How to Report an Online Lending Company in the Philippines

Quick answer

Report an online lending company or online lending platform to the Securities and Exchange Commission (SEC) through the official SEC I-Message portal. Create or sign in to your eSECURE account, open a new ticket, and select Financing and Lending Companies Department and Complaints on Financing and Lending Companies. Upload your identification, loan documents, screenshots, payment records, and a dated account of what happened. The portal lets you track the complaint and submit additional documents or replies. (Securities and Exchange Commission)

A separate or additional report may be necessary when:

• Your personal data, phone contacts, photos, or account information were misused: complain to the National Privacy Commission (NPC).
• The actual creditor is a bank, digital bank, e-money issuer, or another institution supervised by the Bangko Sentral ng Pilipinas: complain first to that institution, then escalate to the BSP Consumer Assistance Mechanism if unresolved.
• There are threats of violence, extortion, identity theft, account takeover, a fictitious loan, or unauthorized transfers: report promptly to law enforcement or the Cybercrime Investigation and Coordinating Center (CICC). Do not wait for the SEC complaint to finish.

Filing a complaint does not automatically cancel a valid loan, suspend payment obligations, erase adverse records, or rewrite the contract. The proper result depends on the documents, the lender’s authority, the charges imposed, the collection methods used, and the relief available from the agency or a court. The SEC has expressly stated that its complaint process is not a mechanism for changing loan terms, declaring a contract void, settling the account, or automatically nullifying interest. (SEC Appointment System)

Send the complaint to the right authority

Problem	Where to report it
Unlicensed lending, undisclosed charges, questionable interest or penalties, misleading loan terms, or unfair debt collection by a lending or financing company	SEC through I-Message
Contact-list harvesting, disclosure of the debt to unrelated people, misuse of photos, excessive app permissions, or other unlawful processing of personal data	NPC, usually after first writing to the company or its data protection officer
Complaint involving a BSP-supervised bank, digital bank, e-money issuer, financing company affiliated with a bank where the regulated institution is the actual provider, or another BSP-supervised financial institution	The institution’s consumer-assistance channel first, then BSP
Threats, extortion, impersonation, phishing, identity theft, fake-loan schemes, hacking, or unauthorized fund transfers	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or CICC, without waiting for the administrative complaint
A demand for an injunction, substantial damages, contract cancellation, or a ruling on private contractual liability	A lawyer, the Public Attorney’s Office if eligible, or the proper court or tribunal

The agency is determined by the actual legal entity and conduct involved, not merely by the app’s branding. BSP guidance specifically directs complaints about financing and lending companies, online lending applications or platforms, and collection agencies to the SEC, while the BSP’s own consumer-assistance mechanism covers BSP-supervised institutions. (Bangko Sentral ng Pilipinas)

Identify the legal lender before filing

An app name may be only a trade name, platform, marketing brand, or collection interface. Look for the legal creditor in the:

• loan agreement or promissory note;
• disclosure statement;
• privacy notice and terms of service;
• payment instructions and electronic receipts;
• app-store listing and developer information;
• text messages or emails confirming loan approval; and
• collection notices.

Record the company’s complete legal name, SEC registration number, Certificate of Authority number if shown, business address, app name, website, email addresses, telephone numbers, and the names used by collectors.

A lending company must generally be organized as a stock corporation and obtain a Certificate of Authority from the SEC before offering loans to the public. Corporate registration by itself does not necessarily establish authority to operate as a lending company. Ask the SEC through I-Message to verify the entity’s current authority when the company’s status is unclear. (SEC Appointment System)

When several apps or collectors are involved, identify which company owns the loan and which company performed each complained-of act. File a separate, clearly organized complaint for each respondent when appropriate. The SEC’s published complaint guidance instructs complainants to complete the form, provide a valid government-issued ID, attach supporting evidence, and address one respondent company per complaint; materially incomplete complaints may be dismissed. (SEC Appointment System)

Conduct that may justify a report

Operating without proper SEC authority

Report a lender that cannot identify its legal entity, falsely claims to be SEC-authorized, uses another company’s registration details, or appears to offer loans without the required Certificate of Authority.

Do not assume that an SEC registration number shown in an advertisement proves that the app itself is authorized. Include the advertisement and ask the SEC to verify the legal entity, Certificate of Authority, and relationship between the company and the online platform.

Hidden or inadequately disclosed loan charges

The Truth in Lending Act requires the creditor to provide a clear written disclosure before the credit transaction is completed. The disclosure generally includes the amount financed, itemized charges, finance charge expressed in pesos, and the percentage rate applicable to the loan. (Lawphil)

Possible complaint grounds include:

• receiving substantially less than the advertised loan amount because of previously undisclosed deductions;
• processing, service, verification, membership, handling, or other charges not clearly disclosed before acceptance;
• an effective cost materially different from the disclosure statement;
• a payment schedule or penalty formula that was withheld until after disbursement; or
• advertisements emphasizing a low daily or monthly rate while omitting mandatory fees that materially increase the true cost.

Attach the pre-loan advertisement, offer screen, disclosure statement, amount actually received, repayment schedule, and your calculation. State the figures rather than relying only on terms such as “excessive” or “illegal.”

Charges above the special ceilings for covered small, short-term loans

For a narrowly defined category of loans—unsecured, general-purpose consumer loans with a principal of ₱10,000 or less and a term of four months or less, entered into, renewed, or restructured beginning April 1, 2026—SEC Memorandum Circular No. 14, Series of 2025 sets these ceilings:

• Nominal interest: 6% per month;
• Effective interest: 12% per month;
• Late-payment or nonpayment penalty: 5% per month on the outstanding scheduled amount due; and
• Total cost: 100% of the amount borrowed, covering cumulative interest, other fees and charges, and penalties.

The circular also addresses attempts to evade the ceilings. Loans outside that specific coverage are not automatically governed by those numerical limits, although disclosure requirements, contractual rules, data-protection obligations, and prohibitions against unfair collection may still apply. (Facebook)

When reporting a possible violation, include:

1. the original principal;
2. the cash or electronic amount actually received;
3. the date the loan was entered into, renewed, or restructured;
4. the original repayment term;
5. every interest charge and fee;
6. every penalty assessed;
7. payments already made; and
8. the lender’s current claimed balance.

Do not simply compare the amount demanded with the cash received without separating principal, prepaid charges, interest, and penalties. The applicable computation may depend on the contract and the circular’s definitions.

Threatening, humiliating, or deceptive collection

The SEC prohibits unfair debt-collection practices by financing and lending companies. Report conduct such as:

• threats of violence or other criminal means intended to harm a borrower, reputation, or property;
• threats to take an action that cannot legally be taken;
• fabricated arrest warrants, court orders, criminal cases, or government notices;
• impersonation of police officers, court employees, lawyers, or government agencies;
• use of a borrower’s photograph to harass, shame, or embarrass;
• repeated communications designed to intimidate rather than legitimately seek payment; or
• collection messages sent to unrelated people to expose or pressure the borrower.

A lawful demand for payment is not automatically harassment. Describe the actual words, dates, frequency, recipients, and context so the regulator can distinguish legitimate collection from prohibited conduct. SEC Memorandum Circular No. 18, Series of 2019 governs unfair debt collection, while NPC rules separately restrict the misuse of personal data during collection. (SEC Appointment System)

Accessing contacts, photos, or other data unnecessarily

Online lenders may process only personal data that are adequate, relevant, suitable, necessary, and not excessive for a declared and lawful purpose. Apps should give accessible privacy information and should not retain or continue permissions that are no longer necessary. (National Privacy Commission)

NPC rules specifically restrict:

• unrestricted processing of a borrower’s contact list;
• contacting people in the contact list for collection when they are not declared guarantors;
• treating a character reference automatically as a guarantor;
• using a borrower’s photograph to harass or embarrass;
• obtaining unnecessary camera, gallery, contact, location, or account permissions; and
• using reference information for unrelated marketing or other incompatible purposes.

A lender may allow a borrower to select references or guarantors from a contact list, but that does not permit unrestricted copying or use of everyone in the list. A character reference is not automatically liable for the loan. For collection, NPC rules permit contact with a properly declared guarantor, not unrelated contacts merely found on the phone. (National Privacy Commission)

How to file an SEC complaint

1. Preserve the evidence before deleting the app

Take screenshots or screen recordings of relevant pages while you still have access. Preserve the original files and avoid cropping away information that identifies the date, time, sender, account, or app.

Before uninstalling the application, save:

• the loan offer and approval screen;
• disclosure statement, agreement, and repayment schedule;
• privacy notice and permission requests;
• account ledger and demanded balance;
• payment instructions and receipts;
• collection messages and app notifications;
• the app-store page, developer name, and version;
• the lender’s legal name and contact details; and
• any messages sent to family members, employers, references, or other contacts.

Changing permissions or uninstalling the app may be sensible after preserving evidence, especially when unnecessary access continues. It does not necessarily erase data already copied by the company.

2. Prepare a dated chronology

Use exact dates and a simple sequence:

1. when you downloaded or first used the app;
2. when you applied;
3. what amount and terms were displayed;
4. what documents were provided before acceptance;
5. how much you actually received;
6. what payments you made;
7. when the disputed charges or collection conduct began;
8. whom the collector contacted; and
9. what response the company gave when you complained.

Distinguish what you personally saw from what another person told you. Ask contacted relatives, coworkers, or references to preserve their own messages and provide short signed statements if they are willing.

3. Calculate the disputed figures

Create a basic table showing:

Item	Amount
Stated principal	₱
Amount actually disbursed	₱
Upfront deductions	₱
Interest charged	₱
Other fees	₱
Penalties	₱
Payments already made	₱
Current demanded balance	₱

Attach the lender’s own ledger or screenshots. Clearly label any calculation you made yourself.

4. Use the SEC I-Message portal

Go to https://imessage.sec.gov.ph/, select Open New Ticket, accept the privacy notice, and sign in through eSECURE. Choose:

Financing and Lending Companies Department → Complaints on Financing and Lending Companies

Complete all required fields, upload readable documents, and create the ticket. Save the ticket number and confirmation. Check the portal regularly because the SEC may request clarification, a reply, or additional evidence, and the portal allows further messages and uploads. (Securities and Exchange Commission)

5. State the requested regulatory action clearly

A practical request may read:

Please verify the respondent’s authority to operate, investigate the complained-of disclosure, charges, collection practices, and personal-data use, direct the respondent to answer the allegations, and take any action within the SEC’s jurisdiction.

Avoid demanding an outcome that the SEC has no power to grant through its administrative complaint process. When you seek damages, an injunction, contract annulment, or another judicial remedy, obtain legal advice about a separate case.

6. Keep proof of filing and respond promptly

Retain:

• the complete complaint as submitted;
• all attachments;
• the ticket or reference number;
• portal messages;
• the respondent’s answer;
• your replies; and
• later collection communications.

Under the SEC’s published complaint guidance, the Commission evaluates the complaint and may require the respondent company to answer or comment. The SEC may also request a reply from the complainant and may pursue enforcement when the evidence provides sufficient grounds. (SEC Appointment System)

Filing a separate privacy complaint with the NPC

A complaint to the SEC does not replace an NPC complaint when the central issue is unlawful processing or disclosure of personal data.

First write to the company or its data protection officer

As a general rule, the NPC requires a complainant to notify the company, personal-information controller, personal-information processor, or other responsible entity in writing and give it a reasonable opportunity to act. When no appropriate or timely action is taken—or no response is received within 15 calendar days—the complainant may proceed to the NPC. (National Privacy Commission)

Your written notice should identify:

• the data involved;
• how it was collected, accessed, disclosed, or used;
• the people who received it;
• the relevant dates;
• the harm or risk caused; and
• what corrective action you are requesting.

Send it through a channel that creates proof of delivery, such as the company’s official complaint email, data-protection email, support ticket, or registered correspondence.

The NPC may waive prior exhaustion for good cause or a serious violation, including circumstances involving grave or irreparable harm, lack of a plain and adequate remedy, or conduct that is patently illegal. State the urgent facts and provide evidence rather than assuming that the exception applies. (National Privacy Commission)

Complete the NPC complaint requirements

The NPC’s formal complaint process generally requires the prescribed complaint form, a clear narration, supporting evidence, correspondence showing prior resort to the respondent, certification against forum shopping, valid identification, and notarization. An incomplete complaint or one lacking evidence may be dismissed without prejudice or require correction. (National Privacy Commission)

The NPC’s official filing page provides the current form and permits submission through the channels stated there, including personal delivery, courier or registered mail, and authorized electronic filing. Check the current instructions and fee schedule before submitting. Certain complainants, including those qualified as indigent, may be exempt from filing fees, and the NPC may grant a waiver for good cause under its rules. (National Privacy Commission)

Use the current instructions at NPC: Filing a Complaint.

Evidence worth preserving

The strongest complaint is specific, chronological, and supported by original records. Preserve as many of the following as apply:

• Valid government-issued identification;
• Loan agreement, promissory note, disclosure statement, and repayment schedule;
• Screenshots of the offer before acceptance;
• Proof of the amount actually disbursed;
• Bank, e-wallet, or remittance statements;
• Receipts and payment confirmations;
• Complete screenshots of texts, chats, emails, and app notifications;
• Call logs and saved voicemails;
• Names, numbers, account handles, and claimed affiliations of collectors;
• Screenshots of app permissions and privacy notices;
• App-store listing, developer details, website, and version number;
• Messages received by relatives, coworkers, employers, references, or other contacts;
• Statements from people who were contacted;
• Copies of any fabricated legal or government document;
• Your written complaint to the lender or data protection officer;
• Delivery confirmation and the company’s response; and
• A calculation of principal, interest, fees, penalties, payments, and remaining balance.

Keep an untouched copy of every original file. Make a separate working copy for highlighting or annotation. Back up the evidence in a location the lending app cannot access.

Be cautious about secretly recording private telephone conversations. Philippine anti-wiretapping rules can make recording legally sensitive. Preserve messages, call logs, voicemails voluntarily left by the caller, and contemporaneous written notes, and seek legal advice before making covert recordings.

Common mistakes that weaken a complaint

Naming only the app

The regulator needs the legal respondent. Include both the app name and the company identified in the agreement, disclosure statement, privacy notice, or payment records.

Submitting cropped or unreadable screenshots

Preserve the sender, number or account, date, time, and surrounding conversation. Export or save the original when possible.

Reporting conclusions without facts

Instead of writing only “the interest is illegal” or “they harassed me,” provide the figures, exact words, dates, recipients, and documents.

Combining unrelated companies in one narrative

Separate each respondent and explain its role. One company may own the loan while another operates the app or performs collection.

Deleting the app before saving records

The app may contain the only accessible copy of the offer, ledger, disclosure statement, permissions, or account history.

Paying an unfamiliar account without verification

A collector may provide a personal e-wallet or newly changed account. Verify payment instructions through the lender’s official channel, and retain proof. Report suspected impersonation or diversion immediately.

Assuming the complaint suspends payment

Unless the creditor, regulator, or court provides a lawful basis, filing alone does not automatically stop contractual due dates. Ask the lender in writing for a statement of account and propose a documented arrangement when you acknowledge an undisputed balance.

Ignoring genuine court papers

A threatening text is not the same as a summons, but genuine court documents should never be ignored. Verify them directly with the court named in the papers—not through the collector’s phone number—and obtain legal help before the stated deadline.

Posting sensitive evidence publicly

Publicly uploading your identification, loan documents, account numbers, or unredacted screenshots may create further privacy and fraud risks. Send complete evidence through official channels; redact sensitive details from public posts.

When help is urgent

Act immediately when:

• someone threatens physical harm or violence;
• a collector demands money in exchange for not publishing private data or photos;
• a loan appears in your name that you did not obtain;
• your phone, email, bank, e-wallet, or identity documents may have been compromised;
• unauthorized transfers or withdrawals are occurring;
• someone impersonates the police, a court, or another government office;
• intimate images or highly sensitive information are being distributed;
• your employer or unrelated contacts are being repeatedly targeted;
• you receive an authentic summons, subpoena, court order, or formal government notice; or
• the conduct is causing an immediate safety or mental-health crisis.

Contact the affected bank or e-wallet at once to secure the account and dispute unauthorized transactions. Change compromised passwords from a trusted device, activate multifactor authentication, preserve evidence, and report cybercrime to the PNP Anti-Cybercrime Group, NBI Cybercrime Division, or CICC. The CICC’s official reporting channels include hotline 1326 and the contact methods published on its official website. BSP guidance likewise directs fraud and scam concerns to appropriate law-enforcement and cybercrime authorities.

An SEC or NPC proceeding is administrative and may not provide immediate personal protection. For imminent danger, contact law enforcement promptly.

Frequently asked questions

Can I report an online lender even when I still owe money?

Yes. A borrower may report unlawful disclosure, data misuse, unlicensed activity, hidden charges, or unfair collection even when a legitimate unpaid balance exists. The debt issue and the lender’s compliance are separate questions. Continue preserving payment records and distinguish the undisputed balance from the disputed charges or conduct.

Can a lender contact my references?

A lender may process properly collected reference information for a legitimate and disclosed purpose, but a character reference is not automatically a guarantor. NPC rules prohibit unrestricted contact-list processing and prohibit contacting unrelated persons for debt collection merely because their details appear on the borrower’s phone. A declared guarantor is treated differently, subject to valid and separate consent and the applicable agreement. (National Privacy Commission)

Is accessing my entire contact list automatically lawful because I tapped “Allow”?

Not necessarily. Consent is not a blank check. Processing must still be lawful, transparent, necessary, proportionate, and limited to a declared purpose. NPC rules prohibit unbridled contact-list processing and unnecessary or excessive app permissions. (National Privacy Commission)

Can the lender use my photo in a collection message?

NPC rules state that a photograph obtained through camera or gallery access must not be used to harass or embarrass the borrower for debt collection. Preserve the image, recipients, dates, sender details, and the app permission screen, then consider complaints to both the NPC and SEC. (National Privacy Commission)

Can the SEC erase my loan or reduce the balance?

Not automatically through a complaint. The SEC can investigate regulatory violations and take action within its jurisdiction, but its published guidance says it cannot use the complaint process to rewrite loan terms, cancel or settle the loan, declare the contract void, or automatically nullify interest as excessive. Contractual relief may require negotiation or a separate legal proceeding. (SEC Appointment System)

Should I complain to the lender before going to the SEC?

A prior written complaint can help create a record and may resolve errors, but do not delay urgent reporting of threats, fraud, or continuing harm. For an NPC privacy complaint, prior written resort to the respondent is generally required unless a recognized exception applies; a response normally should be allowed for up to 15 calendar days. (National Privacy Commission)

What if I do not know the company behind the app?

Submit all identifying information available—app name, screenshots, developer, website, payment account, collector numbers, privacy notice, loan documents, and app-store link—and ask the SEC to identify and verify the operator. Also report the listing to the app store when it appears fraudulent, without treating the app-store report as a substitute for an official complaint.

Can I complain anonymously?

A formal complaint normally requires enough information to establish the complainant’s identity, standing, allegations, and evidence. Do not rely on anonymity unless the relevant agency’s current filing channel expressly allows it for the type of report being made. Formal SEC and NPC proceedings may require identification and documents.

How long will the case take?

There is no single completion period applicable to every complaint. Timing depends on completeness, jurisdiction, service on the respondent, requests for additional evidence, the company’s answer, and whether the matter proceeds to investigation or enforcement. Monitor the official ticket or case channel and respond promptly.

Should I stop paying after filing?

Do not treat filing as an automatic payment suspension. Request a current statement of account, dispute specific charges in writing, and obtain legal advice when the amount is substantial or the contract is contested. Pay only through verified official channels and retain receipts.

Official sources

• SEC I-Message complaint portal (Securities and Exchange Commission)
• SEC I-Message User Guide, including the complaint category for financing and lending companies (Securities and Exchange Commission)
• Republic Act No. 9474 and its implementing rules on lending companies and Certificates of Authority (SEC Appointment System)
• Republic Act No. 3765, Truth in Lending Act (Lawphil)
• SEC Memorandum Circular No. 18, Series of 2019, on unfair debt-collection practices (SEC Appointment System)
• SEC Memorandum Circular No. 14, Series of 2025, on recalibrated interest-rate and fee ceilings for covered loans (Facebook)
• NPC Circular No. 2020-01 on loan-related transactions (National Privacy Commission)
• NPC Circular No. 2022-02 amending the loan-related privacy rules (National Privacy Commission)
• NPC complaint filing page (National Privacy Commission)
• NPC Rules of Procedure, as amended (National Privacy Commission)
• BSP Consumer Assistance Mechanism guidance and agency-routing guide (Bangko Sentral ng Pilipinas)
• Cybercrime Investigation and Coordinating Center

General-information disclaimer

This article provides general Philippine legal information, not individualized legal advice or a prediction of how an agency or court will decide a particular case. Procedures and legal consequences may depend on the creditor’s identity, the loan date and terms, the documents provided, and the specific conduct involved. Verify current forms, filing fees, addresses, and electronic channels on the relevant agency’s official website before filing, and consult a Philippine lawyer when safety, substantial money, court proceedings, or possible criminal liability is involved.

Sources and procedures checked as of July 20, 2026.