Quick answer

If an online lending app took your money, used your identity, released a loan you did not request, threatened you, or exposed your personal information, act immediately:

Stop further payments until you verify the lender, debt, and payment channel.
Save all evidence before deleting or resetting anything.
Contact your bank or e-wallet immediately if money or account credentials were involved.
Secure your phone, email, SIM, and financial accounts.
Report unfair collection to the Securities and Exchange Commission (SEC).
Report unlawful use of personal data to the National Privacy Commission (NPC).
Report threats, fraud, identity theft, or account compromise to cybercrime authorities.

A genuine unpaid loan does not automatically disappear because the lender used an abusive collection method. But a lender cannot lawfully turn debt collection into harassment, public shaming, threats, or uncontrolled access to your contacts. If you never applied for or received the loan, dispute it in writing and do not “settle” merely because someone is threatening you.

First identify what happened

“Online lending app scam” can describe several different situations. The correct response depends on which one applies.

You paid an advance fee but received no loan

The operator may demand a “processing,” “verification,” “insurance,” “release,” or “unlocking” fee, then disappear or demand more money. Stop paying. Preserve the payment records and report the receiving account immediately.

Legitimate fees should be disclosed clearly as part of the credit transaction. Repeated demands to send money to personal or changing accounts are serious warning signs.

A loan appeared under your name without your consent

Someone may have used your identity documents, selfie, mobile number, or compromised account. Send the supposed lender a written dispute stating that you did not apply for, authorize, or receive the loan. Request:

the complete application and loan agreement;
the date, time, device, IP address, and authentication records used;
the identity-verification or KYC records;
the destination account into which the loan was released;
a full statement of account; and
the legal name, SEC registration details, and certificate of authority of the lender.

Do not admit liability while the transaction is being verified. If the money was sent to an account that is not yours, say so expressly.

Money was deposited without clear consent, followed by collection demands

Do not spend an unexplained deposit. Notify the sending institution through a verified official channel and ask for written instructions. Scammers sometimes send or claim to send funds and then demand a larger repayment through a different account.

A mistaken or disputed transfer should be handled through the financial institutions involved—not through threats, secret repayment instructions, or personal accounts supplied in chat.

You obtained a real loan, but collectors are harassing you

This may involve a valid debt and an unlawful collection method at the same time. Ask for an itemized statement, verify the creditor, and address any legitimate balance through the lender’s official consumer-assistance channel. Separately document and report the harassment.

Under the Financial Products and Services Consumer Protection Act, financial service providers must treat consumers fairly, protect client data, disclose material costs, maintain a free complaints mechanism, and refrain from abusive collection or debt-recovery practices. Providers may also be responsible for acts of their employees, agents, and accredited third-party collectors.

What online lenders and collectors are not allowed to do

The March 18, 2026 joint advisory of the DICT, NPC, and SEC confirms that the rules apply to online lending platforms whether recorded or unrecorded. Prohibited conduct includes:

requiring unnecessary app permissions;
unauthorized, excessive, or disproportionate processing of personal data;
using personal information to harass or shame a borrower;
threatening violence, reputational harm, property damage, or action that cannot legally be taken;
collecting from people in the borrower’s contact list who are not guarantors; and
contacting a character reference as though that person were responsible for the debt.

A character reference is not automatically a guarantor. A guarantor must have expressly consented to assume responsibility for the loan. The government’s current position is set out in the official Joint Advisory on Online Lending Platforms.

An app may use limited access to contacts to let a borrower select references or guarantors, or derive proportionate metadata for a specified legitimate purpose. That does not permit uncontrolled copying or use of the entire contact list for collection and public shaming.

What to do immediately

1. Preserve evidence before uninstalling the app

Take screenshots or screen recordings showing:

the app’s name, icon, developer, store listing, download link, and version;
the lender’s stated corporate name, address, website, and license details;
advertisements and promises made before you applied;
loan offers, contracts, disclosures, repayment schedules, and privacy notices;
amounts allegedly borrowed, amounts actually received, deductions, interest, fees, and penalties;
chats, texts, emails, call logs, voice messages, threats, and collection scripts;
posts or messages sent to relatives, coworkers, employers, or social-media contacts;
account numbers, QR codes, payment links, mobile numbers, and names of recipients;
bank or e-wallet transaction receipts and reference numbers;
permissions requested or used by the app; and
the date and time of every significant event.

Export conversations where possible. Keep the original files, not only cropped screenshots. Back them up to a secure location. Ask affected contacts to preserve the messages they received and to note when and how they received them.

Do not alter or fabricate evidence. Avoid provoking the collector merely to obtain more threats.

2. Stop communicating through unverified channels

Do not send another payment, ID, selfie, one-time password, PIN, password, screen-sharing code, or remote-access permission to a number or link supplied by the suspected scammer.

Find the lender’s official contact details independently. Do not rely on the same message that demanded payment. If a collector claims to represent a company, ask for the collector’s full name, agency, authority to collect, and the lender’s official complaint channel.

3. Contact the bank or e-wallet immediately

If you transferred money, disclosed credentials, approved an unfamiliar transaction, or lost control of an account:

report the transaction as disputed or fraudulent;
ask whether the recipient account can be flagged and whether funds can still be held or recovered;
request a case or ticket number;
change passwords and PINs using a trusted device;
sign out other sessions;
replace exposed cards or account credentials where appropriate; and
ask whether additional identity-verification or account restrictions are advisable.

Speed matters, but recovery is not guaranteed. Do not falsely report a transaction that you knowingly authorized; describe exactly how the scam or deception occurred.

For a complaint involving a BSP-supervised bank, e-money issuer, money-service business, or payment provider, first use that institution’s consumer-assistance mechanism. If its response is unsatisfactory, escalate through the BSP Consumer Assistance Channels and BSP Online Buddy.

4. Secure your device and identity

After preserving evidence:

revoke unnecessary access to contacts, photos, camera, microphone, location, SMS, files, and accessibility services;
remove unknown device administrators, configuration profiles, and remote-access apps;
update the operating system and security software;
change the passwords of the email and mobile account tied to your financial services;
enable multi-factor authentication;
inform your mobile provider if SIM takeover is suspected; and
review bank, e-wallet, email, and social-media activity for other unauthorized access.

If the app may have obtained identity documents, monitor for unfamiliar loan applications, accounts, or verification messages. Warn close contacts briefly that messages claiming you owe money may be unauthorized. Avoid reposting the scammer’s links or exposing other victims’ personal information.

Verify whether the lender is authorized

Under the Lending Company Regulation Act of 2007, a lending company must be organized as a corporation and must have SEC authority to operate.

A corporate registration alone is not enough. Check both:

whether the company legally exists; and
whether it has authority to operate as a lending or financing company and to use the particular online lending platform.

The app’s brand may differ from the corporation’s legal name. Ask the SEC to verify the connection. A listing in an app store, a business permit, a social-media page, or an SEC-looking registration image does not by itself prove authority to offer loans.

Use the SEC’s official iMessage complaint and inquiry portal rather than relying on screenshots supplied by the app.

Send a written dispute or demand

A concise written notice can establish that the account is disputed and give the provider an opportunity to stop ongoing harm. Include only necessary personal information.

State:

your name and reliable contact details;
the account or transaction reference, if known;
whether you deny applying for the loan, dispute the amount, or complain about collection conduct;
the specific calls, messages, disclosures, or transactions challenged;
the documents and accounting you require;
that communications must be directed to you through a specified channel;
that unauthorized contact with non-guarantors and unlawful disclosure must stop;
that unnecessary app permissions are withdrawn; and
the corrective action requested.

You may request access to personal data being processed, the source of the data, recipients of disclosures, correction of inaccurate data, and—where legally applicable—blocking or erasure. These rights and their limitations are explained in the NPC’s Data Privacy Act implementing rules.

Erasure is not absolute. A provider may retain information when a lawful basis remains, including what is necessary to establish, exercise, or defend legal claims. It still cannot use retained data for unauthorized harassment or public shaming.

Where to report

Different agencies address different parts of the problem. You may need to report to more than one.

Securities and Exchange Commission

Report an unauthorized lender, undisclosed or questionable lending terms, or unfair collection by a lending or financing company to the SEC Financing and Lending Companies Department through SEC iMessage. Select the service for complaints on financing and lending companies and retain the ticket number.

The 2026 joint advisory also lists the SEC hotline 1-4732 (1-4SEC). Confirm current contact details on the official portal before relying on a telephone number.

National Privacy Commission

File with the NPC when the app or collector unlawfully accessed, retained, disclosed, or used personal data—for example, by harvesting contacts, messaging coworkers, posting a borrower’s identity, or refusing to correct a fraudulent account.

The NPC currently requires its prescribed complaint format. Its formal complaint instructions direct complainants to use the current form, have the complaint notarized, attach supporting documents, and submit it in person, by courier, or by scanned email to the address stated on the official page. The NPC introduced a new Complaint-Affidavit template effective July 1, 2025, so use the current download rather than an old copy.

Where practicable, include your prior written communication with the company and its response. If contacting the company first would be dangerous or impracticable, explain why in the complaint.

Cybercrime authorities

Report fraud, account compromise, identity misuse, extortion, or threats to law enforcement. The 2026 joint advisory lists:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph
PNP Anti-Cybercrime Group: acg@pnp.gov.ph

The advisory also provides telephone and additional reporting details. Confirm them from the official advisory because government contact channels can change.

Depending on the proven facts, deception, threats, unauthorized access, identity misuse, or technology-assisted offenses may fall under the Revised Penal Code, the Cybercrime Prevention Act, the Data Privacy Act, the Anti-Financial Account Scamming Act, or other laws. The proper charge depends on evidence and should be determined by investigators and prosecutors.

If you actually owe money

Ask the verified lender for:

a copy of the signed or electronically authenticated agreement;
proof of the amount released and where it was sent;
a complete statement showing principal, interest, fees, penalties, payments, and balance;
the legal basis for disputed charges; and
an official payment channel and receipt.

Do not pay a collector’s personal bank or e-wallet account without independently confirming that the lender authorized it. If a settlement is reached, obtain written terms stating the amount, deadline, treatment of the remaining balance, and the document the lender will issue after payment.

The Philippine Constitution prohibits imprisonment merely for debt. That does not immunize separate acts such as fraud, falsification, or issuing a worthless check when the legal elements are present. A message claiming that police will immediately arrest you solely because a civil loan is overdue is a warning sign, but do not ignore an authentic summons, subpoena, prosecutor’s notice, or court document.

Common mistakes to avoid

Paying repeated “release” or “verification” fees.
Treating an app-store listing as proof that the lender is licensed.
Deleting the app and messages before preserving evidence.
Publicly posting unredacted IDs, contracts, account numbers, or other victims’ details.
Admitting a disputed debt merely to stop threats.
Ignoring a legitimate balance because the collector behaved unlawfully.
Negotiating through a collector whose authority cannot be verified.
Sending payment to a newly supplied personal account.
Giving an OTP or installing a screen-sharing app for “refund processing.”
Filing only with the app store when money, privacy, or criminal conduct is involved.
Blocking every number before saving the messages and call details.
Assuming a character reference is automatically liable for the loan.

When help is urgent

Contact the police or emergency services immediately if there is a credible threat of physical harm, stalking, an attempt to enter your home or workplace, or a threat involving a child.

Seek prompt legal assistance if:

you receive an authentic court summons, subpoena, warrant, or prosecutor’s notice;
a large amount or multiple accounts are involved;
your identity appears to have been used for several loans;
intimate images, confidential records, or workplace information are being threatened or published;
the lender continues contacting non-guarantors after written notice;
you are being pressured to sign a confession, waiver, restructuring agreement, or settlement you do not understand; or
a bank, e-wallet, or lender rejects a documented unauthorized-transaction claim.

The Public Attorney’s Office may assist qualified indigent persons, subject to its eligibility and case-assessment rules. A private lawyer can also evaluate civil, criminal, privacy, and regulatory remedies based on the actual documents.

Frequently asked questions

Should I uninstall the lending app immediately?

Preserve evidence first. Then revoke unnecessary permissions and uninstall it if doing so is safe and will not destroy evidence you need. If malware or remote control is suspected, disconnect the device from sensitive accounts and seek technical help.

Can the app contact everyone in my phone?

No. Current government guidance prohibits contacting people in the borrower’s contact list for debt collection unless they are guarantors. Character references are for identification or verification and do not become guarantors without express consent.

Does harassment cancel a legitimate loan?

Not automatically. The debt and the collection misconduct are separate issues. Verify and address any lawful balance while reporting abusive or unlawful conduct.

Should I repay money I never received?

Demand proof of the application, authentication, disbursement, destination account, and accounting. Dispute the loan in writing. Do not pay solely because of threats.

Can I be arrested simply for failing to pay an ordinary loan?

Not merely for debt. However, separate alleged criminal conduct may be investigated if its legal elements are present. Never ignore genuine official process, but verify threatening documents directly with the named court, prosecutor, or agency.

Can a reference be forced to pay?

Not merely because the person was named as a reference. A guarantor must expressly consent to undertake the obligation, and the enforceability or extent of any guaranty depends on the actual agreement and applicable law.

Where should I complain first?

Use the lender’s official complaints mechanism if the provider is identifiable and it is safe to do so. Report unfair lending or collection to the SEC, privacy violations to the NPC, payment-account issues to the bank or e-wallet and then the BSP where applicable, and fraud or threats to cybercrime authorities.

Is money recovery guaranteed after reporting?

No. Reporting quickly may improve the possibility of tracing or holding funds, but recovery depends on timing, the payment route, available balances, evidence, and the results of the institutions’ and authorities’ investigations.

This article provides general Philippine legal information, not legal advice or a prediction of any case outcome. Rights and remedies depend on the loan documents, transactions, communications, identities of the parties, and available evidence. Official sources and procedures were checked as of July 27, 2026.