Quick answer

If an online lending app deposits money into your bank or e-wallet without your clear approval, do not spend, transfer, or “renew” the money. Receiving funds does not, by itself, prove that you agreed to a loan. A valid contract generally requires consent, a definite object, and a lawful cause under the Civil Code of the Philippines.

However, unauthorized money is not automatically yours to keep. If it was delivered by mistake, the Civil Code’s rule on solutio indebiti may require its return. The safest course is to preserve the full amount, dispute the loan in writing immediately, notify your bank or e-wallet, and arrange any return only through a verified and documented channel.

Do not pay interest, penalties, “cancellation fees,” or processing charges merely because the app demands them. Whether you owe anything—and whether a loan was actually formed—depends on what you clicked, signed, authenticated, or authorized and what the lender can prove.

Take these steps immediately

1. Leave the money untouched

Keep the entire amount available in the receiving account. Do not withdraw it, use it for expenses, transfer it to another personal account, or send it to a number supplied by an unknown collector.

Preserving the funds helps show that you did not accept or benefit from the supposed loan. It also allows the originating and receiving institutions to trace or reverse the transfer safely.

If the account automatically used part of the deposit—for example, to cover a negative balance—notify the institution immediately and ask how the transaction should be handled.

2. Record the transaction before changing anything

Save evidence showing:

The amount, date, time, and transaction reference number
The sender name, account number, mobile number, or payment-provider identifier
Your balance immediately before and after the deposit
The app’s name, developer, download page, and displayed company name
All loan screens, account history, repayment schedules, fees, and due dates
Text messages, emails, calls, notifications, and collection messages
The app permissions and privacy notice
Any screen showing that you did not apply, rejected an offer, cancelled an application, or never confirmed disbursement

Use screenshots and, where helpful, a screen recording that shows the path through the app. Export statements or transaction histories instead of relying only on screenshots. Keep original files and back them up somewhere the app cannot access.

Do not uninstall the app until you have preserved the evidence. Afterward, you may revoke unnecessary permissions and uninstall it, but first confirm that doing so will not erase records you still need.

3. Notify your bank or e-wallet through its official support channel

Tell the receiving institution that the credit appears to be an unauthorized or disputed loan disbursement. Ask it to:

Record a formal dispute or incident report
Identify the originating institution or trace the transfer, if permitted
Explain whether an institution-led reversal is available
Place appropriate safeguards on your account
Give you a case or reference number
Confirm any reversal or return in writing

Use the institution’s official app, website, hotline, or branch. Do not rely on a hotline or link supplied by the lending app.

A receiving institution may not be able to reverse a completed transfer without the sender’s participation or other legal authority. Even so, reporting promptly creates an important record and may help detect account takeover or identity theft.

4. Dispute the alleged loan directly with the company

Send a dated written notice to the company’s official customer-service address and data protection officer, if listed. State that:

You dispute having applied for or accepted the loan
You did not authorize the disbursement
You have not used the funds
The money remains available, subject to a verified and documented return process
You do not consent to interest, fees, penalties, automatic renewals, or collection activity
You require the company to place the account on hold while it investigates

Request copies of all records on which the company relies, including:

The supposed application and loan agreement
The Truth in Lending disclosure statement
The date and exact method of acceptance
Electronic signatures, one-time-password records, device and IP logs, timestamps, and audit trails
Identity-verification records and submitted documents
The disbursement instruction and transaction reference
The calculation of the amount allegedly owed
The company’s SEC registration and Certificate of Authority
The legal name of the company operating the app
The source and lawful basis for processing your personal data
The identities or categories of parties to whom your information was disclosed

A legitimate lending company must have authority from the Securities and Exchange Commission to operate. Under the Lending Company Regulation Act of 2007, a lending company may not conduct business without SEC authority. Its implementing rules also require a disclosure statement before consummation of the transaction, including the principal, interest, fees, payment schedule, penalties, collection charges, and method of calculating the obligation.

5. Return funds only through a verified process

Do not send the money to a collector’s personal bank account, QR code, cryptocurrency wallet, remittance recipient, or newly supplied mobile number. That can expose you to a second loss while the original app continues to claim payment.

Prefer one of these methods:

A reversal handled by the receiving and originating financial institutions; or
A return to the verified corporate account from which the money came, supported by written instructions from the company’s official channel.

Before returning anything, obtain written confirmation that:

The exact principal received is the amount being returned
No interest, fee, or penalty is admitted
The alleged loan will be cancelled and marked closed
Collection and credit reporting will stop
A receipt and zero-balance or account-closure confirmation will be issued

Keep the transaction receipt and the company’s acknowledgment. If the company insists on payment to an unrelated account, demands additional charges, or refuses to confirm closure, pause and seek legal help.

Does receiving the money make the loan valid?

Not necessarily.

Article 1318 of the Civil Code identifies consent, object, and cause as essential requisites of a contract. Philippine Supreme Court decisions have likewise recognized that without the required consent, no binding contract is perfected. A deposit alone does not conclusively establish that the recipient knowingly accepted all loan terms.

But the facts matter. A lender may claim that consent was given through an electronic signature, an OTP, a checkbox, biometric verification, or continued use of the app. The dispute may therefore turn on records such as the acceptance screen, audit trail, disclosure statement, device logs, and disbursement instruction.

The situation is different if you:

Applied for a loan and knowingly approved the final offer
Authorized automatic or repeat disbursements
Used the deposited funds after seeing the loan terms
Confirmed acceptance by OTP or another authentication method
Later expressly acknowledged or settled the debt

Those facts do not automatically resolve every issue, but they can materially affect the analysis. If someone used your identity or device without permission, report identity theft rather than simply calling the transfer a lender error.

Why you should not treat the deposit as free money

Article 2154 of the Civil Code provides that when something is received without a right to demand it and was delivered through mistake, an obligation to return it arises. The Supreme Court has applied this doctrine to mistaken payments.

Accordingly, even if no valid loan was formed, the sender may still have a claim for return of the principal if the transfer was genuinely erroneous. That is different from enforcing unagreed interest, penalties, or fees.

Keeping the money untouched and offering a safe, documented return protects your position better than spending it or ignoring the sender.

Protect your phone, accounts, and identity

If you never applied at all, assume that your personal data or account may have been compromised.

Take these precautions:

Change the passwords for your email, bank, e-wallet, and mobile account.
Use unique passwords and enable multi-factor authentication.
Review recent logins, linked devices, beneficiaries, and transactions.
Ask your mobile provider whether there were recent SIM-replacement or account-change requests.
Revoke the lending app’s access to contacts, storage, photos, camera, microphone, location, SMS, and call logs unless still needed to preserve evidence.
Remove unknown apps and device-administration privileges.
Check whether your IDs, selfies, or account details were submitted elsewhere.
Inform close contacts if the app may have copied their information or may contact them.

The National Privacy Commission’s loan-transaction guidelines require lawful, transparent, and proportionate processing of personal data. They apply to covered loan-processing activities even when the person acting as a lender lacks the required SEC authority.

The joint DICT–NPC–SEC advisory on online lending platforms reiterates that unnecessary permissions and unauthorized, excessive, or disproportionate processing are prohibited. It also states that lenders may not contact people in a borrower’s contact list for collection unless they are guarantors who actually consented to that role.

If collectors start calling or messaging

Keep communications short and in writing. You may say:

I dispute this alleged loan and did not authorize the disbursement. The principal remains untouched pending a verified return process. Please suspend collection, preserve all application and authentication records, and communicate only through your company’s official written channel.

Do not argue about the facts over repeated calls. Do not provide new selfies, IDs, OTPs, contacts, card details, or screen-sharing access to a collector.

Save evidence if collectors:

Threaten violence, arrest, deportation, or public humiliation
Pretend to be police officers, lawyers, courts, or government agencies
Threaten legal action that cannot lawfully be taken
Contact your employer, relatives, friends, or unrelated contacts
Publish or distribute your personal information
Use insults, obscenities, intimidation, or repeated disruptive calls
Demand payment to personal or unverified accounts

The SEC prohibits unfair debt-collection practices by financing and lending companies. The 2026 joint advisory specifically identifies harassment, threats to harm a person or reputation, and threats of action that cannot legally be taken as prohibited practices.

A private collector cannot have you arrested simply by sending a text message. Ordinary nonpayment of debt is not, by itself, imprisonment for debt. Fraud or identity-theft allegations are different matters and should be handled with counsel if authorities actually contact you.

Where to complain

Securities and Exchange Commission

For a lending or financing company, submit a complaint through the SEC’s official iMessage ticketing system. Select the service for complaints on financing and lending companies and attach your evidence.

Include the app name, legal company name, transaction details, disputed agreement, collection messages, your written objection, and the company’s response. Ask the SEC to verify the company’s authority and whether the app was properly reported as an online lending platform.

National Privacy Commission

If your personal data was obtained, used, disclosed, or used for harassment without a lawful basis, first notify the company in writing and give it an opportunity to act. Under the NPC’s current complaint mechanics, proof of this notice should accompany the complaint. If the company fails to take timely or appropriate action—or gives no response within 15 calendar days—you may proceed with an NPC complaint.

Observe the applicable filing periods. The NPC rules generally require filing within six months from the privacy violation or breach, or within 30 days from the last communication with the respondent, whichever is earlier. Because these periods can expire quickly, do not delay while collection continues.

Your bank, e-wallet, or its regulator

Complete the financial institution’s internal complaint process first. If the institution is supervised by the Bangko Sentral ng Pilipinas and does not resolve the matter, use the BSP’s official consumer-assistance channels shown on the BSP website.

A complaint against the lender and a transaction dispute with the bank or e-wallet are separate matters. Filing one does not automatically file the other.

Law-enforcement authorities

Report promptly to the appropriate cybercrime or police authority if there is evidence of identity theft, account takeover, forged documents, extortion, impersonation, threats of violence, or unauthorized access to an account or device.

If someone is in immediate physical danger, contact local emergency services or the nearest police station. Preserve the original messages, numbers, account details, URLs, and transaction records before blocking the sender.

Evidence checklist

Keep a single chronological file containing:

Your signed written dispute and proof it was sent
The company’s replies or proof of no response
Bank or e-wallet statements and transaction references
Screenshots and screen recordings from the app
The supposed agreement and disclosure statement
OTP, email, and login histories
Call logs, recordings made lawfully, voicemails, and messages
Names and numbers used by collectors
Proof of contacts, employers, or relatives being approached
Copies of SEC, NPC, bank, e-wallet, and police complaints
Receipts and written closure confirmation if the principal is returned

Write a timeline while events are fresh. Note dates, times, people involved, and exactly what was said. Avoid editing original screenshots or deleting message threads.

Common mistakes to avoid

Spending the money because you believe an unauthorized loan is automatically void
Returning it to an unverified personal account
Paying a “cancellation,” “unlocking,” or “verification” fee
Clicking “accept,” “extend,” “renew,” or “settle” merely to stop notifications
Giving an OTP, PIN, password, selfie, or additional ID to a collector
Deleting the app before preserving evidence
Making a partial payment without stating that the debt is disputed
Ignoring written demands or official court papers
Assuming the app’s brand name is the lender’s legal corporate name
Filing only with an app store instead of the relevant regulator
Waiting until privacy-complaint deadlines have passed

When legal help is urgent

Consult a Philippine lawyer promptly if:

The money has already been spent or transferred
The lender claims you signed or authenticated an agreement
Your identity documents or accounts were used by another person
The company reports or threatens to report the account as delinquent
You receive a demand letter from a law office
You receive a subpoena, summons, court order, or communication verified to be from law enforcement
Collectors threaten violence, publish personal information, or contact your workplace
The company refuses a safe return but continues adding charges
The amount is substantial or multiple apps are involved

Do not ignore genuine legal papers. Verify them directly with the issuing court, office, or agency using independently obtained contact details.

Frequently asked questions

Must I return the money?

You may have to return the principal if it was delivered by mistake, even if no loan contract was formed. Keep it intact and arrange the return through a verified, documented process. Whether additional amounts are owed depends on a valid agreement and the applicable law.

Do I have to pay interest or penalties?

Not merely because the app transferred money. Ask the company to prove your consent and provide the agreement, disclosure statement, authentication records, and calculation. Do not voluntarily admit unagreed charges.

Can I simply transfer the money back to the number that texted me?

No. Confirm the recipient through your bank or e-wallet and the company’s official corporate channel. A collector’s personal account or unfamiliar QR code may be fraudulent and may not close the alleged loan.

What if I started an application but never accepted the final offer?

Dispute the disbursement and demand the complete audit trail. Starting an application does not necessarily prove acceptance of a later offer, particularly if the amount, interest, fees, or repayment terms had not been disclosed and accepted. The exact screens, terms, and authentication records will matter.

What if somebody else applied using my identity?

Notify the lender and receiving institution that the transaction involves suspected identity theft. Secure your accounts, request the application and authentication records, and report the incident to the appropriate authorities. Do not describe the other person as authorized unless that is true.

May the app contact everyone in my phone?

No. Current official guidance prohibits contacting people in a borrower’s contact list for debt collection unless they are guarantors who separately consented to that responsibility. Character references are not automatically guarantors.

Should I uninstall the app?

First preserve the relevant records. Then revoke unnecessary permissions and uninstall it if doing so is safe. Also change passwords and review the device for unknown apps or administrative access.

Can the lender have me arrested for refusing to pay immediately?

A collector cannot order your arrest. A disputed private debt does not itself authorize imprisonment. Separate criminal conduct—such as proven fraud—raises different issues, but threatening arrest without legal basis may itself be an unfair collection tactic. Verify any purported official notice independently and consult counsel.

This article provides general Philippine legal information, not legal advice for a specific case. Contract formation, repayment duties, privacy remedies, and complaint deadlines can depend on the documents and facts. Official sources and procedures were checked as of July 27, 2026.