Filing a Complaint Against an Online Lending App in the Philippines

A practical, step-by-step legal guide (Philippine context)

Quick take: If an online lending app (OLA) harasses you, shames you, or charges undisclosed fees, you can: (1) complain to the lender’s helpdesk (required as a first step for most financial disputes), then (2) escalate to the right regulator—SEC for lending/financing companies, NPC for data-privacy violations (e.g., debt shaming, phonebook scraping), BSP if the lender is a bank/e-money issuer, and (3) consider criminal, civil/small-claims, or telco/NTC routes if threats or illegal collection tactics are involved. Keep paying what you validly owe (at least the principal) while disputing illegal charges, and preserve evidence.

1) Legal framework (what rules apply)

Lending/Financing regulation
- Lending Company Regulation Act of 2007 (R.A. 9474) and the Financing Company Act of 1998 (R.A. 8556): lending and financing companies must be registered with the SEC and—if they use an app—comply with SEC rules for online lending platforms (OLPs).
- Truth in Lending Act (R.A. 3765): lenders must clearly disclose finance charges and the true/effective interest rate before you borrow.
- Financial Products and Services Consumer Protection Act (R.A. 11765, “FCPA”): empowers financial regulators (SEC, BSP, Insurance Commission) to enforce consumer-protection standards, require internal complaint-handling, and sanction abusive practices.
Debt collection & harassment
- The SEC prohibits unfair debt-collection practices by lending/financing companies and their agents (e.g., threats, public shaming, contacting people in your phonebook, false representation as a lawyer/police, repeated harassment).
Data privacy
- Data Privacy Act of 2012 (R.A. 10173): personal data must be processed lawfully, with proper consent, purpose limitation, and proportionality. “Debt shaming” (messaging your contacts/employer, posting your data) and excessive permissions (e.g., scraping your phonebook) can be unlawful. The National Privacy Commission (NPC) enforces this.
Electronic transactions
- E-Commerce Act (R.A. 8792) recognizes e-signatures and electronic records; disclosures made digitally can be binding if compliant.
Cybercrime & threats
- Cybercrime Prevention Act (R.A. 10175) covers cyber-libel, threats, extortion, etc. Criminal complaints can be filed via the PNP/Anti-Cybercrime Group or NBI.
No imprisonment for debt
- The 1987 Constitution, Art. III, Sec. 20: No imprisonment for non-payment of debt. Collectors cannot jail you for unpaid loans (absent fraud or a separate crime).
Interest and charges
- The usury ceilings were effectively lifted decades ago (banks and lenders may set rates), but courts strike down “unconscionable” interest and penalties. In practice, abusive rates/fees can be reduced or invalidated in court (see e.g., Medel v. Court of Appeals, G.R. No. 131622, 27 Nov 1998).

2) Who regulates what (choose the right venue)

Issue	Primary venue
The app is a lending/financing company (registered or not), abusive collection, non-disclosure of fees, illegal OLP	SEC (Enforcement & Investor Protection; Corporate Governance & Finance Supervision)
Data-privacy abuses (debt shaming, scraping contacts/photos, overbroad consent, security breach)	NPC
The lender is a bank, EMI/e-wallet, or BSP-supervised (not an SEC lending/financing company)	BSP (Consumer protection)
Threats, extortion, cyber-libel, identity misrepresentation as police/lawyer	PNP-ACG / NBI (criminal)
Harassing spam calls/SMS, SIM/number issues	Your telco and NTC
Refunds/damages, invalid interest/fees, breach of contract	Courts (including Small Claims)

Tip: Many OLAs are SEC-supervised (not banks). If you borrowed from a bank app or a regulated e-wallet, that’s BSP.

3) What conduct typically violates the rules

Unregistered/illegal lending: lending or operating an OLP without proper SEC registration/secondary license.
Unfair debt-collection: threats, obscene/insulting language, debt shaming (messaging your phonebook/employer), misrepresenting as a lawyer/police officer, repeated harassment at odd hours.
Non-disclosure/misrepresentation: hidden fees, misleading APRs, bait-and-switch.
Privacy abuses: collecting unnecessary permissions (e.g., contacts, photos) as a condition to lend; sharing your data with third parties without lawful basis; posting your personal data online.
Security failures: leaking your data; failing to honor your data-subject requests (access, deletion, objection).
Illegal threats: “You’ll be jailed,” “We’ll post your nude photos,” “We’ll raid your house,” etc.—these can be crimes.

4) Evidence checklist (start today)

Collect and keep unaltered copies:

App store listing (name, publisher), screenshots of onboarding (consent screens, permissions), loan offer, disclosures, and privacy policy.
Your loan contract, payment receipts, transaction IDs, and chat/email threads with the lender.
Harassment logs: date/time of calls/SMS, screenshots/recordings of voicemails, debt-shaming group chats/posts, caller numbers.
- Caution: The Anti-Wiretapping Act (R.A. 4200) generally bans recording a private conversation without all parties’ consent. Don’t secretly record live calls; keep voicemails, texts, and screenshots instead.
Device permissions page showing what the app can access.
If a non-borrower (e.g., a contact who was messaged), keep the message showing how your data was used.

5) The required first step: complain to the lender (FCPA)

Under the FCPA, financial service providers must have a Consumer Assistance/Complaint Mechanism. Before regulators take your case, they usually expect you to write the lender first and give them a chance to fix it.

What to send the lender

State your full name, loan/account number, dates, and the specific issues (e.g., undisclosed fees, debt shaming on [date], threats via [number]).
Demand: (a) stop harassment, (b) correct your account (remove illegal fees, provide accurate statement), (c) honor data-subject rights (delete contacts, restrict processing), and (d) written resolution.
Attach screenshots/receipts. Give a reasonable deadline for a written response.

If they ignore or deny your complaint, escalate to the regulator(s) below and attach proof you tried to resolve it.

6) How to file with the SEC (lending/financing issues)

Use the SEC route if the entity is a lending or financing company (or you suspect it is) or the problem is unfair collection, illegal OLP, or non-disclosure of charges.

What to prepare

Complaint letter/affidavit (facts in order: who, what, when, where, how you were harmed).
Proof of identity and contact details.
Evidence (see checklist).
Proof you first complained to the lender and their reply (or lack of it).

What the SEC can do

Order the company to cease abusive practices, take down illegal OLPs, require refunds/adjustments, and penalize/suspend erring companies and officers. It can also refer crimes to prosecutors.

7) How to file with the NPC (data-privacy & debt shaming)

Go to the NPC if the app scraped your contacts, messaged your employer/friends, posted your photos/data, refused to honor your access/erasure/objection rights, or had a data breach.

Best practice before filing

Send a Data Subject Request to the lender’s Data Protection Officer asking for:
- Access (what data they hold about you),
- Source of your contacts,
- Legal basis for processing,
- Erasure/restriction (stop contacting your phonebook),
- Copy of their privacy impact assessment (if any).
Give a reasonable time to respond. Keep proof.

What to file with NPC

Complaint-affidavit stating the violations (e.g., processing beyond consent, unlawful disclosure to your contacts, failure to implement security measures).
Your evidence and the DPO exchange (or proof they ignored you).

Possible outcomes

Compliance orders (e.g., delete your data, stop debt shaming), fines, and referrals for criminal prosecution for serious violations.

8) How to file with the BSP (banks, EMIs, e-wallets)

If the app belongs to a bank, e-money issuer, or other BSP-supervised institution:

File first through the provider’s Consumer Assistance channel (FCPA).
If unresolved, escalate to the BSP with your complaint letter, evidence, and the provider’s response (or inaction).

BSP can direct the institution to correct accounts, reverse improper fees, and improve complaint handling, among others.

9) Law-enforcement, telco, and courts

PNP-ACG / NBI (criminal): File if there are grave threats, extortion, cyber-libel, identity misrepresentation, or unauthorized access to your device. Bring evidence and valid ID.
Telco & NTC (harassing calls/SMS): Ask your telco to block numbers and lodge a complaint; you may escalate persistent spam/harassment to the NTC. The SIM Registration Act (R.A. 11934) supports tracing registered SIM users.
Civil court / Small Claims:
- To claim refunds/damages or challenge unconscionable interest/penalties.
- Small Claims (no lawyers needed) is designed for money claims up to the then-prevailing threshold (the Supreme Court raised this to ₱1,000,000 in 2023; thresholds can change—check the latest before filing).
- Keep paying what you validly owe; you can pay under protest for disputed fees while preserving your right to recover them.

10) Practical protections (right now)

Revoke invasive permissions: Phone Settings → Apps → [App] → Permissions; deny Contacts, Photos/Media, Call logs unless strictly needed.
Preserve evidence: Don’t delete messages or group chats—even if upsetting.
Do not secretly record live calls (R.A. 4200). Save voicemails and texts instead.
Use written channels (email/chat) for an audit trail.
Pay the principal and clearly dispute unlawful charges; keep official receipts.
If your contacts are being messaged: Post a short note to them (sample below) so they stop engaging with collectors.

11) Frequently asked questions

Q: The app says I’ll be jailed tomorrow if I don’t pay. A: No one can jail you for ordinary non-payment of debt. That’s unconstitutional. Only a court can issue judgments and sheriffs enforce them—never a collector by text.

Q: Do I have to keep paying if the app is “illegal”? A: The obligation to repay the principal generally remains, but unlawful interest/fees and abusive tactics can be challenged. Document your payments and disputes.

Q: They messaged my boss and my family. A: That’s classic debt shaming and likely a Data Privacy Act violation. Preserve screenshots and escalate to NPC (and SEC if it’s a lending/financing company).

Q: Can they seize my salary or GCash without a court order? A: No. Garnishment or asset seizure requires a final court judgment and due process, not a collector’s demand.

Q: The loan “APR” shown in the app seems wrong. A: The Truth in Lending Act requires accurate disclosure of the effective interest and charges. Misleading APRs can be grounds for an SEC complaint and account correction.

12) Templates you can copy-paste

Replace [bracketed] fields and attach screenshots/receipts.

A) Complaint to the lender (FCPA first contact)

Subject: Consumer Complaint re [Loan/App Name], Account [#]

Dear [Lender Name/Support Team],

I am [Full Name], borrower under Account [#]. I am raising the following issues:
1) [Undisclosed fees/misstated interest], charged on [date].
2) [Harassment/debt shaming], via [calls/SMS/social media] on [dates] from [numbers/accounts].
3) [Privacy violation], including [access to phonebook/contacts messaged], without valid legal basis.

Demands:
• Immediately cease all harassment and communicate with me only via [email/official channel].
• Correct my account by removing unlawful fees/charges and provide a written, itemized statement.
• Honor my Data Privacy rights: restrict processing to what’s necessary for collections and delete all contacts and photos scraped from my device.

Please respond in writing within [7–10] days. I reserve my rights under the FCPA, Truth in Lending Act, Data Privacy Act, and SEC rules on unfair debt collection.

Sincerely,
[Name]
[Address / Mobile / Email]

B) Data Subject Request to the lender’s DPO (for NPC cases)

Subject: Data Subject Request under the Data Privacy Act – [Full Name]

Dear Data Protection Officer,

Pursuant to R.A. 10173, I request:
1) Access: the personal data you hold about me; sources of such data (including any access to my contacts).
2) Legal basis: your specific lawful basis for processing and contacting third parties in my phonebook.
3) Erasure/Restriction: delete all contacts harvested from my device and stop any further disclosure or debt-shaming practices.
4) Security measures: your measures to prevent unauthorized disclosure and harassment.

Please reply within a reasonable period. I will escalate to the NPC if unresolved.

Sincerely,
[Name / ID type & number]

C) SEC complaint cover letter (attach affidavit & evidence)

Subject: Complaint vs [Company/App] for Unfair Debt Collection / Violations of Lending/Financing Laws

To the Securities and Exchange Commission:

I am filing an administrative complaint against [Company/App], which offers online lending in the Philippines. On [dates], their collectors [threatened/debt-shamed me, contacted my employer/contacts], and charged undisclosed fees. I first complained to the company on [date] (no resolution / unsatisfactory reply).

Attached: Affidavit, screenshots, call/SMS logs, loan contract, receipts, and my prior complaint.

Reliefs sought: Cease abusive collection, account correction/refund of unlawful fees, penalties against the company and agents, and take-down of any non-compliant online lending platform.

Respectfully,
[Name / Address / Contact]

D) Short note to contacts (if they were messaged)

Hi! If you received messages about me from [App/Collector], please ignore and block them.
They obtained your number without your consent. I have reported this as a Data Privacy violation.
Thanks for understanding—please don’t engage with them.

13) Outcome: what to expect

Administrative: regulators may order the lender to fix your account, refund/adjust charges, stop harassment, delete unlawfully processed data, and penalize the company/agents.
Criminal: law enforcement may pursue charges for threats, cyber-libel, or serious data-privacy offenses.
Civil: courts can reduce unconscionable interest/penalties, award damages, and enforce settlements.
Platform actions: offending apps can be delisted from app stores or taken down upon regulator request.

14) Final pointers

Pick the right venue(s): It’s normal to file with both SEC (lending/collection) and NPC (privacy), plus law-enforcement if there are threats.
Stay factual and calm: your credibility is your strongest asset.
Consult a lawyer for high-value claims, complex damages, or if you’re sued.
This guide is general information, not legal advice. Laws and thresholds can change; check the latest forms and submission channels when you file.

If you want, I can turn these into filled-out letters based on your situation (names, dates, screenshots) so you can file right away.