Someone Used Your GLoan or GCredit Without You: Locking the Account, Disputing the Debt, and Escalating

The first hour: stop the damage

When you see a loan you never took, or a credit line that has been used, stop further damage first and investigate second. The order matters, because every minute the account stays open is another chance for the same person to borrow again.

Change passwords and log out other devices. In the official app, change both your login password and your transaction PIN, open the list of logged-in devices, and sign out anything you do not recognise. If you can no longer log in, call the official hotline immediately and ask for a temporary lock on the account.

Switch off borrowing. Check whether the app lets you disable or freeze the loan and credit features, or ask support to suspend them temporarily so no further borrowing can happen while the case is open.

Check that you still control your number. If your phone suddenly lost signal or stopped receiving SMS, your number may have been hijacked through a SIM swap. Recover it with the telco first; see when your number is hijacked. Until you have it back, the other person can keep receiving one-time PINs.

Report in the app and get a ticket. Through the official help centre, state that a loan or credit use you did not apply for appeared at a certain date and time, give the amount, and ask the platform to freeze, investigate and reverse the debt. Save the ticket number.

Capture everything. Screenshot the loan record, where the borrowed money went, login history, SMS notices and your call log. All of this becomes evidence when you dispute the loan.

Work out how they got in

Unauthorised borrowing usually comes from one of a few situations. Knowing which one applies shapes how you write the dispute and how you prevent a repeat, so spend a few minutes reconstructing the days before the loan appeared.

A one-time PIN was tricked out of you. Someone posed as wallet support, a courier or a prize notice and got you to read out a code or log in through a link. This is the most common cause. Platforms look closely at whether a code was disclosed, so explain honestly what happened, including the exact words of any message you received.

Your number was hijacked. Someone took over your number through a SIM swap and used SMS codes to log in or reset your password. The telco's SIM replacement record is key evidence here, so ask the telco for it in writing.

Your phone or ID was lost. A stolen, unlocked phone, or an ID used to verify identity on a new device. Provide the police report and the time of loss.

Someone close to you. A relative, partner, colleague or employee who knew your password or could reach your phone. This is emotionally hard, but the process is the same: dispute in writing and report it, and the platform will look at device and fund-flow records.

If you did give a code to someone without realising, do not hide it. An honest account of how you were deceived is far better than the platform finding contradictions in its own logs. For the overall damage-control sequence after a scam, see what to do after being scammed.

Disputing the loan in writing

Beyond the in-app report, send a formal written dispute through the official email or support channel and keep proof of sending. Its purpose is to state clearly that you did not apply for this loan, that you dispute the debt, and that you want it investigated and reversed.

Include your name, registered mobile number and account details; the date, time, amount and reference of the disputed loan; when and how you discovered it; what you believe happened, whether a tricked PIN, a hijacked number, a lost phone or someone close to you; what you have already done, such as changing passwords, reporting to police and contacting the telco; and your requests: pause collection, investigate, cancel the debt, and correct any related credit records.

Attach the police report or blotter entry, the telco's SIM replacement or disconnection record if relevant, any lost-phone report, screenshots, and the in-app ticket number. Some platforms ask for a sworn affidavit stating the loan was not applied for or authorised by you; prepare it in the format the platform requires and have it notarised.

Be truthful. If you actually took the loan and now cannot repay, that is not misuse but a debt problem, handled entirely differently. Do not use a denial to avoid repayment; false statements can carry legal risk.

Keep the dispute short and factual, ideally one or two pages plus annexes. Reviewers move faster on a clear timeline than on a long narrative, and a tidy file is easier to forward to a regulator later if you need to escalate.

Do you have to repay? Handling collection notices

This is the question people ask most. In principle, a loan you did not apply for, did not authorise and did not benefit from can be disputed, and you should not be required to repay it. But the platform only cancels after reviewing, and until then its systems may keep sending reminders and may even record the loan as overdue.

The practical approach has three parts. First, state in writing that you dispute the loan, have reported it to police, and are in the platform's process, and ask that collection and late charges be paused during the investigation. Second, keep a record of every collection notice. Third, do not ignore the platform's messages; answer each one in writing, quoting your ticket number and the dispute letter.

Whether to pay first and seek a refund later depends on the amount, how the review is going and how much your credit standing matters to you right now. It is a judgement call, and a licensed lawyer can help you weigh it. Paying does not admit the debt, but mark any payment in writing as "made under dispute, with all rights to recover reserved."

If collection crosses the line, such as contacting people in your phone book, public shaming or threats, that is itself a violation. Keep the evidence, complain to the relevant regulator, and report to police if needed; see online lending harassment.

If the loan has affected your credit record, once the platform cancels the debt, ask it in writing to correct the record with the credit information bureau, and keep the confirmation.

If the platform will not act: police, regulators and lawyers

File the police report on day one rather than waiting for the platform to refuse. Visit the local police station for a blotter entry or report to a cybercrime unit, bringing your ID, screenshots, ticket number and written statement. The report is a key document in showing the platform and regulators that you are the victim; see reporting cybercrime in the Philippines.

If the platform does not investigate or answer within a reasonable time, or its conclusion is plainly unreasonable, for instance "the correct one-time PIN was used, so the transaction is valid" with no regard to a hijacked number, ask in writing for the basis of its decision and then escalate to the central bank. E-wallets are supervised by the Bangko Sentral ng Pilipinas, whose consumer assistance channel refers complaints to the platform and requires a response; see escalating a bank or e-wallet complaint to the BSP.

If the in-wallet loan product is provided by a partner lending or financing company, that part may also fall under the Securities and Exchange Commission. The two complaints can run in parallel; mention each in the other so both regulators see the full picture.

For larger amounts, a known misuser, or if you want to pursue the person responsible, consult a licensed lawyer about a criminal complaint and civil recovery. Avoid intermediaries promising to "erase the debt internally" for an upfront fee; that is usually a second scam.

Throughout, keep one log of every contact with the platform, the telco, the police and any regulator, with dates and references. It keeps your account consistent across all of them.

Preventing it, and how Yixing can help

A few measures block most misuse. Never share a one-time PIN with anyone, including people claiming to be wallet support. Use separate strong passwords and biometric locks on both the phone and the wallet. Turn off loan and credit features you do not use. Enable notifications for every transaction. Treat your mobile number as the key to the wallet: keep it active and update the wallet before changing numbers. Do not log in on shared devices, and do not share wallet passwords even within the family.

Keep only small balances in the wallet and hold larger sums in a bank account with stronger protections. For transfer, cash-in and cash-out basics, see e-wallet transfers, cash-in and cash-out. For the scam where a stranger sends money and asks for it back, see the mistaken-transfer scam.

Yixing can help on the paperwork and communication side: turning the events into a clear Chinese and English timeline, drafting the written dispute and complaints to the platform and the BSP, preparing translations for an affidavit, accompanying you to a police station or branch, and referring you to licensed counsel where needed. Yixing is a consulting firm registered with the Philippine Securities and Exchange Commission (SEC Registration No. CS202009551). We are not a bank, e-wallet or law enforcement body, we never receive or repay funds for anyone, and we promise no outcome on cancellation. See our settling-in support. For your individual case, consult a licensed lawyer; this article is not legal advice.

If you manage wallets for elderly parents or a household helper, set them up with borrowing features switched off from the start and walk them through the one rule that matters most: no code is ever shared, whoever asks.