If an online lending app suddenly sends money to your GCash, Maya, bank account, or e-wallet even though you did not apply for a loan, treat it as a disputed and possibly fraudulent transaction — not as a normal loan. Do not panic, do not immediately pay “processing fees,” “extension fees,” or interest, and do not let collectors pressure you into admitting a debt you never agreed to. The right response is to preserve evidence, secure your accounts, formally dispute the loan, arrange a safe return or reversal of the actual amount received when appropriate, and report the app if it uses harassment, your contacts, or your personal data.

Do You Have to Pay an Online Loan You Did Not Apply For?

Usually, you are not bound to pay interest, penalties, or charges on a loan you never consented to.

Under Article 1318 of the Civil Code, there is no contract unless there is consent, an object, and a cause. The Supreme Court has repeatedly explained that consent means a meeting of offer and acceptance. In plain English: a lender cannot create a valid loan contract by simply sending you money and later demanding repayment with interest if you never agreed to borrow. (Lawphil)

However, there is an important practical point: do not treat the money as free money. If money was sent to you by mistake or without a valid basis, Article 2154 of the Civil Code on solutio indebiti may require the recipient to return what was unduly received. The Supreme Court describes solutio indebiti as applying when something is received without a right to demand it and it was delivered by mistake. (Supreme Court E-Library)

So the practical answer is:

Issue	Practical legal position
You never applied, clicked “borrow,” signed, confirmed by OTP, or otherwise accepted	You can dispute that any loan contract exists
Money was actually credited to your account	Keep it intact and prepare to return or reverse the actual amount received through a safe, documented channel
The app demands interest, penalties, “service fees,” or “extension fees”	Dispute these unless they can prove a valid loan contract and lawful disclosure
The app threatens to shame you, message contacts, or post your photo	Preserve evidence and report to the SEC, NPC, and cybercrime authorities

The goal is to avoid two mistakes: first, paying unlawful charges out of fear; second, spending money that may later have to be returned.

Why Online Lending Apps Disburse Unauthorized Loans

Unauthorized disbursement usually happens in one of these ways:

You installed the app and completed KYC, but did not knowingly apply. Some apps push “pre-approved” offers, confusing buttons, auto-renewal, or hidden confirmation screens.
You previously borrowed and the app claims an automatic renewal. This should be checked carefully. A previous loan does not automatically prove consent to a new loan.
Someone used your identity. A family member, agent, scammer, or data thief may have used your ID, selfie, phone number, SIM, or e-wallet details.
The app sent money first to pressure you later. Some abusive lenders send small amounts and then demand a much larger repayment within days.
There was a wrong transfer or system error. This is less common, but still possible.

The facts matter. A paper contract is not always required because Philippine law recognizes contracts in different forms when the essential requisites are present. But the lender still needs to prove that you consented to that specific loan, amount, term, interest, and repayment obligation.

Legal Basis: Your Rights Under Philippine Law

Civil Code: No Consent, No Loan Contract

A loan is still a contract. If you did not give consent, the lender cannot simply impose interest or penalties. Article 1318 of the Civil Code requires consent, object, and cause before a contract exists, and the Supreme Court has described consent as the meeting of offer and acceptance. (Lawphil)

But if you actually received the money, the Civil Code principle against unjust enrichment becomes relevant. Under Article 2154, if something was received when there was no right to demand it and it was delivered by mistake, the obligation to return it may arise. (Supreme Court E-Library)

That is why the safest position is: “I deny any loan contract, but I am willing to return the exact amount actually received through a lawful and documented reversal/refund process.”

Financial Products and Services Consumer Protection Act

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, covers financial products and services, including credit and digital financial products. It recognizes regulators such as the SEC and BSP and gives them enforcement powers over financial service providers under their jurisdiction. The law also allows regulators to act against excessive or unreasonable interests, fees, charges, and other abusive conduct. (Supreme Court E-Library)

For online lending apps, the SEC is usually the key regulator when the entity is a lending company, financing company, or online lending platform operated by them.

Truth in Lending Act

Republic Act No. 3765, the Truth in Lending Act, requires disclosure of finance charges and the true cost of credit. Its policy is to protect borrowers from lack of awareness of the true cost of credit. (Lawphil)

If the app never clearly disclosed the amount borrowed, deductions, interest, processing fees, due date, penalties, and total repayment before the alleged loan was consummated, that supports your dispute.

Interest and Fee Caps for Covered Online Loans

For certain unsecured, general-purpose loans of lending companies, financing companies, and their online lending platforms not exceeding ₱10,000 and with a tenor of up to four months, BSP Circular No. 1133 sets ceilings including a nominal interest rate cap of 6% per month, an effective interest rate cap of 15% per month, a 5% per month cap on late-payment penalties, and a total cost cap of 100% of the amount borrowed.

These caps do not mean you must pay a loan you never agreed to. They mean that even where there is a valid covered loan, the lender still cannot impose unlimited charges.

SEC Rules Against Unfair Debt Collection

The SEC has issued rules and advisories against unfair debt collection practices by lending and financing companies. SEC Memorandum Circular No. 18, Series of 2019 prohibits abusive collection practices, and the SEC’s online issuances list it together with Memorandum Circular No. 19, Series of 2019 on online lending platform disclosure and reporting. (appointment.sec.gov.ph)

A 2026 joint advisory by the DICT, NPC, and SEC also warned the public about online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data. It states that unnecessary app permissions, excessive processing of personal data, and contacting persons in the borrower’s contact list other than guarantors for debt collection are prohibited.

Data Privacy Act and NPC Rules

Republic Act No. 10173, the Data Privacy Act of 2012, protects personal information. The NPC issued Circular No. 20-01 on processing personal data for loan-related transactions after receiving complaints that some online lending apps accessed contact lists, cameras, locations, and storage and used personal data in ways that damaged people’s reputations.

The NPC later amended the guidelines through NPC Circular No. 2022-02 to cover loan applications, granting of loans, collection, closure of loan accounts, character references, and guarantors. The NPC emphasized “just-in-time” notices before obtaining consent for specific data processing. (National Privacy Commission)

Cybercrime, Identity Theft, and Access Device Fraud

If someone used your name, ID, SIM, email, bank account, or e-wallet to apply for the loan, the matter may involve cybercrime or fraud. Republic Act No. 10175, the Cybercrime Prevention Act of 2012, includes computer-related identity theft. Republic Act No. 8484, the Access Devices Regulation Act, penalizes fraudulent acts involving access devices, including unauthorized or fraudulently applied-for access devices. (Lawphil) (Lawphil)

If the collector threatens you, your family, your employer, or your contacts, possible criminal issues may also arise under the Revised Penal Code, such as threats, coercion, unjust vexation, or grave oral defamation depending on the facts.

What to Do Immediately After Receiving an Unauthorized Loan

1. Do Not Spend the Money

Keep the exact amount intact if possible. Move it only if necessary to prevent automatic debit or unauthorized access, and keep a clear record of where it went.

For example:

If ₱3,500 was credited to your GCash, keep ₱3,500 available.
If the app demands ₱6,800 after five days, dispute the excess.
If the bank or e-wallet can reverse the credit, ask for an official reversal reference number.

This prevents the app from arguing that you accepted the loan by using the proceeds.

2. Take Screenshots and Save Evidence

Before uninstalling the app or deleting messages, collect evidence:

SMS, email, app notifications, and push notifications about the alleged loan
Transaction receipt showing the amount, sender, date, time, and reference number
Screenshots of the app dashboard showing the alleged loan, due date, fees, and lender name
Screenshots of permissions requested by the app
Terms and conditions, privacy policy, and loan disclosure screen, if accessible
Collector messages, call logs, contact-shaming messages, threats, or fake posts
Proof that you did not click, sign, or confirm a loan, if available
Your written dispute and all replies

Avoid secretly recording phone calls. The Anti-Wiretapping Law, Republic Act No. 4200, prohibits unauthorized secret recording of private communications. Screenshots, call logs, written messages, emails, and witness statements are usually safer evidence. (Lawphil)

3. Secure Your Phone, SIM, Email, and E-Wallets

Unauthorized disbursement may be a warning sign that your identity or accounts have been compromised.

Do these quickly:

Change passwords for your email, e-wallets, banking apps, and social media.
Enable two-factor authentication.
Revoke app permissions for contacts, camera, location, microphone, photos, and storage.
Check whether your phone number or email is linked to unfamiliar accounts.
Report suspicious transactions to your bank or e-wallet provider.
If your SIM or phone was lost, file a telco report and keep the reference number.

If the app still has access to your contacts or gallery, uninstalling may help stop future access, but gather evidence first.

4. Contact Your Bank or E-Wallet Provider

Report the credit as an unauthorized or disputed loan disbursement. Ask whether the transaction can be reversed to the sender through official channels.

Request:

Incident or ticket number
Written confirmation that you reported the unauthorized credit
Details of the sender or merchant, if the provider can lawfully disclose them
Instructions on how to return or reverse the amount without paying a random collector

Do not send money to a personal GCash number or bank account given by a collector unless the lender confirms in writing that it is an official repayment or refund channel. Many victims lose money twice this way.

5. Send a Written Dispute to the Lending App or Company

Use email, in-app support, and any published Data Protection Officer or customer service address. Keep the tone short, firm, and factual.

A useful wording is:

I dispute the alleged loan. I did not apply for, request, confirm, or consent to this loan. I do not admit any loan contract, interest, penalty, service fee, processing fee, or collection charge.

The amount of ₱_____ was credited to my account on _____ with reference number _____. I am willing to return the exact amount actually received through a lawful, secure, and documented reversal or refund process, without admission of liability.

Please provide the alleged loan application record, consent record, OTP or electronic confirmation log, Truth in Lending disclosure, loan agreement, privacy notice, name of the registered lending or financing company, SEC registration details, and official refund channel.

Stop all collection activity, contact-list messaging, public shaming, threats, and processing of my personal data while this dispute is pending.

Do not write “I promise to pay the loan” if your position is that you never borrowed.

6. Return Only the Actual Amount Received, If Appropriate

If you are sure money was credited to you and you still have it, the cleanest solution is usually to return the exact net amount received, not the inflated amount.

Safer options include:

Bank or e-wallet reversal through the provider.
Payment to the registered company’s official account, not a collector’s personal account.
Written acknowledgment that the payment is a return of disputed funds, not admission of a loan.
Proof of payment with reference number and screenshot.

Write something like: “Payment of ₱_____ is made only as return of the amount credited to my account, without admission of any loan contract, interest, penalties, fees, or charges.”

If the lender refuses to give a safe official channel, document that refusal and keep the funds available.

Where to File Complaints in the Philippines

Problem	Where to file	What to prepare
Unauthorized online loan, abusive collection, unregistered or suspicious lending app	SEC through the official iMessage SEC-wide ticketing system	Narrative, screenshots, app name, company name, SEC details if known, transaction proof, collector messages
Contact shaming, misuse of contacts/photos/IDs, excessive app permissions, data privacy violation	National Privacy Commission	Notarized complaint form, screenshots, privacy issue narrative, proof of identity, supporting evidence
Identity theft, hacking, threats, fake posts, cyber harassment, use of your ID or e-wallet without consent	NBI Cybercrime Division or PNP Anti-Cybercrime Group	IDs, screenshots, device, transaction records, affidavits, links, account details
False loan appears in your credit report	Credit Information Corporation Online Dispute Resolution System	CIC credit report transaction reference number, disputed lender, proof that loan is unauthorized
Immediate threats to personal safety	Nearest police station, then cybercrime unit if online	Blotter request, screenshots, names/numbers/accounts of harassers

The SEC’s iMessage platform is its web-based system for public inquiries, complaints, incidents, and requests; it generates tickets and allows status tracking. (Securities and Exchange Commission)

For NPC complaints, the NPC states that a formal complaint must be in the required form, printed, filled out, notarized, and submitted in person, by courier, or by scanned email. (National Privacy Commission)

For NBI cybercrime complaints, the NBI Citizen’s Charter lists investigative assistance for victims of computer crimes, with no fee for the initial complaint process and sworn statements or affidavits as part of the investigation stage. (National Bureau of Investigation)

For credit-report errors, the CIC Online Dispute Resolution System is designed to resolve discrepancies between data submitted by a lender or other submitting entity and what appears in the consumer’s CIC credit report. (Credit Information Corporation)

Documents to Prepare

Prepare one folder, digital and printed if possible, containing:

Valid government ID
Proof of ownership of the phone number, email, e-wallet, or bank account
Transaction receipt or bank/e-wallet statement
Screenshots of app dashboard, loan details, and payment demands
Screenshots of messages to you and your contacts
Screenshots of abusive posts, fake accounts, or edited photos
App name, developer name, website, email address, privacy policy, and terms
SEC registration or Certificate of Authority details, if available
Written dispute letter and proof it was sent
Bank/e-wallet incident report or ticket number
Police blotter or cybercrime complaint, if already filed
Affidavit or sworn statement if required by the agency

For OFWs and foreigners abroad, affidavits or sworn statements may need notarization at a Philippine Embassy or Consulate, or local notarization with proper authentication depending on the receiving office’s requirements. DFA apostille rules generally apply to Philippine public documents for use abroad; foreign documents for use in the Philippines follow the authentication rules of the country where they were issued and the requirements of the Philippine receiving agency. (Apostille Philippines)

Common Scenarios and How to Handle Them

“I installed the app but never clicked apply.”

This is common. Ask the app to produce the specific consent record: the loan application timestamp, amount selected, disclosure accepted, OTP confirmation, IP/device logs, and the loan agreement. If they cannot show clear consent, dispute the loan.

“The app says I agreed because I uploaded my ID.”

Uploading an ID for verification is not automatically the same as agreeing to a loan. KYC may prove identity, but the lender still needs to show consent to the specific loan and its terms.

“They sent ₱2,000 but demand ₱4,500 after seven days.”

Dispute the charges. If there was no valid consent, you should not admit interest or penalties. If you return the funds, return only the actual amount received unless a competent authority or court determines otherwise.

“They are messaging my contacts.”

Save screenshots from your contacts. Ask those contacts to forward the exact messages, sender numbers, timestamps, and screenshots. The 2026 DICT-NPC-SEC advisory states that contacting people in the borrower’s contact list other than guarantors for debt collection is prohibited.

“They are threatening to post my face or call my employer.”

Preserve the threats and file with the SEC for abusive collection, the NPC for misuse of personal data, and cybercrime authorities if threats, fake posts, edited photos, identity theft, or hacking are involved.

“Someone used my ID to borrow.”

Treat it as identity theft. File a cybercrime report, notify the lending company in writing that the account is fraudulent, ask for deletion or blocking of unlawfully processed data, and monitor your credit report.

“The lender filed a small claims case.”

Do not ignore court papers. If the claim is within the small claims threshold, the case may be handled by first-level courts such as the MTC, MTCC, MCTC, or MeTC. OCA circulars implementing the Rules on Expedited Procedures refer to small claims where the claim does not exceed ₱1,000,000, exclusive of interest and costs. (Office of the Court Administrator)

Bring your evidence: no application, no consent, no valid disclosure, disputed disbursement, your offer to return the actual amount received, and proof of complaints filed. If you receive a summons, follow the court’s deadlines carefully.

Practical Timeline

Timeframe	What to do
First 24 hours	Do not spend the money, screenshot everything, secure accounts, report to bank/e-wallet
Within 1–3 days	Send written dispute to the lender/app and ask for proof of consent and official refund channel
Within 3–7 days	File SEC/NPC/cybercrime complaints if there is harassment, data misuse, or identity theft
Within 1–2 weeks	Follow up using ticket numbers; return actual funds only through safe documented channels
Within 30 days	Check whether the app reported the alleged loan to any credit-reporting system; dispute false entries
If court papers arrive	Respond within the stated deadline; do not rely only on agency complaints

Frequently Asked Questions

Can an online lending app force me to pay if I did not apply?

Not automatically. A loan requires consent. If you never applied, confirmed, or agreed to the loan, you can dispute the existence of a loan contract. But if money was actually credited to you, keep it intact and arrange a documented return or reversal of the actual amount received.

Should I return the money even if I did not borrow it?

Usually, yes, if you actually received it and can safely return it. Return only the actual amount credited, through an official and documented channel, and state that the return is not an admission of a loan, interest, penalties, or fees.

Should I pay the interest to stop harassment?

Do not pay unlawful charges just because collectors are threatening you. Preserve the threats and report them. Paying inflated charges may encourage further demands and may be treated by the app as an admission unless your payment message clearly reserves your rights.

What if I already spent the money?

Document what happened and still dispute the unauthorized loan. You may remain civilly liable to return the amount actually received if it was not yours to keep, but that is different from admitting a valid loan with interest and penalties.

Can a lending app contact my phone contacts?

For debt collection, lending and financing companies should not contact people from your contact list other than proper guarantors. Excessive contact scraping, public shaming, and using contacts to harass you may violate SEC and NPC rules.

Can I uninstall the app immediately?

You can, but first take screenshots of the dashboard, loan details, permissions, privacy policy, messages, and account information. After saving evidence, revoke permissions and uninstall if needed to protect your data.

What if the app is not registered with the SEC?

Report that to the SEC. Unregistered or unrecorded online lending operations are a serious red flag. Also report data misuse to the NPC and cybercrime-related acts to the NBI or PNP.

Can foreigners file complaints in the Philippines?

Yes, if the lending activity, data processing, harassment, or financial transaction is connected to the Philippines or a Philippine-regulated entity. The practical challenge is documentation. Foreigners abroad should keep digital evidence and check notarization, consular, or authentication requirements for affidavits and formal complaints.

Will this affect my credit score?

It might if the lender reports the alleged loan. Check your CIC credit report and file a dispute if an unauthorized loan appears. The CIC dispute system is designed for discrepancies in credit reports, but the CIC generally relies on records and the submitting entity’s correction or verification process. (Credit Information Corporation)

What if collectors keep calling after I dispute the loan?

Keep a log of calls, numbers, dates, times, and messages. Send one written instruction to stop harassment and communicate only in writing. If they continue with threats, shaming, contact messaging, or fake posts, add those incidents to your SEC, NPC, and cybercrime complaints.

Key Takeaways

No consent generally means no valid loan contract.
Do not spend the money if an app sends funds you did not request.
Return or reverse only the actual amount received through a safe, official, documented channel.
Do not admit interest, penalties, service fees, or extension fees unless a valid loan and lawful disclosure are proven.
Screenshot everything before uninstalling the app.
Report harassment and abusive collection to the SEC.
Report misuse of contacts, IDs, photos, and personal data to the NPC.
Report identity theft, hacking, threats, fake posts, or cyber harassment to the NBI or PNP cybercrime authorities.
Dispute false credit-report entries through the CIC.
Do not ignore court papers if the lender files a collection case.