If an online lending app is harassing you, messaging your contacts, threatening to shame you online, hiding charges, or operating without proper authority, you have several remedies in the Philippines. The right complaint route depends on what happened: the Securities and Exchange Commission (SEC) usually handles online lending apps and financing/lending companies; the National Privacy Commission (NPC) handles misuse of personal data; the BSP handles banks and other BSP-supervised financial institutions; and the PNP Anti-Cybercrime Group, NBI Cybercrime Division, CICC, or prosecutor’s office may be appropriate when there are threats, cyber libel, identity theft, hacking, or extortion. This guide explains where to file, what evidence to prepare, what laws protect you, and what to realistically expect after filing a complaint.

What Problems Can You Complain About?

Online lending app complaints in the Philippines usually fall into one or more of these categories:

Harassment or abusive debt collection, such as repeated threats, insults, intimidation, or humiliating messages.
Contacting your phone contacts, employer, relatives, neighbors, or social media friends to pressure you to pay.
Posting or threatening to post your personal information online.
False statements, such as claiming that you already have an arrest warrant or that non-payment alone automatically means jail.
Hidden interest, charges, or loan terms, especially when the app did not clearly disclose the total finance charge, effective interest, penalties, or net proceeds.
Operating without SEC authority, or using a different app name from the registered corporate lender.
Unauthorized processing of personal data, including excessive app permissions, access to contacts, photos, or location, or sharing your personal data with third parties without a lawful basis.
Cybercrimes, such as identity theft, hacking, cyber libel, threats, extortion, or creating fake posts or edited images.

A single incident can justify more than one complaint. For example, if a collector threatens you and sends your loan details to your contacts, you may have an SEC complaint for unfair collection practices, an NPC complaint for data privacy violations, and a criminal complaint if the messages contain threats, extortion, or defamatory accusations.

Which Government Agency Should You File With?

Your main problem	Where to file	Practical notes
Harassment, abusive collection, unfair collection practices, hidden loan charges, deceptive app advertising, or an online lending app operating as a lending/financing company	SEC	The SEC regulates lending companies and financing companies. BSP guidance also says complaints involving financing companies, lending companies, online lending apps/platforms, and collection agencies are best directed to the SEC.
Accessing your phone contacts, sending messages to your contacts, posting your personal data, refusing to correct/delete data, or excessive collection of personal information	National Privacy Commission (NPC)	The Data Privacy Act gives data subjects rights over their personal information and empowers the NPC to receive complaints, investigate, mediate, adjudicate, issue orders, and award indemnity. (National Privacy Commission)
The lender is a bank, credit card issuer, e-money issuer, or another BSP-supervised financial institution	Financial institution first, then BSP Consumer Assistance Mechanism	BSP consumer assistance is generally second-level recourse. The consumer should first complain to the financial institution’s own assistance mechanism, then elevate to the BSP if unresolved.
Death threats, threats of physical harm, blackmail, hacking, identity theft, fake social media posts, cyber libel, or extortion	PNP Anti-Cybercrime Group, NBI Cybercrime Division, CICC, or prosecutor’s office	These may involve criminal laws such as the Revised Penal Code and the Cybercrime Prevention Act of 2012, depending on the exact acts committed. (Supreme Court E-Library)
Inaccurate credit information or credit report issues	Credit Information Corporation or the relevant submitting entity	This is different from harassment. For collection harassment by online lending apps, the SEC and NPC are usually more relevant. (Credit Information Corporation (CIC))

Legal Basis: Your Rights Against Abusive Online Lending Apps

SEC regulation of lending and financing companies

Most online lending apps are connected to a lending company or financing company. Under the Lending Company Regulation Act of 2007, Republic Act No. 9474, a lending company must generally be a corporation and must have authority from the SEC before conducting lending business. The SEC has authority to regulate, supervise, require reports, inspect, and impose administrative sanctions on lending companies, including suspension, revocation, and fines. (Supreme Court E-Library)

Financing companies are separately governed by the Financing Company Act of 1998, Republic Act No. 8556, which also requires proper corporate authority and places financing companies under SEC enforcement, subject to certain powers of the Monetary Board on rates and charges. (Lawphil)

This means an app cannot simply say, “We are just a platform,” if it is effectively offering loans, collecting payments, or using a lending/financing company structure without the required authority.

Truth in lending and disclosure of charges

The Truth in Lending Act, Republic Act No. 3765, protects borrowers by requiring clear disclosure of the true cost of credit. Creditors must disclose items such as the amount financed, finance charges, and the total charges in writing. (Lawphil)

For online loans, this matters because many borrowers receive less than the advertised loan amount after service fees, processing fees, platform fees, or advance interest are deducted. A borrower should be able to understand:

the principal amount;
the net proceeds actually released;
interest;
service or processing fees;
penalty charges;
due date;
total amount payable;
consequences of late payment.

The SEC has also issued circulars for financing and lending companies, including rules on unfair debt collection practices, online lending platform reporting, advertisements, and truth-in-lending implementation. (SEC Appointment System)

Financial consumer protection rights

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, recognizes financial consumer rights such as fair treatment, disclosure and transparency, protection against fraud and misuse, data privacy and protection, and timely handling of complaints. It applies to financial products and services, including those offered through digital channels, and identifies regulators such as the SEC and BSP. (Supreme Court E-Library)

This law is especially important for app-based lending because it recognizes modern financial services delivered through online or digital channels. It also states that financial service providers may be responsible for acts of accredited third-party service providers involved in marketing, transactions, or debt collection. (Supreme Court E-Library)

Data privacy rights

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information and sensitive personal information. It defines personal information processing broadly, including collection, recording, organization, storage, retrieval, use, disclosure, blocking, erasure, and destruction. (National Privacy Commission)

As a data subject, you have rights such as access, correction, blocking, removal, destruction of unlawfully obtained or unauthorized data, and indemnity for damages in proper cases. (National Privacy Commission)

For online lending apps, common data privacy issues include:

accessing contacts without a valid purpose;
using contact lists to shame or pressure borrowers;
sending loan details to relatives, friends, employers, or co-workers;
collecting excessive personal data not necessary for the loan;
posting personal information publicly;
refusing to correct or delete unlawfully processed data.

Government guidance has also identified concerns involving app access to debtor phone contacts, posting personal information, threats of death or physical injury, and profane language. (Credit Information Corporation (CIC))

Criminal laws may apply to threats, defamation, and coercion

Debt collection is not a license to threaten, defame, coerce, or humiliate a borrower. Depending on the facts, abusive conduct may involve provisions of the Revised Penal Code, including grave threats, coercion, unjust vexation, libel, oral defamation, slander by deed, or intriguing against honor. (Supreme Court E-Library)

If the act is committed through a computer system, social media, messaging app, or other information and communications technology, the Cybercrime Prevention Act of 2012, Republic Act No. 10175, may also be relevant. (Lawphil)

Non-payment of an ordinary loan is generally a civil matter. However, separate acts such as threats, cyber libel, identity theft, falsification, fraud, or extortion can create criminal exposure for the person committing those acts.

Before Filing: Preserve Evidence Immediately

Your complaint will be stronger if you present organized proof. Do this before uninstalling the app, deleting messages, or changing phones.

Evidence to save

Save clear copies of:

the app name and app store page;
the corporate name of the lender, if shown in the app, loan agreement, privacy policy, disclosure statement, or email;
SEC registration details or certificate of authority, if displayed;
screenshots of the loan offer, loan agreement, disclosure statement, interest, fees, due date, and penalties;
proof of disbursement, such as bank or e-wallet transaction history;
proof of payments made;
collection messages, SMS, emails, chat messages, Viber, WhatsApp, Telegram, Messenger, or social media posts;
call logs showing repeated calls;
names, phone numbers, user IDs, email addresses, and account names of collectors;
messages sent to your contacts, employer, family, or friends;
screenshots of defamatory posts, threats, edited images, or public shaming;
app permissions showing access to contacts, photos, location, camera, microphone, or storage;
the app’s privacy policy and terms and conditions;
your prior complaint to the app or company, if any.

For online posts, capture the date, time, profile name, URL or username, comments, and full screen. If a friend or co-worker received a message about your loan, ask them to send screenshots showing the sender, date, number, and full content.

Make a simple timeline

Prepare a one- to two-page timeline with:

date of loan application;
amount applied for;
amount actually received;
due date;
amount demanded;
payments made;
first harassment incident;
contacts who received messages;
threats or posts made;
steps you took to complain to the app.

Agencies handle many complaints. A clear timeline helps the evaluator understand what happened quickly.

Protect your accounts

Do not share your OTP, PIN, passwords, account numbers, card numbers, passport details, or full ID details with anyone claiming to process your complaint. BSP consumer guidance specifically warns consumers not to share sensitive credentials and account information when filing complaints.

You may also consider revoking app permissions, changing passwords, enabling two-factor authentication, checking e-wallet and bank activity, and warning close contacts not to respond to collectors.

Step-by-Step: How to File a Complaint with the SEC

The SEC is usually the main agency for complaints against online lending apps operating as lending or financing companies.

1. Identify the correct respondent

Do not rely only on the app name. Many lending apps use a brand name that is different from the corporate name.

Look for the respondent’s legal name in:

loan agreement;
disclosure statement;
privacy policy;
app terms and conditions;
app store developer page;
SMS or email footer;
collection demand letter;
payment instructions;
SEC registration or certificate of authority shown in the app.

If you cannot identify the company, state that clearly in your complaint and provide all app names, phone numbers, payment accounts, screenshots, and app store links you can find.

2. Check whether the company is authorized or recorded

Under RA 9474, lending companies generally need SEC authority to operate as lending companies. (Supreme Court E-Library)

The SEC has previously directed complainants to verify lending companies, financing companies, and recorded online lending platforms through SEC lists and related verification channels. (www.foi.gov.ph)

This step matters because your complaint may involve not only harassment but also possible unauthorized lending activity.

3. Prepare your written complaint

Your complaint should be factual and organized. Include:

your full name and contact details;
app name and corporate name, if known;
loan account number, if any;
amount borrowed and amount released;
amount demanded;
due date and payment history;
names, numbers, and accounts used by collectors;
exact words used in threats or harassment;
names of contacts who received messages;
explanation of hidden fees or misleading disclosures;
list of attachments;
what action you are asking the SEC to take.

Avoid writing only “Please help, they are harassing me.” Instead, give concrete details:

“On 12 March 2026 at 8:43 a.m., collector number 09XX-XXX-XXXX sent a message to my employer stating that I am a scammer and demanding payment of ₱4,500. A screenshot is attached as Annex C. I did not authorize the company to disclose my loan details to my employer.”

4. File through the SEC iMessage portal

The SEC has an official iMessage web-based platform for public inquiries, complaints, incidents, and requests. It generates a unique e-ticket and was created to replace informal channels such as direct email or Google Forms for many SEC concerns. (iMessage)

The SEC iMessage portal accepts feedback, reports, and complaints, and the SEC states that it takes every ticket seriously. (iMessage)

When filing, choose the category or department most closely related to lending and financing companies or consumer complaints. Attach your evidence in organized files. If the portal limits uploads, submit the most important documents first and state that you can provide additional annexes upon request.

5. Keep your ticket number and monitor responses

After submission, save:

ticket number;
date and time filed;
confirmation email or screenshot;
copies of all uploaded documents;
any follow-up instructions from the SEC.

If the SEC asks for clarification, answer directly and attach missing evidence. Delays often happen because the complaint does not identify the company, lacks screenshots, or does not clearly explain the timeline.

6. Understand what the SEC can and cannot do

The SEC can investigate regulated entities and impose administrative sanctions within its authority. Under RA 9474, the SEC may regulate, supervise, inspect, require reports, and impose sanctions on lending companies. (Supreme Court E-Library)

Under RA 11765, regulators such as the SEC may also enforce financial consumer protection rules and, in appropriate cases, order payment or reimbursement arising from financial consumer complaints. (Supreme Court E-Library)

However, an SEC complaint does not automatically cancel a valid debt. If you borrowed money, the underlying obligation may still need to be resolved. The complaint focuses on unlawful, abusive, deceptive, or unauthorized conduct.

Step-by-Step: How to File a Data Privacy Complaint with the NPC

File with the NPC if the online lending app misused your personal data, accessed your contacts, disclosed your loan to other people, posted your information, or refused to respect your data rights.

1. Use the correct NPC complaint form

The NPC requires formal complaints to follow a specific format. Its public guidance says complainants should download the form, fill it out, have it notarized, and submit it in person, by courier, or by scanning and emailing it to the NPC complaints email address. (National Privacy Commission)

The NPC also announced a new Complaint-Affidavit template effective July 1, 2025, and stated that the old version would no longer be accepted after the transition period. (National Privacy Commission)

Using the wrong form is a common reason for delay.

2. State the privacy violation clearly

Your NPC complaint should explain what personal data was processed and why the processing was improper. Examples:

“The app accessed my contacts and sent my loan details to my sister and employer.”
“The collector posted my name, photo, phone number, and alleged debt on Facebook.”
“The app required access to my entire contact list even though this was not necessary for loan processing.”
“I withdrew consent and requested deletion, but the company continued using my data for collection harassment.”
“My personal information was shared with unknown third-party collectors.”

The Data Privacy Act gives data subjects rights to access, correct, block, remove, or destroy unlawfully obtained or unauthorized personal data, and to seek indemnity in proper cases. (National Privacy Commission)

3. Attach privacy-specific evidence

For NPC complaints, include:

screenshots of app permissions;
privacy policy and terms;
messages sent to your contacts;
screenshots of posts containing your personal data;
proof that the information came from the lending app or collector;
names and phone numbers of affected contacts;
your request for correction, deletion, blocking, or withdrawal of consent, if any;
proof that the company ignored or denied your request.

4. Notarize and submit

A formal NPC complaint generally requires a notarized complaint-affidavit. Submission may be done personally, by courier, or by scanned email submission to the NPC complaints address, following NPC requirements. (National Privacy Commission)

If you are abroad, you may need to execute documents before a Philippine embassy or consulate, or use notarization/apostille procedures depending on how the document will be used. For an initial inquiry or scanned submission, check the NPC’s current instructions, but for formal affidavits, expect identity verification and notarization requirements.

5. Possible NPC action

The NPC can receive complaints, investigate, mediate, adjudicate, issue cease-and-desist orders, and award indemnity in proper cases under the Data Privacy Act. (National Privacy Commission)

NPC cases can take time, especially when the respondent is difficult to identify, the app uses several names, or the evidence does not clearly connect the collector to the lender.

When to File with the BSP Instead

File with the BSP only if the financial institution is BSP-supervised, such as a bank, credit card issuer, e-money issuer, or another covered financial institution.

BSP consumer guidance states that its Consumer Assistance Mechanism is generally a second-level recourse. You should first file with the financial institution’s own consumer assistance or customer service mechanism. If unresolved, you may escalate to the BSP through its consumer assistance channels.

The BSP guidance also specifically says complaints involving financing companies, lending companies, online lending apps/platforms, and collection agencies are best directed to the SEC.

When to File a Criminal Complaint

Go to law enforcement or the prosecutor’s office if the situation involves more than an ordinary collection dispute.

Examples include:

threats to kill you or harm your family;
threats to publish edited nude images or fake scandal content;
blackmail or extortion;
hacking or unauthorized access to accounts;
identity theft;
pretending to be a police officer, court sheriff, prosecutor, or lawyer;
posting defamatory accusations online;
sending humiliating messages to your employer or community;
using your photos, IDs, or personal information to create fake accounts.

The Revised Penal Code includes provisions on threats, coercion, libel, slander, and other offenses against honor. (Supreme Court E-Library)

If the act was done through online platforms, mobile apps, SMS, messaging apps, or social media, the Cybercrime Prevention Act may also become relevant. (Lawphil)

For cybercrime concerns, BSP public guidance also lists contact channels for the PNP Anti-Cybercrime Group, NBI Cybercrime Division, and Cybercrime Investigation and Coordinating Center.

Documents to Prepare

Document	Why it matters	Practical tip
Valid government ID	Confirms your identity as complainant	Redact unnecessary ID numbers when sharing outside official channels.
Loan agreement or disclosure statement	Shows loan amount, interest, fees, due date, and lender identity	Screenshot the full document, not only the first page.
App screenshots	Helps identify the app, developer, terms, permissions, and loan details	Include date/time where possible.
Payment proof	Shows what you already paid and when	Include bank/e-wallet reference numbers.
Harassment screenshots	Core evidence for SEC or criminal complaint	Capture sender number, date, time, and full message.
Screenshots from contacts	Proves third-party disclosure or shaming	Ask contacts not to delete messages.
Call logs and recordings	Shows frequency and pattern of collection calls	Note that recordings may raise privacy issues; use them carefully and preserve call logs at minimum.
Privacy policy and app permissions	Supports NPC complaint	Screenshot permissions before uninstalling the app.
Written timeline	Helps agencies understand the case quickly	Use dates, amounts, names, and exact events.
Notarized complaint-affidavit	Usually needed for formal NPC or criminal complaints	Use the current official form when filing with NPC.
Special power of attorney	Useful if someone in the Philippines will file for an OFW or foreigner abroad	Attach IDs of both principal and representative.

Practical Timelines and Bottlenecks

Timelines vary widely because complaints depend on the agency, completeness of evidence, respondent identity, and whether the case becomes administrative, privacy-related, or criminal.

Stage	Usual practical timing	Common bottleneck
Evidence gathering	Same day to 1 week	Deleted chats, missing app screenshots, contacts unwilling to provide screenshots
SEC ticket filing	Same day once documents are ready	Wrong or incomplete respondent name
SEC evaluation or referral	Weeks to months	Large complaint volume, unclear facts, missing attachments
NPC complaint preparation	Several days to 2 weeks	Notarization, wrong template, incomplete affidavit
NPC proceedings	Months or longer	Difficulty identifying data controller or proving disclosure
Criminal complaint preparation	Days to weeks	Need for affidavits, certified screenshots, witness cooperation
Prosecutor or cybercrime investigation	Months or longer	Technical evidence, identity of anonymous accounts, telco/platform records

A good complaint is not necessarily long. It is clear, chronological, evidence-based, and specific.

Common Mistakes to Avoid

Deleting the app too early

Many borrowers uninstall the app immediately after harassment starts. This can remove access to loan details, terms, privacy settings, and in-app messages. Take screenshots first, then consider revoking permissions or uninstalling.

Filing with only emotional statements

Agencies need facts. Instead of saying “They destroyed my life,” write what happened, when, who did it, what was said, who received the message, and what proof is attached.

Naming only the app, not the company

The app name may not be the legal respondent. Always look for the corporate name in the loan agreement, privacy policy, payment instructions, and app store developer profile.

Paying random “settlement” accounts without verification

Some collectors use personal e-wallets or bank accounts. Before paying, verify that the payment channel is official and that you will receive a receipt or updated statement. Keep screenshots of every payment.

Thinking an SEC or NPC complaint automatically erases the loan

A complaint may address harassment, privacy violations, deceptive practices, or unauthorized operations. It does not automatically cancel a legitimate debt. However, unlawful charges, undisclosed fees, or abusive collection methods may be relevant to the agency’s action.

Ignoring threats because “it is just debt collection”

Threats of harm, public shaming, fake criminal cases, and sexualized edited images should be preserved and escalated quickly. These are not normal collection practices.

Special Situations

The online lending app contacted my employer

Save the message your employer received. Ask the recipient to provide a screenshot showing the sender, number, date, time, and full message. Include this in both the SEC complaint and, if personal data was disclosed, the NPC complaint.

If the message falsely accuses you of being a scammer, criminal, or immoral person, criminal or civil remedies may also be relevant depending on the exact wording and publication.

The collector says I will be arrested

A collector cannot truthfully say that an ordinary unpaid loan automatically results in jail. Non-payment of a loan is generally a civil matter. Criminal liability requires a separate criminal act, such as fraud, falsification, threats, or other offenses.

Save the threat. False threats of legal action may support an unfair collection complaint, especially if used to intimidate the borrower.

The app is not registered with the SEC

State this in your complaint and attach screenshots showing the app name, developer, loan documents, and payment channels. Under RA 9474, a lending company must have SEC authority to operate. (Supreme Court E-Library)

If the app is unregistered or uses multiple names, the SEC, NPC, or law enforcement may need the technical details you provide to identify the operators.

I am an OFW or foreigner outside the Philippines

You can still organize evidence and file online where the agency accepts electronic submissions. For formal affidavits or representative filing, you may need notarization, consular acknowledgment, apostille, or a special power of attorney, depending on the document and agency requirement.

If someone in the Philippines will file on your behalf, prepare:

special power of attorney;
copy of your ID or passport;
representative’s valid ID;
complete evidence folder;
signed narrative or affidavit.

I really owe money. Can I still complain?

Yes. Owing money does not allow a lender or collector to harass you, shame you, misuse your data, threaten you, or deceive you about legal consequences. Your complaint should separate two issues:

the loan obligation, including principal, interest, fees, and payment history; and
the unlawful conduct, such as harassment, data misuse, threats, or hidden charges.

Frequently Asked Questions

Where do I file a complaint against an online lending app in the Philippines?

For most online lending app complaints, file with the SEC, especially if the issue involves unfair collection practices, hidden charges, deceptive lending practices, or unauthorized lending. File with the NPC if the app accessed your contacts, shared your personal data, or posted your information. File with cybercrime authorities or the prosecutor if there are threats, extortion, identity theft, hacking, or online defamation.

Is it better to complain to the SEC or NPC?

It depends on the violation. The SEC is usually better for lending-related misconduct, such as abusive collection and unauthorized lending. The NPC is better for personal data misuse, such as contacting your phone contacts or posting your personal information. Many serious online lending app cases require both.

Can an online lending app contact my phone contacts?

An online lending app should not misuse your contact list to shame, harass, or pressure you through other people. If the app accessed or used your contacts beyond what is lawful, necessary, transparent, and consented to, you may file a privacy complaint with the NPC and a lending-related complaint with the SEC.

Can I be jailed for not paying an online loan?

Non-payment of an ordinary loan is generally a civil matter. A collector should not threaten arrest merely because you cannot pay. However, separate acts such as fraud, falsification, threats, identity theft, or other criminal conduct can create criminal issues. Save any message claiming you will be arrested and include it in your complaint.

What if the app is not on the SEC list?

Gather all evidence showing the app name, developer, company name, payment accounts, loan documents, phone numbers, and messages. The fact that you cannot find the app or company in SEC records may be important. Under Philippine law, lending companies generally need SEC authority before operating as lending companies. (Supreme Court E-Library)

Do I need a lawyer to file a complaint?

For an initial SEC complaint, many borrowers file on their own if they have clear evidence. For NPC formal complaints, criminal complaints, complex harassment cases, large amounts, or cases involving public posts and serious threats, properly drafted affidavits and organized evidence become more important.

How long does an online lending app complaint take?

A simple ticket or initial complaint can be filed quickly once your evidence is ready. Agency evaluation may take weeks or months depending on complaint volume, completeness of documents, and whether the respondent can be identified. NPC and criminal proceedings can take longer because they may require affidavits, investigation, mediation, or adjudication.

What is the strongest evidence against an online lending app?

The strongest evidence usually includes dated screenshots of threats or harassment, messages sent to your contacts, loan agreements showing charges, payment records, app permissions, privacy policy screenshots, and a clear timeline connecting the collector or app to the lending company.

Can I file even if the collector used a different phone number every time?

Yes. Save all numbers, screenshots, names, account handles, payment channels, and the timing of each message. Patterns matter. If the messages refer to the same loan, amount, app, or due date, that can help connect the collectors to the lending operation.

Can I file a complaint from abroad?

Yes, especially for SEC iMessage submissions or scanned NPC submissions where allowed. For formal affidavits, criminal complaints, or representative filing in the Philippines, you may need notarization, consular acknowledgment, apostille, or a special power of attorney depending on the agency or proceeding.

Key Takeaways

File with the SEC for most complaints against online lending apps, abusive collection practices, hidden charges, deceptive ads, or unauthorized lending.
File with the NPC when the app misuses your personal data, accesses contacts, shares your loan details, or posts your information.
File with cybercrime authorities or the prosecutor for threats, extortion, identity theft, hacking, cyber libel, or serious online harassment.
Save evidence before deleting the app: screenshots, loan terms, payment records, messages, call logs, app permissions, and messages sent to your contacts.
Identify the legal company behind the app, not just the app name.
A complaint does not automatically erase a valid debt, but lenders and collectors must still follow Philippine law.
The most effective complaints are factual, chronological, specific, and supported by clear attachments.