Predatory Online Lending Apps in the Philippines: Unconscionable Interest, Harassment, and How to File a Complaint

This guide explains how online lending apps (OLAs) should operate under Philippine law, what counts as abusive lending and collection, and exactly how to document issues and file complaints. It’s written for borrowers, advocates, and in-house compliance teams. Philippine context throughout.

TL;DR (What you need to know)

Legality: Lending and financing companies must be SEC-registered and, if they use an app, that app must comply with SEC rules.
Interest & fees: There’s no fixed usury cap, but courts strike down “unconscionable” rates and charges. Hidden “processing fees” that slash cash-out are red flags.
Harassment: Loan shaming, threats, contacting your phone contacts, and other abusive tactics are illegal under SEC rules, the Data Privacy Act (DPA), and the Cybercrime law.
Non-payment ≠ crime: You cannot be jailed for civil debt alone. Threats of arrest are bluff or illegal coercion.
Where to complain:
- SEC → unregistered lenders, unfair collection, deceptive terms
- NPC → privacy violations (contact scraping, shaming messages)
- PNP/NBI Cybercrime → threats, doxxing, hacking, cyber-libel
- Optional: BSP/your e-wallet or bank if payment rails are abused
Evidence wins: Save screenshots, call logs, messages, app permissions, receipts. Write a short timeline.
You can settle safely: Pay only to official channels, keep receipts, and send a cease-and-desist for harassment.

1) Who regulates online lending apps?

Securities and Exchange Commission (SEC) Regulates lending companies (RA 9474, the Lending Company Regulation Act) and financing companies (RA 8556). Issues rules for Online Lending Platforms (OLPs), including disclosure requirements and prohibitions on unfair collection.
National Privacy Commission (NPC) Enforces the Data Privacy Act of 2012 (RA 10173). Targets apps that harvest contacts, leak data, or use personal data for shaming.
Bangko Sentral ng Pilipinas (BSP) Supervises banks and some non-bank payment providers (e-wallets). While most OLAs fall under SEC, payment channels used for collection can be BSP-supervised—useful when disputing abusive transfers.
Law enforcement PNP Anti-Cybercrime Group / NBI Cybercrime Division for threats, doxxing, cyber-libel, unauthorized access, and extortion.
Financial Products and Services Consumer Protection Act (RA 11765, 2022) Gives SEC/BSP/IC broader powers against abusive practices and mandates fair treatment, transparency, and complaint handling.

2) The legal backbone (plain-English)

Freedom to contract ≠ license to abuse: Contracts can be voided if contrary to law, morals, or public policy (Civil Code Art. 1306; Arts. 19–21 on abuse of rights/damages).
Interest in writing: No interest is due unless expressly stipulated in writing (Civil Code Art. 1956).
Truth in Lending: RA 3765 requires clear disclosure of finance charges and effective cost.
Legal interest rate: Courts generally apply 6% per annum for legal interest/judgments (post-2013 jurisprudence).
Unconscionable interest: The Supreme Court repeatedly reduces or nullifies rates like 3%–10% per month (or higher), labeling them “iniquitous” or “unconscionable.”
Unfair collection (SEC rules): Prohibits threats, profanities, public shaming, contacting third parties, misrepresentations, and similar tactics.
Data privacy (DPA): Processing must be lawful, proportional, and transparent. Harvesting contacts or blasting third parties about a borrower’s debt usually lacks lawful basis.

3) Unconscionable interest & junk fees (how to spot them)

Red flags

Very short terms (e.g., 7–14 days) paired with daily rates and “service/processing” fees deducted upfront.
Cash-out is far less than the “approved loan amount.”
Forced renewals/rollovers that capitalize unpaid charges.
No standardized disclosure of the effective annual percentage rate (APR).

How to compute the real cost (worked example)

App shows: “₱5,000 loan, 14 days, 1%/day interest, 10% processing fee.”

Advertised interest: 1%/day × 14 days = 14% of ₱5,000 = ₱700.
Processing fee: 10% × ₱5,000 = ₱500 deducted upfront.
Cash you actually receive: ₱5,000 – ₱500 = ₱4,500.
Amount due on day 14: Principal ₱5,000 + Interest ₱700 = ₱5,700.
Two-week effective cost vs cash-out: ₱1,200 (₱700 interest + ₱500 fee) on ₱4,500 received = 26.67% in 14 days.
Approximate APR: 26.67% × (365/14) ≈ ~694% per annum.

Even if the app “calls” some charges fees, courts and regulators look at the effective cost. Rates like this are classic unconscionability territory.

4) Harassment & unfair collection practices

Common illegal tactics

Loan shaming: Texting/calling your contacts, posting your photo/name online, group chats tagging your relatives/co-workers.
Threats of arrest, criminal cases, or workplace reporting for mere non-payment.
Obscene/insulting language; repeated calls at unreasonable hours; false representations (e.g., pretending to be from government).

Know your rights

Non-payment of civil debt is not a crime. You cannot be jailed for it.
Contacting third parties about your debt is generally prohibited (both under SEC rules and the DPA).
You can demand they stop harassing you and to use a single, written channel (email) for communications.

Possible criminal overlaps

Grave threats, grave coercion, unjust vexation (Revised Penal Code)
Cyber-libel, identity theft, illegal access (RA 10175)
DPA offenses (unauthorized processing, unauthorized disclosure)

5) Data Privacy Act (DPA) essentials for borrowers

Lawful basis: Apps must have a valid legal basis for processing (consent, contract necessity, legal obligation, etc.).
Consent must be freely given, specific, informed. “All-or-nothing” permissions (e.g., grant phonebook access or no loan) are high-risk and often invalid, especially when used to shame borrowers.
Data minimization: Collect only what’s necessary. Bulk contact scraping is rarely necessary.
Your rights: To be informed, to object, to access, to rectify, and to request erasure/blocking of unlawfully processed data.

6) Evidence to gather (checklist)

Screenshots/screen recordings: App permission screens, fee breakdowns, due dates, chat/call harassment, threats, social posts.
Message exports: SMS/Chat logs (show sender, date/time).
Call logs/voicemail: With timestamps.
Proof of payments: Receipts, reference numbers, account names.
App details: App name, developer name, version, links, any shown SEC registration details.
Your timeline: 1–2 pages summarizing what happened and when.
Witness statements: If friends/contacts received harassment messages.

7) How to file a complaint (step-by-step)

A) SEC (unregistered lenders, unfair terms, unfair collection, deceptive marketing)

Prepare a package:
- Cover letter (1 page) with your ID and contact info.
- Timeline (dates, what happened).
- Evidence (screenshots, audio transcripts, payment proofs).
- Identify the company name, app name, and any business addresses/numbers used.
What to allege (use those that apply):
- Lending/financing without registration; or use of an unregistered OLP.
- Unfair debt collection practices (loan shaming, threats, contacting third parties).
- Deceptive disclosures (hidden fees, misleading interest).
- Violations under RA 11765 (fair treatment, transparency).
Where/how:
- File via the SEC’s online complaint intake or EIPD channels, or submit at the SEC main/extension offices. (Attach your ID and evidence list.)
What SEC can do:
- Order take-downs, suspend/revoke licenses, fine entities, and refer criminal cases.

B) NPC (privacy violations: contact scraping, public shaming, unlawful disclosure)

Write first to the lender’s Data Protection Officer (DPO):
- Demand cessation of unlawful processing, deletion of contacts, and data minimization.
- Request a copy of their privacy notice and the lawful basis they relied on.
If ignored or unsatisfied, file a sworn complaint with the NPC:
- Include your DPO letter, proof of sending, and all evidence of shaming/third-party contact.
- State your data subject rights invoked (inform, object, erasure) and harm suffered.
NPC outcomes:
- Compliance orders, fines, or referral for criminal prosecution under the DPA.

C) PNP/NBI Cybercrime (threats, doxxing, cyber-libel, hacking)

Bring ID, timeline, and raw evidence (devices if asked).
Identify phone numbers, accounts, URLs, and the specific crimes (e.g., grave threats, cyber-libel, unauthorized access).
Request a blotter and an investigation case number.

D) Payment providers (BSP-supervised)

If the lender forces payment to personal e-wallets/bank accounts or uses the rails to harass you, complain to your e-wallet/bank:
- Attach evidence and ask for merchant validation, account flagging, and reversal where appropriate.
- Escalate through the bank/e-money consumer assistance office if the first line stalls.

8) If you still want (or need) to settle

Ask for a written breakdown (principal, interest, fees, penalties).
Pay only to official accounts (company-named accounts, official app checkout). Avoid paying to personal accounts.
Use traceable channels; keep receipts and reference numbers.
Negotiate: Ask to waive junk fees, reduce interest to a reasonable level, or extend terms without roll-over penalties.
Confirm “paid in full” in writing. Take a screenshot and request an acknowledgment receipt.

9) Two ready-to-use letters (copy, edit, send)

(A) Cease-and-Desist re: Harassment & Unfair Collection

Subject: Cease and Desist – Unfair Debt Collection Practices

I am [Name], borrower under account/app: [details]. Effective immediately, stop all
harassing communications including (1) contacting my relatives, references, or phone
contacts; (2) threats of arrest or public shaming; (3) use of obscene/insulting language;
and (4) repeated calls or messages outside reasonable hours.

Your conduct violates SEC rules on unfair collection and RA 11765 (fair treatment and
consumer protection). Non-payment of civil debt is not a crime.

Communicate with me only via this email: [email]. Provide a written statement of account
with itemized principal, interest, and fees. I reserve all rights to report breaches to
the SEC, NPC, and law enforcement.

[Name] / [Date] / [ID attachment if needed]

(B) DPA Notice to the Lender’s DPO (prior to NPC complaint)

Subject: DPA Rights – Unlawful Processing / Unauthorized Disclosure

Dear DPO,

I am asserting my rights under RA 10173 (Data Privacy Act). Your app harvested my phone
contacts and sent debt-related messages to third parties. I did not freely, specifically,
and knowingly consent to this, and such processing is unnecessary for loan servicing.

I hereby (1) object to further processing; (2) demand cessation of third-party contacts
and loan shaming; (3) request deletion/blocking of unlawfully processed data; and (4)
request your privacy notice, lawful basis for processing, and data retention schedule.

Please respond in writing within a reasonable period and confirm compliance. Otherwise I
will file a complaint with the NPC and seek appropriate remedies.

[Name] / [Account/App details] / [Date]

10) Red flags & safer alternatives

Red flags

No clear company name/SEC registration/DPO.
All-or-nothing app permissions (contacts, photos, location) just to apply.
Huge fees deducted upfront; repayment demanded to personal accounts.
Harassment scripts start immediately on due date.

Safer options to consider

Employer, cooperative, or government loans (SSS, Pag-IBIG multipurpose), community MFIs, credit unions, or banks with clear disclosures.
If you must use an OLA: choose one with traceable ownership, clear rates, no phonebook access, and formal complaints handling.

11) FAQs

Can the lender file a criminal case for non-payment? Civil debt alone isn’t criminal. Criminal liability arises only with independent crimes (e.g., estafa with fraud, BP 22 if you issued a bouncing check). Empty threats of arrest are illegal intimidation.

They say I “consented” to contact scraping. Is that valid? Consent must be freely given, specific, informed. Using contacts to shame you (or disclose your debt) is typically unlawful, consent or not, because it’s disproportionate and not necessary to collect a debt.

What if the interest is outrageous but I signed? Courts may reduce or nullify unconscionable interest and junk fees. Keep all documents and seek legal help to challenge the charges.

Can I sue for damages? Yes. You may claim damages for abuse of rights (Civil Code Arts. 19–21), DPA violations, and defamation/cyber-libel, among others. For modest amounts, consider Small Claims Court (check the latest monetary threshold).

12) Practical filing roadmap (one-page version)

Secure evidence → screenshots, call logs, receipts, app info, timeline.
Send Cease-and-Desist to stop harassment; demand written SOA.
Write the DPO (DPA rights). Keep proof of sending.
File with SEC (unfair collection, deception, unregistered app) and NPC (privacy).
Report to PNP/NBI Cybercrime for threats/shaming/hacks; get a blotter & case no.
Notify bank/e-wallet if rails are abused; ask for account flagging.
If settling, pay officially, keep receipts, get “paid in full” in writing.
Consider civil action (damages/small claims) if harm continues.

13) Final notes & disclaimer

Laws evolve and agencies update procedures. The principles above remain stable: clear disclosures, fair collection, lawful data use, and respect for borrower dignity.
This guide is general information, not legal advice. If you have a live dispute or court dates, consult a Philippine lawyer or a legal aid clinic promptly.

If you want, I can turn this into a fillable complaint pack (SEC + NPC templates + evidence checklist) tailored to your case details.