How to File a Complaint Against Unfair Online Lending Apps (Philippines)

Last updated for laws and rules known as of mid-2024. This is general information, not legal advice.

At a glance (who handles what)

If the app is a non-bank “lending” or “financing” company → Securities and Exchange Commission (SEC) Issues: unregistered apps/companies, illegal/abusive collection, hidden/false fees, deceptive ads, unfair terms.
If the lender is a bank or thrift/rural bank → Bangko Sentral ng Pilipinas (BSP) Issues: bank-issued digital loans, credit cards, CAM/complaint handling failures.
If your phonebook/photos were scraped, contacts harassed, or you were “debt-shamed” → National Privacy Commission (NPC) Issues: unlawful processing of personal data, over-collection, unauthorized disclosure.
If there are threats, extortion, doxxing, cyberlibel, or stalking → PNP Anti-Cybercrime Group (ACG) / NBI Cybercrime Division and your City/Provincial Prosecutor Criminal remedies under the Cybercrime Prevention Act, Revised Penal Code, and related laws.
If the app has scammy or harmful content → Report to Google Play / Apple App Store for takedown review.

You can pursue several tracks at once (e.g., SEC + NPC + police), and filing a complaint does not erase a legitimate debt—it stops abusive or unlawful practices and triggers regulation.

What “unfair” looks like under Philippine rules

Data-privacy violations: scraping your contacts or photos; mass-messaging family/employer; posting your face online (a.k.a. debt shaming); keeping data longer than needed; refusing your data rights. (Data Privacy Act of 2012.)
Abusive collection: threats of arrest or “warrants,” profane/obscene messages, fake government notices, contacting people unrelated to the debt except to locate you, public shaming, doxxing.
Deceptive lending terms: hiding true costs; “service/processing fees” that gut the loan proceeds; bait-and-switch interest or penalties; misrepresenting approvals.
Operating illegally: no SEC Certificate of Authority to operate as a lending/financing company; using shell entities; changing app names to evade enforcement.
Unconscionable charges: while statutory interest ceilings on private loans are largely deregulated, courts may strike down iniquitous or unconscionable interest/penalties and reduce them to reasonable levels under the Civil Code and jurisprudence.

Your rights as a borrower & data subject

Right to clear, truthful disclosure of loan amounts, fees, APR/charges, and collection practices.
Right to fair treatment—no harassment, threats, or public shaming.
Data rights: to be informed, to access, to object, to erasure/blocking of unlawfully processed data, and to damages for proven violations (Data Privacy Act).
Right to redress: to use the lender’s Consumer Assistance Mechanism (CAM) and escalate to the proper regulator (SEC or BSP) if unresolved or the issue is serious/urgent.

Before you file: secure yourself and gather proof

Secure your device & accounts
- Revoke the app’s permissions (Contacts, SMS, Storage, Camera, Location).
- Change passwords for email/social/e-wallets; enable 2FA.
- Consider uninstalling the app after you’ve captured evidence.
Preserve evidence
- Screenshots/screen recordings of: app listing, loan terms, in-app chats, text/IM threats, calls (call logs), social posts used to shame you.
- Copies of IDs you submitted, receipts, payment confirmations, loan agreement, and any “consents.”
- A written timeline: dates of borrowing, due dates, messages received, people contacted by the lender, and your responses.
- Names/roles of collection agents if shown; phone numbers and links used.
Check who regulates the lender
- Is it a bank-issued digital loan? (BSP)
- Is it a lending/financing company? (SEC)
- Are there privacy harms? (NPC)
- Are there threats/extortion/cyberlibel? (PNP ACG/NBI + Prosecutor)

Tip: Keep a simple one-page Evidence Log (Date · What happened · Who did it · Proof file name).

Step-by-step: where and how to complain

A. Write to the lender first (fast, but important)

Most regulators expect you to contact the company’s complaints/CAM and give them a reasonable chance to fix things—except when there is an urgent risk (e.g., ongoing public shaming, threats, or clear illegality).

Send a short, dated email/message that: (1) disputes unlawful/abusive acts, (2) demands they cease harassment/debt shaming, (3) invokes your data rights (stop contacting third parties; delete unlawfully collected data), (4) asks for a full cost breakdown and official payment channels, and (5) gives a clear response deadline (e.g., 5–10 days).
Attach screenshots and your ID (with sensitive numbers masked).

Keep proof you sent this (sent-mail, tracking number, etc.).

B. Escalate to the right regulator(s)

1) SEC (Lending/Financing companies; unregistered/abusive OLAs)

What to file: A complaint/affidavit with your evidence, identifying the app name, real company name (if known), and all abusive acts (debt shaming, threats, hidden fees, no Certificate of Authority, etc.).
What SEC can do: Investigate, issue cease-and-desist orders, seek takedowns, impose administrative sanctions, and recommend criminal action against illegally operating entities.
What to attach: Your ID, loan documents, screenshots, call logs, timeline, copy of your demand to the lender, and a computation showing misleading/undisclosed fees if applicable.
Where: SEC’s enforcement/complaints channels (head office or extension offices; online intake is typically available). Check the SEC website for the current forms and email/portal.

2) NPC (Privacy/Data-shaming)

What to file: A privacy complaint against the app/company (the “personal information controller”) for unlawful processing, improper disclosure, and disproportionate data collection/use.
Prerequisite: NPC generally expects you to first notify the company and try to resolve, unless there’s imminent danger or you’ll suffer irreparable harm (e.g., ongoing public shaming).
What NPC can do: Order cease-and-desist, data deletion/blocking, and impose fines/penalties.
What to attach: Your notice to the company, their reply (if any), your affidavit, screenshots, and proof of the spread or attempted spread of your data.
Where: NPC complaint portal/email; use their current forms.

3) BSP (Banks and their digital lending products)

When: If the lender is a BSP-supervised financial institution (BSFI).
What to file: A complaint showing how the bank failed in disclosure, charged improper fees, handled collections abusively, or mishandled your CAM complaint.
What BSP can do: Direct remedial action, administrative sanctions on supervised institutions.

4) Police / NBI / Prosecutor (Threats, extortion, cyberlibel, stalking)

When: If you receive threats of harm/arrest, extortion (“pay or we post your nude/photos”), doxxing, or cyberlibel.
What to bring: Affidavit, ID, your evidence (exported message threads, URLs, numbers).
What they can do: Investigate under the Cybercrime Prevention Act, Anti-Photo and Video Voyeurism Act (if applicable), and the Revised Penal Code (grave threats, libel, unjust vexation, etc.). The City/Provincial Prosecutor handles the inquest/filing of criminal cases.

C. Report the app to its platform

Use Google Play / App Store “Report” tools for deceptive, harmful, or abusive apps. Attach your evidence and mention any ongoing SEC/NPC case numbers if you have them. Platform actions (warnings, removals) help curb repeat abuse.

Filing checklists (copy this and tick off)

Identity & basics

Government ID (mask TIN/SSS/passport numbers if not needed)
Current contact details (email/mobile)
App name & version; developer/company name (if known)

Loan facts

Amount borrowed / actually received (after fees)
Promised rates/fees vs. actually charged
Due dates and payment history (with receipts)
Terms & screenshots (T&Cs, privacy policy, consent prompts)

Abuse/privacy evidence

Harassing messages/voicemails (screenshots/audio with timestamps)
Posts or messages to your contacts/employer
List of phone numbers/usernames used by collectors
Timeline of events

Process

Your demand/notice to the lender (date sent + proof)
For NPC: proof you first tried to resolve (unless urgent exception)
Complaint/affidavit (signed; notarized if required by the office)

Templates you can reuse

Replace bracketed text […] and delete notes in italics. Keep copies of everything you send.

1) Cease-and-Desist & Data-Privacy Demand to the Lender (send first)

Subject: Urgent: Stop Abusive Collection & Unlawful Data Processing – [Your Name] / [Loan Ref]

To: [Company legal/complaints email or in-app support]

I am a borrower under your app “[App Name]” with reference [Loan Ref/Account]. Since [date], your collectors have:
• [e.g., Messaged my family/employer, posted/shared my personal data, threatened arrest, used obscene language]
• [Describe other abusive or deceptive practices with dates and proof references]

These acts violate my rights under Philippine law, including the Data Privacy Act and consumer-protection rules on fair and humane collection.

Demands:
1) Immediately CEASE contacting any of my relatives, employer, or other third parties and delete any unlawfully obtained data.
2) Provide a full, written breakdown of principal, interest, fees, and penalties, and identify official payment channels.
3) Confirm within [5–10] calendar days that you have stopped abusive acts and have rectified your records.

I reserve my rights to complain to the SEC, NPC, BSP (if applicable), and to pursue civil/criminal remedies.

Sincerely,
[Full Name]
[Mobile/Email]
[Date]

2) SEC Complaint (lending/financing company)

Subject: Complaint vs. [Company/App] for Illegal/Abusive Online Lending Practices

I. Parties
Complainant: [Name, Address, Contact]
Respondent: [Company legal name if known] / “[App Name]”

II. Facts
- On [date], I borrowed ₱[amount]; only ₱[net] was released after undisclosed fees.
- Since [date], Respondent’s agents have [debt-shamed me / threatened arrest / contacted my employer / etc.].
- The app or company [lacks/does not disclose] an SEC Certificate of Authority.

III. Violations Alleged
- Operating as a lending/financing company without proper authority and/or violating disclosure and fair-collection rules.
- Deceptive pricing/fee practices.
- Data-privacy abuses (also being raised to the NPC).

IV. Reliefs Requested
- Investigation and cease-and-desist order; app takedown recommendation.
- Administrative sanctions and referral for prosecution as warranted.
- Direction to rectify charges and cease abusive collection.

Attachments: ID; loan screenshots; proof of payments; harassment screenshots; timeline; my demand letter; [any reply].

[Signature over printed name]
[Date]

3) NPC Privacy Complaint

Subject: Privacy Complaint vs. [Company/App] – Unlawful Processing & Disclosure

I. Complainant: [Name, Address, Contact]
II. Respondent (PIC): [Company legal name if known] / “[App Name]”
III. Nature of Complaint:
- Unlawful data processing: app harvested my contacts and photos without valid, informed consent.
- Unauthorized disclosure: agents messaged my [family/employer], circulating my personal data and alleged debt (debt shaming).
- Disproportionate/irrelevant data collection for the stated purpose.

IV. Prior Steps:
- On [date], I wrote Respondent (copy attached) demanding cessation and deletion. [No response / Inadequate response].

V. Reliefs Requested:
- Order to cease unlawful processing and debt shaming; delete/block unlawfully obtained data.
- Administrative fines/penalties as warranted.

Attachments: ID; my demand notice; evidence pack (screenshots, logs); timeline.

[Signature]
[Date]

Civil vs. criminal vs. administrative: how they differ

Administrative (SEC/BSP/NPC): fastest way to stop abusive practices and penalize entities; may result in app takedown or license revocation.
Criminal (police/NBI → prosecutor → court): for threats, extortion, cyberlibel, computer-related offenses. Penalties may include fines/imprisonment for responsible individuals.
Civil (trial courts/Small Claims for money): to void unconscionable interest/penalties, claim damages for public shaming, or resolve payment disputes. (Check the current Small Claims monetary cap when filing.)

You can do any or all of these in parallel.

Practical FAQs

Can I be arrested for not paying an app loan? No. Debt is a civil matter. You can be arrested only for crimes, not for mere non-payment. Fake “warrants” are a red flag.

Do I still owe the money if the app is unregistered? Usually you still owe at least the principal you actually received. Unlawful terms/charges can be challenged or voided. Get advice for your specific facts.

They messaged my boss and family—what can I do now? Document every message, tell them to stop replying to collectors, and file with NPC (privacy breach) and SEC/BSP (abusive collection). Consider a short memo to HR explaining you’re handling an unlawful debt-shaming incident and have filed with regulators.

Should I keep paying while I complain? If you can, pay only through official channels and keep receipts. Do not transfer to collectors’ personal e-wallets. You can also dispute unlawful charges while continuing to pay the undisputed principal to reduce pressure.

The app wants my phonebook/Photos/SMS access—what should I do? Deny permissions. If already granted, revoke them and consider uninstalling after you’ve captured evidence.

They say they’ll sue me for libel if I post about them. Truthful complaints to regulators or platforms, made in good faith, are generally protected. Public posts can carry risk—stick to official channels and keep evidence.

Red flags when choosing/using lending apps

No company name or physical address; constantly changing app names.
Demands for excessive permissions (Contacts, Media, Location) unrelated to lending.
Up-front “processing” deductions that slash net proceeds; unclear total cost.
Payment only to personal e-wallets/bank accounts.
Threat-filled scripts; countdown timers; fake legal notices.

Good habits that protect you

Keep borrowing to one reputable provider you’ve researched.
Save PDF copies of terms, disclosures, and privacy policy at the time you borrowed.
Use a separate email for lending apps; avoid granting Contacts/SMS permissions.
Keep a payment ledger with dates, channel, reference numbers, and screenshots.
If collectors call repeatedly from new numbers, block and keep a log; consider reporting persistent nuisance communications to your telco.

When to seek a lawyer

Large balances, multiple apps, or risk to employment.
You plan to challenge interest/penalties or sue for damages.
You received a subpoena or a verified court complaint.
You want help drafting a strong affidavit-complaint for SEC/NPC/Prosecutor.

Free or low-cost help may be available from PAO, law school legal clinics, or local Legal Aid groups (availability varies).

Final reminders

Filing complaints helps you and also helps regulators spot patterns and shut down abusive actors.
Complaining does not cancel legitimate obligations—but it does stop harassment, shaming, and unlawful practices.
Keep everything in writing; save copies in a cloud folder; name files clearly (e.g., 2024-05-12_SMS_threats.png).
For emergencies (threats to life/safety), call your local police immediately, then follow through with formal complaints.

If you want, tell me the app name (and whether it’s a bank, lending, or financing company) and I’ll tailor the exact filing paths, checklists, and the wording of your letters to match your situation.