If an online lending company took your money, approved a “loan” but never released the proceeds, accessed your contacts, threatened you, posted your personal information, or demanded inflated charges you never agreed to, treat the situation as both a financial consumer complaint and a possible cybercrime or data privacy violation. In the Philippines, online lending apps and platforms are not allowed to use harassment, public shaming, fake threats of arrest, or uncontrolled access to your phone contacts as collection tools. This guide explains how to protect yourself, preserve evidence, check if the lender is legal, and file the right complaints with the SEC, NPC, PNP, NBI, DICT, your bank, or your e-wallet provider.

First, Identify What Kind of Online Lending Scam Happened

“Online lending scam” can mean different things. The correct remedy depends on what actually happened.

Situation	What it usually means	Main office or remedy
You paid “processing,” “activation,” “insurance,” or “release” fees but no loan was released	Possible scam, estafa, financial account scam, or fake lending operation	PNP Anti-Cybercrime Group, NBI Cybercrime Division, DICT Cyber Hotline, bank/e-wallet
A loan app released less than promised and charged huge deductions	Possible Truth in Lending, SEC, or interest/fee violation	SEC Financing and Lending Companies Department
They contacted your relatives, employer, or phone contacts who were not guarantors	Possible unfair debt collection and data privacy violation	SEC and National Privacy Commission
They threatened arrest, barangay blotter, cyberlibel, deportation, or public posting	Possible unfair collection, threats, coercion, cybercrime, or harassment	SEC, PNP ACG, NBI Cybercrime Division
Someone used your ID to borrow money	Identity theft, data privacy breach, possible cybercrime	PNP ACG, NBI Cybercrime Division, NPC, lender, bank/e-wallet
The lender is registered but collectors are abusive	The loan may exist, but collection methods may be illegal	SEC, NPC, possible criminal complaint

A key point: a real debt does not give a lender the right to harass you. At the same time, if you actually received loan proceeds, violations by the lender do not automatically erase the principal loan. What you can dispute are illegal charges, undisclosed fees, abusive collection methods, unauthorized data use, and fraudulent conduct.

Your Rights Under Philippine Law

Online lenders must be authorized and regulated

Under Republic Act No. 9474, the Lending Company Regulation Act of 2007, a lending company must be organized as a corporation and cannot conduct lending business without authority from the Securities and Exchange Commission. The law also places lending companies under SEC supervision and allows the SEC to impose sanctions, including suspension or revocation of authority. (Supreme Court E-Library)

This means a person or app cannot simply call itself a “lending company,” collect fees, and threaten borrowers without being properly registered and authorized. If the company name, SEC registration number, Certificate of Authority number, office address, or customer service channel is hidden or suspicious, that is already a red flag.

Loan charges must be disclosed clearly

The Truth in Lending Act, Republic Act No. 3765, requires creditors to give borrowers a clear written statement of finance charges and the percentage rate before the credit transaction is completed. The law covers interest, fees, service charges, discounts, and similar charges connected with the extension of credit. (Lawphil)

For ordinary borrowers, this means you should be able to see, before accepting the loan:

the principal amount;
processing or service fees;
interest rate;
due date and loan term;
penalty for late payment;
total amount payable;
actual amount to be disbursed.

A common abusive pattern is showing “₱10,000 approved,” releasing only ₱6,500 after deductions, then demanding ₱12,000 or more within a week. Save screenshots of the offer page, loan agreement, disbursement receipt, and repayment computation.

There are interest and fee ceilings for certain small online loans

Bangko Sentral ng Pilipinas Circular No. 1133, Series of 2021 sets ceilings for certain short-term, small-value, high-cost consumer loans offered by lending companies, financing companies, and their online lending platforms. Covered loans are unsecured, general-purpose loans not exceeding ₱10,000 with a loan tenor of up to four months. The circular provides a nominal interest ceiling of 6% per month, an effective interest rate ceiling of 15% per month including applicable fees, a late payment penalty cap of 5% per month on the outstanding scheduled amount due, and a total cost cap of 100% of the total amount borrowed.

This is important because some apps use daily charges, “extension fees,” “service fees,” and rolling penalties to make a small loan balloon very quickly. If your loan fits the covered category, compare the lender’s computation against these ceilings.

Harassment and public shaming are prohibited collection practices

SEC Memorandum Circular No. 18, Series of 2019 prohibits unfair debt collection practices by financing and lending companies. It covers not only the company itself but also third-party service providers or collection agents hired by them. The circular prohibits, among others, threats of violence or criminal means, threats to take legally impossible actions, obscenities or insults, publication of borrower information, false representations, contacting at unreasonable hours, and contacting persons in the borrower’s contact list other than those named as guarantors or co-makers. (SEC Appointment System)

The same SEC circular provides penalties for violations, including fines and, for serious or repeated offenses, possible suspension or revocation of the lender’s authority to operate.

Lenders cannot freely use your contact list

A 2026 public advisory issued by the DICT, National Privacy Commission, and SEC specifically warns against online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data. It states that unnecessary app permissions, unauthorized or excessive processing of personal data, and contacting persons in the borrower’s contact list other than guarantors are prohibited.

The advisory also explains that a “character reference” is different from a “guarantor.” A reference is usually for identification or verification. A guarantor is someone who separately consented to assume responsibility if the borrower defaults. An app cannot simply treat everyone in your phone contacts as guarantors.

You have financial consumer rights

Under Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, financial consumers have rights to fair treatment, disclosure and transparency, protection against fraud and misuse, data privacy and protection, and timely handling of complaints. The law covers digital financial products and services and gives financial regulators, including the SEC, enforcement and complaint-handling powers. (Supreme Court E-Library)

For civil money claims connected with financial transactions, the same law gives the BSP and SEC adjudicatory authority where the relief sought is payment or reimbursement of money not exceeding ₱10 million, subject to the law’s conditions and the regulator’s rules. (Supreme Court E-Library)

You cannot be jailed for merely failing to pay a debt

Article III, Section 20 of the 1987 Constitution provides that no person shall be imprisoned for debt or non-payment of a poll tax. (Supreme Court E-Library)

So when a collector says, “Ipapakulong ka namin ngayon,” “May warrant na,” or “Pupuntahan ka ng pulis,” because of nonpayment alone, that is usually a pressure tactic. However, this protection does not prevent criminal liability if there was a separate crime, such as estafa, identity theft, falsification, or use of another person’s financial account in a scam. The line is important: ordinary inability to pay is civil; fraud may be criminal.

What to Do Immediately If You Were Scammed

1. Stop paying panic fees

Do not keep sending money just because the app says you must pay another “release fee,” “unlocking fee,” “verification fee,” “tax clearance,” or “anti-money laundering fee.” In many fake loan scams, every payment produces a new excuse for another payment.

Before paying anything else:

ask for the lender’s complete registered corporate name;
ask for its SEC registration number and Certificate of Authority number;
ask for a full statement of account;
ask for the written loan agreement and fee breakdown;
verify the payment account name.

Do not send money to random personal GCash, Maya, bank, or crypto accounts unless you have verified that the account truly belongs to the registered lender.

2. Preserve evidence before deleting anything

Many victims delete the app, messages, or posts out of fear. Preserve first.

Save:

screenshots of the app name, logo, app store page, website, and URL;
loan offer, approval page, loan agreement, and privacy notice;
disbursement record and repayment schedule;
proof of payment, transaction reference numbers, QR codes, account names, and account numbers;
text messages, Viber, Messenger, Telegram, WhatsApp, email, and call logs;
voice recordings, if any;
screenshots of threats, insults, public posts, group chats, or messages to your contacts;
names and numbers used by collectors;
dates and times of each incident.

For social media posts, save the link, screenshot the profile, and capture the date and time. If the post is public shaming, ask a trusted person to screenshot it too, so there is independent proof.

3. Secure your phone and accounts

If you installed a lending app, especially one that requested contacts, SMS, gallery, camera, location, or accessibility permissions:

Revoke app permissions.
Change passwords for your email, e-wallets, banking apps, and social media accounts.
Turn on two-factor authentication.
Remove saved cards or bank links if you suspect compromise.
Block the app’s auto-debit authorization if any.
Report suspicious transactions to your bank or e-wallet immediately.

If money left your bank or e-wallet account, report quickly. Fast reporting improves the chance of freezing funds, tracing recipient accounts, or documenting your claim.

4. Send a written dispute to the lender

Even if the collector is abusive, send a calm written dispute through the lender’s official customer service channel. Keep it short and factual.

Include:

your name and mobile number used for the app;
loan account number, if any;
amount received;
amount already paid;
charges you dispute;
specific abusive acts;
request for a full statement of account;
request to stop contacting third parties who are not guarantors;
request to stop processing unnecessary personal data;
demand that all collectors identify themselves and use official channels only.

Do not admit false facts. Do not promise payment you cannot make. Do not send your ID again unless you are sure you are dealing with the verified company channel.

5. File with the correct agency

Different government offices handle different parts of the problem. Filing only with one office may not cover everything.

Problem	Where to file	Practical notes
Unfair collection, harassment by lending app, overcharging, unauthorized lending operation	SEC through iMessage / FINLEND	Best for registered or supposedly registered lending and financing companies
Contact list misuse, public shaming using personal data, excessive app permissions	National Privacy Commission	Formal complaints generally require a specific form and notarization
Threats, extortion, fake accounts, identity theft, cyber harassment, online scam	PNP Anti-Cybercrime Group or NBI Cybercrime Division	Bring digital evidence and transaction details
Scam involving bank, e-wallet, unauthorized transfer, suspicious financial account	Your bank/e-wallet first, then BSP if unresolved	Ask for reference numbers and written responses
Social engineering, money mule accounts, financial account scam	Bank/e-wallet, law enforcement, BSP where applicable	RA 12010 may be relevant

The 2026 DICT-NPC-SEC advisory lists SEC iMessage for unfair debt collection complaints and also identifies the DICT Cyber Hotline, NBI Cybercrime Division, and PNP Anti-Cybercrime Group for harassment, threats, frauds, and scams. The SEC iMessage portal allows the public to open and track tickets. (Securities and Exchange Commission)

For privacy complaints, the NPC states that a formal complaint must follow its required format, be printed, filled out, notarized, and submitted in person, by courier, or by scanned email submission. (National Privacy Commission)

For unresolved concerns involving BSP-supervised financial institutions such as banks and e-money issuers, BSP’s process generally requires you to report first to the institution’s consumer assistance channel before escalating through BSP’s Consumer Assistance Mechanism. (Bureau of Small and Medium Enterprises)

Evidence Checklist

Prepare one folder, physical or digital, with the following:

Document or proof	Why it matters
Valid ID	Required by most agencies to verify complainant identity
Loan agreement or app screenshots	Shows terms, fees, due date, and consent screens
Proof of disbursement	Shows whether money was actually released
Proof of payment	Shows amounts paid and recipient accounts
Statement of account or demand messages	Shows disputed computation
Screenshots of threats or shaming	Supports SEC, NPC, and cybercrime complaints
Contacted third-party statements	Helps prove the app contacted relatives, employer, or contacts
App permissions screenshots	Helps show excessive data access
App store link or website URL	Helps identify the platform
Corporate name, SEC number, CA number	Helps verify if the lender is legitimate
Bank/e-wallet reference numbers	Helps trace funds and support freezing or dispute requests
Notarized affidavit, if required	Often needed for formal agency or criminal complaints

For screenshots, keep the original files if possible. Do not crop out dates, phone numbers, account names, URLs, or timestamps.

How to File an SEC Complaint Against an Online Lending Company

The SEC is usually the main office for complaints against lending companies, financing companies, and their online lending platforms.

Step-by-step

Verify the lender’s identity. Search the exact corporate name, not just the app name. Many apps use trade names different from the SEC-registered corporation.
Prepare a timeline. Write the facts in order: date of application, amount advertised, amount released, deductions, due date, payment made, first harassment, third-party contacts, threats, and current demand.
Attach evidence. Include screenshots, transaction slips, collection messages, call logs, and proof that non-guarantors were contacted.
File through SEC iMessage. Use the complaint/ticket portal and choose the relevant department or service for financing and lending concerns. Keep your ticket number. (Securities and Exchange Commission)
Watch for follow-up requirements. The SEC may require clearer copies, a complaint form, additional proof, or clarification of the respondent company.
Update your ticket when harassment continues. New threats, new public posts, or new third-party messages should be added to the same record if the portal allows it.

What SEC can realistically do

SEC proceedings are usually regulatory or administrative. The SEC can investigate whether the company violated lending laws, SEC circulars, disclosure rules, or consumer protection standards. Depending on the facts, sanctions may include fines, suspension, revocation, or other enforcement action. SEC action is especially useful when the lender is registered or traceable.

If the app is completely fake, uses random personal accounts, and has no real SEC-registered entity behind it, the SEC complaint may still help document the incident, but law enforcement and bank/e-wallet reporting become more urgent.

When to File with the National Privacy Commission

File with the NPC when the main harm involves personal data.

Examples:

the app accessed your full contact list without a legitimate purpose;
collectors messaged your relatives, co-workers, employer, or clients;
your name, photo, ID, address, or debt details were posted online;
your contacts were told you are a scammer, criminal, or fugitive;
the app required unnecessary permissions before or after loan approval;
you requested deletion or correction of data and were ignored.

The Data Privacy Act of 2012, Republic Act No. 10173, protects personal information in government and private-sector information systems and created the NPC. (National Privacy Commission) The 2026 DICT-NPC-SEC advisory is especially helpful for online lending complaints because it directly addresses contact list abuse, unnecessary app permissions, harassment, and public shaming.

For stronger NPC complaints, attach:

screenshots showing app permissions;
screenshots of messages sent to third parties;
affidavits or written statements from contacted persons;
screenshots of public posts;
privacy notice and consent screen from the app;
your request to stop processing or delete unnecessary data.

When to Go to PNP, NBI, or DICT

Go to law enforcement when the conduct is not just a lending violation but a possible crime.

Possible criminal issues include:

fake loan release scam;
identity theft;
extortion;
grave threats under the Revised Penal Code;
coercion or unjust vexation;
estafa through deceit;
online libel or public defamatory posts;
hacking or unauthorized account access;
use of money mule accounts;
financial account scamming.

The Cybercrime Prevention Act of 2012, Republic Act No. 10175, covers certain offenses committed through computer systems, including online libel under Section 4(c)(4). (Supreme Court E-Library) The Anti-Financial Account Scamming Act, Republic Act No. 12010, also addresses financial account scamming and related offenses such as misuse of accounts in scams. (Lawphil)

Bring printed and digital copies of your evidence. If the scam involved an e-wallet or bank transfer, include:

sending account;
receiving account name and number;
transaction reference number;
date and exact time;
amount;
screenshots of chat instructions telling you where to send money.

Can You Recover the Money?

Recovery depends on speed, traceability, and whether the recipient account can be frozen or identified.

If you sent money to a bank or e-wallet

Report immediately to the bank or e-wallet provider. Ask for:

incident or ticket number;
account restriction or freeze request;
written confirmation of your report;
instructions for submitting a police report or affidavit;
escalation procedure if unresolved.

Then report to PNP ACG or NBI Cybercrime Division. Financial institutions usually need official investigation requests or documentation before releasing information about recipient accounts.

If you overpaid a registered lender

Ask for a corrected statement of account and refund of overcharges. If the amount is within the jurisdiction of the regulator or court process, possible routes include SEC consumer redress, a civil claim, or small claims depending on the facts.

For ordinary money claims not exceeding ₱1,000,000, the Supreme Court’s small claims rules apply in first-level courts and cover money owed under loans and other credit accommodations. (Supreme Court of the Philippines)

If the scammer used fake identities

Recovery is harder if funds moved through mule accounts, crypto, or multiple transfers. Still, filing quickly matters because it creates a paper trail, helps investigators connect cases, and may support freezing or tracing requests.

Common Mistakes That Make the Case Harder

Paying more without verifying the lender

Scammers rely on fear and urgency. Once you pay one “release fee,” they often invent another.

Deleting the app too soon

Delete only after preserving screenshots, agreements, payment records, and permissions. Some victims lose the only copy of the loan terms when they uninstall the app.

Posting emotional accusations without evidence

You can warn others, but avoid making unsupported accusations online. If the lender or collector is identifiable, careless posts may create a separate defamation issue. Stick to facts and preserve evidence for agencies.

Ignoring real court papers

Threats by collectors are different from actual court documents. If you receive a subpoena, summons, order, or notice from a court, prosecutor, SEC, NBI, or PNP, read it carefully and respond within the required period.

Assuming all debts disappear because of harassment

Abusive collection can be illegal, but if you received money, the lender may still claim the legitimate principal and lawful charges. Your dispute should focus on the unlawful conduct, unauthorized data use, excessive fees, and inaccurate computation.

Special Notes for OFWs, Filipinos Abroad, and Foreigners

Online lending scams often affect OFWs and foreigners because scammers know they may be harder to reach physically and may panic when threatened with immigration, employer, or embassy consequences.

Important points:

A Philippine online lender cannot simply cause your deportation because of an unpaid private loan.
If you are abroad, preserve Philippine phone numbers, app screenshots, and e-wallet records because many agencies will ask for transaction details.
If an affidavit is required and you are outside the Philippines, you may need consular notarization at a Philippine Embassy or Consulate, or a properly apostilled foreign notarized document depending on the document and place of execution. Philippine embassies and consulates can notarize private documents such as affidavits and special powers of attorney. (Philippine Embassy)
If you authorize a relative in the Philippines to file or follow up, prepare a Special Power of Attorney when required.
Foreigners should keep copies of passport bio page, visa status, local address, and proof of transaction, but should avoid sending passport copies repeatedly to unverified collectors.

Frequently Asked Questions

Can an online lending company have me arrested for not paying?

Not for nonpayment of debt alone. The Constitution prohibits imprisonment for debt. However, a separate criminal case may exist if there is fraud, identity theft, falsification, or another crime. Threats of immediate arrest by collectors are often abusive pressure tactics.

Is it legal for a loan app to message my contacts?

Generally, no, unless the person contacted is a guarantor or co-maker who properly consented, or the contact falls within a legally allowed purpose. The 2026 DICT-NPC-SEC advisory states that contacting persons in the borrower’s contact list other than guarantors is prohibited for debt collection.

What if I gave the app permission to access my contacts?

Consent is not a blank check. Consent may be invalid or insufficient if it was obtained through deceptive design, was excessive, or allowed processing beyond a legitimate purpose. The 2026 advisory specifically warns against unnecessary permissions and deceptive design patterns.

Should I still pay if the lender harassed me?

If you received the loan, you may still owe the lawful principal and lawful charges. But you can dispute illegal fees, excessive interest, unauthorized deductions, and abusive collection. Ask for a written statement of account and pay only through verified official channels.

Can I file both SEC and NPC complaints?

Yes, when the facts support both. File with the SEC for unfair debt collection, overcharging, unauthorized lending, or lending regulation violations. File with the NPC for misuse of personal data, contact list abuse, public shaming, or excessive app permissions.

What if the company is not registered with the SEC?

Report it to the SEC and law enforcement. Operating as a lending company without valid SEC authority may violate RA 9474. If the operation also collected fees, used fake accounts, or disappeared after payment, file with PNP ACG or NBI Cybercrime Division as a possible scam.

Can I sue for damages if they posted my name or photo online?

Possible remedies may include civil damages, criminal complaints for defamation-related offenses where applicable, data privacy complaints, and SEC complaints for unfair collection. Civil Code Articles 19, 20, and 21 may apply when a person abuses rights, acts contrary to law, or willfully causes injury contrary to morals, good customs, or public policy. (Lawphil)

How long does a complaint take?

Timelines vary. Bank or e-wallet reports should be made immediately because fund tracing is time-sensitive. SEC, NPC, PNP, and NBI matters may take weeks to months depending on evidence, identity of the respondent, volume of complaints, and whether the company is traceable. Keep your reference numbers and submit follow-up evidence when new harassment occurs.

Do I need a lawyer to file a complaint?

For initial reports to SEC, NPC, PNP, NBI, DICT, banks, or e-wallets, many victims file on their own. A lawyer becomes more important if you will file a civil case, respond to a court summons, prepare affidavits for criminal prosecution, or pursue damages.

What if collectors keep calling my employer?

Document each call or message. Ask your employer or HR to save screenshots, call logs, and the caller’s number. Report this to the SEC as unfair collection and to the NPC if personal data was disclosed. If the collector used threats, insults, or false accusations, include those details in a law enforcement report.

Key Takeaways

Do not keep paying release fees or panic fees without verifying the lender.
Save evidence first before deleting the app, blocking numbers, or changing devices.
Check whether the company is SEC-authorized and whether the app name matches the registered corporate entity.
Harassment, public shaming, threats, and contact-list blasting are not lawful collection methods.
File with the SEC for lending violations and unfair debt collection.
File with the NPC for misuse of personal data, contact list abuse, and public posting of borrower information.
File with PNP ACG, NBI Cybercrime Division, or DICT for threats, fraud, identity theft, extortion, or fake loan scams.
Report bank or e-wallet transfers immediately because speed matters for tracing and freezing funds.
Nonpayment of debt alone is not a jailable offense, but fraud or identity-related crimes are different.
If a real loan was released, dispute illegal charges and abusive conduct while keeping records of any lawful payments.