There is almost certainly not a uniform international rule of law on this question. Burden of proof is an issue of civil procedure and not all countries place the same burden of proof on the same person for every single issue.
The applicable law would also depend upon how the issue presented itself.
In a criminal case, the law of the country where the crime is prosecuted would apply (usually a heavy burden of proof on the prosecution). Either the true criminal or the person whose identity was stolen could end up being a defendant (I've had cases where someone's identity is stolen and then they are criminally prosecuted for passing bad checks actually written by the fraudster.)
In a civil case brought by the loan company, some countries would place the burden of proof on the company seeking to enforce its loan on the theory that proving that a party to the contract actually signed the loan is part of their prima facie case, while others might see the claim that a document was made by an impersonator as an affirmative defense in which case the burden of proof might fall on the civil defendant.
In a civil case brought by the identity theft victim to pre-emptively adjudicate that a loan was false, the burden of proof would usually fall on the victim.
In practice, the legal formalities are somewhat irrelevant. A written document with a signature on it that was signed by someone with proper ID is almost always going to satisfy someone's burden of proof that a loan or other document was valid standing alone in any legal system (i.e. the prima facie case will be established), and the victim is always going to have to present evidence that convincingly shows that the person who did this was a fraud (which police reports, etc. will usually do).
Once both sides are presenting evidence that lead to opposite conclusions, the weight of the evidence, and not the burden of proof, is going to be the key issue.
In practice, usually cases like these are resolved before going to trial when the person seeking to enforce criminal or civil laws based upon the existence of documents executed by an imposter is presented with evidence of the identity theft situation. Often, there is a standard process for doing so.
But, it is a pain. Indeed, I once heard on the radio about a similar case where two people in the same city with the same birthdate and gender shared exactly the same name and were constantly being confused and didn't even realize it for many years (thinking that they were just repeatedly victims of identity theft until they figured it out and got to know each other). At least an ID theft victim normally has only one round of annoyance to deal with, rather than a lifetime of it.
