Unconsented Loan Disbursement by Lending Apps (Philippines): Your Rights & How to Contest

This is general legal information for the Philippine setting. It isn’t a substitute for tailored advice from a lawyer who can review your documents.

Quick take

If a lending app put money in your wallet/bank without your free and informed consent, you can challenge the “loan,” stop harassment, and force a reversal or a return of the principal without fees. Move fast: isolate the funds, put the lender on written notice, and escalate to the right regulator (SEC, NPC, BSP) depending on who they are and what they did.

What “unconsented disbursement” looks like

Money was credited even though you never tapped “Agree”/signed the final loan terms.
You only checked eligibility or filled a form, but never confirmed; funds still arrived.
A “re-loan/top-up” was pushed automatically from within the app.
Someone impersonated you (account takeover/identity theft).
The app changed the amount/charges from what you saw before disbursing.

Is there a valid loan?

1) Consent and essential elements (Civil Code)

A contract needs consent, a certain object, and cause. Consent must be free, informed, and specific; it’s voidable if obtained by mistake, fraud, intimidation, or undue influence. If you never consented, there’s no enforceable loan (you can still be obliged to return money you received without a valid basis—see “undue payment” below).

2) “Perfection” of a simple loan

A simple loan (mutuum) is generally perfected upon delivery of the money. But delivery does not cure the absence or defect of consent. If delivery happened without your acceptance (or with vitiated consent), you may treat the credit as undue and demand reversal.

3) Undue payment / unjust enrichment

If money is posted to you by mistake or without a valid contract, the law on solutio indebiti (undue payment) can apply: you may be obliged to return the principal, but the “lender” cannot impose interest, penalties, or fees because no valid loan exists. If the app intentionally pushed funds despite no acceptance, you can insist on reversal or return of principal only.

4) Electronic contracts & signatures

Electronic clicks/taps can create binding contracts under the E-Commerce Act if the lender can prove you accepted the exact terms. Screenshots, logs, OTP trails, timestamps, device IDs are relevant evidence—for both sides.

Your core rights

To withhold payment of any interest, fees, or penalties on an unconsented “loan.”
To demand cancellation/reversal or arrange return of principal only.
To object to data processing and withdraw consent under the Data Privacy Act (DPA); to demand erasure/blocking of unlawfully processed data.
To be free from harassment and shaming: the SEC bans unfair collection practices (e.g., contacting your phonebook, threats, obscene language, public shaming, workplace calls after being told to stop).
To accurate disclosure of finance charges before consummation under the Truth in Lending Act; undisclosed charges are contestable.
To dispute your credit data with the Credit Information Corporation (CIC) if a lender reports you incorrectly.
To complain to the proper regulator: SEC (lending/financing companies, OLAs), NPC (privacy abuses), BSP (BSP-supervised banks/e-money issuers), and DTI (deceptive marketing).

Immediate steps (first 24–48 hours)

Do not use the funds. Keep them untouched so you can cleanly return/reverse.
Preserve evidence: app screens, timestamps, SMS/OTP logs, emails, call logs, wallet/bank ledger, ads shown to you.
Freeze channels:
- Change app and email passwords; enable 2FA.
- If you suspect identity theft, file a fraud report with your bank/e-wallet and consider NBI/PNP Cybercrime reporting.
Send a “No Consent & Cancellation” notice to the lender in writing (email + in-app support), demanding reversal/arranging principal return only, and ordering them to stop processing your contacts and to cease collection harassment.
Alert your bank/e-wallet: log a dispute/recall request for the incoming transfer (PESONet/InstaPay wallet credit reversal rules require beneficiary consent—your formal consent can be to return principal only).
Revoke any auto-debit/auto-debit authority you didn’t grant (file a revocation with your bank if an ADA/PAD was set up).
Document harassment: record dates/times, phone numbers, screenshots, messages to your contacts.

How to contest, end-to-end

A) With the lender (always start here, in writing)

Demand: (i) cancellation of the loan; (ii) reversal of the credit; or (iii) acceptance of return of principal only with zero interest/fees.
Give a firm deadline (e.g., 5 business days) and require a written confirmation.
State that any continued collection will be treated as unfair collection and DPA violations (if they accessed/used your contacts).

B) With your bank/e-wallet

File an incident ticket referencing the incoming credit and attach your notice to the lender.
Ask them to coordinate a recall/reversal with the sender and note that you do not authorize any outgoing debit beyond the principal.

C) With regulators (parallel track if the lender is unresponsive)

1) Securities and Exchange Commission (SEC)

For lending/financing companies and online lending apps (whether registered or not).
Grounds to raise: unconsented disbursement; unfair debt collection (contacting your phonebook, shaming, threats, obscene/abusive language, contacting at odd hours, workplace calls after you told them to stop), hidden charges, or operating without a license.
Reliefs you can seek: order to cease collection, take down the app, and administrative penalties.

2) National Privacy Commission (NPC)

For privacy abuses: scraping/using your contacts, photos, location, or messages without need; unauthorized disclosure to your family, employer, or social media; processing beyond what’s necessary.
Reliefs: stop processing, delete unlawfully collected data, penalties, and damages.

3) Bangko Sentral ng Pilipinas (BSP)

If a BSP-supervised entity is involved (a bank, digital bank, or e-money issuer like major wallets).
Ask BSP’s consumer protection channel to enforce reversal protocols and fair treatment standards under consumer finance rules.

4) Department of Trade and Industry (DTI)

For deceptive or misleading ads/promos (e.g., “zero fees” that morph into hidden charges).

5) Law enforcement / courts

Harassment or doxxing can violate the Revised Penal Code (e.g., grave threats, grave coercion, libel) and the Data Privacy Act (criminal penalties).
Small Claims Court: for money disputes up to ₱1,000,000 (no lawyers required at trial; limits can change—check current rules). Use this if you seek damages or to recover money you returned but the lender still recorded as due.

If they harass or contact your phonebook

Reply once, in writing with a Cease & Desist citing privacy and unfair collection rules.
Tell them not to call your workplace and not to contact third parties (except your counsel/you).
Keep a log and report to SEC/NPC immediately if shaming persists.
Advise affected contacts to ignore and forward any messages to you for evidence.

What you can be asked to repay (and what you can refuse)

Scenario	What you should owe	What you can refuse
Funds credited without your acceptance of final terms	Principal only, promptly returned/reversed	All interest, penalties, processing fees, late charges
Funds credited after fraud/identity theft	Nothing to the “lender”; coordinate chargeback/recovery with bank/wallet	Any collection attempt; any data use
You used part of the funds in good faith before realizing	The used amount of principal; propose structured return without charges	Interest/fees not agreed to; “collection” over the unused part

Evidence checklist

App screens showing no “I agree” on final terms or different terms shown.
Timestamps of app flows, network/OTP logs, device details.
Wallet/bank ledger showing credit.
All messages from the lender, including to third parties.
Copies of your notices and delivery receipts.
ID verification steps you completed (or didn’t).
Contact list permissions you did not grant.

Templates you can use

1) Notice of No Consent & Demand to Cancel/Reverse (send to lender)

Subject: NOTICE OF NO CONSENT; DEMAND TO CANCEL/REVERSE DISBURSEMENT

I, [Full Name], refer to Transaction ID [_____] dated [_____] where ₱[amount] was credited to my [bank/e-wallet].

I DID NOT GIVE CONSENT to any loan contract nor accept final terms. Delivery of funds was unilateral and without my acceptance.

DEMANDS:
1) Cancel the alleged loan and reverse the credit; OR confirm that you will accept immediate return of the principal ₱[amount] with ZERO interest, penalties, or fees.
2) Cease all collection, shaming, or contact with any third party (including contacts/employer).
3) Under the Data Privacy Act, stop processing my personal data beyond what is necessary to reverse/close this incident, delete any contacts or data you scraped, and confirm deletion.
4) Provide, within 5 business days, your complete audit logs showing how you claim I consented.

Non-compliance will be escalated to the SEC and NPC, and I will seek damages. All rights reserved.

Signed,
[Name, mobile, email]

2) Bank/E-Wallet Dispute (incoming credit)

Subject: DISPUTE – UNCONSENTED CREDIT; REQUEST COORDINATED REVERSAL

Please tag the incoming credit from [Sender/Lender], Ref [_____], ₱[amount], date [_____], as DISPUTED. I did not consent to any loan.

I request your assistance to coordinate reversal/recall with the sender. I do not authorize any debit except to return the principal to the sender upon documented agreement. Attached: my notice to the sender.

Signed,
[Name, Account No., mobile]

3) Cease & Desist – Unfair Collection / Privacy

Subject: CEASE & DESIST: UNFAIR COLLECTION / PRIVACY VIOLATIONS

Stop all calls, texts, social media, and third-party contacts regarding an alleged loan I never consented to. Do not contact my employer or my contacts. Any further attempt will be reported to the SEC and NPC and preserved as evidence for damages.

Signed,
[Name]

Special situations

Identity theft / Account takeover: File police/NBI cybercrime report; immediately notify the bank/e-wallet; ask the lender for transaction logs and device fingerprints used to “accept.” You owe nothing to the fraudster or the lender.
Unlicensed lenders: Report to SEC. Contracts with illegal operations can be attacked; at minimum, all charges and collection tactics are contestable, and regulators can shut them down.
Auto “re-loans”: Unless you explicitly opted in to an auto-reloan clause that is clear and conspicuous, treat it as no consent and proceed as above.
Incorrect credit reporting: Get your CIC report via an Accessing Entity; file a dispute to correct or delete the tradeline.

Practical dos & don’ts

Do act fast and in writing; keep everything.
Do insist on principal-only return if they already pushed funds.
Do not pay “processing” or “penalty” fees on a loan you never accepted.
Do not allow them to bully your contacts or employer—report it.
Do escalate simultaneously (lender → bank/e-wallet → SEC/NPC/BSP).

Legal bases (plain-English pointers)

Civil Code: Contracts need valid consent; consent vitiated by mistake/fraud/intimidation/undue influence is voidable (annullable). Simple loan is perfected by delivery, but no consent → no enforceable loan; undue payment rules require returning what was not due, not paying charges.
E-Commerce Act: Electronic contracts and e-signatures are recognized if authenticity is shown.
Rules on Electronic Evidence: Screenshots, metadata, logs are admissible subject to authentication.
Truth in Lending Act: Creditors must make clear, prior disclosure of finance charges; hidden or misleading charges can be challenged.
Data Privacy Act: Rights to be informed, object, access, correct, erase/block, data portability, damages, and to file a complaint; unlawful processing and unauthorized disclosure carry civil and criminal liability.
SEC regulations on lending apps: Unfair debt collection (shaming, phonebook blasts, threats, profane/abusive language, repeated calls at unreasonable hours, workplace calls after being told to stop) is prohibited and sanctionable.

When to get a lawyer

The lender refuses reversal/principal-only return;
They sued or threatened to sue;
There’s substantial harassment or reputational harm; or
You suffered identity theft or financial loss that may warrant damages.

Bring your dossier (timeline, evidence, notices, ticket numbers, regulator filings). A lawyer can send a final demand, file with SEC/NPC/BSP, lodge a criminal complaint for harassment/privacy breaches, or pursue Small Claims/civil remedies.

If you want, I can turn the templates above into filled PDFs with your details, and draft a step-by-step escalation pack you can send right away.