Filing Online Complaints Against Online Lending Apps in the Philippines

Overview

“Online lending apps” (OLAs) are typically lending or financing companies that extend short-term credit via mobile apps or websites. While many operate lawfully, abusive debt collection, misuse of personal data, and unregistered operations remain common. Philippine law gives borrowers multiple avenues to complain and obtain redress—administrative, criminal, and civil.

This article explains your rights, the governing laws, the regulators involved, and step-by-step procedures for filing complaints—plus practical templates and evidence checklists.

The Legal Framework

Core statutes and rules

Financial Products and Services Consumer Protection Act (RA 11765) Establishes financial consumer rights (to fair treatment, privacy, disclosure, and redress). Empowers regulators (SEC, BSP, IC) to investigate complaints, issue cease-and-desist orders, impose penalties, and require restitution.
Lending Company Regulation Act (RA 9474) & IRR and Financing Company Act (RA 8556) Require lending/financing companies to register with the SEC and comply with conduct, capitalization, and disclosure requirements. Unregistered lending activity is illegal.
SEC Memorandum Circulars on OLAs (notably the rules prohibiting unfair debt collection practices and requiring registration/notification of online lending platforms) Ban harassment, threats, public shaming, and contacting persons other than the borrower/guarantor about the debt, among others.
Data Privacy Act (RA 10173) & NPC rules Protect personal data; lenders must have a lawful basis to process data, collect only what’s necessary, disclose purposes, and secure data. Borrowers can complain about “over-collection” (e.g., phonebook scraping) and doxxing (debt shaming).
Cybercrime Prevention Act (RA 10175) and the Revised Penal Code Cover cyber threats, unlawful access, grave/coercion threats, libel, and other related offenses often seen in abusive collections.
Truth in Lending Act (RA 3765) Requires clear disclosure of finance charges and the effective interest rate.

Banks and their subsidiaries are supervised by the Bangko Sentral ng Pilipinas (BSP); insurance-related credit is under the Insurance Commission (IC). Most stand-alone OLAs are under the Securities and Exchange Commission (SEC).

Typical Violations by OLAs

Operating without SEC registration or without approved online lending platforms.
Unfair/abusive debt collection, such as:
- Threats, cursing, or intimidation;
- Public shaming via mass texts or social-media posts;
- Contacting your relatives, employer, or phonebook contacts;
- False representation as law enforcement, lawyers, or court personnel;
- Excessive or late-night calls/messages.
Data privacy breaches: phonebook scraping, accessing photos/files, collecting unnecessary permissions, disclosing or “doxxing” debt information.
Non-transparent pricing: hidden fees, misleading interest/penalties, roll-over traps.
Unlawful collection of biometric/location data or retention beyond necessity.

Where to Complain (and When)

Issue	Primary venue	What they can do
Unregistered OLA; unfair collection by SEC-regulated lenders	SEC (Enforcement & Investor Protection; Financing & Lending Companies divisions)	Investigate, issue cease-and-desist orders, suspend/revoke licenses, penalize, order restitution/disgorgement.
Privacy violations (contact scraping, doxxing, excess permissions, leaks)	National Privacy Commission (NPC)	Order cease processing, require data deletion, levy administrative fines, mandate corrective actions; assist with damages claims.
Threats, extortion, cyber-harassment, identity misrepresentation	PNP-Anti-Cybercrime Group / NBI-Cybercrime Division	Build criminal case; preserve digital evidence; file cybercrime complaints with the prosecutor’s office.
Spam/abusive messages and number blocking	Your telco/NTC	Block numbers/links; take action vs. sender networks.
Banks, e-wallets, credit card issuers	BSP Consumer Assistance	Direct redress and regulatory sanctions for supervised entities.
Damages, injunctions vs. lender/collectors	Civil courts (incl. Small Claims up to ₱1,000,000)	Monetary damages, injunctive relief, attorney’s fees.

Barangay conciliation usually does not apply to complaints against corporations or for regulatory/penal matters.

Evidence: What to Gather Before You File

Identity of the OLA: app name, developer/company, SEC registration/company name (as shown in disclosures), in-app screenshots.
Your transaction trail: loan agreements, e-promissory notes, payment receipts, account statements, interest/fee breakdowns, due-date notices.
Harassment record: screenshots of messages/chats, call logs, voicemails, timestamps, and the phone numbers used.
- Avoid illegal recordings: the Anti-Wiretapping law (RA 4200) restricts recording of private communications without required consent. If in doubt, stick to written communications, voicemails, and device call logs.
Data privacy proof: app permission pages, screenshots showing requests for phonebook/photos, notices to your contacts, and any public posts disclosing your data.
Impact and damages: medical/psychological reports (if applicable), employer HR notes, affidavits of contacts who were harassed, proof of lost wages or expenses.

Keep originals; export files with readable filenames (e.g., 2025-07-14_Threats_from_09xxxxxxxx.png). Back up to a separate device or cloud drive.

How to File: Step-by-Step

A. Complaining to the SEC (lending/financing conduct; unregistered OLAs)

Write a Complaint-Affidavit identifying the OLA, your relationship (borrower/guarantor), and specific violations (e.g., harassment, unlawful disclosure, usury-like charges, unregistered status).
Attach evidence (see checklist) and a government-issued ID.
Ask for specific relief: cease-and-desist, penalties, restitution of illegal charges, and referral for criminal action if warranted.
File with the SEC office handling enforcement/financing and lending matters. (If the OLA is clearly a bank or e-money issuer, file with BSP instead.)
Monitor and cooperate: respond to SEC subpoenas or clarifications; attend conferences if scheduled.

B. Complaining to the NPC (privacy violations)

First notify the OLA’s Data Protection Officer (DPO) in writing, asserting your rights (access, erasure, objection) and describing the violation. Give a reasonable time to respond (e.g., 10–15 days).
If unresolved, file a complaint with the NPC: include your DPO notice, the OLA’s response (or lack thereof), and your evidence.
Seek orders to stop processing, delete unlawfully collected data (e.g., contacts), secure your data, and require the OLA to notify affected third parties it harassed.
Consider claiming damages under the Civil Code (Articles 19/20/21) alongside administrative remedies.

C. Reporting Criminal Conduct (threats, extortion, doxxing)

Go to PNP-ACG or NBI-Cybercrime with your evidence.
Execute a Sworn Statement describing the facts.
Request preservation letters to telcos/platforms to retain logs while the case is evaluated.
The case may proceed to the City Prosecutor for inquest or preliminary investigation.

D. Telco/NTC Measures

Ask your carrier to block offending numbers and report spam/abuse.
Keep the carrier reference number as supporting evidence for your regulatory complaints.

E. Civil Actions (parallel or after regulatory steps)

For monetary claims up to ₱1,000,000, consider Small Claims (no lawyers required).
For ongoing harassment or data misuse, seek injunctive relief (temporary restraining order/permanent injunction).
Base claims on abuse of rights, privacy violations, and unfair collection; attach the same evidentiary set.

Practical Tools

1) Short, Firm Notice to the OLA (send before or alongside complaints)

Subject: Cease Abusive Collection and Unlawful Data Processing

I am [Name], borrower under Loan/App ID [____]. Your agents have engaged in unlawful conduct, including [harassment/public shaming/contacting my relatives/excessive permissions]. This violates RA 11765, RA 10173, RA 9474/RA 8556, and SEC rules on unfair debt collection.

I demand that you:
(1) Cease contacting third parties and using threatening/obscene language;
(2) Restrict communications to written email/SMS during 8:00 AM–5:00 PM on weekdays;
(3) Delete contact list and other unnecessary data collected from my device;
(4) Provide a complete statement of account, itemizing interest, penalties, and fees.

Unless I receive written confirmation within 5 working days, I will proceed with complaints to the SEC/NPC/PNP-ACG and pursue damages.

2) Complaint-Affidavit Outline (SEC / Prosecutor)

Parties and capacity (borrower/guarantor).
Jurisdiction (SEC for lending/financing; or criminal venue).
Statement of Facts (chronological; attach exhibits).
Violations cited (SEC unfair collection rules; RA 11765; RA 9474; RPC/Cybercrime if applicable).
Reliefs sought (CDO, fines, license revocation, restitution, referral for prosecution).
Verification and Attestation (subscribed before a notary/public official).

3) NPC Complaint Core Points

Identify personal data collected and lawful basis claimed by OLA (often consent/contract).
Explain why processing is excessive (e.g., contacts/photos not necessary for lending).
Describe disclosure to third parties (messages to contacts/employer).
Request erasure, restriction, and deletion, plus administrative fines.

Strategy: Which Track First?

Privacy breach or doxxing? Start with NPC (to stop data misuse) and SEC in parallel if the OLA is SEC-regulated.
Unregistered OLA or systemic harassment? Lead with SEC; add PNP-ACG/NBI if there are threats/defamation.
You mainly want your money back (illegal fees/charges)? SEC complaint seeking restitution; consider Small Claims for damages if needed.
Bank-issued loan or credit card? Use the BSP complaints pathway.

Parallel filing is allowed; just be consistent and disclose other cases you’ve filed.

Frequently Asked Questions

Do I have to pay if the collection is abusive? Yes, lawful debt remains payable, but abusive or illegal practices can lead to regulatory sanctions and refunds of unlawful charges. You can also direct the OLA to communicate only in writing and during reasonable hours.

Can they message my boss or family? Debt collectors are not allowed to disclose or discuss your debt with third parties (except your guarantor or as allowed by law). Doing so may violate SEC rules and the Data Privacy Act.

Can they threaten arrest or say there’s a “warrant”? No. Only courts issue warrants, and non-payment of civil debt is not a criminal offense by itself. False representation is sanctionable.

They scraped my contacts when I installed the app—legal? Generally excessive for lending’s purpose. Unless strictly necessary and properly consented to, it risks violating the Data Privacy Act and can be ordered stopped by the NPC.

What if the app is not in the app stores anymore? You can still complain. Provide screenshots, payment records, and any reference numbers or corporate names shown in the app or SMS/email trails.

Borrower Rights to Assert

Right to fair and respectful treatment and freedom from harassment.
Right to privacy and data protection (access, correction, objection, erasure).
Right to disclosure of total cost of credit (interest, fees, penalties).
Right to redress (complaints handling, restitution, and damages).
Right to choose communication channels and reasonable hours.

Practical Tips

Use a separate email for OLA communications; avoid giving unnecessary permissions.
If you’ve paid, secure a clearance or full statement of account.
Document everything from day one; contemporaneous screenshots carry weight.
Do not engage with harassing collectors beyond a single written notice; let regulators handle it.
For safety, update your SIM registration details if necessary and coordinate with your telco for blocking.
Consider credit counseling and reputable consolidation options to avoid roll-over traps.

Sample Filing Checklist (copy/paste)

Government ID; proof of address/contact.
Loan contract/e-PN and payment records.
Screenshots: app profile, in-app disclosures, harassment messages, permission prompts.
List of offending phone numbers/handles with timestamps.
Notice sent to OLA/DPO and proof of delivery.
Affidavits from affected contacts (if doxxed).
Telco/NTC reference numbers for blocking.
Medical/HR documentation (if claiming moral/exemplary damages).
Draft Complaint-Affidavit and verification page.

Final Notes

Regulators can act even if you still owe—abuse and privacy violations are separate issues.
Keep your requests specific: stop harassment, delete data, disclose fees, refund illegal charges.
If the OLA is a bank or e-wallet, use the BSP channel; if it’s insurance-related credit, use the IC.
For high-stakes situations (e.g., serious threats or large losses), consult counsel to coordinate filings across the SEC, NPC, and law enforcement and to pursue civil damages efficiently.

This article provides general information for Philippine borrowers and isn’t a substitute for tailored legal advice.