fake application, forged documents, threatened you, or used fake accounts, report it to law enforcement.

You may go to the NBI Cybercrime Division. The NBI Citizen’s Charter page for investigative assistance for victims of computer crimes states that the service is available to the general public, and the complainant proceeds to the CyberCrime Division to file a complaint or request investigation. (National Bureau of Investigation)

You may also report cybercrime incidents through government cybercrime reporting channels. The DOJ Office of Cybercrime was created under RA 10175 and is designated as the central authority for cybercrime-related matters. (Department of Justice)

For online scams, the Inter-Agency Response Center hotline 1326 is described by Scam Watch Pilipinas as a joint project involving DICT, CICC, NPC, and NTC to centralize reporting of online scams to the government. (ScamWatch Pilipinas)

For the complaint, prepare a short sworn statement or complaint-affidavit explaining:

You never applied for the loan
You never authorized anyone to use your identity
You never received the proceeds
What personal data was used
Who contacted you and what they demanded
What threats, harassment, or public shaming occurred
What evidence you are attaching

6. File a complaint with the National Privacy Commission

File with the NPC if the issue involves unauthorized use of your personal data, fake KYC, misuse of your ID or selfie, unlawful disclosure, harassment through your contacts, refusal to correct false data, or failure to stop processing after you disputed the account.

The NPC says a formal complaint must be filed in a specific format. Its complaint page instructs complainants to download the form, print and fill it out, have it notarized, and submit it to the NPC in person, by courier, or by scanned email. (National Privacy Commission)

A strong NPC complaint usually includes:

Notarized complaint form or complaint-affidavit
Government ID of the complainant
Screenshots and call/message logs
Copy of your written dispute to the lender
Proof that your contacts were messaged
Proof of unauthorized processing, such as fake loan documents or app records
Your requested relief, such as deletion/correction, stopping collection-related processing, and damages where appropriate

7. File with SEC or BSP depending on the entity

If the entity is a lending company, financing company, or online lending platform, file with the SEC. The SEC page for financing and lending companies lists SEC Memorandum Circular No. 18, series of 2019 on unfair debt collection practices, and SEC Memorandum Circular No. 19, series of 2019 on disclosure requirements and reporting of online lending platforms. (SEC Appointment System)

If the issue involves a bank, e-wallet issuer, money service business, payment operator, or other BSP-supervised financial institution, first complain to that institution’s internal consumer assistance mechanism. If unresolved, escalate to BSP through BSP Online Buddy, email, mail, phone, or walk-in channels. BSP’s consumer assistance page also lists the CIR Form, consumeraffairs@bsp.gov.ph, and other BSP consumer assistance channels. (Bureau of Soils and Water Management)

8. Check and dispute your credit record

A fake online loan can damage your future bank loans, credit cards, housing loan, car loan, or employment-related financial checks. Do not assume the problem ends when collectors stop calling.

The Credit Information Corporation describes itself as the country’s public credit registry under RA 9510, with functions including receiving and consolidating basic credit data, acting as a central registry, and providing access to reliable credit history information. (Credit Information Corporation)

If a fake loan appears in your credit report, use the CIC Online Dispute Resolution System. CIC states that the ODRS is an online process designed to facilitate dispute resolution with minimum contact, and that RA 9510 requires a simplified dispute resolution process to fast-track settlement or resolution of disputed credit information. (Credit Information Corporation)

Attach your denial letter, police/NBI report if available, NPC/SEC/BSP complaint reference numbers, proof of non-receipt of proceeds, and the disputed credit report entry.

Documents to prepare

Document	Why it matters
Government-issued ID	Proves your identity when filing complaints
Notarized affidavit of denial or complaint-affidavit	States under oath that you did not apply, authorize, sign, receive, or benefit from the loan
Screenshots and call logs	Shows harassment, threats, account numbers, payment demands, and collector identity
Loan app screenshots or account page	Links the demand to a specific app or company
Bank/e-wallet transaction history	Helps show you did not receive loan proceeds
Copies of messages sent to your contacts	Supports privacy and unfair collection complaints
Written dispute to lender	Shows you denied the debt and demanded validation
Police, NBI, or cybercrime report	Supports identity theft and fraud dispute
Credit report excerpt	Needed if the fake loan affected your credit record
Affidavit of loss or theft, if applicable	Supports the timeline of ID compromise
Special Power of Attorney, if abroad or represented	Allows a trusted person in the Philippines to file or follow up

If you are abroad, an OFW, or a foreigner

If you are outside the Philippines, you can still act, but documents may need proper form.

For Filipinos abroad, a Philippine embassy or consulate may notarize or acknowledge affidavits and special powers of attorney. If you use foreign-notarized documents, Philippine agencies or private institutions may ask for an apostille or consular authentication, depending on the country and document type.

For foreigners, prepare a clear copy of your passport, visa or immigration status if relevant, local police report from your country if your ID was stolen abroad, and a notarized or apostilled affidavit explaining that you did not apply for the Philippine online loan. If a Philippine representative will file for you, use a Special Power of Attorney that specifically authorizes the person to file complaints, receive notices, submit evidence, request credit records, and sign dispute documents.

Common mistakes that make identity theft cases harder

Paying just to stop the calls

Paying may feel like the fastest way to end harassment, but it can confuse the record. If you never borrowed the money, focus first on a written denial, demand for validation, and complaints to the proper agencies.

Deleting evidence too early

Many victims delete messages because they are embarrassed or angry. Preserve first, block later. Keep screenshots, original messages, call logs, and payment instructions.

Arguing only by phone

Phone calls leave little proof. Use written channels. After a call, send a message such as: “As discussed today, I deny this loan and request validation.”

Ignoring your credit report

Collectors may stop calling while the disputed account remains reported. Check your CIC or bureau report and dispute inaccurate entries.

Posting accusations on Facebook

You can warn people factually, but avoid naming private individuals as criminals unless you are prepared to defend the statement. Online posts can create separate risks, including defamation or privacy complaints.

Filing with only one agency

These cases often need parallel action: law enforcement for identity theft, NPC for data misuse, SEC or BSP for regulated financial conduct, and CIC for credit record correction.

Sample short dispute message

I am formally disputing this alleged loan. I did not apply for this loan, did not authorize anyone to apply on my behalf, did not sign or electronically accept any loan agreement, and did not receive or benefit from any proceeds.

Please provide the complete application record, KYC documents, consent records, loan agreement, disbursement account, IP address, device details, date and time of application, and the legal name and registration details of the lending or financing company.

Pending investigation, please suspend all collection, stop contacting third parties who are not guarantors, stop reporting or update any reported credit information as disputed, and preserve all records related to this account. I reserve all rights under the Civil Code, Revised Penal Code, Cybercrime Prevention Act, Data Privacy Act, Financial Products and Services Consumer Protection Act, and other applicable laws.

Frequently Asked Questions

Am I required to pay an online loan I never applied for?

No, not simply because a collector says so. A loan is a contract, and Article 1318 of the Civil Code requires consent as one of the essential requisites of a contract. If your identity was used without consent, dispute the account in writing and demand proof that you personally applied, consented, and received the proceeds. (Supreme Court E-Library)

What if the online lender has my ID and selfie?

Having your ID and selfie does not automatically prove you applied. Ask for the full KYC record, liveness check, device logs, IP address, consent trail, disbursement record, and loan agreement. If your ID or selfie was used without authority, it may support a data privacy complaint and cybercrime report.

Can collectors message my contacts?

For debt collection, the 2026 DICT-NPC-SEC advisory states that lending or financing companies, or persons acting as such, may only contact the guarantor, and contacting people on the borrower’s contact list other than named guarantors is prohibited.

Where do I report online lending harassment?

Report to the SEC if the lender is a lending company, financing company, or online lending platform. Report to the NPC if personal data was misused or your contacts were harassed. Report to PNP-ACG, NBI Cybercrime Division, or cybercrime reporting channels if there is identity theft, fraud, threats, or fake accounts.

Can I file with the NPC even if I am not the borrower?

Yes, if your personal data was processed or misused. The Data Privacy Act protects data subjects, meaning individuals whose personal, sensitive personal, or privileged information is processed. NPC’s data subject rights include the right to file a complaint, rectify inaccurate data, erase or block unlawful data, and claim damages where proper. (National Privacy Commission)

What if the fake loan appears in my credit report?

File a dispute through the CIC Online Dispute Resolution System and attach proof that the account is unauthorized. CIC states that its ODRS was created for speedy resolution of disputes concerning credit reports. (Credit Information Corporation)

Should I go to the barangay?

A barangay blotter may help document harassment or threats, especially if collectors visit your home or contact neighbors. However, identity theft, cybercrime, data privacy violations, regulated lending complaints, and credit report disputes usually require action with law enforcement, NPC, SEC, BSP, or CIC. Barangay action alone is rarely enough.

What if the online lending app is not registered with the SEC?

Still preserve evidence and file a complaint. An unregistered or unrecorded app may raise additional regulatory and enforcement issues. Include the app name, screenshots, download link, payment channels, collector numbers, and company names used.

Can I claim damages?

Possibly, depending on proof. The Civil Code allows damages for wrongful acts, bad faith, abuse of rights, privacy invasion, and fault or negligence. Articles 19, 20, and 21 require people to act with justice, honesty, good faith, and to compensate others for damage caused contrary to law, morals, good customs, or public policy. Article 2176 also covers quasi-delict where fault or negligence causes damage without a pre-existing contractual relation. (Supreme Court E-Library)

How long does the process take?

Timelines vary. A lender’s internal review may take days or weeks. NPC, SEC, BSP, CIC, NBI, or police action may take longer depending on backlog, evidence, and whether the company responds. BSP states that postal complaints are evaluated and responded to within seven banking days from receipt, while online complaints through BOB generate a case reference number for tracking. (Bureau of Soils and Water Management)

Key Takeaways

Do not admit or pay a loan you never applied for without first disputing it and demanding proof.
Preserve screenshots, call logs, app records, payment instructions, and proof that you did not receive the proceeds.
Send a written denial to the lender and demand the full loan, KYC, consent, device, and disbursement records.
Report cyber identity theft to law enforcement and data misuse to the NPC.
File with the SEC for lending or financing companies and with the BSP for BSP-supervised institutions.
Check your credit report and dispute any fake loan through CIC’s dispute process.
If you are abroad, prepare a properly notarized, consularized, or apostilled affidavit and SPA if someone in the Philippines will act for you.