Quick answer

If an online lender deceived you, took money through a fake loan or advance-fee scheme, used your identity, or caused an unauthorized bank or e-wallet transaction, report it immediately to:

Your bank, e-wallet, card issuer, or payment provider — ask it to secure your account, dispute the transaction, trace the recipient, and consider any lawful hold on remaining funds.
The government’s 1326 National Anti-Scam Hotline — for prompt scam reporting and inter-agency coordination.
The NBI Cybercrime Division or the nearest police/anti-cybercrime office — to make a criminal complaint and preserve digital evidence.
The Securities and Exchange Commission (SEC) — if a lending or financing company, online lending platform, unlicensed lender, undisclosed charges, or prohibited collection conduct is involved.
The National Privacy Commission (NPC) — if the app accessed contacts, disclosed your debt, impersonated you, misused identification documents, or otherwise processed personal data unlawfully.
The Bangko Sentral ng Pilipinas (BSP) — if the unresolved complaint concerns a BSP-supervised bank, e-wallet issuer, financing institution, or other supervised financial institution.

These reports serve different purposes. A report to the SEC or NPC does not replace a criminal complaint, and a police report does not automatically reverse a transfer. File with every agency that has a relevant role.

First, identify what happened

“Online lending fraud” can describe several different situations:

A fake lender demands a “processing,” “verification,” “insurance,” or “release” fee but never releases a loan.
Someone uses your identity or identification documents to obtain a loan.
A supposed lender obtains your OTP, PIN, password, or remote access to your device and transfers money.
An app changes or conceals the amount financed, interest, fees, due date, or repayment obligation.
A collector directs payment to a personal or unfamiliar account and later denies receiving it.
An online lending platform appears to operate without an SEC-authorized lending or financing company behind it.
A real lender accesses your contacts, publicly shames you, threatens you, or contacts unrelated people about your debt.

The last category may involve unlawful collection or privacy violations even when the loan itself is genuine. An aggressive demand for payment is not automatically fraud. Likewise, filing a complaint does not by itself cancel a valid debt.

Act immediately if money or account access is at risk

Contact the financial institution first

Use only the official number, app, website, or branch of the bank, e-wallet, card issuer, or remittance provider. Do not use a number supplied by the suspected scammer.

Tell the institution that the transaction is fraud-related and provide:

Your name and verified account details;
The transaction date, time, amount, and reference number;
The recipient’s name, account number, mobile number, or wallet identifier;
A short explanation of how the deception occurred;
Whether you disclosed an OTP, PIN, password, card information, or device access; and
The police, NBI, or 1326 report reference, if already available.

Ask for a case number and written confirmation. Request that the institution:

Secure or restrict the compromised account;
Revoke active sessions and unauthorized devices;
Block or replace affected cards;
Record a formal transaction dispute;
Coordinate with the recipient institution to trace or preserve funds; and
Preserve transaction, login, device, and communications records.

Republic Act No. 12010, the Anti-Financial Account Scamming Act, provides a framework for temporarily holding funds involved in disputed transactions and coordinating verification among covered institutions. A hold is not automatic in every case, and recovery is not guaranteed—especially if the money has already been withdrawn or moved. This is why immediate reporting matters. See Republic Act No. 12010.

Change compromised passwords from a clean device. Enable multi-factor authentication and notify your mobile provider if your SIM may have been taken over. Never give an investigator or “recovery agent” your OTP, PIN, password, or full card credentials.

Call 1326

Report the incident to the 1326 National Anti-Scam Hotline, operated through the government’s anti-scam response system coordinated by the DICT and Cybercrime Investigation and Coordinating Center. Be ready with the transaction reference, recipient account, platform name, phone numbers, links, and screenshots.

The hotline is useful for rapid reporting, but it does not replace a sworn criminal complaint when an investigation or prosecution is needed. Information about the government’s anti-scam program is available from the Department of Information and Communications Technology.

Call 911 if there is an immediate threat to life or physical safety.

Preserve evidence before blocking or uninstalling anything

Save complete, unedited copies where possible. Preserve:

The lender’s app name, developer, download page, website, URL, and social-media profile;
Screenshots and screen recordings of the offer, application process, loan dashboard, fees, repayment instructions, and threats;
SMS, email, chat, call logs, voice messages, and collection messages;
The original electronic files or exported conversations, not screenshots alone;
Transaction receipts, reference numbers, account statements, QR codes, and recipient details;
The loan agreement, disclosure statement, promissory note, amortization schedule, and collection notices;
Advertisements promising guaranteed approval or asking for advance payment;
The app’s permissions and privacy notice;
Evidence of contact-list access, public posts, messages to relatives or employers, or identity impersonation;
Copies of identification documents supplied to the lender, marked in your records with when and why they were sent;
Names of witnesses and short notes of what each witness personally saw or received; and
A chronological account listing dates, times, amounts, accounts, and actions taken.

Record the app’s details before uninstalling it. If keeping the app installed creates an immediate security risk, disconnect unnecessary permissions, secure the device, and seek guidance from the bank or investigator. Do not edit, crop, annotate, or repeatedly forward the only copy of important evidence.

Keep complaint acknowledgments and reference numbers from every agency. Store a backup outside the affected phone.

File a criminal complaint

Online lending fraud may fall under estafa or other offenses under the Revised Penal Code, the Cybercrime Prevention Act of 2012, the Access Devices Regulation Act, the Anti-Financial Account Scamming Act, or other laws depending on how the scheme operated. For example, Republic Act No. 10175 covers computer-related fraud and computer-related identity theft. The exact offense and responsible persons must be determined from the evidence; do not assume that every disputed charge constitutes a particular crime.

You may approach:

The NBI Cybercrime Division or an NBI regional or district office; or
The nearest police station or appropriate PNP anti-cybercrime office.

The NBI maintains an online complaint page and publishes its Cybercrime Division and other investigative contacts. Its published procedure for investigative assistance states that complainants may be interviewed, execute sworn statements, submit supporting documents, and make relevant devices available for examination. See the NBI procedure for computer-crime complaints.

Bring or prepare:

A valid government-issued ID;
A clear written chronology;
Copies of all digital and financial evidence;
The suspect’s known names, numbers, accounts, URLs, and locations;
The total amount lost or demanded;
Details of any affected bank, wallet, SIM, email, or social-media account; and
Witness details, if any.

Ask for proof that the complaint was received. A blotter entry, incident report, hotline report, and formal sworn complaint are not necessarily the same document. Ask the receiving office what further affidavit or appearance is required.

There is no single reporting deadline that applies to every form of online lending fraud. Prescriptive periods depend on the offense, penalty, facts, and applicable law. Digital records and recoverable funds can disappear much sooner, so report without waiting to determine the final legal classification.

Report the lender or platform to the SEC

A company may not conduct lending business as a lending company without SEC authority to operate. Corporate registration alone is not enough. The company behind the app should have the authority appropriate to its lending or financing activity. See Republic Act No. 9474.

The SEC accepts complaints involving, among others:

Unauthorized lending operations;
Violations of the Lending Company Regulation Act or Financing Company Act;
Failure to provide the disclosure required by the Truth in Lending Act;
Misrepresentation about the company or loan;
Unfair debt-collection conduct; and
Other regulatory violations involving lending or financing companies.

Use the SEC’s current complaint guidance for lending and financing companies or its iMessage ticketing system.

The SEC’s published instructions call for a completed complaint form, supporting evidence, and a valid government-issued ID. Submit a separate complaint form for each respondent company. The official complaint page identifies the available filing channels and explains what happens after submission.

Check both the company name and the platform name. Scammers sometimes copy the name, logo, registration number, or certificate of a legitimate company. Verify contact information independently and ask the SEC to confirm whether the app is actually operated by or reported under the authorized company.

The SEC can investigate and impose regulatory remedies within its authority, but its complaint page expressly warns that it cannot, through that process alone:

Rewrite the loan’s payment terms;
Declare an interest rate void for being excessive;
Declare the contract void; or
Cancel or settle the borrower’s obligation.

Those questions may require agreement with the lender or action in the proper court.

File a privacy complaint when personal data was misused

Report to the National Privacy Commission when the lender or app:

Accessed contacts or other device data without a valid, proportionate purpose;
Messaged relatives, co-workers, employers, or unrelated contacts about the debt;
Posted your identity, photograph, loan, or alleged delinquency publicly;
Used your ID or personal information for a loan you did not obtain;
Continued processing data after receiving a valid objection or request, where applicable;
Failed to protect your information; or
Used threats, impersonation, or fabricated images involving your personal data.

The Data Privacy Act requires lawful, fair, and proportionate processing. NPC Circular No. 2020-01 specifically addresses personal-data processing in loan-related transactions. The NPC has stated that online lenders may not harvest borrowers’ phone and social-media contact lists merely to shame or pressure them. See the NPC’s official guidance on online lenders and contact lists and Republic Act No. 10173.

Follow the NPC’s current formal complaint instructions. The NPC presently instructs complainants to use the prescribed form, print and complete it, have it notarized, and submit it through an authorized channel with supporting documents. Review the current form and procedural rules before filing because verification, prior notice to the respondent, filing periods, fees, and exceptions can depend on the type and circumstances of the complaint.

If another person’s contacts or data were exposed, that person may also have an independent complaint. Do not file in someone else’s name without authority.

Escalate unresolved complaints involving BSP-supervised institutions

If the transaction or complaint concerns a BSP-supervised financial institution, first complain through that institution’s official consumer-assistance channel. If the issue remains unresolved, escalate it through the BSP Consumer Assistance Mechanism.

The BSP provides its Online Buddy or BOB, as well as a Complaints, Inquiries and Requests form that may be sent to consumeraffairs@bsp.gov.ph. Include the complaint you previously sent to the institution, its response if any, your requested resolution, and relevant supporting documents. Follow the current instructions on the BSP Consumer Assistance Channels page.

The BSP route is for complaints involving institutions it supervises. A stand-alone lending company regulated by the SEC is not converted into a BSP-supervised institution merely because payment passed through a bank or e-wallet. The BSP may address the conduct of the supervised payment institution, while the SEC, NPC, police, or NBI handles other parts of the incident.

If a loan was opened in your name

If you did not apply for the loan:

Notify the purported lender in writing that you dispute the account and request the application, contract, disbursement record, authentication logs, device information, and identity-verification records.
Do not admit the debt or agree to a restructuring merely to stop collection calls.
Ask where the proceeds were sent and provide that information to investigators.
Notify the bank, wallet, email provider, and mobile carrier connected to the identity theft.
File a criminal complaint and preserve proof of your whereabouts, devices, numbers, and genuine signatures at the relevant time.
If your personal information was misused, pursue the NPC process.
If adverse credit information appears, dispute it in writing with the reporting entity and the appropriate credit-information participant.

Do not send additional IDs to an unverified email address or social-media account. Confirm the lender’s official data-protection or complaint channel independently.

Common mistakes to avoid

Paying another fee to unlock or refund the first payment. This is a common continuation of the scam.
Hiring an unverified “fund recovery” service. Scammers frequently return under a new identity and demand recovery fees.
Deleting chats or uninstalling the app before documenting it.
Reporting only to the app store or social-media platform. A takedown request is useful but is not a government complaint.
Waiting for the lender to admit wrongdoing before contacting the bank.
Posting unredacted IDs, account numbers, contracts, or screenshots publicly.
Assuming an SEC registration number proves that the app is legitimate. Confirm the authority to operate and the connection between the company and platform.
Treating every collection demand as proof of fraud. Check the contract, disclosure statement, disbursement, and payment history.
Ignoring a summons, subpoena, court paper, or formal demand. Verify it directly with the issuing court or agency and obtain legal advice promptly.
Believing that a complaint automatically erases a real loan. Pay undisputed obligations through verified channels while formally disputing unauthorized or incorrect amounts.

When legal help is urgent

Consult a Philippine lawyer or the Public Attorney’s Office, if eligible, as soon as possible when:

A large amount or several accounts are involved;
Your identity was used for multiple loans;
A lender has sued, threatened foreclosure, or obtained a court order;
You received a subpoena or must execute a detailed affidavit;
The scam involves a company, employer, family member, or shared account;
Intimate images, threats of violence, stalking, or extortion are involved;
A minor or vulnerable person is affected;
The lender continues publishing personal information despite written notice;
You need an injunction, damages, contract cancellation, or another court remedy; or
An agency rejected the complaint for a procedural or jurisdictional reason.

For immediate danger, call 911 and go to a safe place.

Frequently asked questions

Should I pay a processing fee before a loan is released?

Treat an unexpected advance-fee demand as a serious warning sign, especially when payment must go to a personal account, cryptocurrency wallet, or unrelated e-wallet. Verify the company and loan through independently obtained official contact details. Do not rely on certificates or screenshots sent by the supposed agent.

Can I recover money sent to a scammer?

Possibly, but there is no guarantee. Recovery is more likely when the bank or e-wallet receives a prompt, well-documented report before the funds are withdrawn or transferred onward. Report immediately and obtain a case number.

Is harassment by a real online lender considered fraud?

Not necessarily. It may instead involve prohibited debt-collection practices, privacy violations, threats, coercion, or another offense. Report the conduct to the SEC or NPC as appropriate, and to law enforcement if it includes criminal threats, extortion, impersonation, or other suspected crimes.

Can the lender contact everyone in my phone?

Accessing or using an entire contact list for collection is not automatically lawful merely because an app requested permission. Personal-data processing must have a lawful basis and be necessary and proportionate. Debt-shaming or disclosing a debt to unrelated contacts may support an NPC and SEC complaint.

Will reporting cancel my loan?

No. Reporting fraud or misconduct does not automatically cancel a valid principal obligation. It may help challenge an unauthorized loan, incorrect charges, unlawful practices, or a fraudulent transaction. Contract validity and monetary liability depend on the evidence and, when contested, may require a court’s determination.

Should I report even if I did not lose money?

Yes, particularly if the scammer obtained your ID, account credentials, OTP, device access, selfie, signature, or contact list. Secure affected accounts, preserve the attempted transaction, and report the incident before the information is reused.

Must I choose between the SEC, NPC, BSP, police, and NBI?

No. Their authority can overlap but is not identical. A single incident may justify reports to the payment provider, 1326, law enforcement, the SEC, and the NPC, with BSP escalation for the conduct of a BSP-supervised institution.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Procedures and remedies depend on the documents, institutions, transactions, and conduct involved. Official sources and filing information were checked as of 29 August 2026.