Quick answer

Report the account immediately to the lender or credit issuer through its official fraud or consumer-assistance channel. State clearly, in writing, that you did not apply for, authorize, receive, use, or benefit from the loan or credit account. Ask the provider to:

mark the account as disputed for identity fraud;
stop disbursement, activation, collection, endorsement to collectors, and adverse credit reporting while it investigates;
suspend interest, fees, and charges or provide a comparable accommodation;
preserve the application, identity-verification records, uploaded IDs, signatures, selfies or videos, device and IP logs, OTP records, call recordings, delivery records, and disbursement trail;
give you a complaint reference number and written investigation result; and
correct its records and notify any credit bureau or third party that received inaccurate information if the account is confirmed as unauthorized.

A police or NBI report is important evidence, but it does not by itself erase the account. You should separately dispute the account with the provider, check your Credit Information Corporation report, and escalate unresolved issues to the correct regulator.

Do not ignore collection letters, subpoenas, or court papers. Do not sign a restructuring agreement, settlement, promissory note, or acknowledgment of debt simply to stop collection calls before obtaining legal advice.

What the law generally provides

An account opened through stolen personal information, forged documents, false representations, or unauthorized digital access may involve several laws. The exact offense and liability depend on how the account was opened and used.

Under the Data Privacy Act of 2012, you may demand reasonable access to personal information processed about you, dispute inaccurate information, and seek correction. With substantial proof, you may also seek the blocking, removal, or destruction of information that is false, unlawfully obtained, or used for unauthorized purposes. When information is corrected, you may reasonably request that prior recipients be informed of the inaccuracy and correction.

The Financial Products and Services Consumer Protection Act requires covered financial service providers to maintain a free consumer-assistance mechanism. While a disputed amount or unauthorized transaction is under investigation, the provider must suspend interest, fees, and charges or provide a similar reasonable accommodation. The Act also prohibits abusive collection practices and protects the consumer’s right to have inaccurate or deficient data corrected.

For credit cards, the applicant’s intention and consent must be clear and explicit, and issuers must conduct know-your-client procedures and exercise proper diligence. In a case involving improperly issued credit cards, the Supreme Court held the issuer responsible for the consequences of its failure to exercise the required diligence; however, liability in another case will still depend on its own evidence and circumstances. See Bank of the Philippine Islands v. Spouses Yu, G.R. No. 239092.

Using another person’s identifying information through a computer system without right may constitute computer-related identity theft under the Cybercrime Prevention Act. Applying for or using an access device through falsified documents, false information, a fictitious identity, or misrepresentation may also fall under the Access Devices Regulation Act, as amended by Republic Act No. 11449. Law-enforcement officers and prosecutors—not the lender or the victim—determine what criminal charges the evidence supports.

Act immediately

There is no single reporting deadline that applies to every unauthorized loan or credit account. Delay can nevertheless allow further disbursements, collection activity, or adverse credit reporting and may make electronic evidence harder to obtain.

1. Secure the accounts that may have been compromised

Using a device you reasonably believe is safe:

change the passwords of your primary email, banking, e-wallet, shopping, and social-media accounts;
use unique passwords and enable multi-factor authentication;
review logged-in devices, recovery addresses, forwarding rules, and recent security activity;
contact your mobile network if your SIM stopped working unexpectedly or you suspect a SIM replacement;
lock or report lost government IDs to the issuing agency where an official procedure is available;
remove suspicious apps and review app permissions, particularly access to SMS, contacts, camera, storage, and accessibility services; and
notify your banks and e-wallet providers if their accounts may have been used to receive or move the loan proceeds.

Do not use a link, number, or email address supplied only by a collector or unsolicited message. Find the provider’s contact details through its official website, app, card, branch, or published regulatory record.

2. Send the provider a written identity-fraud dispute

A phone call may be useful for an urgent freeze, but follow it with an email, secure message, branch-received letter, or other channel that creates a record.

Your notice should include:

your full name and safe contact details;
the account number, application number, or reference number, if known;
when and how you discovered the account;
an unequivocal statement that you did not apply for or authorize it;
whether you received any proceeds, card, goods, OTP, or confirmation;
known circumstances of any lost ID, hacked account, phishing incident, or SIM problem;
the specific actions you want the provider to take; and
copies of relevant evidence.

Ask the provider to disclose, subject to lawful limitations:

the application and contract;
the source of the personal information used;
the IDs and other documents submitted;
the signature, selfie, video, voice recording, or biometric verification relied upon;
the mobile number and email registered;
application date, time, channel, device information, and IP logs;
OTP, authentication, and consent records;
the address or person to whom a card, cash, or goods were delivered; and
the bank, e-wallet, merchant, or other destination to which the proceeds were released.

Request preservation even if the provider says it cannot immediately disclose some records because they contain third-party information or form part of an active investigation.

For copies of IDs you submit, consider adding a visible watermark such as “For identity-fraud dispute with [provider], [date] only,” without covering information the provider legitimately needs to verify.

3. Ask for specific interim protection

Do not settle for a vague notation that you “called customer service.” Ask for written confirmation that:

the account is under a formal identity-fraud dispute;
further drawdowns, card use, or disbursement have been blocked where possible;
collections and referral to external collectors have been paused;
interest, fees, and charges have been suspended or comparable accommodation has been provided;
adverse reporting will be withheld or the account will be identified as disputed, subject to applicable reporting rules; and
all relevant records have been preserved.

These measures are interim protections, not a final finding that the account is fraudulent.

4. Report the suspected crime

Report promptly to the NBI Cybercrime Division, the PNP Anti-Cybercrime Group or an appropriate local police unit. Bring a concise chronology and both printed and electronic copies of your evidence.

The NBI provides an online complaint page and information on investigative assistance for victims of computer crimes. Its published divisional directory lists the Cybercrime Division at ccd@nbi.gov.ph, but confirm current details on the NBI website before relying on an email address.

A useful report identifies:

the provider and disputed account;
the amount and date, if known;
the data, ID, email, SIM, or device believed to have been compromised;
the suspected person, account, phone number, IP information, or destination of proceeds, if genuinely known;
all complaint reference numbers; and
the evidence available and records that may need urgent preservation.

State only facts you can truthfully attest to. Do not name a suspected person as the perpetrator based solely on guesswork or a family dispute.

5. Check and dispute your CIC credit report

An unauthorized account may affect your credit history if the lender has submitted it to the Credit Information Corporation. Obtain your own CIC credit report through an authorized channel and review every entry, including variations in your name, address, and identifiers.

If the account appears, use the CIC Online Dispute Resolution System. CIC requires the Transaction Reference Number from a recently obtained credit report. Under its published dispute guidelines, a report used to start a dispute must have been obtained within the preceding 30 calendar days; otherwise, obtain a new report.

CIC does not unilaterally rewrite a lender’s submission. It facilitates and monitors the dispute between you and the submitting entity. Its published classifications provide target resolution periods of:

three working days for a simple dispute;
seven working days for a complex dispute; and
20 working days for a highly technical dispute.

Respond to communications promptly. The published guidelines allow five working days to respond to requests during the process, and non-response may be treated as disinterest in pursuing the dispute.

A CIC dispute addresses the credit-report entry. It does not replace your direct fraud complaint to the lender, regulatory complaint, or criminal report.

Where to escalate an unresolved complaint

For a bank or other BSP-supervised institution

First use the institution’s Financial Consumer Protection Assistance Mechanism. This first-level complaint is required before escalation to the BSP.

If the institution fails to act within a reasonable period or you are dissatisfied with its answer, file through the BSP Consumer Assistance Mechanism, including your provider complaint reference, correspondence, disputed account details, and supporting documents. Available channels include the BSP Online Buddy chatbot, the prescribed complaint form sent to consumeraffairs@bsp.gov.ph, and BSP offices.

Under BSP Circular No. 1169, a complaint must show that you first used the institution’s assistance mechanism. Once BSP directs the institution to answer, the institution generally has 15 days to send its answer to you and BSP. You may reply within 30 days after receiving that answer. Watch all BSP communications because failure to respond within prescribed periods can terminate the assistance process.

BSP adjudication is limited to purely civil financial-consumer claims seeking payment or reimbursement of no more than ₱10 million, excluding legal interest, attorney’s fees, and suit costs. Claims outside BSP jurisdiction, criminal complaints, and cases requiring prior resolution by a court or another agency follow different routes.

For a lending or financing company regulated by the SEC

Complain first to the company and retain proof. If it does not resolve the identity-fraud dispute, use the SEC’s official iMessage ticketing system and select “Complaints on Financing and Lending Companies” or the service that most closely matches the provider and issue.

The SEC route is normally appropriate for lending and financing companies that are not BSP-supervised. The brand shown in an app may differ from the corporation holding the SEC Certificate of Authority, so identify both the app or trade name and the legal company name if available.

If the supposed lender cannot be identified, has no verifiable office, or may be unlicensed, include that fact in your SEC and law-enforcement reports. Do not send additional IDs or money merely because an unknown collector demands them.

For misuse or mishandling of personal data

Write first to the provider or its data protection officer and describe the privacy violation. Ask for access, correction, blocking where legally justified, disclosure of the source and recipients of the data, and notification to recipients of any correction.

Under the current NPC Rules of Procedure, a formal NPC complaint ordinarily requires proof that:

you informed the personal information controller, processor, or concerned entity in writing; and
it failed to take timely and appropriate action or did not respond within 15 calendar days after receiving your written notice.

The NPC may waive exhaustion for good cause or in serious cases described by its rules. A formal complaint must meet verification, evidentiary, certification-against-forum-shopping, and filing-fee requirements. Use the NPC’s formal complaint instructions and current form rather than sending only an informal narrative.

If an online lending app accessed contacts or used personal data for collection, the NPC’s loan-related data guidelines may also be relevant.

Evidence to preserve

Keep the original electronic files where possible, not just cropped screenshots. Preserve:

the first notice, bill, demand letter, credit-report entry, or collector message;
complete email headers and message threads;
SMS, chat, app notifications, call logs, and voicemails;
screenshots showing the sender, date, time, URL, and account reference;
envelopes, courier labels, cards, contracts, or goods received;
the provider’s complaint acknowledgment and every ticket number;
your CIC report and dispute correspondence;
your police or NBI report and supporting affidavit;
notices about changed passwords, new devices, OTPs, SIM replacements, or email recovery;
evidence of where you were or what contact details you used when the application was supposedly made;
proof that you did not own or control the destination account, if available; and
records of collection calls, workplace contact, threats, public posts, or disclosure to relatives.

Maintain a dated chronology. Keep unedited originals and create working copies for submission. Do not publicly post full account numbers, IDs, signatures, addresses, or investigation records.

Common mistakes

Paying or signing simply to stop collection

A payment, restructuring agreement, settlement, or written promise may complicate your position. If part of the account is genuinely yours but another portion is disputed, clearly identify the distinction in writing and obtain advice before signing anything.

Reporting only by telephone

Calls can be denied or poorly documented. Follow every call with a written summary, including the date, time, agent’s name, and reference number.

Treating the police report as automatic cancellation

The provider must still investigate its records, and inaccurate credit information must still be disputed through the appropriate channels.

Giving more personal data to an unverified collector

Verify the provider and use an official channel. A fraudster may pose as a “fraud investigator” to obtain another selfie, OTP, signature, or payment.

Ignoring communications because “the debt is not mine”

Ignoring the matter permits collection and credit reporting to continue. If you receive a summons, subpoena, barangay notice, prosecutor’s notice, or court order, note the date of receipt and obtain legal help immediately.

Deleting compromised accounts or devices too soon

Changing passwords is sensible, but deletion or factory-resetting may destroy evidence. Preserve screenshots, logs, messages, and device information first, unless continued access creates an immediate security risk.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, promptly when:

a complaint, summons, subpoena, or court pleading has been served;
the provider refuses to stop disbursement or continues treating the account as admitted despite a documented dispute;
a mortgage, vehicle loan, payroll arrangement, guaranty, postdated check, or other security document was forged;
the disputed amount is substantial or several lenders are involved;
collectors threaten arrest, public shaming, workplace disclosure, or harm;
the suspected offender is an employee, agent, relative, or person who had authorized access to some—but not all—of your information;
loan proceeds entered an account you own, even if someone else controlled or withdrew them;
you previously confirmed an OTP, signed a document, shared an account, or made payments under unclear circumstances; or
you want damages, an injunction, document production, or other relief beyond correction of the account.

These facts can materially affect consent, agency, benefit, ratification, evidence, jurisdiction, and available remedies.

Frequently asked questions

Am I automatically liable because the loan is under my name?

No. A name or ID appearing in the lender’s records does not by itself prove that you consented to the transaction. Liability depends on the authentic application, identity-verification evidence, release and use of proceeds, and other circumstances. The lender should investigate rather than rely only on its account screen or a collector’s assertion.

Should I pay the minimum amount while the investigation is pending?

Do not pay solely to make collection calls stop without understanding the legal effect. Formally dispute the account and invoke the interim protection available under the Financial Products and Services Consumer Protection Act. If any part of the obligation is genuinely yours, seek advice on how to separate the admitted and disputed portions.

Can CIC delete the account immediately?

No. CIC facilitates correction with the submitting lender and cannot unilaterally change the lender’s submitted data. File both the lender dispute and the CIC dispute, and keep following up until the corrected information appears in a new report.

Is an affidavit of identity theft enough?

It is useful evidence but is not conclusive by itself. Providers and authorities will compare it with application documents, authentication records, device data, the disbursement trail, and other evidence.

What if a relative opened the account?

Report the facts truthfully. A family relationship does not by itself create authority to borrow in your name. However, prior permission, shared access, receipt of proceeds, later payments, or statements acknowledging the transaction may affect the legal analysis.

Can I demand the fraudster’s identity from the lender?

You may request the source of the data, application records, and relevant transaction information under applicable consumer and data-subject rights. The provider may redact third-party information or withhold material when another law, an active investigation, security concerns, or the rights of another person require it. Law enforcement can seek additional records through lawful process.

May collectors contact my relatives or employer?

Collection does not authorize harassment, public shaming, threats, or unrestricted disclosure of personal information. Record every contact and report abusive conduct to the provider and its regulator. Privacy complaints may also be appropriate when personal data is disclosed or processed without a lawful basis.

How long do I have to pursue a claim under the Financial Products and Services Consumer Protection Act?

Actions under that Act generally prescribe five years after the financial transaction was consummated or five years after discovery of deceit or nondisclosure of material facts, but in any event no later than ten years after the violation. Other civil, criminal, privacy, and procedural deadlines may differ. These outer limits are not a reason to delay reporting.

Official resources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, responsibility, and the correct forum depend on the documents and facts. Laws, rules, procedures, and official channels were checked as of 4 August 2026.