Quick answer
If a loan, credit card, credit line, or similar account was opened in your name without your knowledge or consent, immediately dispute it in writing with the lender. State that you did not apply for, authorize, receive, or benefit from the account; demand that collection activity be suspended while it is investigated; and request copies of the application, contract, identity-verification records, disbursement details, and transaction history.
Also secure your compromised accounts, preserve the evidence, report the suspected identity theft to law enforcement, and escalate the lender’s handling to the correct regulator. If the false account appears in your credit report, file a separate dispute with the Credit Information Corporation (CIC).
You are not automatically liable merely because the fraudster used your name or identification. Consent is an essential element of a contract under Article 1318 of the Civil Code. But the result will depend on the evidence—particularly whether you authenticated the application, authorized another person, received the proceeds, or later adopted or acknowledged the obligation.
Act immediately
Do not wait for another billing notice or collection call. A quick response helps prevent further borrowing, protects electronic evidence, and makes it harder for anyone to claim that you accepted the account.
Take these steps in order:
Contact the lender through a verified channel. Use the telephone number, email address, branch, or complaint portal published on the lender’s official website or BSP/SEC records—not a link sent by the collector.
Ask the lender to secure the account. Request that it block further drawdowns, purchases, cash advances, profile changes, and disbursements. If the fraud also affected a deposit account or e-wallet, ask that those accounts be secured separately.
Submit a written identity-theft dispute. A call is useful for immediate containment, but follow it with an email, letter, or complaint-ticket submission that creates a dated record.
Obtain a complaint or reference number. Save the acknowledgment and the name or unit handling the case.
Secure your email, mobile number, financial apps, and device. Change passwords from a trusted device, enable multi-factor authentication, sign out unknown sessions, remove unfamiliar recovery details, and contact your mobile provider if you suspect a SIM swap.
Report the suspected crime. Bring the evidence to the Philippine National Police, preferably a cybercrime unit when digital means were used, or to the National Bureau of Investigation. A police blotter can record the incident, but ask what sworn complaint and supporting documents are required for an investigation.
Check and dispute your credit record. The lender’s internal investigation and the correction of your CIC credit report are related but separate processes.
What to say in the written dispute
Use clear facts rather than broad accusations. Include:
- Your full name and reliable contact details
- The account or reference number, masking unnecessary digits where appropriate
- The date and manner in which you discovered the account
- A categorical statement that you did not apply for or authorize it
- Whether you received any proceeds, goods, card, OTP, or benefit
- Any identification document, mobile number, email address, bank account, selfie, signature, address, employer, or reference used without authority
- The collection messages, credit-report entry, or other record that alerted you
- Any lost ID, phishing, account takeover, SIM-swap, or data-breach incident that may be relevant
- The specific action you want the lender to take
- A list of attached evidence
Ask the lender to:
- Mark the account as formally disputed and suspected identity theft
- Stop new transactions and prevent further release of funds
- Suspend collection escalation and adverse credit reporting while the dispute is being investigated
- Preserve all application, authentication, device, access, communication, and disbursement records
- Provide a complete copy of the application and supposed agreement
- Provide the date, amount, channel, and destination of every disbursement
- Identify the mobile number, email address, address, and payment account used, subject to lawful redaction
- Explain how identity and consent were verified
- Correct its internal records and information submitted to the CIC if the account is confirmed as unauthorized
- Send its final findings and reasons in writing
Do not send passwords, PINs, CVVs, or OTPs. Give only the personal information reasonably necessary to verify your identity and process the dispute.
Request the underlying records
The documents may show whether this is identity theft, a lender error, mistaken identity, or an account that someone opened with alleged authority.
Request copies of, or access to, the following where applicable:
- Loan or credit application
- Promissory note, disclosure statement, and terms and conditions
- Signature, electronic-signature, clickwrap, or consent record
- ID images, selfie, facial-verification result, and video-verification record
- OTP destination and authentication logs
- Application date and time
- IP address, device identifier, and available geolocation record
- Recorded calls, chat logs, and emails
- Named references, employer information, and declared address
- Account-opening and know-your-customer records
- Loan-release instructions and proof of disbursement
- Recipient bank or e-wallet details
- Purchase, cash-advance, or transaction history
- Credit-report submissions and subsequent updates
The Data Privacy Act of 2012 gives a data subject rights that include access to personal information being processed and correction of inaccurate or erroneous data. These rights are not unlimited: an institution may redact another person’s information, preserve evidence, or retain records when required by law.
Preserve evidence before it disappears
Keep original electronic files whenever possible. Screenshots are useful, but they may omit metadata or the full conversation.
Preserve:
- Complete emails with headers
- SMS and messaging-app conversations
- Call logs, voicemail, and lawful recordings
- Collection letters and envelopes
- Screenshots showing the profile, account number, balance, dates, and sender
- The URL and app-store page of any lending application involved
- Fraudulent application documents supplied by the lender
- Bank or e-wallet statements showing that you did not receive the proceeds
- Proof of your location or travel when the application was made, if relevant
- Samples of your genuine signature
- Proof that an ID or SIM was lost or compromised
- Password-reset, new-device, login, and OTP alerts
- Copies of every complaint, acknowledgment, and response
- Your CIC credit report and transaction reference number
- A dated chronology of events
Do not alter suspicious files or continue communicating through an unknown link merely to gather evidence. If a device may contain malware, stop using it for financial transactions until it has been secured.
Report to the correct regulator
If the lender is supervised by the BSP
Banks, digital banks, many non-bank financial institutions, electronic-money issuers, and other BSP-supervised institutions must maintain a first-level Financial Consumer Protection Assistance Mechanism.
Complain to the institution first. If its response is unsatisfactory, or it fails to act under its own complaint process, escalate through the BSP Consumer Assistance Mechanism. The BSP currently accepts escalations through its BSP Online Buddy chatbot or a completed CIR Form sent to consumeraffairs@bsp.gov.ph. Attach proof that you first used the institution’s complaint mechanism.
The BSP advises consumers not to submit PINs, passwords, complete card or account numbers, passports, or identification cards through its complaint channel unless specifically and securely required. The governing consumer-protection framework is found in the Financial Products and Services Consumer Protection Act, BSP Circular No. 1160, and BSP Circular No. 1169.
If it is a lending or financing company
Use the SEC iMessage system and select the service for complaints concerning financing and lending companies. Include the company’s exact corporate name, SEC registration information if known, the lending app or trade name, the disputed account, and proof of your prior complaint to the company.
An app’s brand name may differ from the corporation operating it. Confirm the legal entity before filing so the complaint reaches the correct respondent.
If it is a cooperative
Start with the cooperative’s own consumer-assistance or complaint mechanism. If unresolved, contact the Cooperative Development Authority or the appropriate CDA Extension Office. Special rules may apply to cooperative banks and other cooperatives subject to additional regulators.
If the creditor cannot be identified
Do not pay an unknown collector simply to stop the messages. Ask for the creditor’s complete legal name, address, authority to collect, account reference, and documentary basis for the debt. Verify those details independently before sending identification documents.
Correct a false credit-report entry
The Credit Information System Act gives a borrower the right to dispute erroneous, incomplete, outdated, or misleading credit information.
First obtain your CIC credit report through a CIC-authorized channel. Then use the CIC Online Dispute Resolution Process. CIC guidance requires a transaction reference number from a recently obtained report; under CIC Circular No. 2019-01, the report generally must have been obtained within 30 days before the dispute is filed.
Identify the exact account and explain that it resulted from alleged identity theft. Attach the lender dispute, police or NBI report if available, proof that you did not receive the proceeds, and other supporting records. Filing a police report alone does not automatically remove an entry: the CIC process sends the dispute to the submitting institution for verification and correction.
Do not confuse the statutory rule requiring negative information to be updated within 15 days after payment, liquidation, or settlement with an identity-theft dispute. Paying a debt and denying that the account was ever yours are legally different positions.
Consider a National Privacy Commission complaint
Using your personal data to create a financial account may raise issues under the Data Privacy Act, especially if a company processed inaccurate information, failed to protect your data, refused access or correction, or continued unlawful processing after notice.
Ordinarily, you must first notify the lender or other personal information controller in writing and give it an opportunity to act. Under the NPC rules, a formal complaint generally becomes appropriate if the entity gives no response within 15 days or fails to take timely and appropriate action.
NPC procedural deadlines are short: the complaint generally must be filed within six months from the privacy violation or personal-data breach, or 30 days from the last communication with the entity, whichever is earlier. The NPC may waive procedural requirements for good cause or serious violations, but do not rely on a waiver.
Use the current NPC Complaint-Affidavit and filing instructions. The NPC introduced a new Complaint-Affidavit template effective July 1, 2025. The form must be completed, notarized, and submitted with the required supporting documents through an accepted channel.
An NPC complaint concerns data processing and privacy accountability. It does not, by itself, conclusively determine the validity of a loan or replace a criminal complaint, CIC dispute, or regulator complaint.
Report the suspected crime
When another person intentionally uses your identifying information through a computer system without right, the conduct may constitute computer-related identity theft under Section 4(b)(3) of the Cybercrime Prevention Act. Depending on how the account was created or used, computer-related forgery, computer-related fraud, falsification, access-device fraud, or other offenses may also be relevant. The exact charge is for investigators and prosecutors to determine from the evidence.
File promptly with the PNP or NBI, particularly if:
- Money is still being transferred or withdrawn
- Several accounts were created
- Your email, phone, e-wallet, or bank account was taken over
- A false document or forged signature was used
- The lender identifies a recipient account
- The perpetrator is threatening you or destroying evidence
- Property was mortgaged or offered as security
- A summons, subpoena, demand letter, or court document has arrived
Bring a valid ID, your written narrative, the disputed account details, proof of your complaint to the lender, and organized copies of the evidence. Ask for proof of receipt or the report reference. Do not publicly name a suspected perpetrator unless advised to do so; an incorrect public accusation can create separate legal problems.
Are you legally required to pay?
A genuine loan normally requires your consent. The Civil Code states that there is no contract unless consent, a certain object, and cause concur. An agreement made in someone’s name without authority generally cannot bind that person merely because their identity was used.
However, do not assume that a simple denial will settle every case. Important factual questions include:
- Did you complete or authenticate any part of the application?
- Did you give another person authority to borrow or transact for you?
- Did you share an OTP, password, account, device, or signed blank document?
- Did the proceeds enter an account you own or control?
- Did you use or retain any benefit?
- Did you later promise to pay, restructure, settle, or acknowledge the debt?
- Is the dispute actually about fraud in obtaining your consent rather than a complete absence of consent?
These distinctions may affect the appropriate remedy and the evidence required. The Supreme Court has emphasized that consent is indispensable, but forgery and lack of authority must still be established through competent evidence when disputed.
What not to do
- Do not ignore notices merely because the debt is false.
- Do not pay a “verification,” “cancellation,” or “clearance” fee to an unknown collector.
- Do not admit the debt, sign a restructuring agreement, or make a token payment without understanding the legal effect.
- Do not send an unredacted ID through an unverified social-media account.
- Do not surrender your original evidence.
- Do not delete the lending app, messages, or suspicious emails before preserving them.
- Do not rely only on a telephone conversation.
- Do not assume that a police blotter automatically cancels the account.
- Do not dispute only with the collector; notify the actual creditor and, when necessary, the CIC.
- Do not fabricate an affidavit or report. Knowingly making a false report can itself create liability.
When legal help is urgent
Consult a Philippine lawyer promptly if:
- A collection case has been filed or you received court papers
- A mortgage, vehicle, land title, or other valuable property is involved
- Your salary, deposit, or property is threatened with garnishment or foreclosure
- The lender claims you personally completed biometric or video verification
- Loan proceeds entered an account connected to you
- A relative or employee acted with disputed authority
- You previously signed, paid, settled, or acknowledged the account
- Multiple institutions are reporting fraudulent accounts
- The lender refuses to preserve or provide critical records
- You need urgent court relief or expert examination of a signature, device, or electronic record
Court deadlines stated in a summons or order must be followed even when the claim is fraudulent. A complaint pending with a lender, regulator, or police agency does not ordinarily suspend a deadline imposed by a court.
Frequently asked questions
Should I pay first to protect my credit score?
Not without obtaining advice about the consequences. Payment may complicate a position that you never incurred the debt. Use the lender and CIC dispute processes promptly and ask that the account be marked as disputed.
Is an affidavit of denial enough?
No. A notarized affidavit can formally record your account, but investigators and institutions will consider all available evidence. Support it with records showing how you discovered the account, where the proceeds went, what credentials were compromised, and what you did after discovery.
Must the lender immediately delete everything about the account?
Not necessarily. It may need to preserve records for investigation, regulatory compliance, litigation, or fraud prevention. Ask it to block further use, correct inaccurate attribution, stop improper collection, and retain the fraud evidence—not to destroy the evidence.
What if the loan proceeds entered my bank or e-wallet?
Report the transaction to both the lender and the receiving institution immediately. Explain whether you controlled the account, accessed the funds, or transferred them. Do not move or spend disputed proceeds except on specific advice from the institutions or counsel.
What if a family member used my identity?
The relationship does not automatically create authority or consent. State exactly what you did and did not permit. Do not conceal the person’s identity or falsely claim that your credentials were stolen if you knowingly provided them.
Can a collector contact my relatives or employer?
A creditor may use lawful means to locate or contact a borrower, but threats, deception, public shaming, disclosure of debt to unrelated persons, or misuse of contact lists may violate debt-collection and privacy rules. Preserve every message and report abusive conduct to the creditor and its regulator.
Can I demand compensation?
Possible remedies depend on proof of the violation, fault, and actual harm. The Data Privacy Act recognizes a right to indemnification for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data. Compensation is not automatic; obtain advice about the proper forum and evidence.
Should I replace my IDs?
Report a lost or compromised ID to the issuing agency and follow its replacement or annotation procedure. Replacement alone will not remove an existing fraudulent loan, so complete the lender, regulator, law-enforcement, and credit-report disputes as well.
Official references
- Civil Code of the Philippines
- Cybercrime Prevention Act of 2012
- Data Privacy Act of 2012
- Access Devices Regulation Act, as amended
- Financial Products and Services Consumer Protection Act
- BSP Consumer Assistance Channels
- SEC iMessage
- CIC Online Dispute Resolution Process
- NPC complaint-filing instructions
This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and conclusions may change based on the institution, documents, evidence, and later legal issuances. Official sources and filing information were checked as of July 27, 2026.