Quick answer

If a loan, credit card, credit line, or other credit account was opened using your identity without your knowledge or consent, notify the lender immediately in writing, demand that the account be blocked and formally investigated, secure your accounts, preserve the evidence, and report the identity theft to law enforcement. If the lender does not resolve the matter, escalate the complaint to the regulator with jurisdiction over it. If the false account appears in your credit report, file a separate dispute with the Credit Information Corporation (CIC).

You do not become legally liable for a loan merely because the fraudster used your name, ID, mobile number, or other personal data. A valid contract ordinarily requires your consent. However, the lender may initially treat its records as genuine, so prompt reporting and strong documentation are essential. Do not ignore collection messages, make a token payment, or sign a restructuring agreement merely to stop the calls; those actions may complicate your denial of the account.

Act immediately

1. Contact the lender through an official channel

Use the lender’s verified website, mobile application, customer-service number, branch, or published email address—not a link or number supplied in a suspicious message.

Tell the lender that:

you did not apply for, authorize, receive, or benefit from the loan or credit account;
your identity or personal information appears to have been used fraudulently;
you dispute the entire account and every related charge;
you request an immediate hold on disbursement, collection, interest, fees, and adverse credit reporting while the investigation is pending;
you want the account marked as disputed or allegedly fraudulent, not merely “past due”;
you request preservation of all application and transaction records; and
you want a complaint reference number and a written final investigation result.

Under Section 8(f) of the Financial Products and Services Consumer Protection Act, regulated financial service providers must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, the provider must suspend interest, fees, and charges pending its final investigation report, or provide a similar reasonable accommodation.

If funds have not yet been released, expressly demand that the lender stop disbursement. If they were released, ask the lender to identify—subject to lawful disclosure procedures—the destination bank account, e-wallet, merchant, or cash-out channel and to initiate whatever tracing or recall measures remain available.

2. Ask for the records behind the account

Request copies of, or lawful access to, the personal data and documents attributed to you, such as:

the application form and alleged loan or credit agreement;
identification documents submitted;
selfie, liveness-check, facial-verification, or video records;
electronic signatures, one-time-password records, and consent logs;
registered mobile numbers and email addresses;
application dates, timestamps, device details, and relevant access logs;
recordings of verification or confirmation calls;
declared addresses, employer, references, and emergency contacts;
approval and disbursement records;
the receiving bank or e-wallet details; and
payment, collection, and credit-reporting history.

Some information may be withheld or released only through law-enforcement or court processes because it concerns another person, cybersecurity controls, or an active investigation. Even so, request that the lender preserve the complete records and provide the personal data and documents that the law allows you to access.

The Data Privacy Act of 2012 recognizes rights concerning personal data, including rights to information, access, correction, blocking or removal in proper cases, and damages. These rights are subject to lawful exceptions and do not necessarily require the deletion of records that must be retained as evidence or under another law.

3. Secure the accounts that may have been compromised

Identity theft may involve more than one account. As soon as possible:

change the passwords of your primary email, online banking, e-wallet, cloud-storage, and social-media accounts;
use unique passwords and enable multifactor authentication;
sign out unknown devices and review recovery email addresses and mobile numbers;
contact your telecommunications provider if your SIM suddenly stopped working or you suspect an unauthorized SIM replacement;
block lost or stolen IDs, cards, phones, or access devices through their issuers;
review bank and e-wallet transaction histories;
check whether unfamiliar beneficiaries or linked devices were added;
warn your bank or e-wallet provider if it may have received or transferred fraudulent loan proceeds; and
monitor for new applications, password-reset notices, verification codes, or collection messages.

Do not delete suspicious messages or reset a compromised device before preserving relevant evidence. If possible, first take screenshots, export messages, record dates and times, and back up the original files.

Prepare a clear written dispute

Your written notice should identify the account and state the facts without speculation. Include:

your complete name and reliable contact details;
the disputed account or application number, if known;
when and how you discovered it;
a direct statement that you never applied, consented, signed, received the proceeds, or authorized another person to act for you;
whether any ID, SIM, phone, email, or online account was lost or compromised;
the specific action requested;
a request to preserve all physical and electronic evidence; and
a list of attachments.

Attach only what is reasonably necessary. Watermark copies of IDs where practical—for example, “For identity-theft dispute with [lender], 24 August 2026 only”—without obscuring information needed for verification.

Obtain proof of submission, such as an email delivery record, branch-received copy, courier tracking result, complaint ticket, or screenshot showing the date and reference number.

Evidence to preserve

Keep the original electronic files whenever possible, not only cropped screenshots. Preserve:

text messages, emails, app notifications, and collection messages;
caller numbers, call logs, voice messages, and dates and times of calls;
URLs, app names, social-media profiles, advertisements, and QR codes;
copies of the fraudulent application or account statement;
your genuine specimen signatures, if signature forgery is involved;
proof that you were elsewhere or using a different number, address, employer, or device when the application was made;
records showing where your genuine bank or e-wallet accounts were maintained;
reports concerning a lost ID, phone, SIM, or compromised account;
lender complaint numbers and all replies;
the credit report showing the false account; and
any demand letters or communications from collection agencies.

Do not impersonate the offender, illegally access an account, publish another person’s private information, or arrange a confrontation. Evidence obtained unlawfully may create additional legal problems.

Report the identity theft to law enforcement

Where the identity was used through an online application, mobile phone, email, website, or other computer system, the conduct may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act of 2012. Depending on the evidence, computer-related forgery, computer-related fraud, access-device fraud, falsification, estafa, or other offenses may also be considered. The proper charge depends on how the account was created, used, and funded.

A complaint may be brought to:

the Philippine National Police, particularly an appropriate Anti-Cybercrime Group office or cybercrime unit;
the National Bureau of Investigation cybercrime unit; or
a regular police station, which may document the report and refer it to the appropriate investigators.

The Cybercrime Prevention Act identifies the PNP and NBI as law-enforcement authorities for cybercrime cases. Bring a government-issued ID, a chronological affidavit or written narrative, copies of the disputed account records, communications, transaction details, and proof of your earlier report to the lender.

Act promptly. Electronic evidence may be overwritten or become harder to obtain. Under Section 13 of the Cybercrime Prevention Act, specified computer data are subject to statutory preservation rules, while compelled disclosure generally requires the procedures and authority provided by law. A private complainant should therefore request preservation from the lender and promptly approach investigators who can pursue formal preservation and disclosure measures.

A police blotter or incident report is useful evidence that you reported the matter, but it does not by itself cancel the loan, correct a credit report, or conclusively establish who committed the offense.

Escalate an unresolved complaint to the proper regulator

Complain to the provider first unless emergency circumstances require simultaneous reporting. Keep its acknowledgment and response because regulators commonly ask for proof that you initially used the provider’s consumer-assistance mechanism.

BSP-supervised institutions

For banks, digital banks, e-money issuers, many credit-card issuers, and other BSP-supervised financial institutions, elevate an unresolved complaint through the BSP Consumer Assistance Mechanism.

The BSP currently accepts escalations through its BSP Online Buddy and alternative channels, including a completed Complaints, Inquiries and Requests Form sent to consumeraffairs@bsp.gov.ph. Include your complaint to the institution, its response if any, supporting documents, your requested resolution, and your contact details.

SEC-regulated lending or financing companies

For a lending company, financing company, or its registered online lending platform, use the SEC complaint procedure for lending and financing companies.

The SEC instructs complainants to submit a completed complaint form, a valid government-issued ID, and supporting evidence, with one complaint form for each respondent company. Check the SEC page before filing because submission addresses and procedures may change.

A regulator’s consumer-assistance or administrative process is distinct from a criminal complaint. Reporting to the SEC does not automatically declare a contract void or erase a balance. Ask for the specific corrective action supported by the facts, while separately pursuing credit-report correction and criminal investigation when appropriate.

Other providers

If the account was issued by a cooperative, determine whether the matter falls under the Cooperative Development Authority or, for a cooperative bank or other BSP-supervised institution, the BSP. Jurisdiction depends on the provider’s legal status and the particular financial product.

Correct the false credit record

A lender’s internal correction does not always immediately correct every credit database. Obtain a current CIC credit report and check for:

accounts you never opened;
incorrect balances or payment status;
unfamiliar addresses, numbers, or employers; and
repeated reporting of the same fraudulent account.

The CIC requires a person disputing credit data to first obtain a CIC credit report through an authorized credit-report provider or its available direct-to-consumer channel. An erroneous, misleading, incomplete, or outdated entry may then be disputed through the CIC Online Dispute Resolution System.

Provide the credit report’s transaction reference number and identify the reporting institution, disputed contract, type of loan, balance, payment status, and reason for the dispute. Attach the lender complaint, identity-theft report, and other supporting documents where requested.

The CIC facilitates the dispute with the institution that submitted the data; it does not simply erase an entry on unilateral demand. Continue following up with both the lender and the CIC until you receive written confirmation of the outcome. If a private credit bureau separately displays the account, use that bureau’s dispute procedure as well.

Consider a data-privacy complaint

A false loan may result from stolen information, but that alone does not prove that the lender or another organization violated the Data Privacy Act. A privacy complaint may be appropriate if there is evidence that an organization unlawfully collected, used, disclosed, retained, or failed to secure your personal data, or improperly refused a valid request concerning your data.

First send a written request or complaint to the organization’s data protection officer when practicable. Identify the personal data involved, the suspected unauthorized processing, and the action requested.

If the matter remains unresolved, consult the National Privacy Commission’s complaint instructions. Under the NPC’s published procedure, a data subject may file a notarized complaint-assisted form or verified complaint with supporting evidence and witness affidavits. Follow the current filing and signature requirements shown on the NPC website.

A privacy complaint, lender dispute, regulatory escalation, CIC dispute, and criminal complaint address different issues. One does not necessarily replace the others.

If collectors are already contacting you

Reply once in writing to both the lender and any collection agency:

state that the account resulted from alleged identity theft and is formally disputed;
provide the lender’s complaint reference number;
request verification of the debt and the authority of the collector;
demand that the dispute be recorded and referred back to the lender;
request that collection communications be made through a specified lawful channel; and
preserve all communications.

The Financial Products and Services Consumer Protection Act prohibits abusive collection or debt-recovery practices and makes covered providers responsible for specified acts or omissions of their agents and accredited third-party service providers.

Do not insult or threaten collectors. Do not disclose more personal information than is necessary for verification. If collectors contact unrelated persons, use threats, publicly shame you, or misuse your contacts or personal data, preserve the proof and consider complaints to the lender, its regulator, and the NPC, depending on the conduct.

Why you should not automatically pay

Payment may appear to be the fastest way to stop collection calls, but it can weaken the clarity of your position and may be characterized as acknowledgment or settlement of the account. Do not pay, restructure, or execute a compromise without understanding its legal effect.

At the same time, do not simply ignore the account. A prompt written dispute is much safer than silence. If the lender produces evidence suggesting that the loan proceeds reached an account you own, that someone acted with your authority, or that you later ratified the transaction, obtain legal advice before making further statements.

Common mistakes

Reporting only to the police

A criminal report does not automatically freeze the account or correct the credit record. Notify the lender and, when necessary, the regulator and CIC separately.

Communicating only by telephone

Calls may help stop an urgent disbursement, but follow them with a written complaint. Without a record, it may be difficult to prove what you reported and when.

Paying a small amount to stop collection

A token payment can complicate a complete denial of the account. Seek advice before making any payment or settlement.

Sending unprotected IDs to unofficial contacts

Verify the lender’s channel. Avoid sending IDs through a collector’s personal social-media account or an unverified email address.

Filing a vague complaint

State exactly what you dispute, what you did not authorize, when you discovered it, and what correction you want. Attach organized evidence.

Accusing a specific person without evidence

You may report facts and identify reasonable leads, but do not publicly label someone a criminal without adequate proof. Let investigators determine responsibility.

Assuming one correction fixes everything

Confirm separately that collection has stopped, the lender’s internal records have been corrected, adverse reporting has been withdrawn or amended, and affected credit reports have been updated.

When legal help is urgent

Consult a Philippine lawyer promptly if:

a demand letter, summons, complaint, subpoena, or court document has been served;
the lender claims to have your signature, selfie, OTP, device record, or proof that proceeds reached your account;
property, salary, or another asset is being threatened with attachment or enforcement;
the false account is preventing an urgent housing, business, employment, or legitimate credit transaction;
the lender refuses to suspend charges or continues adverse reporting despite a documented dispute;
collectors are threatening, harassing, or publicly exposing you;
several accounts were opened or substantial funds are involved;
a relative, employee, or business associate may have used your information;
your genuine account may have received or moved the proceeds; or
you are being treated as a suspect rather than solely as a victim.

Do not ignore formal legal process. A complaint to a lender or regulator generally does not extend a court deadline or excuse failure to file a required answer.

Frequently asked questions

Am I liable because the loan is under my name?

Not necessarily. A person ordinarily cannot be bound by a contract that the person never consented to or authorized. But identity, consent, agency, receipt of benefits, and possible ratification are factual questions. Dispute the account promptly and require the lender to produce the basis for attributing it to you.

Should I get an affidavit of loss or denial?

A sworn affidavit can help establish a contemporaneous record, especially if an ID, SIM, phone, or account was lost or compromised. Use an affidavit of loss only if something was actually lost. If the issue is unauthorized use, an affidavit of denial or identity-theft complaint may be more accurate. An affidavit does not by itself cancel the account.

Can I demand that the lender delete all records immediately?

You may demand correction, blocking, and cessation of unauthorized processing where legally proper. However, the lender may need to retain records for investigation, regulatory compliance, fraud prevention, or litigation. A practical request is to block the account, stop collection and adverse reporting, mark it as disputed, preserve the evidence, and correct inaccurate data after investigation.

Should I report the matter even if the loan application was rejected?

Yes. An unsuccessful application may show that your identity remains compromised. Request preservation of the application records, secure affected accounts, and consider a law-enforcement report. The Cybercrime Prevention Act applies computer-related identity theft even where the absence of damage may affect the applicable penalty.

What if the loan proceeds went to an unfamiliar e-wallet?

Give the lender and investigators the available transaction reference, wallet number, date, amount, and screenshots. Do not contact or threaten the wallet holder yourself. The account holder may be the offender, a money mule, or another victim, and subscriber information may require lawful process.

What if the proceeds entered my own account?

Notify the lender and your bank or e-wallet immediately, do not spend or transfer the funds except under documented lawful instructions, and obtain legal advice. Investigators will examine how the account was accessed, who controlled the transaction, and whether you authorized or benefited from it.

Is there one government office that will cancel the account everywhere?

No. The lender investigates and corrects its account records; the financial regulator handles complaints within its jurisdiction; law enforcement investigates possible crimes; the CIC handles disputes over data in CIC credit reports; and the NPC addresses violations involving personal-data processing.

Is there a deadline?

Do not delay. Evidence and recovery opportunities can disappear quickly. Claims under the Financial Products and Services Consumer Protection Act generally prescribe five years from consummation of the financial transaction or discovery of deceit or material nondisclosure, subject to an ultimate ten-year period from the violation and other statutory qualifications. Criminal, civil, privacy, contractual, and procedural deadlines may differ.

This article provides general Philippine legal information, not legal advice for a specific case. Liability and the proper remedies depend on the application records, authentication process, movement of funds, communications, and subsequent conduct of the parties. Official sources and procedures were checked as of 24 August 2026.