Online lending apps and e-money platforms have become part of everyday life in the Philippines. People borrow through mobile applications for emergency cash. They receive salaries, remit funds, pay bills, and store money in e-wallets. But convenience has brought a growing set of legal problems: abusive collection practices, unauthorized deductions, frozen accounts, delayed withdrawals, failed cash-outs, identity misuse, hidden charges, and platforms refusing or delaying release of customer funds.

In the Philippine setting, these issues do not sit in one law alone. They cut across banking regulation, consumer protection, data privacy, cybercrime, contract law, civil liability, criminal law, and administrative enforcement. A user facing a withdrawal problem or an online loan dispute may have remedies before the platform itself, regulators, the police, the courts, or several of them at once. The right legal route depends on the exact facts: whether the issue is a simple service delay, a breach of contract, unfair debt collection, unauthorized access, fraud, privacy abuse, or a refusal to return funds without legal basis.

This article explains the main Philippine legal framework, the common fact patterns, the causes of action that may arise, the proper agencies to approach, the evidence needed, and the practical litigation and non-litigation options available.

I. The Two Core Problem Areas

The topic usually involves two overlapping categories.

The first is online lending disputes. These include:

harassing or humiliating collection practices
threats of arrest or imprisonment for nonpayment
unauthorized access to contact lists or photos
disclosure of the borrower’s debt to friends, relatives, or co-workers
hidden fees, deceptive loan terms, and unconscionable interest or penalties
repeated calls, abusive messages, fake legal threats, and identity shaming
unauthorized auto-debit or wallet deductions

The second is e-money platform withdrawal problems. These include:

failed withdrawals or cash-outs
long-pending withdrawals
frozen or restricted accounts
closure of accounts with funds still inside
demands for repeated verification without resolution
unauthorized transfers out of the account
deductions not explained by the platform
refusal to reverse erroneous transactions
platform claims of “ongoing review” with no definite timeline
inability to access funds needed for daily use

Sometimes both happen together. A borrower may receive a digital loan through a wallet, then the app deducts money directly from that wallet, or the wallet freezes funds because of a lending dispute. In those cases, both lending rules and e-money rules may apply.

II. Philippine Legal and Regulatory Framework

1. Constitution and due process values

At the highest level, Philippine law protects property, privacy, and due process. Money held in an account or wallet is not beyond legal protection simply because the platform is digital. A company cannot lawfully deprive a person of funds or misuse personal information without lawful basis, fair process, and compliance with applicable regulation.

2. Civil Code of the Philippines

Many disputes involving online lending and withdrawals ultimately become civil law cases. The Civil Code is central because it governs:

obligations and contracts
damages for breach
abuse of rights
unjust enrichment
quasi-delicts or fault-based civil liability

Key Civil Code ideas matter a great deal here:

Breach of contract. If a platform accepted funds, promised withdrawal functionality, or agreed to loan terms and then acted contrary to those terms, there may be breach.

Abuse of rights. Even where a company has a legal right to collect a debt or investigate an account, it must act with justice, honesty, and good faith. Harassment, public shaming, oppressive collection, or arbitrary refusal to release funds may support damages.

Unjust enrichment. No one should enrich themselves at another’s expense without legal ground. If a platform holds user money without valid reason, collects charges not authorized, or refuses to return funds after account closure, this principle may apply.

Moral, exemplary, nominal, temperate, and actual damages. In serious cases, especially involving humiliation, anxiety, reputational harm, or bad faith, a claimant may seek damages, sometimes together with attorney’s fees and interest.

3. Electronic Commerce Act

Because these transactions occur through apps, websites, chat messages, emails, and digital records, the Electronic Commerce Act helps validate electronic documents and communications. Screenshots, app receipts, confirmation messages, emails, logs, and other electronic records can be used as evidence, subject to the rules on authenticity and admissibility.

4. Bangko Sentral ng Pilipinas regulation on e-money and payment systems

E-money issuers and operators of payment systems in the Philippines are subject to BSP regulation. In practical terms, if a platform stores value electronically, facilitates transfers, or allows cash-in and cash-out activity, BSP rules on customer protection, risk management, complaints handling, safeguarding of funds, and operational reliability become highly relevant.

Withdrawal disputes often fall into this space:

delayed release of customer funds
failed transactions not promptly reversed
poor dispute resolution
account restrictions without meaningful explanation
weak fraud controls
deficient internal complaint channels

BSP-supervised entities are generally expected to maintain fair treatment standards, complaint mechanisms, and responsible handling of customer funds and transactions.

5. SEC regulation of lending and financing companies

Online lending companies that operate in the Philippines generally fall under the oversight of the Securities and Exchange Commission if they are structured as lending or financing companies. This is a major point in Philippine practice. When the problem concerns the loan product itself, the collector’s conduct, registration issues, or abusive collection acts, the SEC often becomes a key regulator.

This includes issues like:

operating without proper authority
unlawful collection behavior
deceptive loan representations
hidden or excessive charges
misuse of contact information
debt shaming and public disclosure

In short, loan conduct usually points toward the SEC, while wallet/fund-handling conduct often points toward the BSP, though a single dispute can involve both.

6. Data Privacy Act

This is one of the strongest legal tools against abusive online lenders.

Many of the worst lending-app abuses involve data privacy violations:

accessing contact lists beyond what is lawful or necessary
using borrower photos or contacts to shame them
sending messages to third parties about the debt
processing personal data without proper basis
failing to secure personal information
using personal data for harassment or coercive collection

A person harmed by these acts may complain to the National Privacy Commission and may also pursue civil or criminal remedies where supported by facts and law.

The Data Privacy Act matters not only for lenders. E-money platforms also handle sensitive personal and financial data. Unauthorized transactions caused by poor security, improper identity verification, or careless data handling may trigger privacy and security obligations.

7. Cybercrime Prevention Act and related criminal laws

If the conduct involves hacking, phishing, account takeover, malicious access, online extortion, identity theft, illegal interception, or computer-related fraud, cybercrime laws may apply. This becomes relevant where:

a user’s wallet is emptied through unauthorized digital access
fake messages or phishing links capture account credentials
a fraudster impersonates the user to withdraw funds
a platform insider manipulates records
a collector threatens to publish private information online

Criminal liability may exist not just for outsiders, but in some cases for personnel or agents acting unlawfully.

8. Consumer protection principles

Even where a specific financial regulation is not directly invoked, consumer protection concepts remain powerful:

transparency
fair dealing
truthful representation
reasonable fees and charges
effective redress mechanisms
no deceptive or unfair acts

Online financial services are not exempt from basic consumer fairness standards merely because terms are placed in an app.

9. Rules of Court and small claims

When the issue is money owed, refund due, or damages within the allowable scope, the user may consider civil court remedies, including simplified proceedings where available. A straightforward case for refund of funds wrongfully withheld may fit a lower-cost litigation path depending on the amount and the exact relief sought. However, once the case involves complex damages, injunctions, privacy violations, or criminal aspects, regular proceedings may be more appropriate.

III. The Most Common Legal Issues in Online Lending

1. Harassment and abusive collection

A lender has the right to collect. It does not have the right to terrorize.

Unlawful collection conduct may include:

repeated calls at unreasonable hours
obscene, insulting, or threatening language
threats of arrest for mere failure to pay debt
false claims that criminal cases have already been filed
contacting employers, classmates, or relatives to shame the borrower
mass messages exposing the debt
use of fake subpoenas, fake warrants, or fake legal notices
threatening publication of ID cards, selfies, or contact lists

In Philippine law, nonpayment of debt is generally not imprisonment by itself. So threats like “you will be jailed tomorrow if you do not pay today” are often misleading or abusive when used as a collection weapon.

Potential causes of action include:

administrative complaint before the SEC
data privacy complaint before the NPC
civil damages under the Civil Code
criminal complaint if threats, coercion, identity misuse, or cyber offenses are present

2. Unauthorized access to phone data

Some lending apps historically sought broad access to contacts, photos, messages, or device information. Even where a user clicked “allow,” that does not automatically legalize every downstream use. Consent must still be lawful, informed, specific enough, and tied to a legitimate purpose. Debt shaming through contact scraping is especially vulnerable to legal challenge.

3. Hidden fees and deceptive disclosures

A borrower may think they are receiving one amount, only to discover large upfront deductions, service fees, processing charges, and penalties that dramatically alter the real cost of the loan. This can raise issues of:

defective consent
misleading disclosure
unconscionable terms
breach of regulatory disclosure requirements
unfair or deceptive practice

4. Unconscionable interest or penalties

Philippine law does not treat every high interest rate as automatically void, but courts may intervene when charges become unconscionable, iniquitous, or contrary to morals and public policy. This is highly fact-specific. The issue is stronger where the true cost is hidden, stacked through multiple fees, or enforced through oppressive methods.

5. Unauthorized deductions from wallets or linked accounts

A lender may rely on auto-debit clauses, but those must still be valid, transparent, and properly implemented. If deductions exceed what is due, occur without valid authority, or happen from an account that was not lawfully linked, legal claims may arise for refund, damages, and regulatory complaints.

IV. The Most Common Legal Issues in E-Money Withdrawal Problems

1. Failed or delayed withdrawal

A user initiates a withdrawal. The wallet balance is debited, but the bank account or cash-out outlet never receives the money. Sometimes the platform says it is “processing.” Sometimes the transaction disappears into a prolonged “investigation.”

The legal issue is not every short technical delay. Systems fail. The problem becomes legal when:

the delay is unreasonable
the platform gives no adequate explanation
the user follows all required steps but receives no release
the platform fails to reverse a failed transfer
the platform ignores complaints
funds are effectively withheld indefinitely

At that point, breach of contract, negligence, regulatory noncompliance, or unjust enrichment may be argued.

2. Frozen or limited account

Platforms may freeze accounts for fraud monitoring, KYC deficiencies, suspicious transactions, sanctions screening, or security review. Some freezes are valid. But legal issues arise when:

the freeze is arbitrary
the user is not told the basis in any meaningful way
the user complies with verification requests yet remains blocked
the platform keeps the money without final resolution
the freeze is used as a pretext to hold funds without lawful cause

A platform generally has a legitimate interest in compliance and security. But that power is not unlimited. It must be exercised in good faith, within its terms, and consistently with law and regulation.

3. Unauthorized transfer or account takeover

If a user did not authorize the transfer, the dispute can involve:

negligence by the platform
compromised credentials
phishing or scam
SIM swap or social engineering
insider misconduct
weak authentication controls

Legal liability depends on facts such as how access occurred, whether the user shared credentials, whether the system had suspicious patterns, whether the platform acted promptly after notice, and whether internal controls were reasonable.

4. Account closure with funds trapped inside

This is one of the clearest withdrawal disputes. If the platform closes an account for policy reasons, it still must deal lawfully with remaining funds unless there is a specific lawful hold. The question becomes: what legal ground justifies continued retention of money that belongs to the customer?

5. Repeated KYC loop

A common complaint is the endless request cycle:

submit ID
wait
resubmit selfie
wait
submit proof of address
wait
“under review”
no withdrawal allowed

KYC is lawful and often mandatory. But endless non-resolution can become unreasonable, especially where the platform holds substantial user funds and provides no concrete path to release.

V. Administrative Remedies in the Philippines

Administrative remedies are often the most practical first step. They can create pressure, open formal records, and sometimes resolve disputes faster than court.

A. Complaints involving online lending apps: SEC

Where the platform is acting as a lending or financing company, the SEC is often the primary regulator to examine:

registration or licensing issues
abusive collection conduct
unlawful business practices
violations tied to lending operations
conduct of agents, collectors, and service providers

A complaint can be strengthened by submitting:

screenshots of the app
loan contract or terms and conditions
collection messages
call logs
names and phone numbers used by collectors
screenshots of messages sent to third parties
transaction history and payment receipts
proof of deductions
IDs and account details used in the transaction

Administrative complaints do not always produce immediate money recovery, but they can help stop abusive practices and support parallel civil or criminal action.

B. Complaints involving e-money, wallets, withdrawals, and payment failures: BSP

For e-money and payment service issues, BSP-related complaints are central, especially against BSP-supervised entities. Complaints often concern:

unreturned funds
non-reversed failed transactions
unresponsive customer support
unfair restriction of access to funds
deficient complaint resolution
unexplained debits or transfers

The complaint should clearly state:

exact transaction date and time
amount involved
transaction reference number
screenshots before and after the transaction
messages from the platform
prior complaint reference numbers
dates when support was contacted
current status of the funds

The stronger the paper trail, the better.

C. Data privacy complaints: NPC

The National Privacy Commission becomes highly relevant where:

contacts were scraped or used for debt shaming
private information was disclosed to third parties
account data was mishandled
identity documents were misused
personal data security appears deficient

This route is especially important for online lending abuses because privacy harm often causes the most severe personal and reputational damage.

D. DTI, consumer channels, and local enforcement bodies

In some situations, general consumer complaint channels may also help, particularly for deceptive representations, service failures, and refund disputes. The exact fit depends on the entity’s nature and the issue involved. Financially regulated entities may still primarily fall under BSP or SEC channels, but consumer-protection framing remains useful.

E. National Bureau of Investigation or Philippine National Police

Where the conduct is criminal in character, such as fraud, identity theft, cyber intrusion, extortion, threats, or impersonation, law enforcement may be appropriate. This is especially true for:

hacked or stolen accounts
fake support agents
phishing schemes
criminal harassment
blackmail involving personal data or photos

VI. Civil Causes of Action

A victim is not limited to complaining to regulators. A civil action may be filed for monetary recovery and damages.

1. Specific performance

If the platform is obligated to release funds or complete a valid withdrawal and it refuses without lawful basis, the claimant may seek an order compelling performance.

2. Sum of money or refund

Where money is clearly due and demand has been made, an action to recover a specific amount may be proper.

3. Damages for breach of contract

If the company violated the express or implied terms of its service or loan agreement, damages may be claimed, especially where the breach caused financial loss.

4. Damages for abuse of rights and bad faith

This is powerful in harassment and arbitrary withholding cases. Even a company with contractual powers can become liable when it uses them in a manner contrary to justice, honesty, and good faith.

5. Unjust enrichment

This is particularly apt where the platform continues to hold funds without valid basis or keeps charges it had no right to collect.

6. Quasi-delict

If negligence caused the loss, such as weak internal controls leading to unauthorized withdrawal, a quasi-delict claim may be considered.

7. Moral and exemplary damages

These may become important where the user suffered humiliation, anxiety, reputational damage, or oppressive conduct, particularly in debt-shaming cases.

VII. Criminal Exposure of Platforms, Agents, or Other Actors

Not every platform dispute is criminal. Many are contractual or regulatory. But some situations do cross the line.

1. Grave threats, unjust vexation, coercion, or related offenses

Collectors who threaten violence, jail, or reputational ruin may create criminal exposure depending on the words used and the circumstances.

2. Estafa or fraud-type conduct

If the facts show deceit from the start, fake lending operations, or fraudulent appropriation of funds, criminal fraud theories may arise.

3. Computer-related fraud or illegal access

Unauthorized access to e-money accounts, password theft, manipulation of digital records, and other cyber-enabled theft may support cybercrime complaints.

4. Privacy-related offenses

Improper disclosure, processing, or misuse of personal data may carry liability under privacy law.

5. Falsification or impersonation

Fake legal notices, fake court documents, impersonation of lawyers, or forged communications may trigger separate offenses.

VIII. Demand Letter: Why It Matters

Before filing a civil case, a carefully written demand letter is often useful.

It does several things:

formally states the facts
specifies the amount or relief demanded
puts the company in delay where required
creates a documentary record
shows good faith and reasonableness
frames the legal issues early

A solid demand letter should identify:

the account and transaction details
the problem and dates involved
prior efforts to resolve it
the exact relief sought
a reasonable deadline
the legal bases in plain terms
the consequence of noncompliance

For loan harassment cases, the demand may require:

immediate cessation of contact with third parties
deletion or non-use of unlawfully processed data
written confirmation that harassment will stop
compensation where warranted

For withdrawal disputes, the demand may require:

release of funds
reversal of failed transactions
written explanation for the account restriction
restoration of access
refund of charges and damages where applicable

IX. Injunction and Urgent Court Relief

In especially serious cases, ordinary damages after the fact may not be enough.

Examples:

a lender is actively sending defamatory messages to the borrower’s contacts
a platform is threatening to publish private data
a large sum is frozen and business operations are collapsing
repeated unauthorized deductions continue to occur

The user may consider urgent relief such as injunction, where legally justified. This is more complex and usually requires stronger proof, but it can be crucial when the harm is immediate and continuing.

X. Evidence: What Wins These Cases

Digital cases are won or lost on records. The user should preserve everything from the first sign of trouble.

Essential evidence includes:

screenshots of balances before and after
transaction receipts and reference numbers
withdrawal attempts and timestamps
error messages
app notifications
email exchanges
chatbot transcripts
customer support ticket numbers
call recordings where lawfully made
call logs and text messages
messages from collectors
screenshots of messages sent to relatives or contacts
copies of IDs submitted to the platform
account statements
proof of source of funds where relevant
loan terms, disclosure statement, and repayment schedule
evidence of actual damage such as missed payments, penalties, lost business, or emotional harm

Preserve metadata where possible. Do not edit screenshots. Back them up in multiple places. Save messages in original format if possible.

XI. Important Distinctions in Liability

1. Platform failure versus fraud by a third party

A failed withdrawal may be caused by a system issue, a bank-side problem, a scam, or user compromise. Liability differs depending on cause.

2. Borrower default versus illegal collection

A borrower who truly owes money can still be a victim of unlawful collection. Debt does not legalize harassment.

3. Valid compliance hold versus arbitrary freeze

A platform may lawfully hold funds for anti-fraud or KYC reasons. The legal problem is not the existence of review, but its arbitrariness, bad faith, excessiveness, or lack of lawful basis.

4. User negligence versus platform negligence

Where credentials were voluntarily shared, clicked through phishing, or handed to a fraudster, the platform may contest liability. But even then, the platform’s own controls may still be examined. One does not automatically erase the other.

XII. Terms and Conditions: Powerful but Not Absolute

Platforms often rely heavily on their Terms and Conditions. These matter, but they are not magic shields.

A term may still be challenged if it is:

unlawful
unconscionable
contrary to public policy
ambiguous
not fairly disclosed
implemented in bad faith
inconsistent with mandatory law or regulation

For example, a clause allowing broad suspension powers may not justify indefinite retention of funds without fair process. A clause saying the user “consents” to all data use may not validate debt-shaming or disclosure to unrelated third parties.

XIII. Strategy by Scenario

Scenario 1: Debt-shaming by a lending app

A borrower misses payment. The app messages friends and co-workers saying the borrower is a scammer or criminal.

Likely legal routes:

SEC complaint
NPC complaint
civil action for damages
possible criminal complaint depending on the communications used

Most important proof:

screenshots of the messages
names and numbers used
recipients’ statements
proof that the lender or its agents sent them

Scenario 2: Wallet withdrawal pending for weeks

A user attempts to cash out a large balance. The app debits the balance but says “processing” for an unreasonable period, with no reversal and no explanation.

Likely legal routes:

formal complaint to the platform
BSP complaint
demand letter
civil action for release of funds and damages if unresolved

Most important proof:

transaction reference
screenshots of debit and non-receipt
bank statement showing no credit
support tickets and response timeline

Scenario 3: Account frozen after KYC resubmission

A user submits all requested documents, but the account remains blocked and funds are inaccessible.

Likely legal routes:

escalation through platform complaint channels
BSP complaint
demand letter
civil action if prolonged and unjustified

Most important proof:

all submitted IDs and timestamps
emails or messages requesting verification
proof of compliance
current balance and blocked status

Scenario 4: Unauthorized wallet transfer

A user discovers that funds were transferred without authorization.

Likely legal routes:

immediate report to platform
preservation of logs
police or NBI complaint if fraud-related
BSP complaint if platform response is inadequate
civil claim depending on facts

Most important proof:

device/location mismatch
notice timing
account access history if available
screenshots of unauthorized transfers
platform responses

Scenario 5: Loan app auto-deducts more than due

A borrower sees repeated deductions from a linked wallet beyond the lawful amount.

Likely legal routes:

platform dispute
SEC complaint if tied to lending conduct
BSP complaint if wallet mechanism involved
demand for refund
civil action for recovery and damages

XIV. Classifying the Right Defendant

A common mistake is suing or complaining against the wrong entity. The user must identify who actually controlled the relevant act.

Possible defendants or respondents include:

the lending company
the financing company
the e-money issuer
the payment processor
a collection agency
outsourced collectors
the merchant or disbursement partner
unidentified fraudsters
officers or employees, in some cases
John Doe defendants when identities are not yet known

The app name is not always the registered legal entity. Evidence should be collected showing the corporate name, terms of service, official receipts, website information, and regulatory disclosures.

XV. Venue and Procedure

The right venue depends on the type of case:

administrative agency complaint
criminal complaint
civil action for money or damages
small claims where suitable
special civil action or injunction in urgent cases

The amount involved, the user’s residence, the company’s principal office, and the place where obligations were to be performed can matter. So can any venue clauses in the contract, though these are not always controlling if they are oppressive or inconsistent with procedural law.

XVI. Defenses Platforms Commonly Raise

Platforms usually defend these cases by saying:

the user agreed to the terms
the account was flagged for suspicious activity
KYC requirements were incomplete
there was a third-party bank delay
the user shared credentials or OTP
collection actions were done by an independent contractor
the disclosures were visible in the app
the user consented to data processing
the funds were lawfully held for investigation
the account was involved in fraud or policy breach

These defenses must be tested against evidence. Boilerplate responses do not automatically defeat a claim.

XVII. Practical Steps Before Formal Action

In Philippine practice, the strongest complainants are the ones with a clean paper trail. Before escalating, a user should usually:

document the exact issue immediately
preserve screenshots and messages
file an in-app or email complaint and get a ticket number
make a clear written demand
identify the proper regulator
avoid verbal-only exchanges
refrain from deleting the app until evidence is preserved
secure the account, passwords, device, SIM, and linked email if fraud is suspected
keep proof of all losses and consequences

This is not merely practical. It improves legal positioning.

XVIII. Special Issues for Overseas Filipinos and Gig Workers

These disputes hit especially hard when the user is:

an OFW relying on remittance wallets
a freelancer paid through e-money channels
a rider, seller, or gig worker whose daily cash flow depends on withdrawals
a borrower who used a short-term loan during emergency

In such cases, actual damages can be broader:

missed rent
missed tuition
bounced payments
penalties
lost business income
inability to buy essentials

The more concrete the proof, the stronger the claim.

XIX. Can a Person Go Straight to Court?

Yes, depending on the facts. But court is not always the best first move. Administrative complaints can be faster, cheaper, and strategically useful. Still, court may be appropriate where:

large sums are involved
the platform refuses to engage
privacy harm is severe
damages are substantial
urgent injunctive relief is needed
the legal issues are already mature and documented

A person is not always required to exhaust every possible complaint channel before bringing certain judicial actions, but strategy matters. Premature filing without records can weaken a strong case.

XX. Settlement, Refund, and Release Agreements

Many disputes end in settlement. That can be sensible, but the user should read settlement documents carefully.

Watch for clauses that:

waive all future claims
deny wrongdoing
bar complaints to regulators
force confidentiality
require deletion of evidence
release unknown parties too broadly

A refund that is much smaller than the actual loss may not always be wise to accept without review, especially where privacy and reputational harm occurred.

XXI. Key Legal Principles to Remember

A few points capture the whole field:

A lender may collect, but not harass.

A platform may investigate, but not hold funds indefinitely without lawful basis.

A customer may consent to reasonable processing, but not to every abusive use of personal data.

A digital term may bind, but not if it is unlawful, unconscionable, or enforced in bad faith.

A technical issue may excuse a short delay, but not endless non-resolution.

A borrower may owe money, but still be entitled to privacy, dignity, and lawful treatment.

A wallet provider may impose security controls, but must still respect the user’s property rights and due process values.

XXII. Bottom Line

In the Philippines, legal action over online lending and e-money withdrawal problems usually turns on one of five theories: breach of contract, regulatory violation, privacy breach, abusive conduct, or fraud/cybercrime. The strongest cases are built not on outrage alone, but on precise documentation, the correct legal classification of the problem, and use of the right forum.

For online lending abuse, the most important legal tools are often the Civil Code, SEC regulation, and the Data Privacy Act. For withdrawal and trapped-funds disputes, the strongest routes usually involve BSP-regulated complaint processes, contract and unjust enrichment principles, and civil recovery claims. When the facts include hacking, impersonation, blackmail, or fraudulent access, cybercrime and criminal law enter the picture.

The practical lesson is simple: not every app problem is just “customer service.” Once a lender weaponizes private data, once a wallet withholds funds without lawful basis, or once a platform’s actions cause measurable loss or humiliation, the dispute may already be a legal one.

A Philippine claimant who wants results should think in layers: preserve evidence, identify the exact wrong, send a demand, engage the proper regulator, and escalate to civil or criminal action where the facts justify it. That is how online financial harm is turned into a legally actionable case.