For educational purposes only. If you’re in immediate danger, contact the PNP or NBI. For tailored advice, consult a Philippine lawyer.

Quick summary (what to do first)

Stop the bleeding: Change passwords, enable 2FA on email, e-wallets, and banking apps.
Preserve evidence: Screenshot everything (full screen with date/time), export call logs/voicemails, and download app transaction history.
Dispute the “loan”: Send a written dispute and rescission notice to the lending app and its registered email, and to the bank/e-wallet used.
Report the harassment: File complaints with the SEC (lending/financing companies), National Privacy Commission (NPC) (data privacy/“contact shaming”), and BSP (if a bank/e-money issuer is involved).
Consider a criminal complaint for threats, coercion, extortion, or defamation, and civil action for damages and injunction.
Do not pay “processing,” “closure,” or “penalty” fees just to stop harassment—this can worsen things and weaken your case.

The core legal ideas

1) No consent = no loan

A loan (mutuum) is a contract and requires meeting of the minds. If an app unilaterally pushed money into your account (or marked your account as “disbursed”) without your informed consent, there is no valid loan. Any attempt to collect on that “loan” may be unlawful.

Related Civil Code notions that frequently apply:

Consent & vitiated consent: Contracts formed through mistake, fraud, or intimidation are voidable; those lacking consent are void.
Unjust enrichment / solutio indebiti: If money is in your account by mistake, the law avoids unjust enrichment. You may return funds under protest while disputing fees/interest—or hold pending resolution through escrow.

2) Unauthorized processing and harassment are illegal

The Data Privacy Act (DPA) prohibits unauthorized processing of personal data and penalizes malicious or unauthorized disclosures, including “contact shaming” (messaging your employer, relatives, or phone contacts). Apps scraping your contacts or using your ID selfies beyond legitimate, proportionate purposes generally violate privacy principles (transparency, legitimate purpose, proportionality).

3) Debt collection has limits

Philippine regulators have repeatedly condemned abusive collection: threats, doxxing, profanity, shaming posts, and mass texts to your contacts. These may also constitute grave threats, grave coercion, unjust vexation, libel/cyber-libel, and online harassment under various laws.

4) Financial consumer protection

The Financial Products and Services Consumer Protection Act (FCPA) strengthens remedies for abusive practices by banks, e-money issuers, and non-bank lenders. It obliges supervised entities to have complaints-handling, fair disclosure, suitability, and data protection; regulators can order restitution, cease-and-desist, and penalties.

What laws and rules typically apply

Civil Code of the Philippines
- Consent and cause in contracts; void/voidable contracts; damages; unjust enrichment/solutio indebiti.
Data Privacy Act of 2012 (RA 10173) & IRR
- Unauthorized processing, improper disclosure, security measures, data subject rights (access, correction, erasure, objection).
- NPC can order compliance, penalties, and damages; criminal liability exists for certain acts.
Financial Products and Services Consumer Protection Act (RA 11765)
- Consumer protection standards; regulators’ restitution and enforcement powers; internal dispute processes.
Securities Regulation Code and SEC rules on Lending/Financing Companies
- Registration/licensing; prohibition of abusive collection; grounds for suspension/revocation and fines.
Bangko Sentral ng Pilipinas (BSP) regulations (if a bank or e-money issuer, or payments rails were used)
- Consumer assistance, error resolution, and fraud/unauthorized transaction handling.
Revised Penal Code & special laws (depending on conduct)
- Grave threats, grave coercion, unjust vexation, libel (Art. 353–355), slander/defamation, extortion;
- Cybercrime Prevention Act (RA 10175) for online variants (e.g., cyber-libel, computer-related offenses).
- Safe Spaces Act (RA 11313) for gender-based online harassment (if applicable).
- Anti-Photo and Video Voyeurism Act (RA 9995) if intimate images are threatened or disclosed.

Typical violations by abusive online lending apps

“Drop disbursement” (crediting funds without clear consent) and retroactively claiming a loan exists.
Contact scraping and shaming: messaging your employer/family/friends to pressure payment.
Threats and doxxing: publishing your photo/ID with defamatory captions.
Exorbitant, hidden, or rolling fees unrelated to disclosed terms.
Impersonation of public officers (“NBI/PNP case filed”) or fake “court orders.”
Forced waivers of data/privacy rights and coerced permissions beyond what’s necessary.

Step-by-step playbook

A) Evidence and containment (today)

Take comprehensive screenshots
- Chat threads, caller IDs, voicemail, in-app pages, transaction logs, app permissions, and your consent screens (if any).
- Save files as PDF/PNG with timestamps; keep originals unedited.
Export device and app logs
- From the app (transaction history), your bank/e-wallet statement, and SMS call logs.
Secure your accounts
- Change passwords; enable 2FA; remove unknown devices; revoke app permissions in Android/iOS; check connected email sessions.
Preserve the app package info
- App name, developer, version, and links to app store listings.

B) Dispute the “loan” and demand a halt

Send a formal Dispute & Cease-and-Desist letter via email and registered mail to the lender and its officers:

State that you did not consent to any loan; any alleged disbursement was unauthorized.
Rescind/void any purported contract for lack of consent (and/or for vices of consent, unfair terms).
Demand a full account audit and erasure/return of any unlawful fees/interest.
Invoke DPA rights: demand to know what data they hold, sources, recipients, and the legal basis; require cessation of processing for collection and deletion where applicable.
Demand an end to harassment and third-party disclosures; require preservation of logs for investigation.
Give a clear deadline (e.g., 5–7 working days) and state you will file with SEC/NPC/BSP, PNP-ACG, NBI-CCD, and pursue damages.

Tip: If money landed in your account and you wish to return it, do so under protest and only to a verifiable corporate account, with a written acknowledgment that (a) there is no loan, (b) no fees/interest are due, and (c) returning the principal (if any) fully settles the dispute. Avoid sending to personal GCash/PayMaya accounts.

C) Bank/e-wallet dispute (if their rails were used)

File an Unauthorized Transaction/Erroneous Credit report with your bank or e-money issuer.
Ask for reversal/chargeback or corrective posting, and for the provider to flag the merchant/lender for investigation.
Follow the provider’s error-resolution process and obtain a written case/ ticket number.

D) Regulator complaints (parallel tracks)

SEC (for lending/financing companies): abusive collection, unlicensed operations, unfair terms, misrepresentation.
NPC: unauthorized data processing, scraping contacts, disclosure to third parties, shaming.
BSP: if a bank/e-money issuer is involved (e.g., direct debit, wallet rails), raise consumer protection, KYC, and transaction-dispute issues.

Attach your evidence bundle, the dispute letter, and IDs (redact sensitive info where not needed).

E) Criminal and civil action

Criminal: File a complaint-affidavit with the City/Provincial Prosecutor (or PNP-Anti-Cybercrime Group/NBI-Cybercrime). Cite threats, coercion, libel/cyber-libel, extortion, etc., depending on facts.
Civil:
- Injunction/TRO to stop harassment and third-party disclosures.
- Damages (moral, exemplary, attorney’s fees) for wrongful acts.
- Small Claims (if purely monetary and within the Supreme Court’s current small-claims threshold) for recovery/refund.
Data-privacy enforcement: File with NPC for compliance orders, penalties, and damages based on privacy violations.

Evidence checklist (practical)

Screenshots of: app dashboards, consent screens, loan terms, payment schedules, wallet/bank statements.
Threatening messages (full thread, include headers/URLs).
Call logs and audio voicemails (retain originals).
Contact-shaming proof (messages to your contacts, HR, group chats).
Proof of identity misuse (edited images used against you).
Courier receipts, emails with time stamps, ticket numbers.
App metadata: developer name, corporate entity, SEC registration number (if shown).
A timeline of events (who did what, when).

Model letters (short templates)

1) Dispute & Cease-and-Desist (email + registered mail)

Subject: Dispute of Unauthorized Loan, Demand to Cease Harassment and Unlawful Data Processing

I am disputing your claim that I consented to a loan. No valid consent was given. Any alleged disbursement was unauthorized and does not create a loan contract.

Pursuant to civil law and the Data Privacy Act, I demand: (1) immediate cessation of collection and any disclosure to my contacts/employer; (2) full data-processing disclosure (data you hold, sources, recipients, purpose, legal basis); (3) deletion of unlawfully collected data; (4) complete account audit and reversal of charges/interest.

Continued threats, harassment, or disclosure will leave me no choice but to file with the SEC, NPC, BSP, and law-enforcement, and to seek damages and injunctive relief.

Kindly confirm compliance within five (5) working days of receipt.

Name / Address / ID Date

2) Return of Funds “Under Protest” (if applicable)

Subject: Conditional Return of Funds Received Without Consent

Without admitting liability and under protest, I am returning the principal amount you credited without my consent, on condition that you: (1) acknowledge no loan exists; (2) waive all fees/interest/penalties; and (3) cease all collection and data processing unrelated to this closure.

Please reply with the official corporate account details and a signed acknowledgment.

Frequently asked questions

Q: They say I clicked “Agree” in-app. Am I stuck? Not necessarily. Consent must be informed, specific, and freely given. Dark-patterns, pre-ticked boxes, hidden fees, or terms materially different from the screen you saw can vitiate consent. Keep your screenshots and device logs.

Q: They messaged my boss and parents. Is that allowed? Contact-shaming is generally unlawful. It likely violates data privacy and can amount to defamation, coercion, or unjust vexation—and is sanctionable by regulators.

Q: Money was deposited to my account. Do I have to keep it? You can return the principal under protest while disputing any supposed fees/interest, or request that the provider coordinate a proper reversal via your bank/e-wallet. Document the return carefully.

Q: Will uninstalling the app stop harassment? It may stop on-device access, but evidence preservation comes first. Revoke permissions and uninstall after you’ve captured proof.

Q: Can they sue me quickly? They might threaten suit. If they file, you can counterclaim for damages and raise lack of consent, privacy violations, and unfair collection. Courts can grant injunctions against harassment.

Strategic litigation angles (with your counsel)

Void/voidable contract for lack or vitiation of consent; unconscionability of terms.
Data-privacy claims: unauthorized processing, excessive collection (contact scraping), unlawful disclosure, failure to secure data.
Defamation/cyber-libel for shaming posts or mass messages; coercion/threats and extortion if payment is demanded under menace.
Injunctions and protection orders to stop ongoing harassment and compel deletion of unlawfully processed data.
Damages (moral, exemplary) and attorney’s fees.

Practical do’s and don’ts

Do:

Use written channels; keep all replies professional.
Mark returns “without prejudice/under protest.”
Inform your HR/IT (if your employer was contacted) with a short factual memo.

Don’t:

Don’t admit a debt you dispute.
Don’t send IDs/selfies through chat to “verify” unless you initiated a secure, official process.
Don’t pay “closure” or “penalty” fees just to make it stop.

Where to file (typical)

SEC — for abusive collection, unregistered lending, or violations by lending/financing companies.
NPC — for data-privacy violations (contact shaming, unlawful disclosure/processing).
BSP — for issues involving banks/e-money issuers and payment errors.
PNP-ACG / NBI-CCD — for cybercrime (threats, cyber-libel, extortion, identity misuse).
Prosecutor’s Office — to initiate criminal complaints.
Courts — for injunctions and damages; Small Claims for modest monetary recovery.

One-page action plan you can copy

Day 0–1: Secure accounts; gather screenshots/logs; prepare timeline.
Day 1: Send Dispute & C&D to lender; file bank/e-wallet dispute; notify HR if they were contacted.
Day 2–5: File SEC and NPC complaints (attach evidence).
Week 2+: If harassment persists, file criminal complaint and consider injunction; assess civil damages with counsel.
Closure: If returning principal, do it under protest with written acknowledgment; request deletion of your data and written confirmation.

Final note

You are not powerless. Philippine law protects you against non-consensual disbursements and abusive collection. Document everything, act quickly, and escalate through regulators and—if necessary—the courts. If you want, tell me the facts and timeline you have; I can help you convert them into a dispute letter and regulator complaint package.