Quick answer

If a loan, credit card, buy-now-pay-later facility, or other credit account was opened using your identity without your knowledge or consent, report it immediately and in writing to the lender’s fraud or consumer-assistance unit. State clearly that you did not apply for, authorize, receive, use, or benefit from the account. Ask the lender to:

freeze the account and stop further releases, purchases, interest, fees, collection activity, and credit reporting;
mark the account as disputed due to identity theft;
preserve the application, identity-verification records, device and login data, call recordings, disbursement details, and related evidence;
provide copies of the documents and personal data used to open the account; and
investigate, correct its records, notify any credit-reporting recipient, and confirm the result in writing.

Also report the apparent fraud to law enforcement, check your Credit Information Corporation (CIC) credit report, and dispute any inaccurate entry. Escalate an unresolved complaint to the regulator that supervises the lender—usually the Bangko Sentral ng Pilipinas (BSP) for a BSP-supervised financial institution or the Securities and Exchange Commission (SEC) for a lending or financing company.

Do not acknowledge the debt, agree to a payment plan, or make a “good-faith” payment merely to stop collection calls. A contract requires the parties’ consent under Article 1318 of the Civil Code. If you truly never consented, the account should not become your debt simply because someone used your name or identification. The lender may, however, investigate whether you authorized another person, supplied credentials, received the proceeds, or later adopted the transaction. The documents and transaction trail therefore matter.

Act immediately

Speed can prevent another loan drawdown, a cash advance, purchases, damage to your credit record, or the disappearance of electronic evidence.

1. Secure your accounts and identity

Using a trusted device:

Change the passwords of the email account, mobile-banking account, e-wallet, and other services connected to the compromised identity.
Use unique passwords and enable multi-factor authentication.
Ask your mobile network to secure your number if you suspect a lost SIM, SIM replacement, or account takeover.
Lock or replace affected cards and government IDs through the issuing agency’s official process.
Review bank, e-wallet, and email activity for unfamiliar logins, password-reset notices, transfers, or one-time-password messages.
Contact any account that received the loan proceeds if it belongs to you, and ask that further movement be blocked. Do not move or spend unfamiliar funds.
Warn close contacts if the offender is impersonating you, but do not publish sensitive documents or unverified accusations online.

Do not communicate through a link or telephone number supplied by a suspicious collector, text message, or loan app. Find the institution’s official website or use the number printed on a genuine card or statement.

2. Notify the lender in writing

A telephone call is useful for an urgent freeze, but follow it with an email, secure-message submission, branch letter, or official complaint form that produces a reference number.

Include:

your full name and reliable contact details;
the account or application number, if known;
when and how you discovered the account;
an unequivocal statement that you did not apply for or authorize it;
which details appear false, such as the signature, selfie, address, employer, telephone number, email address, device, or receiving account;
whether an ID, SIM, email account, or device was previously lost or compromised;
the relief you want; and
a list of attached evidence.

A useful formulation is:

I dispute this account in full as an unauthorized account created through identity misuse. I did not apply for, consent to, receive, use, or benefit from this credit. Please freeze the account, stop collection and adverse credit reporting, preserve all relevant evidence, provide the records used to open and operate it, investigate the fraud, and confirm your findings and corrections in writing.

Do not sign a document describing you as the “borrower,” request a restructuring, or use wording such as “my loan” without making the dispute clear.

3. Request the underlying records

Ask the lender or its data protection officer for reasonable access to personal data processed about you. Relevant records may include:

the complete application and purported contract;
copies of IDs, signatures, photographs, selfies, or video-verification material;
telephone numbers, email addresses, residential and employment details;
identity-verification and know-your-customer results;
timestamps, IP addresses, device identifiers, login history, and audit logs;
recordings or transcripts of calls and video interviews;
the account into which loan proceeds were released;
transaction and repayment history;
delivery records for a physical card;
collection notes and communications; and
the names or classes of recipients to whom the account was reported.

The Data Privacy Act of 2012 gives data subjects rights that include access and correction. Its implementing rules also address rectification and the erasure or blocking of unlawfully obtained or inaccurate data.

Ask the institution to restrict harmful use of the disputed data while preserving an evidentiary copy. Immediate destruction may make the offender harder to identify. Some records may also have to be retained for legal, regulatory, anti-money-laundering, or claims-related purposes.

4. Report the apparent crime

File a report promptly with the Philippine National Police, including the PNP Anti-Cybercrime Group when electronic systems were used, or the National Bureau of Investigation. The CIC’s official consumer-concerns guidance lists reporting options for credit-related fraud.

Bring or submit copies—not your only originals—of:

a valid ID;
the lender’s messages and account information;
your written dispute and proof that the lender received it;
screenshots showing the sender, number, URL, date, and time;
collection messages and call logs;
your credit report;
proof of where you actually lived or worked when the application was made;
specimen signatures, if the signature is disputed;
proof of a lost ID, SIM, email compromise, or device theft;
bank or e-wallet statements relevant to the claimed disbursement; and
a chronological account of what happened.

Ask for the complaint, blotter, or case reference number and the investigating office’s contact details. A police report supports your dispute, but it does not by itself compel a lender or the CIC to delete an entry. Continue the lender and credit-report correction processes.

Depending on the proved conduct, relevant laws may include the Access Devices Regulation Act, as amended by Republic Act No. 11449, and the Cybercrime Prevention Act. The latter expressly covers computer-related identity theft—the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another person’s identifying information without right. The exact charge depends on the evidence and is for investigators and prosecutors to determine.

Check and correct your credit record

Obtain your CIC credit report through the CIC’s official instructions. Review more than the balance. Check the lender’s name, account status, dates, addresses, contact information, payment history, and other unfamiliar credit facilities.

If the unauthorized account appears, use the CIC’s Online Dispute Resolution System. The CIC describes the dispute process as free, but it cannot simply change a lender’s submission on its own; the submitting entity must participate and submit the appropriate correction.

Upload the strongest available evidence, such as:

the lender dispute and acknowledgment;
a police or cybercrime report;
proof that the application’s telephone number, email, address, signature, device, or disbursement account was not yours;
the lender’s fraud-investigation result; and
an affidavit explaining the identity misuse, if appropriate.

Under the Credit Information System Act, a borrower has the right to dispute erroneous, incomplete, outdated, or misleading credit information. Save the CIC dispute number and every response. After a correction, obtain a fresh report and verify that the account and any related negative history were properly updated.

A CIC dispute addresses the credit record. It does not replace the complaint to the lender, regulator, privacy authority, or law-enforcement agency.

Escalate to the correct financial regulator

For a bank, credit-card issuer, e-money issuer, or other BSP-supervised institution

Use the institution’s own Financial Consumer Protection Assistance Mechanism first. If its response is absent or unsatisfactory, escalate through the BSP’s Consumer Assistance Mechanism, including the BSP Online Buddy or the official complaint form and channels shown on that page.

Attach:

your complaint to the institution;
proof of submission;
its final response, if any;
the account details and collection notices;
supporting identity-theft evidence; and
the specific remedy requested.

The Financial Products and Services Consumer Protection Act requires financial regulators and covered providers to maintain consumer-redress mechanisms. Regulatory assistance is separate from a criminal investigation and may not resolve factual disputes that require testimony, forensic examination, or court action.

For a lending or financing company supervised by the SEC

Use the SEC’s official complaint process for lending and financing companies. The SEC requires its complaint form, supporting evidence, and a valid government-issued ID, with one form for each respondent company.

The SEC may evaluate regulatory violations or refer matters to another agency. Its own guidance cautions that the SEC does not, through this complaint process, declare a loan contract void or cancel an obligation. If the central dispute is whether any contract existed because your identity was used without consent, a court may ultimately have to decide the issue if the lender refuses to correct it.

If you are unsure who supervises the lender

Check the lender’s exact corporate and trade names, website, registration details, and the name shown in the credit report. Do not assume that a loan app is itself the licensed lender; the app may be a platform used by a separate company.

Submit first to the regulator most plausibly responsible and ask for referral if jurisdiction lies elsewhere. The CIC’s consumer-concerns page also identifies regulator routes for different financial institutions.

Consider a National Privacy Commission complaint

Identity misuse commonly involves inaccurate, unlawfully obtained, excessive, or inadequately secured personal data. First write to the lender or other organization that processed the data, preferably addressing its data protection officer. Exercise the relevant rights to access, correction, objection, or blocking, and request an investigation.

If the organization does not take timely and appropriate action, consider a complaint to the National Privacy Commission. NPC procedure generally expects the complainant to have notified the personal information controller in writing and allowed it an opportunity to respond; NPC decisions applying its rules have referred to a lack of response within 15 days as satisfying this preliminary requirement.

A privacy complaint is not automatically established merely because a criminal used your information. The questions may include how the organization obtained the data, whether it had a lawful basis to process it, whether its verification and security measures were reasonable, and how it responded after receiving notice. Preserve the organization’s privacy notice, consent screen, access-permission requests, and response to your data-subject request.

What the law does—and does not—mean for you

Lack of consent is central

Article 1318 of the Civil Code provides that there is no contract unless consent, a certain object, and cause concur. The Supreme Court has likewise explained that consent is essential and that its absence can render a purported transaction inexistent. That principle strongly supports a person who genuinely never authorized the loan.

Nevertheless, identity-fraud disputes are evidence-sensitive. A typed name, electronic signature, selfie, one-time password, or copy of an ID may have been fabricated, stolen, or supplied by someone else. Conversely, the lender may claim that the named person controlled the device, received the proceeds, authorized a relative, or later ratified the transaction. Do not assume that one document settles the case.

A newly opened fraudulent account is different from misuse of your genuine card

The Philippine Credit Card Industry Regulation Law contains a rule concerning transactions made before a lost or stolen credit card is reported to the issuer. That situation is not necessarily the same as an entirely new card or credit account opened without your consent. Make this distinction explicit in every complaint.

Reporting does not guarantee immediate deletion

A lender may legitimately preserve records while investigating, complying with retention duties, or defending legal claims. The practical objective is to stop use and collection, flag the information as disputed, prevent further harm, and obtain an accurate final correction—not to erase evidence prematurely.

Evidence to preserve

Create one secure case folder and keep:

the first notice that alerted you;
complete screenshots rather than cropped excerpts;
original emails with headers where possible;
text-message sender information, URLs, dates, and times;
call logs and contemporaneous notes of conversations;
complaint reference numbers and delivery receipts;
account statements and credit reports;
the application and contract supplied by the lender;
the lender’s privacy notice and identity-verification process;
proof of your actual address, employment, telephone number, and email at the relevant time;
ID-loss reports, SIM-replacement records, and password-reset alerts;
bank or e-wallet statements showing whether you received the proceeds;
collection letters and threats; and
every written response from the lender, CIC, regulator, NPC, police, or NBI.

Keep the original files and work from copies. Avoid editing screenshots. Record a chronology while events are fresh, including the name and position of each person contacted.

Common mistakes to avoid

Paying a disputed account simply to stop calls.
Entering a restructuring or settlement agreement before obtaining advice.
Describing the account as yours without expressly disputing authorization.
Reporting only by telephone and keeping no proof.
Sending full ID images to unverified addresses or social-media accounts.
Clicking a “verification” or “cancellation” link sent by the suspected offender.
Deleting messages, wiping the device, or closing the compromised email before preserving evidence.
Requesting immediate destruction of all records needed to investigate the fraud.
Filing only with the CIC and assuming that this reports the crime.
Filing only a police report and assuming that the credit entry will automatically disappear.
Accusing a particular person publicly without sufficient evidence.
Ignoring court papers or a formal demand because the account is fraudulent.

When legal help is urgent

Consult a Philippine lawyer promptly if:

you receive a summons, complaint, subpoena, or court order;
the lender has filed or threatened a collection case;
wages, deposits, property, or collateral are at risk;
the unauthorized transaction involves a mortgage, vehicle, guaranty, or substantial amount;
the lender refuses to provide records or continues adverse reporting after receiving strong evidence;
loan proceeds entered an account you own or control;
a relative, employee, or business associate may have used your identity with partial permission;
you previously shared an OTP, signed a blank form, lent an ID, or allowed another person to use your account;
collectors threaten, shame, impersonate authorities, or contact unrelated people;
several accounts or institutions are involved; or
investigators ask you to sign an affidavit or execute a settlement whose effect you do not understand.

If there is an immediate threat to safety, extortion, or ongoing loss of funds, contact law enforcement and the affected financial institution at once.

FAQ

Am I required to pay an account I never opened?

Not merely because it bears your name. A valid contract requires consent. Whether you are legally liable can still depend on evidence concerning authorization, receipt or use of proceeds, credential sharing, agency, or later ratification. Dispute the account promptly and do not concede liability casually.

Should I pay a small amount while the investigation is pending?

Usually not without legal advice. A payment or payment arrangement may complicate your position by being portrayed as acknowledgment or adoption of the account. Ask instead for a written freeze on collection, charges, and reporting.

Will an affidavit of denial solve the problem?

It is useful evidence, particularly when detailed and consistent with objective records, but it is not automatically conclusive. Application records, disbursement trails, device data, signatures, communications, and verification materials may be more important.

Can the CIC delete the account immediately?

The CIC facilitates disputes but states that it cannot unilaterally alter data submitted by a lender. File through the CIC dispute system, remain responsive, and provide documents that allow the submitting institution to verify and correct the entry.

Should I file with the BSP or SEC?

Use the BSP for complaints involving BSP-supervised institutions. Use the SEC process for lending and financing companies under SEC supervision. Confirm the legal entity behind an app because its brand name may differ from the licensed lender’s name.

Can I complain to the NPC even if the offender—not the lender—stole my identity?

Potentially, but a privacy violation by the lender is not automatic. First ask the lender’s data protection officer to explain, investigate, correct, or block the processing. An NPC complaint may be appropriate if the organization’s collection, verification, security, disclosure, or response appears inconsistent with the Data Privacy Act.

What if collectors keep calling?

Tell them in writing that the account is disputed as identity theft, give the lender’s complaint reference number, and demand that further communications comply with applicable consumer-protection and collection rules. Preserve every message. Escalate misconduct to the institution and its regulator; report threats or impersonation to law enforcement.

What if the lender says an OTP proves I applied?

An OTP is evidence, but it does not answer every question. Ask which number received it, who controlled that number, what device and IP address were used, what verification preceded the OTP, and where the proceeds went. Report a suspected SIM swap, compromised email, malware infection, or social-engineering incident and preserve supporting records.

Should I close my legitimate accounts?

Not automatically. Closing an account can disrupt access to statements and evidence. First secure it, replace credentials, block unauthorized transactions, download relevant records, and follow the institution’s fraud team’s instructions.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The correct remedy depends on the account documents, transaction trail, institution, and surrounding facts. Official sources and procedures were checked as of August 27, 2026.