Quick answer

If a loan or credit account was opened in your name without your knowledge or consent, report it immediately and in writing to the lender. State clearly that you did not apply for, authorize, receive, or benefit from the account. Ask the lender to:

mark the account as disputed for identity theft;
stop collection activity while investigating;
suspend interest, fees, and charges on the disputed amount;
preserve and disclose the application and identity-verification records;
prevent further transactions; and
correct any information already reported to the Credit Information Corporation (CIC) or another credit bureau.

Also secure your compromised accounts and IDs, make a cybercrime or police report, escalate the complaint to the lender’s regulator if necessary, and dispute any incorrect entry appearing in your CIC credit report.

A report does not automatically erase the account, and a police blotter alone may not resolve the lender’s records. You must create a documented trail showing that you promptly denied the transaction and asked the responsible organizations to investigate and correct it.

You generally do not owe a loan you never authorized

Consent is an essential requirement of a contract under Article 1318 of the Civil Code of the Philippines. Philippine Supreme Court decisions recognize that a contract based on a forged signature may be inexistent for lack of consent.

But the result still depends on the evidence. A lender may investigate whether you personally applied, authorized another person, shared access credentials or one-time passwords, later accepted or ratified the transaction, or received and used the proceeds. A court—not a regulator’s customer-service unit—may ultimately have to decide a genuine dispute over forgery, consent, or liability.

Do not sign a restructuring agreement, make a “good-faith” payment, or describe the debt as yours merely to stop collection calls without first understanding the possible legal effect. At the same time, continue paying any separate, legitimate obligations that are actually yours.

Act immediately

1. Contact the lender through an official channel

Use the lender’s official website, app, branch, hotline, or published consumer-assistance address—not a link or telephone number supplied by an unknown collector.

If collection activity revealed the account, first verify that the supposed lender exists and that the message is not another scam. Obtain the company’s complete legal name and regulator. Do not send additional IDs, selfies, passwords, PINs, or one-time passwords until you have verified the recipient.

Call promptly if the account is still active, but follow the call with a dated written complaint. Ask for a case or reference number and the name or unit handling the investigation.

2. Send a clear written dispute

Your letter or email should identify the disputed account without unnecessarily exposing the full account number. Include:

your full name and reliable contact details;
the account or application reference, if known;
when and how you discovered it;
an unequivocal statement that you did not apply for or authorize the account;
whether you received any proceeds, goods, card, or benefit;
which ID, phone number, email address, address, employer, or bank account appears to have been misused;
any known compromise, such as a lost ID, stolen phone, phishing incident, SIM takeover, hacked email, or leaked documents;
the relief you want; and
a list of attached evidence.

Request written confirmation that the account is disputed. Under the Financial Products and Services Consumer Protection Act, a financial service provider must maintain a free consumer-assistance mechanism. For an alleged disputed amount or unauthorized transaction, it must suspend the imposition of interest, fees, and charges—or provide a similar reasonable accommodation—while its final investigation is pending.

Ask the lender to preserve and, subject to lawful disclosure limits, provide or explain:

the complete application and alleged contract;
copies of the IDs, photographs, selfies, signatures, and supporting documents submitted;
electronic-signature records and audit trails;
identity and “know your customer” verification results;
application dates, timestamps, IP addresses, device identifiers, and registered contact details;
recordings or transcripts of verification calls;
the destination bank, e-wallet, merchant, or other disbursement account;
proof that the proceeds were released and received;
changes made to the account after opening;
collection notes and disclosures to third parties; and
the entities to which the account was reported.

Ask that relevant logs and recordings be preserved even if the lender cannot immediately release them to you. These records may later be needed by investigators, regulators, or a court.

3. Secure the source of the identity compromise

Change passwords for your email, mobile banking, e-wallets, social-media accounts, cloud storage, and government-service accounts. Use unique passwords and enable multi-factor authentication where available.

Also consider these measures, depending on what happened:

Notify your mobile provider if your SIM stopped working unexpectedly or may have been duplicated.
Block lost or stolen bank cards and IDs through the issuing organization.
Tell your bank or e-wallet provider if loan proceeds or suspicious transfers passed through an account connected to you.
Check email forwarding rules, recovery addresses, logged-in devices, and recent security activity.
Remove unknown apps and revoke suspicious app permissions.
Have a compromised device examined before deleting data that may be evidence.
Warn close contacts if fraudsters are impersonating you or approaching them as references.

Do not post full IDs, account statements, police reports, or specimen signatures publicly.

Report the suspected identity theft

Opening an online loan or credit account using another person’s identifying information may amount to computer-related identity theft, computer-related forgery, computer-related fraud, or another offense, depending on the evidence. Section 4 of the Cybercrime Prevention Act of 2012 defines computer-related identity theft as the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another.

Reports involving cybercrime may be made to the Philippine National Police’s cybercrime unit or the National Bureau of Investigation’s cybercrime investigators. The Department of Justice Office of Cybercrime also publishes official cybercrime-reporting information.

Bring or preserve:

the lender’s messages and your written dispute;
the account or application reference;
screenshots showing complete dates, times, sender details, and URLs;
original emails with headers, if available;
call logs, voicemail, and recordings lawfully in your possession;
transaction histories and proof showing where the proceeds went;
copies of the falsified or misused documents;
proof of a lost ID, stolen device, SIM problem, or account takeover;
the lender’s response and investigation result;
a chronological affidavit or narrative; and
identification needed to establish that you are the person being impersonated.

Keep original electronic files. Avoid cropping screenshots so tightly that the sender, date, time, or surrounding context disappears. Export records before an app or device is reset.

A law-enforcement report supports your denial, but investigators and prosecutors determine what offense, if any, the evidence establishes. Filing a report does not itself correct a credit record or decide civil liability.

Escalate to the correct financial regulator

First complain directly to the financial service provider unless urgent circumstances make that impossible. Preserve proof of delivery and the provider’s response.

Banks and other BSP-supervised institutions

If the account was opened by a bank or another institution supervised by the Bangko Sentral ng Pilipinas, and the provider does not resolve the complaint, escalate it through the BSP Consumer Assistance Mechanism.

The BSP directs consumers to its Online Buddy, or BOB. Its official page also lists alternatives, including the prescribed complaint form and consumeraffairs@bsp.gov.ph. Attach your complaint to the institution, its response if any, the case number, supporting records, and the specific resolution requested.

The BSP’s process addresses the conduct of institutions under its supervision. A regulator’s assistance or administrative action is not necessarily a substitute for a criminal complaint or a court case.

Lending and financing companies

For a lending or financing company regulated by the Securities and Exchange Commission, follow the SEC’s official complaint procedure for lending and financing companies.

The SEC requires its complaint form, a valid government-issued ID, supporting evidence, and one complaint form for each respondent company. The SEC may investigate regulatory violations or refer matters to another agency. Its own guidance makes clear that this administrative complaint process cannot itself declare a loan contract void or cancel an obligation.

The SEC’s iMessage portal may also be used to report an issue or open a ticket.

Cooperatives and government lenders

A cooperative’s lending activity may fall under the Cooperative Development Authority, except for a cooperative bank supervised by the BSP. If the account supposedly came from a government institution such as the SSS, Pag-IBIG Fund, or GSIS, use that agency’s official fraud or member-assistance channel first.

Where the lender’s identity or regulator is uncertain, check the regulator named in the provider’s official disclosures and verify the entity through the regulator’s official records.

Check and dispute your CIC credit report

The lender’s internal records and your CIC credit report are separate. Even after the lender accepts your fraud claim, confirm that incorrect reporting has been removed or corrected.

Obtain your own report through the CIC’s official Direct-to-Consumer program. If it contains an account that is erroneous, misleading, incomplete, or outdated, use the CIC Online Dispute Resolution System.

The CIC states that you must first obtain a CIC credit report and use its 14-digit Transaction Reference Number to file an online dispute. Under the Credit Information System Act, a borrower has the right to dispute erroneous, incomplete, outdated, or misleading credit information.

A CIC dispute concerns information in the credit-information system. It does not replace your complaint to the lender, determine criminal responsibility, or conclusively decide whether a contract is valid.

After the correction, obtain another report when practicable and verify the result. Keep both the original report and the corrected version.

Consider a data-privacy complaint

The unauthorized collection or use of your ID, contact details, financial information, photograph, signature, or other personal data may involve the Data Privacy Act of 2012.

The Act gives a data subject rights that include access to personal information, correction of inaccurate information, and—when the statutory conditions are met—blocking, removal, or destruction of false, unlawfully obtained, or unauthorized data. These rights are subject to lawful exceptions, including records that must be retained for legal claims, regulatory duties, or investigations.

Before filing with the National Privacy Commission, ordinarily notify the respondent in writing and give it an opportunity to address the violation. Under the NPC’s current complaint mechanics, proof must show that the respondent failed to take timely or appropriate action or did not respond within 15 calendar days after receiving your written notice.

An NPC complaint generally requires a notarized complaint-assisted form or verified complaint, supporting evidence, and relevant witness affidavits. The NPC’s formal filing instructions identify the permitted submission methods and current requirements.

Do not confuse this 15-day exhaustion rule with an instruction to wait before stopping an active fraud. Report the account to the lender and secure your systems immediately. The 15-day period concerns escalation of the privacy complaint to the NPC.

What to ask the lender to do

Your requested resolution should be specific. Ask the lender to:

confirm that the account is under a formal identity-theft investigation;
block new drawdowns, purchases, transfers, or changes;
suspend collection and adverse reporting while the dispute is investigated;
suspend interest, fees, and charges as required or provide an equivalent accommodation;
communicate the dispute to its collection agency and other service providers;
stop contacting relatives, employers, or unrelated third parties about the disputed debt;
preserve all application, verification, disbursement, access, and collection records;
provide a reasoned written investigation result;
close or correct the account if the claim is substantiated;
correct information supplied to the CIC and other recipients; and
provide written confirmation of every correction.

If the lender rejects the complaint, request the evidence and reasoning it relied upon. Address each disputed point in writing rather than repeatedly starting new complaints through different agents.

Common mistakes to avoid

Reporting only by telephone and keeping no proof.
Paying a disputed account merely to stop calls without getting legal advice.
Clicking a collector’s link or sending more identity documents to an unverified address.
Deleting the fraudulent messages, compromised account, or device before preserving evidence.
Assuming a police blotter automatically cancels the account.
Disputing only with the CIC and not with the lender that supplied the information.
Complaining only to the regulator without first using the provider’s assistance mechanism where required.
Giving investigators or lenders edited screenshots while discarding the originals.
Ignoring court papers because the debt is fraudulent.
Making unsupported public accusations that could complicate the dispute.
Using one vague complaint for several unrelated lenders instead of documenting each account separately.

When legal help is urgent

Consult a Philippine lawyer promptly if:

you receive a summons, complaint, subpoena, demand involving collateral, or notice of foreclosure;
a lender or collector threatens immediate legal action;
the lender insists that its biometric, OTP, signature, or device evidence identifies you;
funds passed through an account you own or control;
a relative, employee, agent, or business associate may have applied using your details;
you previously gave someone authority to transact for you;
you signed any acknowledgment, compromise, restructuring, or payment agreement;
property was mortgaged or pledged;
several accounts have been opened using your identity;
the lender refuses to preserve evidence or continues adverse reporting after accepting the fraud finding; or
the incident has caused substantial financial, employment, immigration, or reputational harm.

A summons has a court-imposed response period. Do not rely on an unresolved lender, regulator, or police complaint as a reason to ignore it.

FAQ

Should I pay the unauthorized loan while it is being investigated?

Do not assume that payment is required merely because the account bears your name. However, payment, nonpayment, and acknowledgment can have legal consequences. Dispute the account immediately, request the statutory accommodation for the disputed amount, and obtain legal advice if the lender demands payment or litigation has begun.

Is an affidavit of denial enough?

It is useful evidence but not conclusive by itself. Combine it with proof of your whereabouts, specimen signatures, device and account records, disbursement information, security alerts, and your prompt written reports.

Can the lender continue adding interest and fees?

For an alleged disputed amount or unauthorized transaction covered by the Financial Products and Services Consumer Protection Act, the provider must suspend interest, fees, and charges pending its final investigation report or provide a similar reasonable accommodation. Raise this expressly in your complaint.

Can I demand deletion of all information about the account?

You may request correction, blocking, or deletion when legally justified, but immediate wholesale deletion is not always appropriate. The lender may need to preserve evidence and retain records required by law or necessary for an investigation or legal claim. Ask that the information be restricted, marked as disputed, protected from misuse, and corrected wherever it was disclosed.

What if the account does not appear on my CIC report?

Continue the lender, security, law-enforcement, and regulatory steps. Not every discovery means the account is already visible in the report, and absence from a current report does not prove that the application never occurred.

What if the lender is fake or unlicensed?

Do not send money or more personal information. Preserve the solicitation, app details, website, numbers, payment instructions, and messages. Report the suspected fraud to cybercrime authorities and the appropriate regulator. If an app or website is impersonating a real institution, notify the real institution through its official channel as well.

Can a regulator cancel the loan for me?

Not necessarily. Regulators can assist consumers, investigate supervised entities, require compliance, and impose appropriate administrative measures. A contested declaration that a contract is void or that no civil liability exists may require agreement by the lender or a judicial determination.

Should I replace every ID that may have been copied?

Ask each issuing agency whether replacement, blocking, annotation, or another protective measure is available and appropriate. A photocopied ID cannot always be made unusable, so monitoring and documented notice to affected institutions remain important.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. The correct remedy depends on the lender, documents, manner of identity misuse, movement of funds, and procedural stage. Official sources and procedures were checked as of 30 August 2026.