Quick answer

Report most online lending app complaints to the Securities and Exchange Commission (SEC) through the official SEC iMessage portal. Direct the ticket to the Financing and Lending Companies Department (FINLEND) when the complaint concerns unfair collection, questionable charges, lack of disclosures, an unlicensed operator, or other conduct by a lending or financing company. The portal lets you open a complaint ticket and check its status; the government’s March 2026 advisory also lists the SEC hotline 1-4732 (1-4SEC). (imessage.sec.gov.ph)

Use a different or additional agency when the conduct falls within its jurisdiction:

Problem	Where to report
Harassment, public shaming, threats tied to collection, contacting non-guarantors, questionable fees, or an apparently unlicensed lending company	SEC–FINLEND
Misuse or disclosure of contacts, photos, IDs, messages, or other personal data	National Privacy Commission (NPC)
Threats, fraud, scams, identity takeover, hacking, or other cybercrime	DICT Cyber Hotline, NBI Cybercrime Division, or PNP Anti-Cybercrime Group
A loan or credit service provided by a bank, e-money issuer, or another BSP-supervised financial institution	Complain to the institution first, then escalate to the Bangko Sentral ng Pilipinas (BSP) if unresolved

You may need to report the same incident to more than one agency. For example, threats sent to your relatives may involve both unfair debt collection under SEC rules and unlawful personal-data processing under NPC rules. Keep the facts consistent and disclose related proceedings whenever a complaint form requires it.

A complaint does not automatically erase a valid loan, suspend a payment obligation, or guarantee damages. It asks the proper authority to examine the lender’s conduct. Continue requesting a written statement of account and dispute only the amounts or practices you genuinely question.

Conduct that should be reported

Unfair or abusive collection

The SEC’s rules prohibit unfair debt-collection practices by financing and lending companies. Current joint guidance specifically identifies conduct involving:

harassment, intimidation, or public shaming;
threats of violence or other criminal means against a person, reputation, or property;
threats to take action that cannot legally be taken;
use of personal data to harass a borrower or another person; and
contacting people in the borrower’s contact list for collection when they are not the borrower’s guarantors. (National Privacy Commission)

A collector may demand payment through lawful means. The existence of an unpaid account, however, does not authorize threats, humiliation, doxxing, impersonation, or indiscriminate messaging of relatives, co-workers, employers, friends, and other contacts.

Contacting character references or phone contacts

A character reference is not automatically a guarantor. Current government guidance requires online lending platforms to distinguish between:

a character reference supplied only for identification or verification; and
a guarantor who separately and expressly consented to answer for the loan in case of default.

For debt collection, the lender or collector may contact the guarantor—not every person found in the borrower’s phone. A person does not become a guarantor merely because the borrower entered that person’s name or number in an app. (National Privacy Commission)

Excessive access to or misuse of personal data

An app’s access to personal data is not automatically lawful merely because the user tapped “Allow.” The processing must still have a specified and legitimate purpose and must not be unnecessary, excessive, or disproportionate.

The DICT, NPC, and SEC have reiterated that:

unnecessary app permissions are prohibited;
unrestrained processing of contact lists is prohibited;
camera or photo-gallery access should be limited to legitimate purposes such as identity verification or know-your-customer checks;
permissions should be turned off when their purpose has been achieved; and
personal data should be retained only as long as necessary for the stated purpose, legal claims, or another lawful basis. (National Privacy Commission)

Report the app to the NPC when it uploads, uses, or discloses contacts, photographs, identification documents, messages, employment details, or other information in a way that appears unrelated, excessive, deceptive, or intended to shame or pressure someone.

Undisclosed or questionable loan charges

The Truth in Lending Act requires a creditor, before the credit transaction is consummated, to provide a clear written statement showing applicable information such as the amount financed, itemized charges, the finance charge in pesos, and the finance charge expressed as a simple annual rate on the unpaid balance. (Lawphil)

Preserve and report situations in which:

the amount deposited was substantially lower than the stated principal without a clear explanation;
fees were deducted but not disclosed before acceptance;
the repayment amount changed after the loan was released;
the lender refuses to provide the contract, disclosure statement, or computation;
payments are not credited; or
penalties appear inconsistent with the agreement or applicable SEC limits.

For certain unsecured, general-purpose loans of ₱10,000 or less with a term of no more than four months, entered into, restructured, or renewed beginning April 1, 2026, SEC Memorandum Circular No. 14, series of 2025 applies specific ceilings, including a 6% monthly nominal-interest cap, 12% monthly effective-interest-rate cap, 5% monthly cap on late-payment penalties based on the outstanding scheduled amount due, and a cap under which interest, fees, charges, and penalties together may not exceed 100% of the principal. These limits do not automatically apply to every loan; coverage depends on the principal, term, purpose, security, and transaction date. (Facebook)

When unsure whether a cap applies, do not rely only on the rate displayed in an advertisement. Submit the complete agreement, disclosure statement, amount actually received, payment schedule, renewal history, and charge computation to the SEC.

An app or lender that may be unlicensed

A lending company generally needs SEC authority to operate as a lending company. The app’s brand name may differ from the corporation legally extending the loan.

Warning signs include:

no corporate name or business address in the contract or app;
no SEC registration or Certificate of Authority information;
collection through unrelated personal accounts;
a company name that does not match the payment recipient;
refusal to identify the creditor; or
claims that registration with an app store, local government, or another private platform is equivalent to SEC authority.

Search the disclosed corporate name through Check with SEC. Save the search result or screenshot. An app’s absence from your search is a reason to ask the SEC to verify its status, but it is not by itself a final legal finding.

Preserve evidence before blocking or uninstalling the app

Capture the evidence first. Uninstalling an app, deleting messages, resetting the phone, or changing numbers may remove material needed to identify the operator and prove what happened.

Preserve:

App and operator details
- exact app name and logo;
- app-store listing and link;
- developer name;
- website, privacy notice, and terms;
- corporate name, SEC number, Certificate of Authority details, address, and customer-service information;
- names and numbers used by collectors.
Loan records
- application and approval screens;
- promissory note, loan agreement, disclosure statement, and repayment schedule;
- stated principal and net amount actually received;
- release date, due date, interest, fees, penalties, and renewal terms;
- bank or e-wallet transaction records;
- receipts and proof of every payment;
- current statement of account or payoff computation.
Evidence of abusive conduct
- complete screenshots showing the sender, number, date, time, and surrounding conversation;
- SMS, email, in-app messages, social-media messages, and call logs;
- voicemails and other recordings already obtained lawfully;
- posts, edited photographs, group chats, or messages sent to third parties;
- screenshots supplied by relatives, co-workers, references, or other recipients;
- the exact words of threats and the date each threat was made.
Privacy evidence
- permissions requested by the app;
- consent screens and pre-ticked options;
- privacy notices shown when the loan was obtained;
- evidence that contacts, photographs, or documents were uploaded or disclosed;
- requests you made to withdraw consent, obtain access, correct information, or stop unlawful processing.
Earlier complaint records
- your written complaint to the lender;
- delivery confirmation;
- its response, if any;
- reference or ticket numbers;
- follow-up messages and proposed resolutions.

Back up the originals in another device or secure cloud folder. Keep an unedited version of every screenshot or file. Use clear filenames such as 2026-07-20_SMS-threat-number-date-time.png and prepare a chronological incident list.

Do not publish unredacted IDs, account numbers, children’s details, contact lists, or other people’s private information on social media. Submit relevant unredacted evidence only through official or otherwise secure channels when necessary.

After preserving the evidence, review the app’s permissions and revoke access that is no longer necessary. Change compromised passwords and PINs, enable multi-factor authentication, and contact your bank or e-wallet immediately if there are unauthorized transactions. Removing the app from the phone may stop future device access, but it may not delete data already transmitted to the operator.

How to file a complaint with the SEC

1. Identify both the app and the legal lender

Do not name only the app. State, as far as the documents show:

the app or website name;
the corporate lender or financing company;
the collection agency, if identified;
the developer or publisher;
relevant numbers, email addresses, payment accounts, and websites; and
SEC registration or authority information, if available.

When the operator is unknown, explain where you obtained the app and attach anything that may help the SEC identify it.

2. Prepare a concise chronology

A useful chronology answers:

When did you apply?
What amount was represented as the loan?
What amount did you actually receive?
What disclosures were shown before you accepted?
When was payment due?
What did you pay?
What amount is now being demanded?
What did the collector do?
Who else was contacted?
What personal data appears to have been used?
What did you ask the lender to do?
How did it respond?

Separate facts you personally observed from information reported by another person. Attach that person’s screenshot or statement when available.

3. Open an SEC iMessage ticket

Go to the SEC iMessage portal, register or sign in as required, and choose Open a New Ticket. State that the matter concerns a financing or lending company or online lending platform and request referral to FINLEND. The portal also provides a ticket-status function. (imessage.sec.gov.ph)

Include:

your full name and reliable contact details;
respondent’s app and corporate names;
loan and account identifiers, without placing passwords or PINs in the complaint;
a chronological summary;
the specific collection, disclosure, licensing, or fee issue;
the harm caused;
steps already taken with the lender;
the resolution requested; and
an indexed set of attachments.

Possible requests include investigation, verification of authority to operate, correction of the account, a complete written computation, cessation of prohibited collection, and appropriate regulatory action. Do not demand a result that the SEC may lack authority to grant.

4. Save the ticket details

Keep the ticket number, acknowledgment, filing date, and a complete copy of everything submitted. Check the portal for updates and answer requests for clarification promptly.

The SEC portal does not publish one universal filing deadline covering every possible online-lending complaint. File as soon as practical because messages, account access, app listings, and payment records can disappear, while separate civil or criminal remedies may have their own prescriptive periods.

How to file a data-privacy complaint with the NPC

1. Ordinarily notify the lender in writing first

Under the NPC’s amended rules, a complainant ordinarily must inform the personal information controller, processor, or concerned entity in writing and give it an opportunity to act. If it fails to take timely and appropriate action or does not respond within 15 calendar days after receiving the written notice, the matter may be brought to the NPC. (National Privacy Commission)

Your notice may ask the company to:

stop contacting non-guarantors;
explain the source and use of your data;
identify all recipients of an unlawful disclosure;
correct inaccurate information;
stop unnecessary processing;
preserve relevant logs;
delete data that no longer has a lawful retention basis; and
confirm the action taken.

Keep proof that the notice was delivered.

The NPC may waive the prior-notice requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy from the respondent, or patently illegal action. The current complaint form therefore allows a complainant who did not contact the respondent to state the reason. (National Privacy Commission)

Do not wait 15 days before seeking police, cybercrime, medical, or other emergency help when there is a credible threat or ongoing account compromise.

2. Use the current NPC Complaint-Affidavit

Download the current form from the NPC filing page. The formal complaint must be completed, signed, and notarized. The NPC’s current form warns that incomplete allegations or missing supporting evidence may result in outright dismissal and asks for a valid government-issued ID. (National Privacy Commission)

The complaint should identify:

the complainant and respondent;
the personal data processed;
the date, time, and place or online setting of the incident;
the specific acts complained of;
a clear chronological narration;
all supporting documents;
correspondence with the respondent;
the relief requested; and
other proceedings involving the same issues.

The rules also require verification and a certification against forum shopping. If another action or claim involving the same issues exists, disclose it accurately. (National Privacy Commission)

3. Attach organized proof

The NPC form expressly requires supporting evidence. Label each attachment and refer to it in the narration—for example:

Annex A: loan-app privacy notice;
Annex B: screenshot of requested permissions;
Annex C: message sent to a non-guarantor;
Annex D: written complaint to the lender;
Annex E: proof of delivery;
Annex F: lender’s response;
Annex G: witness screenshot or affidavit.

A long collection of unexplained screenshots is less useful than a chronological narrative that connects each allegation to a specific annex.

4. Submit through an authorized channel

The NPC filing page permits submission:

in person;
by courier; or
by scanning and emailing the completed, notarized complaint.

The current form lists:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City 1103 Email: info@privacy.gov.ph Telephone: +632 5322 1322 (National Privacy Commission)

NPC rules provide for filing fees unless an exemption or discretionary waiver applies, including qualifying indigent complainants. Check the current schedule linked on the NPC filing page rather than relying on an old amount. (National Privacy Commission)

Reporting threats, fraud, scams, or cybercrime

The March 18, 2026 joint government advisory lists these channels for other forms of harassment, threats, fraud, and scams:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph Telephone: (632) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph or onlinecims.ocs@gmail.com Telephone: (632) 8723-0401 local 7491 (National Privacy Commission)

Use these channels, or go to the nearest appropriate law-enforcement office, when the evidence suggests:

credible threats of physical harm;
extortion or blackmail;
impersonation;
account takeover;
unauthorized transfers;
falsified documents;
malicious distribution of photographs or personal information;
phishing or malware;
a fictitious lender collecting money; or
another possible criminal offense.

Give investigators the original messages, URLs, numbers, transaction references, recipient account details, dates, and preserved device records. Do not threaten the suspected offender, alter screenshots, or attempt to access another person’s account to obtain evidence.

When the BSP is the correct route

The BSP is not the default regulator for every online lending app. Use the BSP route when the provider is a BSP-supervised financial institution, such as a bank or another entity under BSP supervision.

First submit the complaint to the institution’s own consumer-assistance channel. If it remains unresolved, escalate it through the BSP Online Buddy (BOB). As an alternative, complete the BSP Complaints, Inquiries and Requests form and send it to consumeraffairs@bsp.gov.ph. (Bureau of the Treasury)

The BSP asks for:

a summary of the concern;
the resolution requested;
your telephone number and email address;
a copy of the complaint sent to the institution;
its response, if any; and
supporting documents. (Bureau of the Treasury)

The BSP consumer-assistance direct line is (02) 5306-2584. A complaint against an ordinary SEC-regulated lending company should generally go to SEC–FINLEND instead.

A practical complaint format

Use plain facts rather than insults, assumptions, or lengthy legal arguments.

Respondent: [App name and corporate lender] Loan/account reference: [Reference number] Date obtained: [Date] Principal represented: ₱[amount] Net amount received: ₱[amount] Amount demanded: ₱[amount] as of [date]

On [date], I obtained a loan through [app]. Before acceptance, the app showed [describe the disclosures]. The amount actually deposited was ₱[amount], while the repayment demanded was ₱[amount].

Beginning [date], persons using [numbers/accounts] sent the attached messages. On [date], they contacted [name or relationship], who was not my guarantor, and disclosed [information]. On [date], they threatened [state the exact substance without exaggeration].

I complained to the company in writing on [date]. It [did not respond/responded as follows]. Proof of delivery and its response are attached.

I respectfully request [verification of authority to operate, investigation of unfair collection or data processing, a complete statement and computation, correction of records, cessation of prohibited conduct, or other appropriate relief].

Attachments: [Numbered index]

Adapt the wording to what actually happened. Do not state that an app “stole” data, committed a crime, or violated a particular provision unless the evidence supports that characterization. It is enough to describe the acts and ask the regulator to determine whether they were lawful.

Common mistakes that weaken a complaint

Naming only the app

Regulators need the legal lender, developer, collection agency, payment recipient, or other identifying information whenever available. Include both the brand and the corporate operator.

Deleting the evidence too early

Capture the app listing, agreement, permissions, messages, account history, and payment instructions before uninstalling, blocking, or resetting the device.

Sending cropped screenshots without context

A screenshot should show the sender, date, time, and enough surrounding conversation to establish meaning. Keep the original file.

Filing with only one agency despite different violations

The SEC, NPC, BSP, and law-enforcement agencies perform different functions. A privacy complaint alone may not address threats, and a police report alone may not address the lender’s SEC authority.

Assuming every contact is prohibited

A lender may communicate with the borrower and may contact a person who validly and expressly consented to be a guarantor. The stronger complaint identifies contacts who were neither borrowers nor consenting guarantors and shows what was disclosed or demanded.

Assuming the complaint cancels the loan

Regulatory reporting and debt validity are separate issues. Ask for a complete statement of account, identify disputed items, and keep proof of any payment you make.

Paying through an unexplained personal account

Before sending money, verify the authorized payment channel and request written confirmation of how it will be credited. Preserve the recipient’s registered name, account number, reference number, and receipt.

Posting everything publicly

Public posts can expose your own ID, loan details, account numbers, and other people’s data. They can also complicate the factual record. Send full evidence to the proper authority rather than turning a complaint into a public argument.

Ignoring official notices

Do not ignore an SEC, NPC, BSP, police, prosecutor, or court communication. Check deadlines in the particular notice. A regulator’s request for missing documents and a court summons require different responses.

When legal help is urgent

Seek prompt help from a Philippine lawyer, the Public Attorney’s Office when eligible, or another recognized legal-aid provider when:

you receive a summons, subpoena, prosecutor’s notice, or court pleading;
a collector threatens or attempts physical violence;
intimate images, children’s information, or highly sensitive records are being distributed;
your bank, e-wallet, email, SIM, or identity has been compromised;
a company is using documents or signatures you did not provide;
significant money was transferred through fraud;
an employer or business is suffering continuing reputational harm;
the lender files a civil case;
you intend to claim damages; or
prescription or a filing deadline may be approaching.

A genuine court document should be reviewed, not ignored. Verify it through the issuing court or agency rather than relying on the collector’s explanation.

Frequently asked questions

Can I report an app even if I still owe money?

Yes. Being in default does not authorize prohibited collection or unlawful processing of personal data. Be candid about the unpaid balance and distinguish the debt from the conduct you are reporting.

Can a lending app message all my contacts?

No. Current joint guidance prohibits contacting people in the borrower’s contact list for debt collection unless they are guarantors. A guarantor must have separately consented to assume that role. A character reference is not automatically a guarantor. (National Privacy Commission)

Can I be jailed simply because I did not pay an online loan?

The Constitution states that no person shall be imprisoned for debt. Nonpayment alone is not a basis for imprisonment. This does not immunize separate conduct that may constitute an independently defined offense, such as proven fraud; whether another offense exists depends on the actual facts, not merely on a collector’s accusation. (Lawphil)

Should I uninstall the app immediately?

Preserve the evidence first, then revoke unnecessary permissions and remove the app when appropriate. If the phone or accounts appear compromised, prioritize security and obtain technical or law-enforcement assistance. Uninstalling may not remove information already transmitted to the operator.

Can my relative report messages sent to them?

The borrower can include the messages in an SEC complaint. A relative or other recipient whose own personal data was processed or disclosed may also have a basis to approach the NPC, depending on the facts. Obtain the recipient’s original screenshots and a statement explaining how and when the messages were received.

Can I complain without first writing to the lender?

You may submit an SEC report promptly. For a formal NPC complaint, the general rule is written notice to the respondent and no timely appropriate action or response within 15 calendar days. The NPC may waive that requirement for good cause or a serious violation, so explain and prove why prior notice was unsafe, impossible, or inadequate. (National Privacy Commission)

Can I file with the SEC, NPC, and police at the same time?

Yes, when the incident presents distinct regulatory, privacy, and criminal issues. Describe the same events consistently and disclose related filings when a form or certification requires it. Filing in several places does not guarantee that every agency will accept jurisdiction.

What if I cannot identify the company behind the app?

Report every available identifier: app link, developer, website, privacy-policy address, payment recipient, phone numbers, email addresses, screenshots, bank or e-wallet account, and loan reference. State plainly that the legal operator is unknown and ask the SEC or investigators to identify it.

Will the agency recover my money?

Not necessarily. Agencies may investigate, require explanations, facilitate redress within their authority, impose administrative measures, or refer matters elsewhere. Refunds, damages, debt cancellation, and criminal liability depend on the governing law, evidence, procedure, and requested relief. Republic Act No. 11765 recognizes financial consumers’ right to timely handling and redress of complaints, but it does not guarantee a particular outcome in every case. (eLibrary)

Official sources and filing links

General-information disclaimer

This article provides general Philippine legal information, not legal advice for a particular loan, complaint, or court case. Jurisdiction, available remedies, rate-cap coverage, deadlines, and possible liability can depend on the lender’s regulatory status, the transaction date and documents, and the exact conduct proved. Official sources and procedures were checked on July 24, 2026.