How to Report Online Lending Scams in the Philippines
A comprehensive legal guide for consumers, 2025 edition
1. Why online-lending scams matter
- Proliferation of unlicensed apps: Since 2019 the Securities and Exchange Commission (SEC) has issued dozens of Cease-and-Desist Orders (CDOs) against fly-by-night “pay-day” apps that charge triple-digit interest and publicly shame borrowers.
- Data-harassment tactics: Scraping contacts, blasting threats, and publishing borrowers’ photos violate the Data Privacy Act of 2012 (RA 10173) and may constitute unjust vexation, libel, or grave threats under the Revised Penal Code.
- Consumer-protection momentum: In 2022 Congress enacted the Financial Products and Services Consumer Protection Act (RA 11765), giving the Bangko Sentral ng Pilipinas (BSP), SEC and Insurance Commission sharper teeth against abusive fintech players.
2. Legal foundations you should cite
| Law / Regulation | Key Sections to Reference | Typical Violations in Scam Lending |
|---|---|---|
| RA 9474 — Lending Company Regulation Act | Secs. 4–6 (registration); Sec. 13 (penalties) | Operating without SEC primary license |
| RA 8799 — Securities Regulation Code | Secs. 53–54 (EIPD enforcement) | Fraudulent solicitation of investments disguised as “loans” |
| RA 11765 — Financial Consumer Protection Act | Secs. 4, 11–14 (prohibited acts, remedies) | Unfair collection, mis-selling, hidden fees |
| RA 10173 — Data Privacy Act | Sec. 25 (unauthorized processing); Sec. 31 (penalties) | Contact-scraping, doxxing borrowers |
| RA 10175 — Cybercrime Prevention Act | Sec. 4(b)(2) (computer-related fraud) | App-based phishing and fake payment portals |
| Revised Penal Code (RPC) | Art. 315 (estafa); Art. 282 (grave threats) | Non-existent loan release; blackmail for payment |
| BSP Circular 1098/1169 | Sec. 311 (digital credit risk, consumer assistance) | BSP-supervised lending platforms (banks/e-money issuers) |
3. Recognising a scam
- Unregistered entity – no SEC Certificate of Authority (CA) number in the app store listing.
- Sky-high fees – total “service fees” exceed the 6% cap imposed by SEC Memorandum Circular 19-2019.
- Permission overreach – the app demands access to contacts, photos, or location beyond KYC requirements.
- Harassment – collection agents threaten arrest warrants, contact employers, or post defamatory content online.
4. Preserve your evidence first
| Evidence Type | How to Capture | Why It Matters |
|---|---|---|
| App screen recordings & screenshots | Use built-in “screen-record” or “screencap” immediately after every transaction | Proves abusive UI, interest computation, pop-ups |
| SMS / chat threads | Export text files or take sequential screenshots showing dates & numbers | Shows harassment timeline, phone identifiers |
| Call recordings | Enable auto-record (if lawful in your locale) or note detailed call logs | Verifies threats & extortion |
| Official receipts / e-wallet logs | Download PDF statements, email confirmations | Links payments to the lender |
| Identity documents required by the app | Keep copies of what you submitted | Demonstrates degree of data exposure |
5. Where — and how — to report
| Agency | Jurisdiction & Best Use | Filing Channels | Typical Outcome |
|---|---|---|---|
| SEC – Enforcement & Investor Protection Department (EIPD) | All lending entities without primary/secondary SEC licence; unfair collection; investment fraud angle | • Email: epd@sec.gov.ph • Online form via eSPARC • Walk-in: Secretariat Bldg., PICC Complex, Pasay | CDOs, revocation, fines of ₱10 k–₱1 M per day |
| BSP – Consumer Assistance Mechanism (CAM) | Banks, EMI-licensed platforms (e.g., GCash loans) | • Email: consumeraffairs@bsp.gov.ph • CAM portal • (02) 8708-7087 | Mediation, supervisory sanctions |
| National Privacy Commission (NPC) | Contact-scraping, “doxxing”, privacy breaches | • File NPC Complaint Form + Annexes • Email: complaints@privacy.gov.ph | Compliance order; up to ₱5 M fine; criminal referral |
| NBI – Cybercrime Division (CCD) | Computer-related fraud, phishing sites, large-scale estafa | • Affidavit + ID + Proof, 2/F NBI CCD, U.N. Ave., Manila | Digital forensics, subpoenas, prosecution |
| PNP – Anti-Cybercrime Group (ACG) | Harassment calls, online libel, threats | • Blotter at Camp Crame HQ or any ACG RU/DO | Inquest referral to prosecutor |
| Department of Trade & Industry (DTI) | Hidden surcharges violating Consumer Act (if lender falls outside SEC/BSP scope) | • Email: consumercare@dti.gov.ph • Call 1-D-TI (1-384) | Mediation, fines, closure orders |
| Office of the City/Provincial Prosecutor | Criminal complaints for estafa, unjust vexation, grave threats | • Verified & notarised Complaint-Affidavit + annexes | Warrants, trial |
6. Step-by-step complaint procedure
Run a name search in SEC’s Online Search Portal or call (02) 8818-0921 to confirm the entity lacks a CA.
Stop data leakage: uninstall app permissions; preserve a cloned APK for evidence.
Draft a Complaint-Affidavit
- Title: “Complaint-Affidavit for Violations of RA 9474, RA 10173, Art. 315 RPC, et al.”
- Parties: Full names, addresses, and (if unknown) “John Does.”
- Narration: Chronological, cite dates, screenshots as “Annex A,” “B,” etc.
- Prayer: Request CDO, account takedown, refund, prosecution.
Attach documentary proof: ID, proof of transactions, device forensics if available.
Notarise the affidavit (for criminal filings) or sign a Verification & Certification of Non-Forum Shopping (SEC).
Email or file in person to the chosen agency; request an acknowledgement receipt or docket number.
Monitor: The SEC EIPD usually issues show-cause orders within 30 days; follow up via phone or the eFAST tracker.
Parallel privacy complaint: Submit to NPC if harassment occurred — attach the same annexes, flag “imminent risk to data subjects.”
Optional civil action: Within four years file for damages under Art. 32 Civil Code (violation of constitutional rights) or Consumer Act.
Attend hearings: Be prepared for mediation; if unresolved, the case elevates to formal investigation or prosecution.
7. Sample complaint-affidavit skeleton
Republic of the Philippines )
City of ________ ) S.S.
COMPLAINT–AFFIDAVIT
I, (Name), Filipino, of legal age, resident of __________, after having been duly sworn, depose and state:
1. On 5 June 2025 I downloaded the mobile application “CASH-NOW” from the Google Play Store…
2. The respondent is CASH-NOW LENDING OPC, with registered business address at ______, or if unregistered, JOHN DOE et al…
3. The app imposed a ₱2,200 “processing fee” on a ₱6,000 loan (Annex “A”), equal to **36.66 %** upfront, violating SEC MC 19-2019…
[Detailed chronology]
PRAYER
WHEREFORE, I respectfully pray that:
a) A Cease-and-Desist Order be issued;
b) Criminal charges for estafa, cyber libel, and data-privacy violations be filed;
c) Respondents refund all payments plus moral damages of ₱_____;
IN WITNESS WHEREOF…
___________________
Affiant
SUBSCRIBED AND SWORN…(Attach Verification & IDs; label screenshots as Annex A-E.)
8. Possible remedies & sanctions
| Forum | Sanction Range | Real-world examples |
|---|---|---|
| SEC CDO & Revocation | Fine ₱10 k-₱1 M per day; closure of online platforms | “Pesopop Lending Corp.” revoked March 2024 |
| NPC Compliance Order | Up to ₱5 M admin fine; order to delete data; criminal referral | “WeLoan” ordered to purge contact list Nov 2023 |
| Criminal Court (Estafa) | Prisión correccional to reclusión temporal (2 – 20 years) + restitution | 2022 NBI case vs. “FastLoan” execs |
| Civil Damages | Actual + moral + exemplary damages; attorney’s fees | 2021 Makati RTC decision awarded ₱300 k for harassment |
9. Quick tips to avoid future scams
- Check before you click: Validate SEC CA number and BSP licence (if bank-linked).
- Read consent screens: Allow only camera/photo access needed for ID capture; deny contacts.
- Cap your exposure: Borrow only via platforms integrated with Credit Information Corp. to build legitimate credit history.
- Enable two-factor authentication on e-wallets to block unauthorised debit.
- Educate peers: Share SEC advisories via community Facebook groups and barangay assemblies.
10. Final notes & disclaimer
- Time limits: Privacy complaints must be filed within one year from discovery; estafa within 15 years (Art. 90 RPC).
- No automatic debt forgiveness: SEC CDOs halt collection but do not erase legitimate debt; consult a lawyer before ceasing payment.
- Professional help: For large sums or cross-border syndicates, engage counsel or accredited fintech-law NGOs like FinTech Alliance PH or IBP-Legal Aid.
This article is for general legal information as of 7 August 2025. It is not a substitute for personalised legal advice. Laws and procedures may change; always verify with the issuing agency or a qualified Philippine attorney before relying on this guide.