I. Introduction

The rise of digital lending in the Philippines has made credit faster and more accessible, but it has also created new forms of consumer harm. One recurring complaint involves an unauthorized digital loan transaction, where a person discovers that a loan was taken out, processed, disbursed, collected, or reported under their name without their valid consent.

This may happen through identity theft, account takeover, SIM or device compromise, forged e-signatures, unauthorized use of personal data, deceptive app permissions, illegal collection practices, or fraudulent loan applications made by third parties. In other cases, a borrower may have interacted with a digital lending app but disputes the transaction because the loan amount, fees, consent, repayment terms, data access, or collection methods were not lawfully disclosed or authorized.

In the Philippine setting, this issue sits at the intersection of consumer protection, data privacy, lending regulation, cybercrime, electronic commerce, contract law, and criminal law. A proper complaint should therefore be framed not only as a “loan dispute,” but as a possible violation of multiple legal obligations imposed on lending companies, financing companies, online lending platforms, payment providers, debt collectors, and persons who unlawfully used another person’s identity or data.

II. What Is an Unauthorized Digital Loan Transaction?

An unauthorized digital loan transaction may refer to any of the following:

A loan account created without the complainant’s consent.
A loan application submitted using stolen or misused personal data.
A digital loan approved through identity theft, fake credentials, or forged electronic consent.
A loan disbursed to an account not owned or controlled by the complainant.
A loan booked after the complainant merely downloaded an app, inquired, or attempted registration.
A loan amount, interest, fee, or repayment term different from what was disclosed or accepted.
Repeated loan renewals, rollovers, or reborrowing done without clear consent.
Unauthorized access to contacts, photos, messages, or device information used for collection or harassment.
False reporting of the complainant as delinquent to a credit bureau or database.
Collection demands made against a person who never borrowed or never authorized the transaction.

The key issue is consent. A valid loan requires a meeting of minds between the lender and the borrower regarding the principal terms: the identity of the parties, the amount borrowed, interest, fees, repayment date, penalties, and other material conditions. In a digital setting, consent may be given electronically, but it must still be voluntary, informed, provable, and legally valid.

III. Why These Complaints Are Serious

An unauthorized digital loan can cause immediate and long-term harm. The complainant may suffer harassment from collectors, damage to credit reputation, unauthorized use of sensitive personal information, public shaming, threats to family or coworkers, emotional distress, financial loss, and difficulty obtaining legitimate credit in the future.

Digital loan abuse is especially serious because many online lenders and collectors rely on speed, automation, and data access. Once a loan is booked in a system, the complainant may be treated as a debtor even before the company properly verifies whether the transaction was valid. This reverses the burden in practice: the innocent person is forced to prove that they did not borrow.

Legally, however, a lender should be able to prove the basis of its claim. A company demanding payment must establish that there was a valid loan, that the complainant consented to it, that the amount is correct, and that its collection methods comply with law.

IV. Governing Laws and Regulations in the Philippine Context

A. Civil Code: Consent and Valid Contracts

Under Philippine civil law, a contract requires consent, object, and cause. A loan transaction without valid consent may be attacked as void, unenforceable, or invalid depending on the circumstances. If the complainant’s identity was used without authority, there may be no true meeting of minds between the complainant and the lender.

Consent must not be obtained through fraud, mistake, intimidation, undue influence, or misrepresentation. In digital loans, the lender must be able to show that the borrower knowingly agreed to the transaction and its terms.

Important civil law issues include:

whether the complainant actually applied for the loan;
whether the app’s consent mechanism was clear;
whether the terms were disclosed before acceptance;
whether the electronic signature or OTP was validly attributable to the complainant;
whether the loan proceeds were received by the complainant;
whether the lender exercised proper verification;
whether there was fraud by a third party.

If there was no valid consent, the complainant may deny liability and demand cancellation of the account, cessation of collection, correction of records, and damages when warranted.

B. Electronic Commerce Act: Validity of Electronic Documents and Signatures

The Philippine legal system recognizes electronic documents and electronic signatures. However, recognition does not mean that every digital click, OTP, checkbox, or app interaction automatically proves consent.

A lender relying on electronic consent should be able to show reliable records, such as:

date and time of application;
IP address, device identifier, or session records;
OTP logs;
registered mobile number or email used;
digital copy of the loan agreement;
consent screen or disclosure accepted;
identity verification documents submitted;
account to which proceeds were disbursed;
audit trail showing acceptance of the terms.

If these records are incomplete, inconsistent, or point to a different device, number, account, or person, the complainant may argue that the digital transaction was not validly authorized.

C. Data Privacy Act of 2012

The Data Privacy Act is central to unauthorized digital loan complaints. Digital lenders commonly collect names, addresses, IDs, selfies, phone numbers, employment information, device data, contacts, and sometimes other sensitive or excessive information.

A lending company or online lending platform that processes personal data must comply with the principles of transparency, legitimate purpose, and proportionality. It should collect only data that is necessary and must clearly inform the data subject how the data will be used.

Possible data privacy issues include:

use of personal data to create a loan account without consent;
collection of excessive data through app permissions;
accessing the borrower’s phone contacts without lawful basis;
contacting third parties who are not co-makers or guarantors;
disclosing alleged debt to relatives, employers, or friends;
sending humiliating or threatening messages;
public shaming or posting debt information online;
failure to provide a privacy notice;
refusal to delete or correct inaccurate personal data;
failure to secure data from identity theft or unauthorized processing.

The complainant may file a complaint with the National Privacy Commission when the matter involves misuse, unauthorized processing, disclosure, or failure to protect personal data.

D. Lending Company Regulation Act and SEC Regulation of Lending Companies

Lending companies in the Philippines are generally regulated by the Securities and Exchange Commission. A lending company must be properly registered and authorized. Online lending platforms connected with lending or financing companies may also fall under SEC supervision.

Complaints may involve:

operating without proper authority;
use of unregistered online lending applications;
unfair, abusive, or deceptive collection practices;
failure to disclose interest, charges, and penalties;
misleading advertising;
oppressive loan terms;
unauthorized or excessive fees;
threats, harassment, or shaming;
failure to provide documents proving the debt.

The SEC has repeatedly taken action against abusive online lending practices, especially those involving unfair debt collection, privacy-invasive tactics, and harassment. A complainant may report the lending company, financing company, or online lending app to the SEC if the entity is registered with or subject to SEC jurisdiction.

E. Financial Products and Services Consumer Protection

The Philippine framework on financial consumer protection strengthens the rights of consumers who use financial products and services, including credit and lending services. Financial service providers are expected to observe fair treatment, transparency, responsible pricing, proper disclosure, data protection, and effective complaint handling.

For unauthorized digital loan complaints, this means the provider should have a real dispute-resolution process. It should not merely insist on payment while ignoring the consumer’s claim of fraud or lack of consent. It should investigate, suspend collection when appropriate, preserve records, and correct erroneous information.

F. Cybercrime Prevention Act

If the unauthorized loan resulted from hacking, account takeover, phishing, identity theft, SIM compromise, unauthorized access, or fraudulent use of digital credentials, the matter may involve cybercrime.

Possible cybercrime-related acts include:

illegal access to an account or device;
computer-related identity theft;
computer-related fraud;
misuse of credentials or OTPs;
phishing or deceptive digital schemes;
unauthorized use of electronic data.

A complainant may seek assistance from cybercrime authorities, including the cybercrime units of law enforcement agencies, especially when there is evidence that a third party fraudulently used the complainant’s identity or digital accounts.

G. Revised Penal Code and Other Criminal Law Concepts

Depending on the facts, an unauthorized digital loan may also involve traditional criminal offenses, such as:

estafa or swindling;
falsification;
use of falsified documents;
unjust vexation;
grave threats;
coercion;
libel or cyberlibel;
slander or oral defamation;
identity-related fraud.

If collectors threaten arrest, imprisonment, public humiliation, or harm, criminal liability may arise. Nonpayment of a debt is generally not a crime by itself, and collectors should not misrepresent civil debt as a criminal offense merely to intimidate the complainant.

V. Common Scenarios

1. The Complainant Never Applied for the Loan

This is the clearest unauthorized transaction scenario. The complainant receives collection messages despite never downloading the app, applying for a loan, signing an agreement, or receiving proceeds.

The complaint should demand proof of:

the loan application;
the loan agreement;
the identity verification submitted;
the electronic signature or consent record;
the receiving account or wallet;
the device, mobile number, and email used;
the disbursement record.

If the lender cannot prove that the complainant validly borrowed the money, the complainant should demand cancellation of the account and correction of any adverse report.

2. The Complainant Downloaded the App but Did Not Borrow

Some users download an app to check eligibility or compare loan offers. A loan may later be booked despite the user claiming not to have accepted final terms.

The legal issue is whether the app clearly separated registration, credit scoring, loan offer, and final loan acceptance. A lender should not treat mere app installation, inquiry, or partial registration as acceptance of a loan.

3. The Loan Was Disbursed to a Different Person or Account

If the loan proceeds were sent to an e-wallet, bank account, or payment channel not owned by the complainant, this strongly supports a dispute. The lender should explain why it released money to that account and what verification was performed.

The complainant should request the disbursement reference number, receiving institution, masked account details, date and time, and verification records. If another person received the proceeds, the matter may involve fraud or identity theft.

4. The Complainant’s ID or Selfie Was Misused

Digital lending apps often require identity documents and selfies. If these were stolen or misused, the complainant should file reports not only against the lender but also regarding the source of the identity theft.

The lender should be asked to provide the ID image, selfie, liveness check result, and KYC records used for approval. If the images are not genuine or were recycled from another source, the complainant may deny the transaction.

5. The Loan Was Authorized but the Charges Were Not

Some complaints are not about the existence of the loan but about unauthorized fees, hidden charges, excessive deductions, undisclosed interest, or inflated penalties. In these cases, the issue becomes unfair disclosure, deceptive terms, or abusive lending practice.

The complainant should demand a full statement of account showing:

principal;
amount actually received;
interest;
processing fee;
service fee;
platform fee;
late charges;
penalties;
total amount due;
computation basis;
payment history.

6. The Loan Is Being Collected Through Harassment

Even if a loan exists, collection must be lawful. A lender or collector should not harass, shame, threaten, or disclose the alleged debt to unrelated persons.

Unlawful or abusive collection may include:

threatening imprisonment for debt;
threatening violence;
sending defamatory messages;
contacting all phone contacts;
messaging employers or coworkers;
posting the borrower’s photo online;
falsely accusing the borrower of a crime;
using obscene, insulting, or degrading language;
repeated calls intended to harass;
pretending to be a lawyer, police officer, court employee, or government official.

A separate complaint may be filed for abusive collection even if the loan itself is disputed or even if part of the debt is valid.

VI. Rights of the Complainant

A person facing an unauthorized digital loan demand has several rights:

Right to dispute the debt. The complainant may deny liability and demand proof.
Right to receive documents. The lender should provide the loan agreement, statement of account, disclosure statement, and records supporting the alleged consent.
Right to data privacy. The complainant may demand that personal data be corrected, blocked, deleted, or no longer unlawfully processed.
Right to be free from harassment. Collection must be fair, lawful, and not abusive.
Right to correction of credit information. If the lender reported false or disputed information, the complainant may seek correction.
Right to complain before regulators. Depending on the facts, complaints may be filed with the SEC, National Privacy Commission, law enforcement cybercrime units, Bangko Sentral ng Pilipinas for covered financial institutions, or other relevant agencies.
Right to seek damages. If the complainant suffered injury due to negligence, fraud, privacy violation, defamation, harassment, or wrongful reporting, civil remedies may be considered.

VII. Duties of Digital Lenders and Online Lending Platforms

A legitimate digital lender should be able to demonstrate:

proper registration and authority to operate;
clear identity of the lending entity;
transparent loan terms;
fair interest and fee disclosures;
valid consent before loan booking;
secure identity verification;
proper data privacy notices;
limited and lawful data collection;
secure storage of personal data;
lawful collection practices;
accessible customer complaint channels;
prompt investigation of disputed transactions;
suspension of abusive collection while a dispute is pending;
correction of erroneous records.

A lender that cannot produce basic proof of the loan should not continue aggressive collection against the complainant.

VIII. Evidence to Gather

The strength of an unauthorized digital loan complaint depends heavily on evidence. The complainant should preserve:

Screenshots of all collection messages.
Call logs and recordings, where lawfully obtained.
Names, numbers, email addresses, and social media accounts used by collectors.
App name, website, company name, and SEC registration details if available.
Loan account number or reference number.
Demand letters or text messages.
Proof that the complainant did not receive the proceeds.
Bank or e-wallet records.
Proof of identity theft, if any.
Police blotter or cybercrime report, if already filed.
Copies of IDs allegedly used.
Screenshots of app permissions.
Privacy policy and terms shown by the app.
Credit report or adverse listing, if any.
Communications sent to relatives, employers, or contacts.

The complainant should avoid deleting messages or uninstalling the app before preserving evidence, because the app may contain transaction records, notices, or permission settings.

IX. First Steps After Discovering the Unauthorized Loan

The complainant should act quickly and systematically.

First, do not immediately pay a disputed loan merely because of threats. Payment may later be interpreted by the company as acknowledgment, although payment under protest can still be explained. If payment is made to stop harassment, it is best to clearly state in writing that payment is made under protest and without admitting liability.

Second, send a written dispute to the lender or platform. The dispute should demand proof of the loan and request suspension of collection while the matter is under investigation.

Third, secure accounts. Change passwords, enable two-factor authentication, check e-wallet and bank activity, secure SIM cards, and report suspicious access.

Fourth, preserve evidence. Screenshots should show dates, numbers, names, and full messages.

Fifth, file complaints with the proper agencies depending on the facts.

X. Where to File a Complaint

A. Securities and Exchange Commission

File with the SEC when the complaint involves a lending company, financing company, online lending app, unfair collection practice, undisclosed charges, or possible unregistered lending operation.

The complaint should include the app name, company name, screenshots, loan details, collection messages, and a clear statement that the transaction is unauthorized or disputed.

B. National Privacy Commission

File with the NPC when the complaint involves unauthorized use of personal data, access to contacts, public shaming, disclosure of debt to third parties, failure to correct data, or misuse of identity documents.

The complaint should clearly describe what personal data was processed, how it was misused, who received it, and what harm resulted.

C. Cybercrime Authorities

File with cybercrime authorities when there is identity theft, account hacking, phishing, unauthorized digital access, SIM compromise, fraudulent use of OTPs, or fake online accounts.

The complainant should bring screenshots, device information, suspicious links, account access logs if available, and any evidence showing that another person used the complainant’s identity.

D. Bangko Sentral ng Pilipinas

If the entity involved is a BSP-supervised financial institution, bank, e-money issuer, payment service provider, or similar covered entity, the complainant may use the relevant consumer assistance channels.

E. Credit Information and Credit Reporting Channels

If the unauthorized loan was reported as delinquent, the complainant may dispute the credit record and demand correction or removal of inaccurate information.

F. Regular Courts or Prosecutor’s Office

When damages are significant or criminal conduct is involved, the complainant may consult counsel regarding a civil action, criminal complaint, or both.

XI. Demand Letter Structure

A good complaint or demand letter should be clear, factual, and firm. It may include:

Complainant’s identity and contact information.
Name of lending app or company.
Loan reference number, if known.
Statement that the transaction is unauthorized or disputed.
Chronology of events.
Denial of consent and/or receipt of proceeds.
Demand for proof of loan.
Demand to stop collection while investigation is pending.
Demand to stop contacting third parties.
Demand to preserve all records.
Demand to correct or delete inaccurate data.
Notice that complaints may be filed with regulators and law enforcement.

The tone should avoid emotional accusations unsupported by facts. It should focus on lack of consent, lack of proof, privacy violations, harassment, and requested remedies.

XII. Sample Complaint Letter

Subject: Formal Complaint and Dispute of Unauthorized Digital Loan Transaction

To Whom It May Concern:

I am formally disputing the alleged digital loan account being collected from me under your platform. I deny having validly authorized, applied for, accepted, or received the proceeds of the alleged loan.

I request that you immediately provide complete documentary and electronic proof of the alleged transaction, including the loan application, loan agreement, disclosure statement, consent logs, OTP verification records, device and IP logs, identity verification records, disbursement records, receiving account details, statement of account, and all records showing that I personally and validly consented to the loan.

Pending your investigation and submission of proof, I demand that you suspend all collection activity against me, stop all calls and messages to my relatives, employer, coworkers, and other third parties, and refrain from reporting or continuing to report the disputed account as delinquent.

I also demand that you preserve all records relating to this transaction, including system logs, KYC documents, app permission logs, communications, collection instructions, and third-party collector records.

If my personal data was used, accessed, disclosed, or processed without lawful basis, I reserve all rights under the Data Privacy Act of 2012 and other applicable laws. If this matter involves identity theft, fraudulent digital access, or unauthorized use of my credentials, I also reserve the right to seek assistance from cybercrime authorities.

This letter is sent without admission of liability and with full reservation of my rights and remedies under Philippine law.

Sincerely, [Name] [Contact Information] [Date]

XIII. Possible Defenses Against Collection

A complainant may raise several defenses, depending on the facts:

No consent. The complainant never applied for or accepted the loan.
No receipt of proceeds. The money was not disbursed to the complainant.
Identity theft. A third party used the complainant’s personal data.
Invalid electronic authorization. The digital consent records are unreliable or not attributable to the complainant.
Lack of disclosure. The lender failed to disclose essential terms before acceptance.
Unfair or abusive terms. Charges, fees, or penalties are unconscionable or not properly explained.
Illegal collection methods. Even assuming a debt exists, harassment and public shaming are unlawful.
Data privacy violation. The lender or collector processed or disclosed personal data without lawful basis.
Wrong party. The complainant is being mistaken for another person.
Unregistered or unauthorized lender. The entity may lack authority to operate or collect.

XIV. Burden of Proof

In practical terms, collectors often pressure the complainant to prove that they did not borrow. But legally, a party claiming payment should be able to prove the obligation.

A lender should be able to prove:

the existence of the loan;
the identity of the borrower;
the borrower’s consent;
the amount disbursed;
the account that received the proceeds;
the terms agreed upon;
the amount still due;
the legal authority of any collector acting on its behalf.

The complainant, meanwhile, should gather evidence showing non-consent, non-receipt, identity theft, privacy violations, or harassment.

XV. Collection Harassment and Third-Party Contact

One of the most common abuses in online lending is the use of shame-based collection. Collectors may send messages to a borrower’s phone contacts, employer, relatives, or social media friends. These tactics may violate privacy and may also give rise to civil or criminal liability if the messages are defamatory, threatening, or coercive.

A lender may contact a reference only for a lawful and limited purpose, such as verifying contact information, and only if there is a proper basis. A reference is not automatically a guarantor, co-maker, or debtor. Unless a third party legally undertook liability, the lender should not demand payment from that person.

Collectors should not disclose the debt to uninvolved third parties. Doing so may constitute unauthorized processing or disclosure of personal information.

XVI. Effect on Credit Records

An unauthorized digital loan may damage a person’s credit profile if reported as unpaid. The complainant should dispute any inaccurate record as soon as discovered. The written dispute should be sent to the lender and, where applicable, to the credit reporting entity or financial institution involved.

The complainant should demand:

deletion or correction of the disputed account;
written confirmation that the account is under dispute;
suspension of negative reporting pending investigation;
certification that the complainant is not liable if the transaction is found unauthorized.

XVII. Practical Tips for Complainants

A complainant should:

communicate in writing as much as possible;
avoid hostile or threatening replies;
keep screenshots and backups;
demand proof before discussing payment;
avoid clicking suspicious links;
avoid giving additional IDs unless the recipient is verified;
check whether the lender is registered;
file regulatory complaints if harassment continues;
secure bank, e-wallet, email, and mobile accounts;
consider a police or cybercrime report if identity theft is suspected.

XVIII. Remedies That May Be Requested

Depending on the facts, the complainant may request:

cancellation of the unauthorized loan;
cessation of collection;
deletion or correction of personal data;
blocking of unlawful processing;
removal of adverse credit reporting;
written certification of non-liability;
disclosure of all records used to approve the loan;
investigation of responsible employees, agents, or collectors;
damages for harassment, defamation, or privacy violation;
regulatory sanctions against the lender or collector;
criminal investigation where fraud or identity theft is involved.

XIX. Liability of Lending Apps, Collectors, and Third Parties

Liability may attach to different actors.

The lending company may be liable if it approved the loan negligently, failed to verify identity, imposed undisclosed terms, mishandled personal data, or used abusive collection methods.

The online lending platform may be liable if it processed data unlawfully, facilitated unauthorized transactions, or allowed deceptive app practices.

The collection agency or collector may be liable for threats, harassment, defamation, coercion, or unauthorized disclosure of personal information.

A third-party fraudster may be liable for identity theft, fraud, falsification, or cybercrime.

A payment or wallet account holder who received proceeds may become relevant to the investigation if the disbursement went to an account not belonging to the complainant.

XX. Important Distinction: Unauthorized Loan vs. Inability to Pay

A complaint is stronger when it clearly separates unauthorized transactions from ordinary nonpayment. A person who borrowed but later cannot pay has a different issue from a person who never authorized the loan.

However, even a valid borrower remains protected from harassment, privacy abuse, hidden charges, and unlawful collection. The existence of a debt does not give a lender the right to threaten, shame, defame, or misuse personal data.

XXI. Recommended Complaint Theory

A strong Philippine legal complaint may frame the case as follows:

There was no valid consent to the digital loan.
The lender has not proven that the complainant applied for, accepted, or received the loan.
The complainant’s personal data may have been unlawfully processed or used.
The collection activity is premature, unfair, or abusive while the transaction is disputed.
Any third-party disclosure or harassment violates privacy and consumer protection principles.
Any adverse credit reporting should be suspended, corrected, or removed.
The lender should preserve records and identify the source of the alleged application.
Regulators and law enforcement should investigate possible violations.

XXII. Conclusion

Unauthorized digital loan transactions are not merely private collection disputes. In the Philippines, they may involve invalid consent, defective electronic contracting, identity theft, data privacy violations, abusive lending practices, cybercrime, consumer protection breaches, and unlawful debt collection.

The most important step is to shift the issue from emotional argument to documented legal dispute. The complainant should demand proof, preserve evidence, stop unlawful collection, protect personal data, and bring the matter before the proper regulatory or law enforcement bodies when necessary.

Digital lending must remain lawful, transparent, and accountable. Speed and automation do not excuse lenders from proving consent, protecting personal data, and treating consumers fairly. Where a loan was not authorized, the complainant should not be forced to pay, suffer harassment, or bear the consequences of a transaction that was never validly made.