Sharing your government ID, home address, selfie, bank or e-wallet details, and specimen signature with an online lender can be frightening—especially when the lender becomes evasive, demands more information, or appears unlicensed. A specimen signature alone does not automatically prove that you borrowed money. Your immediate priorities are to preserve evidence, block further access to your accounts and devices, notify the lender in writing, check whether a loan or financial account was created, and report any unauthorized use to the appropriate Philippine agency.
Does Sharing a Specimen Signature Mean You Already Have a Loan?
Not necessarily.
Under Articles 1305, 1318, and 1319 of the Civil Code, a valid contract generally requires a meeting of minds, a definite object, and a lawful cause or consideration. Article 1317 also provides that a contract entered into in another person’s name without authority is generally unenforceable unless that person later ratifies or accepts it. For a simple loan, Article 1934 states that the loan is perfected upon delivery of the money or other object of the loan. (Lawphil)
This means that sending a specimen signature as part of an inquiry or application is different from:
- Agreeing to final loan terms;
- Signing or electronically accepting a loan contract;
- Completing an OTP, facial verification, or other authentication process;
- Receiving the loan proceeds; or
- Making payments that may be treated as confirmation of the transaction.
Online agreements can be legally binding. Under the Electronic Commerce Act of 2000, an electronic signature may have the same legal effect as a handwritten signature when the method used reliably identifies the person and shows that the person approved the electronic document. Electronic records must still be authenticated when their genuineness is disputed. A pasted image of a signature, standing alone, is not automatically conclusive proof that its owner approved a particular loan. (Lawphil)
The lender may nevertheless have other evidence, such as an OTP log, device information, IP address, recorded consent, application history, or proof that money was deposited into an account you control. That is why you should request the lender’s complete records rather than relying only on whether your handwritten signature appears on a document.
Application, approved loan, and disbursed loan are different stages
| Stage | What it usually means | Immediate concern |
|---|---|---|
| Inquiry or preliminary application | You submitted information but may not have accepted final terms | Unauthorized retention or misuse of personal data |
| Approved but not disbursed | The lender claims the application passed its assessment | A contract may still be disputed depending on consent and authentication |
| Disbursed | Money was sent to a bank account, e-wallet, or another recipient | Identify where the funds went and whether you authorized the transfer |
| Collection stage | The lender or collector demands payment | Ask for validation, dispute unauthorized debt in writing, and preserve every message |
| Reported to a credit database | A loan appears in your credit report | File a dispute with the lender and the Credit Information Corporation |
Why Your IDs and Specimen Signature Are Legally Protected
The Data Privacy Act of 2012, or Republic Act No. 10173, protects information that can identify you. Government-issued identification numbers and documents are classified as sensitive personal information. A signature, selfie, account number, phone number, address, and device data may also be personal information or authentication data, depending on how they are used. (National Privacy Commission)
An online lender cannot lawfully collect unlimited information merely because you clicked “apply.” Personal data must be processed for a declared and lawful purpose, using a valid legal basis such as informed consent or a legitimate need connected with the loan transaction. Consent must be freely given, specific, and informed—not hidden in vague wording that supposedly permits any future use. (National Privacy Commission)
The National Privacy Commission’s Circular No. 2020-01 on loan-related transactions specifically addresses lending and financing companies, online lending applications, third-party service providers, and even unauthorized or unlicensed actors processing personal data for loan-related activities. Among other things, it provides that:
- Lenders should collect only information that is adequate, relevant, necessary, and not excessive;
- Borrowers must be informed about profiling and automated decision-making;
- Lending apps must not demand unnecessary access to contacts, photos, messages, or other device data;
- Contact lists and social-media contacts must not be harvested for debt collection or harassment;
- Photos and other personal data must not be used to embarrass or harass a borrower;
- Character references must be properly informed about the use of their information; and
- The lender remains responsible when it engages a collection agency, technology provider, or other personal-information processor.
You also have the right to ask what information is being processed, where it came from, why it is being used, who received it, and how long it will be kept. You may seek correction, blocking, deletion, or destruction when information is inaccurate, unlawfully obtained, used without authority, or no longer necessary—subject to legitimate legal-retention and evidence-preservation requirements. (National Privacy Commission)
What to Do Immediately After Sharing Your Information
1. Preserve evidence before deleting anything
Take screenshots or export copies of:
- The lender’s website, app-store page, social-media account, and advertisements;
- The application form and every screen containing permissions or consent language;
- The privacy notice, loan terms, interest disclosures, and repayment schedule;
- Messages, emails, call logs, and collection threats;
- The phone numbers, account names, QR codes, and payment instructions used;
- The date and time you submitted each document;
- Any confirmation page, reference number, OTP, or approval message;
- Any bank or e-wallet transaction connected with the lender; and
- The files you sent, including the exact ID and specimen-signature image.
Record the app’s name, developer, website, and Android package name or Apple listing. Scam lenders frequently change brand names, pages, and phone numbers after complaints begin.
Do not edit the original screenshots. Keep a second copy in secure cloud storage or an external drive. A simple written timeline is also valuable: identify what you submitted, why you submitted it, what the lender represented, and what happened afterward.
2. Revoke the app’s access to your phone
After preserving the evidence, open your phone’s privacy or application settings and revoke access to:
- Contacts;
- Photos and videos;
- Camera and microphone;
- SMS messages;
- Call logs and phone functions;
- Location;
- Files and storage; and
- Accessibility services.
Then uninstall the application if you no longer need it for evidence. Check whether the app installed a device-management profile, VPN, keyboard, or accessibility service, because these permissions can provide unusually broad access.
Review your Google, Apple, Facebook, and email security pages for connected applications and active sessions. Remove unfamiliar access. If you reused the same password elsewhere, change it on every affected account.
3. Secure your email, SIM, bank, and e-wallet accounts
Change the passwords or PINs of any account whose details you shared. Use a unique password and enable multifactor authentication.
Check your email for:
- New forwarding rules;
- Changed recovery addresses or phone numbers;
- Password-reset messages you did not request;
- New device logins; and
- Deleted security notifications.
Contact your bank or e-wallet provider immediately if you shared an OTP, PIN, card security code, login password, recovery code, or a photo showing complete card or account credentials. Ask the provider to place appropriate restrictions, replace compromised credentials, and monitor unauthorized transactions. The Bangko Sentral ng Pilipinas advises consumers to report identity theft and suspicious activity promptly to the affected financial institution. (Bureau of the Treasury)
If your SIM suddenly loses service or you receive unexpected SIM-replacement notifications, contact your telecommunications provider immediately. These may indicate an attempted SIM takeover.
4. Send the lender a formal written notice
Do not rely on a phone call. Send the notice through every verifiable channel available, such as the lender’s official email address, privacy-officer email, customer-service portal, registered office, or SEC-listed contact details.
A useful notice may read:
Subject: Notice of suspected unauthorized use of personal data and request for records
On [date], I submitted [identify the documents and information] solely for [state the purpose]. I dispute and do not authorize any loan, account, electronic signature, disclosure to third parties, or use of my personal data beyond that stated purpose unless you can provide evidence of my valid and informed consent.
Please confirm whether any application, account, or loan has been created in my name. Provide copies of the application, contract, disclosure statement, consent records, electronic-signature audit trail, OTP and authentication logs, device and IP records, facial-verification records, disbursement instructions, proof of release of funds, and the names or categories of all recipients of my information.
Please restrict further processing and third-party contact while this matter is disputed. Correct, block, or delete information that lacks a lawful basis, subject to lawful retention requirements, and preserve all records needed to investigate possible fraud.
Please respond in writing within 15 calendar days.
The 15-calendar-day period is important because the National Privacy Commission’s complaint rules generally require a complainant to notify the respondent first and give it an opportunity to act. Proof that the respondent failed to provide an appropriate response within 15 calendar days should normally accompany a later NPC complaint. (National Privacy Commission)
Do not demand immediate destruction of every record if fraud may already have occurred. Ask the lender to stop unauthorized processing while preserving logs and documents needed to identify who used your information.
5. Verify whether the lender is legally authorized
Check more than the company’s name.
A corporation may be registered with the Securities and Exchange Commission but still lack the authority required to operate as a lending or financing company. Verify:
- The company’s exact legal name;
- Its SEC registration;
- Its Certificate of Authority to operate as a lending or financing company;
- Whether the online lending platform is recorded with the SEC;
- Whether its website, app, address, and contact information match official records; and
- Whether the SEC has issued a warning, revocation, or cease-and-desist order involving the company or platform.
A screenshot of an SEC certificate supplied by the lender is not enough. Certificates can be altered or may belong to a different company. Use the SEC’s current records and advisories, and file concerns through the official SEC iMessage portal. (Securities and Exchange Commission)
6. Check whether a loan appears in your credit record
The Credit Information Corporation is the Philippines’ central public credit registry. Obtain your credit report through the current options listed on the CIC website. Look for:
- A lender you do not recognize;
- An unfamiliar loan account;
- An incorrect balance or status;
- An application or obligation you did not authorize; or
- A loan reported under a misspelled or incomplete version of your name.
If you find an error, use the CIC’s online dispute process. The CIC will coordinate with the institution that submitted the information. The CIC generally cannot simply erase an entry on its own because the submitting institution must verify or correct its data. (Credit Information Corporation (CIC))
Republic Act No. 9510 requires the CIC to investigate and verify disputed information within five working days from receipt of the complaint, although full correction may take longer when the submitting lender must review records or provide a response. (Credit Information Corporation (CIC))
A newly opened loan may not appear immediately. Check again after several weeks and continue monitoring your bank, e-wallet, email, and credit records for several months.
7. Do not spend money deposited without your authorization
If money unexpectedly enters your account:
- Leave the funds untouched.
- Take screenshots and download the account statement.
- Notify your bank or e-wallet provider.
- Notify the lender in writing that you dispute the transaction.
- Ask for written instructions verified through the lender’s official corporate channel.
- Return funds only through a documented and independently verified process.
Do not send the money to a personal e-wallet or account merely because a collector instructs you through chat. That could result in the money being sent to a scammer while another party continues to demand repayment.
Receipt of funds is important because delivery may affect whether a loan was perfected under Article 1934 of the Civil Code. It does not automatically prove that you authorized the application, particularly if the funds were sent to an account you do not own or were obtained through identity theft. (Lawphil)
8. Warn affected contacts without making unsupported public accusations
If the lending app accessed your contacts, consider privately warning family members, coworkers, or references that they may receive suspicious messages. Tell them not to provide information, click links, send money, or engage with collectors.
Avoid posting unverified accusations, personal phone numbers, or names of individual employees on social media. Preserve the evidence and report it through official channels instead.
Where to Report Unauthorized Use or Harassment
Different agencies handle different violations. Filing with one agency does not always resolve every part of the problem.
| Problem | Where to report it | Practical first step |
|---|---|---|
| Excessive data collection, contact harvesting, unauthorized disclosure, public posting of IDs or selfies, or refusal to honor privacy rights | National Privacy Commission | Send the lender a written notice first and retain proof of delivery |
| Unlicensed lending, an unrecorded online platform, misleading disclosures, or unfair collection practices | Securities and Exchange Commission | Submit a complaint or inquiry through SEC iMessage |
| Unauthorized bank, card, or e-wallet transaction | The financial institution, then the BSP if unresolved | Use the institution’s formal consumer-assistance channel immediately |
| Fake loan, identity theft, falsified application, account takeover, threats, or cyber-enabled fraud | PNP cybercrime unit, NBI Cybercrime Division, or appropriate law-enforcement office | Bring original evidence, a timeline, IDs, and transaction records |
| Incorrect loan information in a credit report | Credit Information Corporation and the submitting lender | Obtain the credit report, identify the disputed entry, and submit supporting evidence |
| Threats involving physical harm or immediate danger | Nearest police station or emergency authorities | Preserve the messages and seek immediate protection |
Filing a complaint with the National Privacy Commission
The NPC’s complaint mechanics generally require:
- A notarized complaint-assisted form or verified complaint;
- Supporting evidence and affidavits;
- Proof that you first notified the respondent in writing; and
- Proof that the respondent did not act appropriately or did not respond within 15 calendar days.
The complaint may be filed personally, by registered mail, through a courier, or through an authorized NPC email channel. Failure to use the required form, provide supporting proof, or give the respondent an opportunity to respond can result in outright dismissal. The NPC may impose administrative sanctions and fines, award appropriate relief within its authority, and refer possible criminal violations to the Department of Justice. (National Privacy Commission)
Filing against the lender with the SEC
Include as much identifying information as possible:
- Legal and brand names;
- App name and app-store link;
- Website and social-media pages;
- SEC registration or Certificate of Authority details, if known;
- Phone numbers and email addresses;
- Loan documents and disclosure statements;
- Screenshots of threats or contact-list use;
- Proof of disbursement and payments; and
- Your written dispute and the lender’s response.
SEC Memorandum Circular No. 18, series of 2019 prohibits unfair debt-collection practices by lending and financing companies. Collection methods involving threats, insults, false representations, disclosure to unrelated persons, or conduct intended to shame a borrower may support an SEC complaint. (SEC Appointment System)
Complaining about a bank or e-wallet provider
Start with the institution’s own Financial Consumer Protection Assistance Mechanism or formal customer-service process. Obtain a ticket or reference number.
If the institution does not resolve the complaint, escalate it through the BSP Consumer Assistance Channels, including the BSP Online Buddy or the current Consumer Inquiry and Request form. Attach the institution’s response, your complaint reference, identification, transaction records, and supporting screenshots. (Bureau of the Treasury)
Reporting identity theft or falsified documents
Unauthorized use of your identity in a computer system may fall under computer-related identity theft or computer-related forgery under the Cybercrime Prevention Act of 2012, Republic Act No. 10175. Falsifying or knowingly using falsified private documents may also fall under Article 172 of the Revised Penal Code, depending on the evidence and circumstances. (Lawphil)
The Anti-Financial Account Scamming Act, Republic Act No. 12010, may also apply when another person uses someone else’s identity or identification documents to open or operate a financial account, or uses social engineering to obtain sensitive identifying information for fraudulent purposes. (Lawphil)
A barangay blotter can help create a dated incident record, particularly when the people involved are locally known. It does not replace an NPC, SEC, bank, NBI, or police cybercrime complaint, and it does not by itself prove that a loan is invalid.
Documents to Prepare
| Document or evidence | Why it matters | Practical tip |
|---|---|---|
| Valid government ID | Establishes your identity as complainant | Submit through secure official channels |
| Copy of the ID or signature file shared | Shows exactly what was exposed | Keep the original file metadata when possible |
| Chronological incident summary | Helps agencies understand the sequence | Include exact dates, times, numbers, and amounts |
| Screenshots and exported conversations | Proves representations, threats, and admissions | Capture the account name and date, not only the message text |
| Privacy notice and app-permission screens | Shows what the lender disclosed or requested | Save these before uninstalling the app |
| Proof of written notice | Required or highly useful in complaints | Keep sent emails, delivery receipts, and tracking records |
| Bank or e-wallet statement | Shows whether and where money was disbursed | Highlight the transaction without altering the original statement |
| Credit report | Establishes an unauthorized reported obligation | Mark the specific entry being disputed |
| Affidavit of denial or unauthorized use | Records your sworn version of events | Have it notarized when required by the receiving agency |
| Witness affidavit | Supports calls, threats, or contact-list harassment | The witness should describe only what they personally saw or received |
| Police, NBI, or barangay record | Shows that the incident was reported | Keep the reference number and receiving officer’s details |
An Affidavit of Loss is appropriate when an original document or ID was actually lost. When you still possess the ID but its image or details were misused, an Affidavit of Denial, Affidavit of Unauthorized Use, or detailed complaint affidavit is usually more accurate.
Notarization confirms that you personally swore to the affidavit before a notary. It does not automatically cancel a loan, invalidate every document containing your signature, or prove that the lender committed fraud.
What to Demand If a Loan Was Created in Your Name
Ask the lender for the complete transaction file, including:
- The original application;
- The final loan agreement and disclosure statement;
- Date and time of acceptance;
- Electronic-signature audit trail;
- OTP destination and verification logs;
- IP address and device identifiers;
- Facial-recognition or liveness-verification records;
- Recorded calls or video verification;
- Bank or e-wallet account nominated for disbursement;
- Proof that the account belonged to you;
- Date, amount, and reference number of the disbursement;
- Payment history;
- Credit-reporting history; and
- The names of collection agencies and other recipients of your data.
Compare these records with your devices, phone numbers, locations, and accounts. A disbursement to an unrelated account, an unfamiliar device, or an OTP sent to a number you never controlled can strongly support an unauthorized-use claim.
Do not ignore a genuine court summons. A demand text, collection email, or threat of a “warrant” is not the same as a summons issued by a court. Verify any supposed case directly with the named court branch. If a collection case was actually filed, submit your denial, fraud evidence, correspondence, and account records within the applicable court deadline.
Common Mistakes That Can Make the Problem Worse
Deleting the app and messages too soon
Uninstalling the app may stop some access, but it can also remove application screens, account details, and consent records. Preserve evidence first.
Sending another selfie or ID to “cancel” the application
Scammers often claim that an additional ID, selfie, video, signature, OTP, or payment is needed to close the account. Verify the request through the company’s official SEC-recorded contact information before sending anything else.
Paying a small amount just to stop the calls
A payment can complicate your position because the lender may present it as acknowledgment of the obligation. Do not pay a disputed loan until you have verified the contract, disbursement, and recipient of the funds.
Assuming a new signature solves the problem
Changing the way you sign does not erase an existing signature image or automatically invalidate documents created with it. Focus on written notices, account security, evidence preservation, monitoring, and formal disputes.
Demanding deletion before obtaining the evidence
You may have a right to blocking or deletion, but transaction logs could establish that another device, phone number, or bank account was used. Request restriction of unauthorized processing while requiring the lender to preserve evidence.
Believing a corporate-registration screenshot proves the lender is legitimate
SEC incorporation does not necessarily mean that the company is authorized to lend or that its particular online platform is recorded. Verify the company, Certificate of Authority, and platform separately.
Ignoring collection messages because the debt is fake
You do not need to admit the debt, but you should dispute it promptly in writing. Silence can allow the lender to continue collection activity or report the account without seeing your documentary objection.
Special Considerations for OFWs and Foreigners
An OFW or foreign national may still file complaints involving a Philippine lender, a Philippine-based data controller, or processing connected with the Philippines. The Data Privacy Act has provisions allowing application beyond Philippine territory when the processing involves Philippine citizens or residents, or when the entity or transaction has sufficient links to the Philippines. (National Privacy Commission)
Many initial notices, SEC submissions, CIC disputes, and financial-institution complaints can be started electronically. However, a verified complaint or affidavit may require notarization.
For a document executed abroad, the receiving Philippine agency may require either:
- Execution before a Philippine Embassy or Consulate; or
- Notarization under the law of the foreign country followed by an apostille, when the country participates in the Apostille Convention.
Requirements differ by agency and country. Check the receiving office’s current instructions and the relevant Philippine post’s consular procedures. The Philippine Embassy’s apostille guidance explains the general treatment of foreign public documents for use in the Philippines. (Philippine Consulate General Nagoya)
An authorized representative in the Philippines may be asked to present a special power of attorney. If the document was executed abroad, it may likewise need consular notarization or an apostille.
Frequently Asked Questions
Can an online lender create a loan using only my specimen signature?
A signature image can be misused to make a document appear authentic, but it does not automatically prove valid consent. The lender should be able to establish the application history, authentication process, agreed terms, and disbursement. Immediately dispute the transaction and request the complete audit trail.
Should I change my signature after sharing it?
Changing your signature rarely solves the main problem. It does not cancel existing documents or prevent someone from reusing the old image. Secure your accounts, send written notices, monitor your credit record, and report actual misuse. Replace an ID through the issuing agency when it was lost, altered, or otherwise requires replacement under that agency’s rules.
Can I require the lender to delete all my personal information?
You may request deletion, blocking, correction, or restriction when the data was unlawfully obtained, inaccurately processed, used without authority, or is no longer necessary. The lender may retain limited information when required by law or reasonably necessary for fraud investigation, legal claims, accounting, or regulatory compliance. Ask it to identify the legal basis and retention period for anything it refuses to delete. (National Privacy Commission)
Can the lender contact my family, coworkers, or employer?
A lender may contact a person you validly identified as a guarantor, co-borrower, or properly informed reference for a legitimate purpose. It should not harvest your entire contact list, disclose your alleged debt to unrelated people, or use contacts to shame and harass you. Such conduct may violate NPC rules, the Data Privacy Act, and SEC debt-collection regulations.
Can the lender post my ID, selfie, or signature on social media?
Publishing these materials to embarrass or pressure you can constitute unauthorized disclosure and unlawful processing of personal information. Preserve the post, URL, account details, comments, date, and time before reporting it to the platform, NPC, SEC, and law-enforcement authorities when appropriate.
Should I file a police report even if no money has been taken?
A report is especially useful when a fake account or loan has already been created, documents were falsified, threats were made, funds were diverted, or account-takeover attempts occurred. When there is only a concern about possible future misuse, begin with evidence preservation, security measures, written notices, and monitoring while remaining ready to report any concrete fraudulent act.
What should I do if the lender deposited money without my permission?
Do not spend or transfer it. Notify the lender and receiving financial institution in writing, dispute the transaction, and request a documented reversal or return process. Verify every return instruction independently and retain proof of the final disposition of the funds.
How can I find out whether someone obtained a loan in my name?
Ask the lender for confirmation and complete records, review your bank and e-wallet accounts, obtain a CIC credit report, monitor emails and text messages, and investigate unfamiliar credit inquiries or collection notices. Repeat the credit check later because reporting may not be immediate.
What if collectors threaten to have me arrested?
Nonpayment of an ordinary civil debt does not by itself turn a collection dispute into an arrest warrant. Fraud or another criminal offense is a separate matter requiring evidence and lawful proceedings. A genuine warrant or summons comes through official judicial channels, not merely through a collector’s text message. Verify any claimed case directly with the named court or agency.
How long should I monitor for identity misuse?
Monitor closely for at least several months. Review account alerts continuously, check your credit record again after several weeks, retain your evidence, and investigate every unfamiliar OTP, password-reset request, account-opening notice, loan message, or collection call.
Key Takeaways
- A specimen signature alone does not automatically establish a valid loan or prove that you accepted particular terms.
- Preserve screenshots, documents, messages, transaction records, and app details before deleting anything.
- Revoke unnecessary device permissions and secure your email, SIM, bank, and e-wallet accounts.
- Send the lender a written dispute and data-access request, giving it 15 calendar days to respond for purposes of a possible NPC complaint.
- Verify the company’s lending authority and online platform through current SEC records—not through documents supplied only by the lender.
- Obtain and monitor your CIC credit report, and dispute any unauthorized or inaccurate entry.
- Do not spend unexpected loan proceeds or return them through an unverified personal account.
- Report privacy violations to the NPC, lending violations to the SEC, financial-account complaints through the institution and BSP, and identity theft or falsification to law-enforcement authorities.
- A notarized affidavit records your sworn account but does not automatically cancel a loan or invalidate every document bearing your signature.
- Never ignore a genuine court summons, even when you believe the loan was created fraudulently.