Quick answer

Report the account immediately and in writing to the bank, financing company, lending company, credit-card issuer, or loan app shown as the creditor. State clearly that you did not apply for, authorize, receive, use, or benefit from the account. Ask the provider to:

block the account and prevent further disbursements or transactions;
suspend collection, interest, fees, penalties, and adverse credit reporting while it investigates;
preserve all application, identity-verification, device, IP-address, telephone-number, disbursement, and transaction records;
give you the account details and documents linked to your identity;
correct its records and notify credit-information recipients if the account is confirmed fraudulent; and
give you a complaint reference number and a written final investigation result.

Do not pay, promise to pay, restructure the account, or sign an acknowledgment merely to stop collection calls. Those actions can complicate your position. A police or cybercrime report is important evidence, but it does not by itself cancel the account; you must also dispute it with the provider and, if it appears in your credit report, through the Credit Information Corporation.

If money was disbursed into one of your genuine bank or e-wallet accounts, notify that institution immediately and do not move, spend, or return the money based only on instructions from an unknown caller. Use the institution’s official fraud channel and ask for written instructions.

Act immediately

1. Secure the accounts and devices that may have been compromised

From a device you reasonably believe is safe:

change the passwords for your email, banking, e-wallet, loan-app, cloud-storage, and social-media accounts;
enable multi-factor authentication;
sign out unknown devices and review recent logins;
block or replace a compromised SIM through your telecommunications provider;
ask your bank or e-wallet provider to secure affected accounts and review suspicious transactions;
remove unfamiliar apps and revoke unnecessary access to contacts, messages, photos, storage, camera, and location; and
contact the issuing agency if a government ID was lost, stolen, altered, or exposed.

Do not delete suspicious messages, apps, emails, or account records until you have preserved usable copies. Changing credentials is important, but evidence of how the fraud occurred may also be needed.

2. Confirm the creditor through an independent channel

A collection message may name a legitimate company even when the sender is an impostor. Do not rely on a link, telephone number, QR code, or payment instruction contained in the suspicious message.

Find the provider’s contact details through its official website, mobile application, statement, branch, or regulator. Ask whether an account actually exists under your name and request at least:

the creditor’s complete corporate and business name;
account or contract number, with unnecessary digits masked where appropriate;
application date, approval date, and account-opening channel;
loan or credit limit, amount released, current balance, and transaction history;
destination bank account, e-wallet, merchant, or cash-out channel;
mobile number, email address, home address, employer, and IDs used in the application;
copies of the application, contract, disclosures, consent records, uploaded documents, photographs, selfie or liveness results, and electronic signatures;
authentication, OTP, device, IP-address, geolocation, and audit records, where available and lawfully disclosable; and
the provider’s privacy officer and consumer-assistance contact details.

The provider may redact information belonging to another person or withhold material that the law protects. Ask it to preserve the complete unredacted records for regulators, investigators, prosecutors, or a court.

Send a formal written dispute

Use a traceable channel such as the provider’s official complaint portal or email. If you file at a branch or office, bring two copies and ask that your copy be stamped received.

Your dispute should say, in substance:

I dispute this account in full. I did not apply for, authorize, sign, receive, use, or benefit from it. Please treat this as an identity-theft and unauthorized-account complaint, block further activity, suspend collection and adverse reporting while the matter is investigated, preserve all relevant records, and provide the documents and data used to open and operate the account. Please correct all internal and external records if the account cannot be shown to be mine and send me the written investigation result.

Modify that statement if any part is not true. For example, say so if you received an OTP but did not disclose it, if a relative used your identity, or if proceeds entered your account without your knowledge. Accuracy matters.

Attach copies rather than originals of supporting documents. Redact information that is not needed, but leave enough visible to identify you and the disputed account.

Under the Financial Products and Services Consumer Protection Act, Republic Act No. 11765, a financial service provider must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the provider must, pending its final investigation report, suspend interest, fees, and charges or give a similar reasonable accommodation. Whether a particular account and provider fall within that provision can depend on the product and regulator.

For institutions supervised by the Bangko Sentral ng Pilipinas, the BSP financial-consumer framework also requires assistance for fraud concerns, clear information about the action being taken, and a timely and transparent claims process.

Ask the provider to identify its published investigation timetable. Do not assume that one universal deadline applies to every institution or product.

Report the possible crime

Using another person’s identifying information without right may constitute computer-related identity theft when the statutory elements are present. The governing provision is section 4(b)(3) of the Cybercrime Prevention Act, Republic Act No. 10175. Depending on the evidence, other offenses—such as fraud, falsification, unlawful access, or violations of the Data Privacy Act—may also be investigated. The proper charge is for investigators and prosecutors to determine.

You may report the incident to:

the nearest Philippine National Police station or appropriate PNP cybercrime unit; or
the National Bureau of Investigation Cybercrime Division or an NBI regional office.

The NBI’s official procedure permits victims of computer crimes to file a complaint, undergo an interview, execute a sworn statement, and submit relevant devices and documents. Its citizen’s charter for cybercrime assistance states that this service has no fee. Current NBI offices and contacts are available through the NBI official directory.

Bring or prepare:

a chronological account of what happened;
valid identification;
the disputed account details;
complaint acknowledgments from the creditor;
collection messages and call logs;
relevant emails, text messages, screenshots, URLs, app names, and social-media profiles;
proof that the stated telephone number, email address, address, employer, signature, device, or receiving account is not yours, where applicable;
proof concerning a lost ID, compromised SIM, hacked email, or data breach;
bank or e-wallet statements showing whether you received any proceeds; and
names and contact details of possible witnesses.

Ask for the report, complaint, or reference number. Submit it to the creditor as supplemental evidence. Do not exaggerate or accuse a named person unless you have a factual basis.

Escalate to the correct financial regulator

Complain to the provider first unless urgent circumstances make that impracticable. Keep its acknowledgment and final response—or proof that it failed to respond under its own stated process.

Banks, credit-card issuers, e-wallets, and other BSP-supervised institutions

If the provider is supervised by the BSP and its internal consumer-assistance process does not resolve the matter, elevate the complaint through the BSP’s official consumer-assistance channels. The BSP’s Consumer Assistance Mechanism is generally a second-level recourse, so include:

your complaint to the institution;
its response, if any;
the complaint reference number;
the disputed account and amount;
your requested resolution; and
supporting evidence.

Use only contact information published on the BSP website, because complaint channels can change.

Lending and financing companies and online lending platforms

The Securities and Exchange Commission regulates lending and financing companies within its jurisdiction. First verify the company’s exact registered name; the app’s brand name may be different.

A complaint or regulatory report may be filed through the SEC iMessage portal. Include the company and app names, account details, your prior dispute, the company’s response, collection conduct, and evidence of unauthorized use of your identity. A complaint to the SEC does not replace a criminal report or a credit-report dispute.

If the supposed creditor cannot identify a registered company or refuses to disclose who owns the debt, report that fact. Do not send payment or additional identity documents to an unverified entity.

Other providers

Cooperatives, insurance-related products, and other specialized entities may fall under a different regulator. Ask the provider to identify its regulator and verify that answer through an official government website before filing.

Check and correct your credit record

Obtain your own credit report through the Credit Information Corporation’s official direct-to-consumer process or an authorized provider. Review it for:

the unauthorized account;
unfamiliar lenders or contracts;
incorrect addresses, telephone numbers, employers, or identification numbers;
balances or payment statuses you do not recognize; and
other accounts opened around the same time.

If the account or related data appears, use the CIC Online Dispute Resolution System. CIC requires the consumer first to obtain a credit report. The dispute may cover erroneous, misleading, incomplete, or outdated credit data.

CIC sends the dispute to the institution that submitted the information. CIC explains that it cannot simply alter submitted credit data unilaterally, so continue pursuing the creditor as well. Save the credit-report transaction reference number, dispute acknowledgment, correspondence, and corrected report.

If the creditor confirms fraud, ask it in writing to:

close or cancel the account without liability to you;
remove the balance, fees, interest, and collection status;
correct information supplied to CIC and any other credit bureau or recipient;
notify collection agencies and assignees that the account is disputed or fraudulent;
stop contacting your relatives, employer, or other third parties; and
give you written confirmation of every correction.

Exercise your data-privacy rights

The use of your personal data to create a loan or credit account may raise rights under the Data Privacy Act of 2012, Republic Act No. 10173. Subject to lawful limitations, data subjects may seek access to their personal data, dispute inaccuracies, and request rectification, blocking, or erasure where the legal requirements are met.

Write to the provider’s data protection officer and ask:

what personal data it processed;
where the data came from;
the purposes and legal bases claimed for processing;
the recipients or categories of recipients;
the dates and manner of processing;
the automated or identity-verification process used, if applicable;
correction of inaccurate information; and
restriction or blocking of disputed processing where legally available.

Erasure is not automatic. A provider may need to retain records because of legal, regulatory, evidentiary, anti-fraud, or legal-claim obligations. Even then, it should not continue treating false account information as accurate merely because records must be preserved.

If you believe a person or organization unlawfully processed, disclosed, or failed to protect your data, first raise the issue with the organization or its data protection officer and preserve the response. A formal complaint to the National Privacy Commission must follow its required format. The NPC’s current instructions require the complaint form to be completed, notarized, and submitted personally, by courier, or by scanned email. Check the NPC formal-complaint page for the current form, filing address, email, fees, and procedural requirements before filing.

Do not use the NPC’s personal-data-breach notification system as a substitute for an individual complaint; that system principally serves breach notifications by covered organizations.

Evidence to preserve

Create one folder, preferably with an encrypted backup, containing:

the first message, call, bill, credit alert, or demand that revealed the account;
full screenshots showing dates, times, sender details, URLs, and account identifiers;
original emails with headers where possible;
call logs, recordings lawfully made, and notes of conversations;
letters, envelopes, collection notices, and delivery records;
complaint forms, ticket numbers, acknowledgment emails, and regulator submissions;
credit reports before and after the dispute;
copies of the application and contract provided by the creditor;
specimen signatures and records showing your location or activity on relevant dates;
proof of SIM replacement, account takeover, lost IDs, or compromised email;
bank and e-wallet statements tracing the alleged proceeds;
an inventory of documents supplied to each recipient; and
a dated timeline of every contact and response.

Keep original files. Forwarding, editing, cropping, or repeatedly saving a file may remove metadata. Export important chats before blocking the sender, but do not continue engaging merely to gather evidence.

If collectors contact you

Tell the collector in writing that the debt is disputed because the account was opened through identity theft. Ask for:

the creditor’s legal name;
the collector’s authority to act;
the account and contract details;
the source of the collector’s information; and
the address or official channel for serving the dispute.

Do not disclose an OTP, password, PIN, card security code, selfie, full ID image, or unrelated personal information. Do not install a “verification” app or allow remote access to your phone.

Keep evidence of threats, public shaming, impersonation, disclosure to contacts, or repeated harassment. Report such conduct to the provider and its regulator and, where appropriate, to law enforcement or the NPC. The legality of particular collection conduct depends on the words used, the recipient, the frequency, the information disclosed, and the regulator’s applicable rules.

Common mistakes to avoid

Ignoring the demand because the debt is not yours. Delay can allow more charges, collection activity, or adverse reporting.
Reporting only to the police. Also dispute the account directly with the creditor and through CIC if it appears in your credit report.
Paying a small amount “for closure.” Payment may create an argument about acknowledgment or settlement.
Disputing only by telephone. Follow up in writing and retain proof of receipt.
Sending more IDs to an unverified collector. Confirm the recipient through an independent official channel.
Deleting the app or messages before preserving evidence.
Assuming the app name is the creditor’s legal name. Identify the registered company behind it.
Claiming you never received proceeds when they entered your account. Explain exactly what happened and whether the funds remain untouched.
Posting complete IDs, account numbers, or complaint records publicly. Public posts can cause a second exposure of your data.
Filing an incomplete CIC dispute. Identify each disputed contract and attach documents relevant to that entry.
Treating a regulator complaint as a court judgment. Regulatory, criminal, privacy, credit-reporting, and civil remedies have different functions.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a summons, subpoena, prosecutor’s notice, small-claims pleading, or court paper has been served;
your salary, property, deposit, or other asset is threatened with legal process;
the creditor alleges that you received or used the proceeds;
a signature, selfie, video, or OTP record appears to connect you to the application;
the fraud involves a relative, employee, business partner, or shared device or account;
multiple accounts or substantial amounts are involved;
you are being threatened, extorted, publicly shamed, or contacted at work;
a collector demands immediate payment in exchange for withdrawing a complaint;
your bank, e-wallet, SIM, or email remains under another person’s control; or
a provider or regulator has rejected the dispute despite strong contrary evidence.

Court and administrative deadlines may continue even while an internal investigation is pending. Never ignore formally served papers.

Frequently asked questions

Am I required to pay a loan I never applied for?

Not merely because an account carries your name. The provider must investigate whether a valid obligation exists and whether you authorized or benefited from it. The outcome may depend on the contract, authentication records, destination of proceeds, device and account evidence, and your conduct. Dispute the account immediately rather than relying on a verbal denial.

Should I pay first and request a refund later?

Generally, do not pay or acknowledge a completely unauthorized account without individualized legal advice. Report and dispute it. If there is an immediate legal proceeding or a complicated factual issue, consult counsel before taking a position.

What if the loan proceeds entered my real account?

Notify your bank or e-wallet provider and the lender immediately. Do not spend or independently transfer the money. Ask the institutions to preserve and trace the transaction and provide written instructions. Receipt of funds can materially affect the investigation, even if you did not request them.

What if somebody used a copy of my ID?

Report the unauthorized account, preserve evidence of where the copy may have been obtained, secure the corresponding government record where possible, and ask the provider for the application and identity-verification records. A copied ID alone does not establish that you consented to the loan.

Can I demand the application documents?

You may request access to personal data and documents connected with the account, subject to lawful restrictions and necessary redactions. Ask both the consumer-assistance unit and the data protection officer. If access is refused, request the specific legal or regulatory basis in writing.

Will a police report remove the account from my credit report?

No. It supports your position but does not automatically change credit data. Dispute the entry with the submitting creditor and through the CIC process.

Can CIC erase the account immediately?

CIC states that it cannot unilaterally change information supplied by a submitting institution. It facilitates the dispute and correction process with that institution. Supply complete evidence and continue following up with the creditor.

What if the lender is unregistered or the loan app has disappeared?

Preserve the app name, package or store link, website, telephone numbers, payment accounts, messages, and screenshots. Report the matter to law enforcement and the SEC. Do not pay an unidentified collector merely because it possesses some of your personal information.

Is there a single deadline for reporting identity theft?

There is no single reporting deadline that safely applies to every lender, regulator, criminal offense, privacy complaint, credit dispute, or court case. Report immediately. Check the current rules for each remedy, and obtain legal advice if formal proceedings or older incidents are involved.

Should I obtain an affidavit of denial?

A sworn statement may help law enforcement, regulators, or the creditor, but its form and contents should match the facts. Do not use a generic affidavit that contains assumptions or inaccurate statements. Ask the receiving office what it requires, and obtain legal assistance for a complex or high-value case.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions can depend on the provider, documents, transactions, and surrounding facts. Official sources and procedures were checked on 29 August 2026.