A loan you know nothing about, an unexpected repayment obligation, or a notification from a bank or non-bank financial institution (IFN) you do not remember dealing with should be investigated immediately. In some cases, it may be a simple error, but there are also situations in which someone's personal data is used for fraud or identity theft.
This is a real problem. In September 2026, the Romanian Center for Alternative Dispute Resolution in Banking (CSALB) reported that consumers had submitted more than 170 requests concerning fraud through banking channels during 2026. Some of the cases involved victims who found themselves responsible for debts after loans were taken out in their names or after criminals gained access to their phones, accounts, or banking applications.
If you suspect that someone has used your CNP or other personal information to obtain a loan, there are several practical steps you can take to check what happened and begin disputing a debt you do not recognize.
How can I check whether there are loans in my name?
The first step is to check the information recorded by Biroul de Credit, Romania's credit bureau. It operates a database used by participating financial institutions and contains information about the credit activity of individuals.
You can request access to the information recorded about you through the official Biroul de Credit website. Individuals have the right to access their personal data and review the information reported about them.
Your credit information may include, among other things:
- loans reported by participating financial institutions;
- the institutions that reported the information;
- details about credit products granted in your name;
- information about overdue payments;
- loans where you are listed as a co-borrower or guarantor;
- certain information about credit checks performed by participating institutions.
If you find a loan you do not recognize, identify the institution that reported it and record all available information about the contract.
Can someone take out a loan using only my CNP?
Knowing your CNP alone should not be sufficient to legitimately obtain a loan in your name. Financial institutions use additional procedures to identify applicants and assess loan applications.
However, the risk becomes much greater when someone has obtained additional personal information or access, such as:
- a photograph or copy of your identity card;
- your phone number and access to your SMS messages;
- your email address and password;
- bank card details;
- access to your internet or mobile banking account;
- OTP codes or other authentication codes;
- remote access to your phone or computer;
- photos, video recordings, or other information that could be used during an identity verification process.
Therefore, if you recently sent a copy of your identity document to a suspicious person or website, you should not assume that the only problem is that someone knows your CNP.
What should I do if I find a loan I did not take out?
If you discover an unknown loan, act quickly and keep evidence of every step you take.
1. Contact the bank or IFN immediately
Contact the institution listed as the lender and state in writing that you do not recognize the loan and dispute having entered into the agreement.
Ask for information about the contract and the procedure used to conclude it. Depending on the circumstances, relevant information may include the documents used for identification, the date the loan was taken out, the method used to sign the agreement, and other details related to the approval of the loan.
Keep the reference number of your complaint, emails, responses, and copies of all documents you send or receive.
2. Check your information with Biroul de Credit
If the loan appears in your Biroul de Credit records and you believe the information is incorrect, you can request that the data be corrected.
Biroul de Credit states that responsibility for the accuracy of reported information belongs to the participating institution that submitted it. That institution is also responsible for changing the reported information when a correction request is justified.
Under the applicable procedures, you may also be able to request restriction of the processing of disputed data while its accuracy is being investigated.
3. Contact the Police if you suspect identity theft or fraud
If there are indications that your personal information was used without your consent to obtain a loan, report the situation to the Police and provide the documents and evidence available to you.
Do not delete SMS messages, emails, conversations, or other information that may be connected to the incident. Even something that initially appears unimportant may later help establish how your personal data or accounts were compromised.
4. Secure any accounts that may have been compromised
If another person may have gained access to your phone, email, or online accounts, change your passwords and review your active sessions and connected devices.
Pay particular attention to:
- your primary email account;
- internet and mobile banking;
- accounts where you have stored payment information;
- phone numbers and recovery methods associated with your accounts;
- applications that have access to your accounts or personal information;
- remote-access software installed on your phone or computer.
If your bank card details or banking application may have been compromised, contact your bank immediately to secure the affected accounts.
Can I dispute incorrect information in Biroul de Credit?
Yes. Biroul de Credit states that when recorded information is incorrect or outdated, the individual concerned may request that the institution which submitted the information correct it.
There is an important distinction: Biroul de Credit does not simply change information because a user asks for it to be removed. The disputed data must be checked by the institution that originally reported it.
If the accuracy of the information is disputed, you may also request restriction of its processing where the applicable conditions are met. According to Biroul de Credit's procedures, restricted data is treated differently in the credit reporting system while the restriction remains in place.
Can I have the loan removed from Biroul de Credit?
Disagreeing with an entry does not automatically mean that it can be deleted. Personal data may be deleted when there is a valid legal basis, for example when it has been processed unlawfully or when the applicable retention period has expired.
If a loan was recorded as a result of fraud, the circumstances first need to be clarified with the institution that reported the loan and, where appropriate, through reports made to the relevant authorities.
Biroul de Credit also warns consumers about companies that promise to remove negative information from the credit bureau in exchange for payment. When there is a legitimate reason for correcting or deleting information, individuals can exercise their rights directly and are not required to pay an intermediary simply to submit such a request.
How can I check whether a CNP is valid?
If you need to check the structure of a Romanian CNP, you can use the CNP validator on VerificareCNP.ro. The tool checks whether the number follows the structure and validation rules of a Romanian Personal Numeric Code.
Important: validating a CNP does not show whether loans exist in that person's name and does not confirm the identity of the CNP holder. Credit information should be obtained through official sources and the relevant financial institutions.
What can someone do with a copy of my identity card?
A copy of an identity document contains several pieces of information that may be useful in an identity theft attempt, including your full name, CNP, document series and number, photograph, and other personal details.
Possessing a copy of your identity card does not automatically mean that someone can obtain a loan in your name. However, combining that document with access to your phone, email account, banking services, or other personal information can significantly increase the risk of fraud.
Be particularly cautious if someone asks you to install remote-access software or provide authentication codes received by SMS. A legitimate institution should not require you to give an unknown person remote control of your phone in order to “secure” an account.
I received an SMS about a loan I do not recognize. Does that mean I have been defrauded?
Not necessarily. The message itself could be a phishing or smishing attempt designed to persuade you to open a link and provide personal information.
Do not use the link contained in the message. If the SMS claims to come from a bank or IFN, independently find the institution's official contact details and verify the situation directly.
Fraudulent loans are a real problem in 2026
The risk is not merely theoretical. On September 9, 2026, CSALB reported that it had received more than 170 requests concerning fraud through banking channels during the year. The cases described included people who said loans had been taken out in their names or after criminals gained access to phones, passwords, confidential information, or home-banking applications.
In some of the cases discussed by CSALB, the reported losses reached approximately €20,000.
These cases also demonstrate why you should never give an unknown person remote access to your phone, passwords, authentication codes, or banking applications, regardless of the explanation they provide.
What you should remember
If you suspect that a loan has been taken out in your name without your consent, do not assume the problem will disappear on its own. Check the information recorded about you with Biroul de Credit, contact the institution listed as the lender, and dispute in writing any loan you do not recognize.
If there are indications of identity theft or fraud, report the incident to the relevant authorities and immediately secure any accounts and devices that may have been compromised.
At the same time, it is important to distinguish between someone knowing your CNP and the broader compromise of your identity. Another person knowing your CNP does not automatically mean they can obtain a loan in your name. The risk becomes considerably greater when the CNP is combined with identity documents, passwords, access to your phone, email account, or banking services.
Article updated in September 2026. This information is provided for general informational purposes and does not constitute legal advice. For information about loans and credit data recorded in your name, use the official channels provided by Biroul de Credit and the financial institution concerned.