Here’s a practical, everything-you-need legal explainer on complaints against abusive online lending apps (OLAs) in the Philippines—so you can spot violations, preserve evidence, and pursue the right remedies without getting lost in acronyms.

What counts as an “abusive” online lending app?

In Philippine law and regulation, abusive collection and data practices generally include:

Debt shaming: messaging or calling your family, employer, or contacts; posting defamatory content; group chats naming and shaming.
Threats & harassment: threats of bodily harm, arrest, criminal cases for mere nonpayment (which is not a crime), obscene or profane language, repeated calls at odd hours.
Privacy intrusions: scraping your phonebook/photos; collecting more data than necessary; using data without your consent; continued processing after you revoke consent; failure to secure your data (data leaks).
Notorious loan terms & misrepresentations: hidden fees, failure to disclose true cost of credit, false “no interest” ads with large “service charges,” bait-and-switch rollovers.
Operating illegally: unregistered “lending/financing company,” fake business name, no principal place of business, or operating an online platform without required authorization.

Nonpayment is not a criminal offense. Lenders may sue in civil court to collect, but they may not threaten arrest, jail, or criminal cases just for nonpayment. Threats like these are classic red flags.

The legal framework (who does what)

Securities and Exchange Commission (SEC) Regulates lending and financing companies and online lending platforms. Issues rules on fair collection practices, platform conduct, and registration/authorization. Can suspend/revoke licenses, shut down illegal OLAs, and impose administrative sanctions.
National Privacy Commission (NPC) Enforces the Data Privacy Act (DPA). Unlawful processing, overcollection of phonebook data, disclosure to your contacts, security breaches, and debt shaming via contact-blasts are typical privacy violations. NPC can order cease-and-desist, data deletion, damages (through courts), and penalties.
Bangko Sentral ng Pilipinas (BSP) Regulates banks and certain financial institutions. If the app is a bank product or works through a bank/e-money issuer, some conduct standards or consumer protection rules may apply. (Pure “lending companies” stay under SEC.)
Department of Trade and Industry (DTI) Handles unfair or deceptive trade practices for non-SEC entities and some advertising concerns. Useful where the actor is a non-lending merchant app misrepresenting financing.
Philippine National Police – Anti-Cybercrime Group (PNP-ACG) / NBI-Cybercrime When there are criminal elements: grave threats, extortion, cyber libel, unjust vexation, grave coercion, identity theft, and related cybercrimes.
Courts
- Civil: damages for defamation/privacy violations; injunctions; small claims for abusive charges/unauthorized debits; declaratory relief.
- Criminal: threats, coercion, libel (including cyber libel), extortion, falsification, unlawful access, etc.
App stores & telcos Not regulators, but you can report abusive apps for TOS violations, and work with your telco to block numbers and secure your SIM.

Your rights (high level)

To be treated fairly in collection: no harassment, no shaming, no threats of arrest.
To privacy & data protection: collection must be lawful, transparent, minimal, and secure; no disclosure to your contacts without proper legal basis.
To clear disclosures of all fees and the true cost of credit before you borrow.
To withdraw consent and to object to processing not needed to perform the loan contract or required by law.
To access/correct your personal data and to file complaints with regulators.

Typical violations mapped to legal hooks

Harassment / threats / shaming → unfair collection practices (administrative), grave threats, grave coercion, unjust vexation, libel/cyber libel (criminal), and torts (civil damages).
Contacting your phonebook / posting your info → unlawful processing and unauthorized disclosure under the DPA (administrative; possible criminal liability under DPA’s penal provisions).
Hidden fees / misstatements → violations of truth-in-lending / consumer protection norms; possible administrative sanctions.
Unregistered lender → illegal lending (administrative/criminal under special laws); SEC can shut down.

Evidence you should preserve (make this your checklist)

Loan trail: app name, version, screenshots of listings, registration/authorization labels, offer screen with stated fees/tenors.
Contracts & disclosures: digital loan contract, T&Cs, privacy notice, consent screens, fee schedules, repayment calendar, transaction receipts.
Harassment artifacts: screenshots/recordings of calls, voicemails, chat threads (with visible numbers/usernames), timestamps, caller IDs.
Debt-shaming proof: messages to your contacts, group chats, posts, emails to your HR, any disclosure showing (a) who sent it and (b) how they got the contacts.
Device permissions: screenshots of app permissions (contacts, SMS, storage, camera, microphone), and when they were granted.
Data leak indicators: unusual logins, unconsented data reuse, other apps suddenly contacting you using the same data.
Payment proof: bank/GCash/coins wallet transfers, reference numbers, acknowledgments.
Identity linkage: if the app uses multiple shell names, capture corporate name, business address, and payment beneficiary names.

Keep originals; export .mp4/.m4a for recordings, .pdf for captures, and maintain hashes if possible. Don’t edit—annotate separately.

What to do—three-track approach (you can do all in parallel)

Track A — Regulatory complaints

1) SEC complaint (abusive/illegal lending practices)

When to file: harassment, shaming, non-disclosures, illegal charges, unregistered lender, or rogue collection agents.
What to submit:
- Complaint-Affidavit (facts, dates, violations)
- Proof (see evidence list)
- Your government ID and contact details
- If representing someone, a SPA (Special Power of Attorney)
Relief you can ask for: order to cease abusive collection, take down the app, admin penalties, referral for criminal action, and public advisory against the app.

2) NPC complaint (privacy/data abuses)

When to file: debt shaming, phonebook scraping, disclosures to contacts, excessive data collection, data breach, refusal to honor your rights requests.
What to submit:
- Complaint form (identify the personal data misused and harm suffered)
- Screenshots, call logs, witness statements (contacts who were harassed)
- Copies of the privacy notice/consent you saw (or state none was provided)
- Your data rights request and the app’s non-response/refusal (if any)
Relief: Cease-and-desist, erasure/rectification, penalties, and orders to stop contacting your phonebook.

Pro tip: In your filings, map each fact to a rule (e.g., “App used my contacts for collection without consent → unlawful processing under DPA; contacted my boss at 11:45 p.m. with threats → unfair collection practice.”)

Track B — Criminal & civil remedies

Criminal complaints (PNP-ACG / NBI / Prosecutor’s Office):
- Grave threats, grave coercion, extortion, libel/cyber libel, unlawful access, identity theft, violation of DPA penal provisions.
- Attach device extractions or certified screenshots; identify accounts/numbers used.
Civil actions (Regional Trial Court / Small Claims depending on amount):
- Damages for defamation/privacy invasion; injunction against further harassment; claims over unauthorized fees/debits.
- For smaller sums (statutory thresholds), use Small Claims (no lawyer required), especially to recover wrongful charges or penalty overcollections.

Track C — Self-help & containment

Revoke app permissions (contacts/SMS/storage) and uninstall the app; clear cached data.
Change passwords and enable 2FA on email/wallets.
Ask your telco to block offending numbers; use built-in spam filters.
Warn your contacts/HR that you’re dealing with an abusive OLA and that any messages about you are unlawful; ask them to preserve evidence and not engage.
Report the app to the app store for policy violations.

How to write a strong complaint-affidavit (structure you can copy)

Parties: You (full name, address, ID), the respondent OLA (all known business names, addresses, platform links), and its collection agents (if identified).
Jurisdiction & venue: Why SEC/NPC/Prosecutor has authority.
Facts (chronological, dated): loan offer, disclosures (or lack thereof), permissions sought, collection incidents (by date/time), shaming episodes (with recipients).
Violations: cite unfair collection practices, DPA provisions, cybercrime/penal code as applicable.
Harm: emotional distress, reputational damage, interference with employment, financial loss.
Relief sought: cease-and-desist, deletion of your data, penalties, public advisory; for criminal—indictment; for civil—damages and injunction.
Attachments: numbered exhibits (A, B, C…) with a table of exhibits.
Verification & jurat: sign before a notary (or follow the current rules on e-verified filings, if applicable).

FAQs (short, straight answers)

Is my debt erased if the app was abusive or unregistered? No. Obligation may remain, but illegal collection is sanctionable. You can dispute illegal charges and negotiate fair terms; regulators can shut down or penalize the app regardless of what you owe.

They threatened to file a criminal case for nonpayment. Is that real? Nonpayment of a loan is civil, not criminal. Threatening arrest/jail for nonpayment is abusive and reportable. Different story if there’s fraud (e.g., fake IDs, willful deceit)—that’s not ordinary nonpayment.

They messaged my boss and parents. What do I tell them? Say you’re addressing an abusive OLA practicing unlawful disclosure; ask them to save the messages and, if willing, give brief affidavits confirming they were contacted.

They keep calling at midnight. Calls at unreasonable hours for collection are a hallmark of unfair practices. Record timestamps; include them in your complaint.

They accessed my contacts even after I uninstalled. That suggests continued unlawful processing or data sharing; perfect for an NPC complaint seeking erasure and cease-and-desist.

Quick “triage” playbook (printable)

☐ Stop data bleed: revoke permissions, uninstall, change passwords, enable 2FA.
☐ Evidence: screenshots (numbers visible), call logs, contracts/receipts, permission screens.
☐ Notify allies: employer/family—do not engage; preserve messages as evidence.
☐ File complaints:
- SEC (unfair/illegal lending & collection)
- NPC (privacy breaches, debt shaming)
- PNP-ACG/NBI (threats, libel, extortion, cybercrimes)
☐ Consider civil action: damages/injunction; Small Claims for wrongful charges.
☐ Report the app to app stores.

Practical tips for borrowers

Borrow only from registered entities (ask for their corporate name, principal office, and registration; if they dodge, that’s a red flag).
Read the privacy notice; deny contacts/SMS/storage permissions—these are not required to compute a loan.
Get everything in writing: amount disbursed, fees, tenor, repayment schedule, how penalties are computed.
Use a dedicated email/number for OLAs to limit exposure.
Pay through traceable channels (bank/e-wallet) and keep proof.

Bottom line

You have three strong levers: (1) SEC for abusive/illegal lending behavior, (2) NPC for data privacy violations and debt shaming, and (3) criminal/civil actions for threats, libel, coercion, and damages. Pair these with evidence discipline and data hygiene, and you can both stop the harassment and hold the app accountable—without giving up your legitimate defenses on the debt itself.