Online Lending App Complaints in the Philippines: A Practical Legal Guide

I. Why this matters

Online lending has lowered barriers to credit for millions of Filipinos—but it has also produced a wave of complaints: harassment (“debt shaming”), abusive collection, hidden charges, unauthorized data use, and lending by unregistered entities. This article organizes everything a borrower needs to know about rights, violations, remedies, and how to take action in the Philippine legal and regulatory setting.

II. Key regulators and who handles what

Securities and Exchange Commission (SEC) – Regulates lending companies (Lending Company Regulation Act, R.A. 9474) and financing companies (R.A. 8556, as amended). Oversees online lending platforms (OLPs) run by these entities. Handles: illegal/unregistered lending, abusive collection, interest/fee caps (where applicable), and platform compliance.
Bangko Sentral ng Pilipinas (BSP) – Regulates banks, e-money issuers (EMIs), virtual asset service providers, and payment system operators. Handles: issues when the lender is a bank/EMI, payment disputes, unauthorized debits, and financial consumer protection duties under the Financial Consumer Protection Act of 2022 (FCPA, R.A. 11765).
National Privacy Commission (NPC) – Enforces the Data Privacy Act of 2012 (DPA, R.A. 10173). Handles: excessive/irrelevant data collection, scraping of contact lists, unauthorized disclosures to your friends/family (“debt shaming”), security breaches, and unlawful processing.
Credit Information Corporation (CIC) – Implements the Credit Information System Act (R.A. 9510). Handles: access to your credit report and disputes over inaccurate negative entries.
Law enforcement (PNP-ACG / NBI-CCD) – Handles: threats, extortion, doxxing, stalking, identity theft, cyber libel, and other crimes under the Revised Penal Code and the Cybercrime Prevention Act (R.A. 10175).
Local courts (MTC/RTC; Small Claims) – Civil remedies (damages, injunction) and Small Claims (now up to ₱1,000,000) for money disputes without lawyers.

Rule of thumb:

If it’s about registration, abusive collection, hidden fees → SEC (for lending/financing companies).

If it’s about a bank/e-wallet or payment problem → BSP.

If it’s about contact scraping, public shaming, privacy → NPC.

If there are threats/extortion → law enforcement (plus the relevant regulator).

III. The legal framework, at a glance

R.A. 9474 (Lending Company Regulation Act) & R.A. 8556 (Financing Company Act)
- Lending/financing companies must be SEC-registered and (for OLPs) comply with SEC regulations specific to online platforms.
- Unregistered lending is illegal.
- SEC has issued rules on unfair debt collection and on registration and conduct of online lending platforms.
R.A. 11765 (FCPA, 2022)
- Establishes financial consumer rights (to disclosure, fair treatment, data privacy, redress) and regulator powers to order restitution, refunds, and penalties.
- Requires internal dispute resolution (IDR) and clear complaints handling by financial service providers.
R.A. 10173 (Data Privacy Act)
- Lawful basis for processing, transparency, proportionality, security measures, and data subject rights (access, correction, erasure, objection).
- Debt shaming via mass texts to your contacts typically violates the purpose limitation and proportionality principles.
Interest & fee controls; unconscionable terms
- No general usury ceiling (Usury Law ceilings were lifted decades ago), but:
  - SEC has imposed specific caps and conduct requirements for certain small, short-term, unsecured loans of lending/financing companies.
  - Courts can strike down unconscionable interest and charges under the Civil Code (freedom of contract is not absolute). The legal interest rate for forbearance/damages is 6% per annum (judicial rate), guiding courts when they adjust excessive rates.
Debt collection conduct
- SEC rules prohibit harassment, threats, obscene language, public shaming, contacting persons not the borrower except for limited location/verification, and contacting the borrower at unreasonable hours.
- Even if money is owed, threatening arrest is unlawful—non-payment of debt is a civil matter, not a criminal offense by itself.
Cyber and penal laws
- Grave threats, extortion, cyber libel, identity theft, coercion, unjust vexation may all be implicated by abusive collection tactics. Preserve evidence.

IV. What typically goes wrong (and why it’s unlawful)

“Debt shaming”: Mass messaging/calls to family, friends, co-workers; posting on social media. → Violates SEC unfair collection rules and DPA (unauthorized disclosure; disproportionate processing).
Contact-list scraping & overbroad permissions: Apps demanding phonebook, photos, location unrelated to creditworthiness or servicing. → Likely violates data minimization/proportionality under the DPA.
Harassment & threats: Threats of arrest, “case filing tomorrow,” contacting employer/HR, obscene/insulting language, calling late at night or too frequently. → Prohibited collection conduct; may also be criminal.
Hidden charges & fee stacking: Vague “processing fees,” daily “penalty” that balloons, double-charging via multiple e-wallet links. → Violates clear disclosure duties; unconscionable charges can be voided/reduced.
Unauthorized debits: Auto-deductions from linked e-wallets beyond what you authorized. → BSP and FCPA issues; refund/restitution may be ordered.
Unregistered or “front” entities: Using shell companies or foreign apps with no Philippine license. → Illegal lending; SEC can issue cease and desist orders and file cases.

V. Your rights as a borrower

To be treated fairly and without harassment.
To clear, comparable, and upfront disclosure of interest, fees, APR/EIR, repayment schedules, penalties, and collection practices.
To privacy and protection of your personal data; your contacts should not be used to shame you.
To access, correct, and erase personal data (subject to retention/legal bases) and to object to unlawful processing.
To complain through the lender’s internal complaints process and, if unsatisfied, to escalate to the SEC/BSP/NPC and seek judicial remedies.
To accurate credit reporting and to dispute erroneous negative entries with CIC.

VI. Immediate steps if you’re being harassed or overcharged

Secure evidence
- Screenshots of messages/calls (show timestamps, numbers, app names).
- Call recordings/voicemails (if lawfully recorded).
- Contract, T&Cs, disclosure screens at onboarding.
- App permissions granted (phone settings), and any privacy notices.
- Proof of payments/ledger.
- Names/IDs of agents (if available), and company names shown in the app/store listing.
Lock down access
- Revoke app permissions (contacts/camera/storage/location).
- Unlink payment instruments (e-wallets/bank accounts) if unauthorized debits occurred; request chargeback/dispute.
- Consider uninstalling the app after gathering evidence.
- Change passwords; enable MFA on email/e-wallet.
Use the lender’s complaints channel (required under FCPA)
- File an internal complaint: state facts, violations (harassment/privacy/fees), and specific relief (stop contact with third parties, correct ledger, refund fees, delete unlawfully obtained data).
- Ask for a written response and reference number.
Escalate to regulators (parallel filing is fine)
- SEC: for abusive collection, unregistered lending, hidden/illegal fees, OLP misconduct.
- NPC: for debt shaming, contact scraping, unauthorized disclosure, security lapses.
- BSP: if a bank/EMI/e-wallet is involved (unauthorized debits, failed dispute resolution, FCPA breaches).
- CIC: request your report and dispute wrong entries.
Report crimes
- PNP-ACG/NBI-CCD for threats, extortion, doxxing, cyber libel, identity theft. Bring your evidence pack.
Consider Small Claims/Civil action
- For refunds, damages, or injunction to stop harassment. Small Claims up to ₱1,000,000 (no lawyers required).

VII. How to file: regulator-by-regulator playbook

A. SEC (lending/financing companies & OLPs)

What to allege: company/app name, proof of registration status if known (or the lack of it), abusive collection (calls/texts to third parties; threats; late-night calls), undisclosed/illegal fees, misleading ads, and any interest cap violations applicable to small, short-term loans.
What to attach: screenshots, contract/T&Cs, receipts, call logs, list of third parties contacted, and your complaint to the company (and its reply or non-reply).
What SEC can do: investigate, issue cease and desist orders, suspend/revoke registration or OLP authority, impose penalties, and refer for prosecution.

B. NPC (privacy/data abuses)

What to allege: unlawful processing, lack of lawful basis, excessive permissions, disclosure to third parties, security failures, refusal to honor data rights (access, erasure, objection).
Relief to seek: stop processing, delete unlawfully obtained data, cease “debt shaming”, and administrative fines/penalties.
Tip: include device screenshots showing permissions and any privacy notice contradictions.

C. BSP (banks/e-wallets/payment disputes)

Typical issues: unauthorized debits/auto-debit overreach, chargeback denials, failure to acknowledge within a reasonable period or resolve complaints, lack of clear disclosures.
Relief to seek: reversal/refund, proper investigation, improvements to controls, and compliance with FCPA standards.

D. CIC (credit report disputes)

Steps: request your credit report, identify incorrect/unsupported negative data from the lender, and file a dispute. The reporting entity must correct or justify the entry.

E. Law enforcement

File a criminal complaint for grave threats/extortion/cyber libel/identity theft, attaching your evidence. You can pursue criminal and regulatory routes simultaneously.

VIII. Interest, fees, and penalties: what’s reasonable?

Disclosure first. Lenders must give clear, prominent disclosures of interest (APR/EIR), fees, penalties, and collection practices before you accept the loan.
Caps and conduct rules apply to lending/financing companies for certain small, short-term, unsecured loans (typical for many OLPs). Even where a specific numeric cap doesn’t apply, unconscionable charges can be struck down by courts.
Penalty interest/late fees must be reasonable and not cumulative in a way that defeats public policy. Courts routinely reduce oppressive rates and charges.

IX. Defenses and practical pointers if you owe money

You still owe lawful principal and reasonable charges. Asserting your rights is not the same as evading debt. Offer a good-faith repayment plan in writing.
Demand lawful collection. You may state—in writing—that further contact with third parties is prohibited and that all communication should be in writing or during reasonable hours.
Negotiate waivers of junk fees or penalty reductions in exchange for prompt settlement.
Keep everything in writing; avoid verbal-only arrangements.

X. Templates (copy-adapt as needed)

1) Internal complaint to the lender (FCPA-style)

Subject: Complaint re: Abusive collection & unlawful data processing – [Your Name], [Loan/App]

I am filing a formal consumer complaint regarding the following:

Abusive collection (dates, numbers used, samples attached);

Unauthorized disclosure to my contacts / scraping of my phonebook;

Hidden/undisclosed fees and excessive penalties; and

Failure to provide clear disclosures and a privacy notice compliant with the DPA.

I request: (a) cessation of all third-party contact, (b) deletion of unlawfully obtained data, (c) correction of my ledger (remove junk fees/penalties), and (d) written resolution within your stated complaint timelines.

Attached: evidence pack. Please confirm receipt and provide a reference number.

2) NPC privacy complaint (summary)

I allege unlawful processing of my personal data by [Company/App], including excessive permissions and disclosure to my contacts for collection purposes, violating the Data Privacy Act (lawful basis, proportionality, and purpose limitation).

I request orders to cease processing, delete unlawfully acquired data, and sanction the entity. Evidence attached.

3) SEC abusive collection complaint

I allege violations of SEC rules on unfair debt collection by [Lending/Financing Company/OLP]: harassment, third-party contacts, threats, and undisclosed charges.

I request investigation, cease and desist, and appropriate penalties, with restitution/refund of unlawful fees.

XI. Evidence checklist (attach as PDFs/screenshots)

Contract/T&Cs and in-app disclosures at onboarding
App permissions granted (device settings screenshots)
Privacy notice (if any) and any contradictions with actual practice
Call logs, message threads, voicemail/audio files
Names/IDs of agents and numbers used
Payment proofs/receipts; ledger statements
Credit report entries (for CIC disputes)

XII. Barangay conciliation, Small Claims, and venue

Barangay conciliation may not apply where one party is a juridical entity (e.g., corporation) or the parties are in different cities/municipalities; check Chapter 7, Katarungang Pambarangay (LGC).
Small Claims (no lawyers) now covers money claims up to ₱1,000,000—ideal for recovering unlawful fees or damages arising from abusive practices. Venue is where you reside or where the defendant resides (subject to procedural rules).

XIII. Common myths—debunked

“We can have you arrested tomorrow if you don’t pay.” False. No debtor’s prison; non-payment is civil, absent fraud/other crimes.
“We can message your contacts; you consented.” Not if consent was unclear, coerced, bundled, or disproportionate. The DPA requires lawful basis and proportionality.
“All these fees are standard.” Unconscionable or undisclosed fees can be voided; regulators can order restitution.
“We’re just a platform, not a lender.” Online lending platforms operated for or by lending/financing companies are regulated; they cannot evade rules through labels.

XIV. Strategic paths to resolution

Fast relief: Internal complaint → simultaneous SEC/NPC/BSP filing → ask for interim cessation of third-party contact.
Money back: Seek ledger correction/refunds; if refused, proceed to Small Claims or regulatory restitution.
Privacy-first: Prioritize NPC if “debt shaming” is ongoing; ask for stop-processing orders.
Systemic impact: If unregistered or serially abusive, highlight public interest; regulators often act swiftly on patterns.

XV. Practical FAQs

Can I refuse to give the app my contacts? Yes. If the app requires it, that likely breaches proportionality—report to NPC and SEC.
They keep calling my boss. What can I do? Inform the company in writing that third-party contact is prohibited; file with SEC and NPC attaching call logs.
They posted my photo online. Preserve URLs/screenshots; file NPC complaint and cybercrime report immediately; consider protection orders/injunctions.
I already repaid, but they won’t clear my balance. Demand ledger correction and certificate of full payment; escalate to SEC/BSP and CIC if your report remains negative.
Can I settle for less? Yes—negotiate a written settlement with clear waivers, then keep all receipts.

XVI. Final takeaways

Document everything, act quickly, and file in parallel (lender → regulator(s) → law enforcement if needed).
Harassment and debt shaming are unlawful even if you owe money.
Unregistered lending is illegal—these operators can be shut down.
Privacy is fundamental: contact scraping and disclosure to your friends/family are typically violations.
Courts and regulators can reduce/void abusive charges and order refunds.

This guide summarizes prevailing rules and practices in the Philippines. For high-stakes cases or when you’re unsure about jurisdiction or remedies, consult a Philippine lawyer to tailor the strategy to your facts.