Someone Used Your ID to Take Out a Loan in the Philippines: How to Deny the Debt, Report It and Close the Leak

The first 24 hours: pay nothing, delete nothing, put your denial on the record

Rule one: never make a goodwill payment, however small. The moment you pay anything, the lender holds evidence that the borrower acknowledged the debt and performed on it, and your later denial becomes far harder. Collectors know this, which is why the standard script is some version of pay one instalment now and we will verify the rest for you. The only purpose of that sentence is to get a payment on record.

Then work through this order:

1. Preserve every collection contact exactly as it arrived. Screenshot and export SMS, call recordings, Messenger and Viber threads, and emails, and back them up to cloud storage. Note the company or app name the collector uses, the supposed loan date, the amount they claim, any contract number, and the account they say the money was released to. These details become the backbone of every complaint you file later.
2. Do not block or delete the sender. Blocking cuts off your own evidence trail. Use your phone's do-not-disturb or filtering features to keep the noise down while the record keeps building.
3. Send one calm written denial. Three sentences are enough: you have never applied for or signed any loan with them; you request the loan agreement, the identity documents submitted, and the face-verification record used at application; and you require collection to stop until those are provided. No insults, no threats, no long explanations. This message will be one of your most useful exhibits.
4. Warn the people around you. Loan apps harvest the applicant's contact list, which in a fraud case is the thief's list rather than yours, but if the thief also has your number and social accounts, your colleagues, landlord and friends may be contacted. A one-line heads-up that someone used your documents and that they should ignore and never pay any collector saves you a great deal of explaining later.

Nothing in this first day requires visiting an office. What it does is fix the starting point of your evidence chain: a timestamped denial, made immediately, with a demand that the other side prove its claim. That timestamp will matter at every later step.

Work out what was actually opened, with whom, and using which of your documents

Do not act until you know what kind of case you have, because a loan in your name can start from at least three very different places. One: a registered lending or financing company ran a real application using your passport image and a selfie that is not you. Two: an unregistered loan app or private lender with no genuine onboarding at all, where the supposed loan record may be nothing more than a fabricated screenshot. Three: there is no loan; the debt story is simply a pressure tactic designed to make you transfer money to the caller.

How to tell them apart:

• Demand the loan agreement, the ID submitted, the face-verification capture and the disbursement record. A legitimate institution should be able to show these to a person it claims is the borrower. If all you get is a blurry screenshot or silence, treat the case as type two or three.
• Check the lender's registration. Lending and financing companies in the Philippines, including the great majority of loan apps, fall under the Securities and Exchange Commission, which licenses them and regularly publishes lists of revoked or warned online lenders. If the company does not exist on paper, your denial gets much stronger and the SEC itself becomes a route to shut the collection down.
• Follow the money. If the collector says the funds were released to your account, ask for the last digits and the date, then check. In a genuine identity-theft case the money usually went to an e-wallet controlled by the thief, often one registered with your documents too. That means you are dealing with a shadow account as well as a loan; see the section on stopping the bleeding below.
• Reconstruct where your documents went. List every time you handed over a passport scan, an ACR I-Card photo or a visa page: agencies, employers, landlords, condo admin, telco stores, money changers, hotels, car rentals. Each is a possible leak. If you have recently dealt with an agency that went dark, as described in our guide to a vanished agency, it belongs at the top of the suspect list.

Finally, pull your own credit record. The Philippines has a statutory credit information body that aggregates loans reported by lenders, and you can request your own report. Every unfamiliar entry you find goes into your affidavit and complaints.

Denying the debt properly: in writing, under oath, once and completely

A verbal denial binds nobody. What works in the Philippines is a notarised affidavit, a sworn written statement with legal consequences for you if it is false. That is exactly why lenders, regulators and police treat it seriously, and why it is the document that converts you from a silent debtor into a documented victim.

Structure it like this:

1. Who you are: full name, passport details, current immigration status, and reliable contact information.
2. Exactly what you deny: the company or app name, the claimed loan date and amount, copying the lender's own figures rather than estimating, any contract number, and the disbursement account digits. One paragraph per loan if there are several.
3. Why you cannot be the applicant: you never registered with that platform, never completed face verification, the disbursement account is not yours, and your document copy was handed to a named party on a given date. Objective alibi evidence helps enormously, for example immigration records showing you were in another city, or abroad, on the application date.
4. What you have already done: the date of your first written denial and any complaints or police reports already filed.
5. What you require: that collection stops, that your personal data is deleted, and that the application record is released so the thief can be traced.

Any practising notary public can notarise it; write it in English and attach copies of your ID. Once signed, it goes to three places at the same time: the lender, through email or its official complaint channel with proof of sending; the regulators and police described in the next section; and your own cloud backup.

A common mistake is assuming the problem will fade if ignored. Loan defaults in the Philippines can be reported to the credit information body and surface later when you open a bank account, apply for a card, or go through financial checks during certain immigration status changes. In rare cases a lender files a civil claim, and if you never formally denied liability, a default judgment is a real risk. The affidavit is not about winning an argument with a collector; it is about putting your denial where the system can see it. Where litigation is possible, speak to a lawyer.

Where to report: the lending regulator, the privacy commission and cybercrime police, all in parallel

Three channels run in parallel and do not conflict: one governs the lender's right to operate, one governs your personal data, and one governs the crime itself. Using only one of them is usually not enough to make the collection stop.

Channel one: the Securities and Exchange Commission. Lending and financing companies, which is what almost every loan app legally is, are supervised by the SEC. It runs a dedicated complaint route for online lending covering unregistered operation, abusive collection and fraudulent lending. Attach your affidavit, the collection records and the lender's name and app. If the lender turns out to be unregistered, the SEC's own action, such as a public advisory or a takedown order, becomes powerful evidence supporting your denial.

Channel two: the National Privacy Commission. Using your identity documents for a purpose you never authorised is, at its core, misuse of personal data under the Data Privacy Act. The NPC accepts complaints against the party that leaked your documents, for example a company you submitted them to, and against an institution that released funds despite an obvious identity mismatch. This channel does not recover money, but it can force the lender to explain where your document came from, which is the single most useful lead for tracing the thief. The obligations businesses carry are summarised in our Data Privacy Act basics guide.

Channel three: a criminal complaint. Borrowing in someone else's identity is a criminal matter, handled by the Philippine National Police Anti-Cybercrime Group or the NBI's cybercrime division. How to preserve electronic evidence so it is actually accepted, and which office to approach first, is covered in our guide to reporting cybercrime in the Philippines; the mechanics of a police blotter and what to bring are in how to file a police report. Copy the blotter or acknowledgment several times; it is the universal proof of victim status you will show to every other institution.

All three channels use the same bundle: affidavit, ID copies, collection records, lender details and your first written denial. Assemble one folder, print a set and keep a cloud set, and hand over a complete copy at each office rather than rebuilding it every time. If you are in the country on an employer-sponsored visa, give HR a copy of the police acknowledgment too, so the company is not blindsided if a collector calls the office.

Stop the bleeding: one stolen ID rarely opens just one account

A thief holding your passport scan almost never opens a single account. The usual pattern is a batch: several e-wallets, several loan apps, sometimes a SIM registered in your name to receive the verification codes. While you deal with the loan in front of you, sweep for every other shadow account, or next month brings a new collector.

The sweep:

• E-wallets. Wallets registered with your documents can exist without your knowledge. Contact each provider's support, state that your identity has been stolen, attach the police acknowledgment and affidavit, and ask them to identify and close any account in your name that you did not open. If one of your own wallets gets restricted during this process, the appeal route is explained in our guide to a frozen GCash account.
• Mobile numbers. SIM registration is mandatory in the Philippines, so a thief may have registered a line using your ID and then used it to sign up for other services. Ask your carrier to list all numbers registered under your documents and cancel the ones that are not yours. If your own number has been taken over rather than cloned, that is a separate emergency, covered in our SIM-swap guide.
• Bank accounts. Traditional banks require in-person onboarding, so fraudulent bank accounts are less common, but notify your bank anyway, ask for a fraud flag on your file, and change online banking credentials and the linked phone number.
• Online accounts. If the thief has your number and email, rotate the passwords on everything that matters, switch on two-factor authentication, and move it from SMS codes to an authenticator app.

Should you replace the passport itself? A leaked scan is not a lost passport and normally does not require replacement. If, however, the leak included the full data page, visa pages and both sides of the ACR I-Card, and misuse keeps recurring, ask the consular section of the Chinese Embassy whether renewal is advisable, and update the Bureau of Immigration afterwards. The more practical fix is to watermark every copy from now on, writing the recipient, purpose and date across the image so that any future leak is useless to a lender.

Closing the leak, spotting the second scam, and what Yixing can and cannot do

The point of a post-mortem is not blame; it is closing the hole that is still open. Go back through the hand-over list from section two: which recipient took a clean, unwatermarked photo of your passport; which one asked for it over a chat app; which one later became unreachable. The most suspicious of them is your NPC complaint target and often the police's first lead toward the thief.

Then learn to recognise the second scam. Identity-theft victims quickly attract offers of help: a self-described lawyer who can erase the debt from the system for a fee, an insider at the platform who will cancel the account for a processing charge, a credit-repair service that can clean your record for a payment. There is one reliable test: anyone who asks you to pay first in order to make a debt that is not yours disappear is running a scam. None of the legitimate routes, the affidavit, the SEC complaint, the privacy complaint, the police report, requires paying a stranger. The realistic order of operations for recovering from a fraud, including why publicly naming the other side can backfire, is in what to do after being scammed in the Philippines.

Four habits prevent a repeat: watermark every document copy with recipient and purpose; never send raw ID images over chat, send a masked version and show the original in person; give agencies, employers and landlords a signed inventory of what you handed over; and check your credit report and wallet registrations periodically.

What Yixing can do. Yixing is a private consultancy registered with the Philippine SEC (Registration No. CS202009551), accredited by the Bureau of Immigration (Accreditation No. CA-202624381-1, valid to 30 June 2027), DOLE and the Philippine Retirement Authority. In an identity-theft case we can help you organise evidence and document checklists, prepare the factual portion of an English affidavit and arrange notarisation, accompany you to the police or relevant agencies, and explain the situation if the incident touches financial checks on your immigration status. We cannot erase a debt or intervene in a lender's internal process, and we do not give legal advice. See our settling-in services for the scope of support. Consult a licensed lawyer for your own case; this article is not legal advice.