The Scale of the Problem

As of 2026, the Presidential Anti-Organized Crime Commission (PAOCC) has received over 15,000 formal complaints against abusive online lending apps (OLAs). Many victims suffer repeated harassment, public shaming on Facebook/Viber, death threats, unauthorized contact harvesting from phonebooks, gallery access, and doxxing. Most predatory apps are unregistered with the SEC and operate illegally.

Common Violations by Online Lending Apps

Unauthorized access to contacts, photos, SMS, microphone, or location
Harvesting and sharing third-party data (family, friends, colleagues)
Public shaming / “doxxing” on social media
Death threats, rape threats, profanity, fake police/military calls
Extremely high effective interest rates (often 300%–1,000%+ p.a.)
Fake “processing fee” or deposit scams

Key Laws Applicable

Data Privacy Act of 2012 (RA 10173) + NPC Circular 20-01 (prohibits contact harvesting for collection)
Lending Company Regulation Act (RA 9474)
Financing Company Act (RA 8556)
SEC Memorandum Circular No. 18, s. 2019 (Unfair Debt Collection Practices)
Cybercrime Prevention Act (RA 10175) + Grave Threats (Art. 282, Revised Penal Code)
RA 11313 (Bawal Bastos Law) – if sexual in nature

Recommended Order of Filing (Most Effective Strategy)

Securities and Exchange Commission (SEC) → Fastest results against unregistered apps
National Privacy Commission (NPC) → Strongest for privacy violations
PNP Anti-Cybercrime Group (ACG) / NBI Cybercrime Division → For criminal threats

1. Filing with the SEC (Primary & Most Recommended Route)

Best for: Unlicensed operation, unfair collection, shaming

How to File (2026):

Preferred: Online via iMessage portal → https://imessage.sec.gov.ph/
Alternative: Email epd@sec.gov.ph (Enforcement and Investor Protection Department)
Subject: “Complaint vs. [App Name] – Illegal Lending + Harassment”

Requirements:

Sworn Complaint-Affidavit (notarized)
Screenshots of app, loan agreement, collection messages, shaming posts
Proof of disbursement
List of contacted persons (if any)

Possible SEC Actions:

Cease & Desist Order
App takedown (Google Play / App Store)
Fines up to ₱1,000,000
Criminal referral to DOJ/NBI

2. Filing with the National Privacy Commission (NPC)

Best for: Pure privacy violations (contact harvesting, data sharing, shaming)

Current Procedure (as of 2026):

Download the official 2025 Complaint-Affidavit Form: → https://privacy.gov.ph/wp-content/uploads/2025/07/2025.07.01-Complaint-Affidavit-with-Q_A.pdf
Completely fill out, print, notarize
Mandatory: First send a formal written complaint to the company’s Data Protection Officer (DPO) and wait 15 days (Exhaustion of Administrative Remedies)

Submission Options:

Email (scanned notarized copy): complaints@privacy.gov.ph
Personal: NPC Office, PICC, Pasay City
Courier: Same address

Penalties NPC Can Impose:

Up to ₱5,000,000 per violation
Order to delete all harvested data
Criminal prosecution (up to 6 years imprisonment)

3. Criminal Complaint (Threats & Cyberlibel)

File at:

PNP Anti-Cybercrime Group → acg@pnp.gov.ph or their online complaint form
NBI Cybercrime Division (main office or regional)
DOJ Office of Cybercrime → cybercrime@doj.gov.ph

Common Charges:

Grave Threats
Cyberlibel / Online Libel
Extortion / Blackmail
Violation of RA 11313

Essential Evidence Checklist

App name, package name, company name, registration details
Loan agreement / Promissory Note screenshots
All collection messages (with timestamps & numbers)
Screenshots of shaming posts (Facebook, Viber groups, TikTok)
Call logs / recordings (if legal)
Messages received by family/friends
Proof you paid or tried to pay

Additional Remedies

File small claims for actual damages + moral damages (up to ₱1,000,000)
Class action or mass complaints (highly encouraged – NPC & SEC fast-track these)
Report to PAOCC One-Stop Desk (they coordinate multi-agency actions)

Best Practice in 2026: File simultaneously with SEC + NPC. Criminal complaint only if there are serious threats (death, rape, kidnapping).

Most victims who file properly with SEC and NPC see collection harassment stop within 2–8 weeks after the agency issues a warning or C&D order.

This is the complete, updated process as of February 2026.