Introduction

Online lending has become common in the Philippines because borrowers can apply through mobile apps, websites, or social media without visiting a bank or lending office. While legitimate online lending platforms are regulated, many abusive or fraudulent operators use the convenience of digital lending to deceive borrowers, charge illegal fees, misuse personal data, harass contacts, threaten victims, or collect money without authority.

An online lending scam may involve a fake lending company, an unregistered online lending app, an abusive debt collection scheme, identity theft, unauthorized access to phone contacts, or cyber harassment. Because these acts may violate several Philippine laws, a victim may need to report the incident to more than one government agency.

This article explains where to report an online lending scam in the Philippines, what laws may apply, what evidence to prepare, and what practical steps victims should take.

What Is an Online Lending Scam?

An online lending scam is any fraudulent, deceptive, unauthorized, or abusive lending-related activity conducted through the internet, mobile applications, text messages, social media, email, or other electronic means.

Common examples include:

Fake loan offers

Scammers pretend to be a lending company and ask the borrower to pay an “advance fee,” “processing fee,” “insurance fee,” or “release fee” before the loan is supposedly released. After payment, the scammer disappears.
Unregistered online lending apps

Some apps offer loans without being properly registered or authorized to operate as lending or financing companies.
Abusive debt collection

Some lenders or collectors shame borrowers online, threaten them, contact their family and friends, use insults, publish personal information, or falsely accuse them of crimes.
Unauthorized access to contacts and photos

Some apps require excessive phone permissions and later use the borrower’s contacts, photos, or personal data for harassment.
Identity theft

Scammers may use a victim’s ID, selfie, phone number, or personal data to apply for loans or create accounts.
Phishing and account takeover

Victims may be tricked into clicking links, giving OTPs, or entering banking or e-wallet details on fake loan websites.
Excessive or hidden charges

Some lenders advertise low interest but deduct large fees upfront, impose unclear penalties, or conceal the true cost of borrowing.
Threats of criminal prosecution for nonpayment

Collectors may threaten arrest, imprisonment, barangay blotter, NBI complaints, or public humiliation even when the matter is essentially a civil debt issue.

Main Agencies Where You Can Report an Online Lending Scam

1. Securities and Exchange Commission

The Securities and Exchange Commission, or SEC, is one of the most important agencies for complaints involving online lending companies in the Philippines.

You should report to the SEC if the issue involves:

An online lending app or company operating without registration.
A lending or financing company using abusive collection practices.
Harassment by collectors.
Public shaming, threats, or intimidation by an online lender.
Misrepresentation that the company is authorized by the SEC.
Lending apps not appearing in the SEC list of registered or recorded online lending platforms.

The SEC supervises lending companies and financing companies. Legitimate lending companies must generally be registered with the SEC and must have the required authority to operate. Online lending platforms are also subject to SEC rules and circulars, especially those dealing with disclosure, fair collection practices, and abusive behavior.

A complaint to the SEC may result in regulatory action, such as investigation, penalties, suspension, revocation of registration, or public advisories against the company.

2. National Privacy Commission

The National Privacy Commission, or NPC, handles violations involving personal data and privacy.

You should report to the NPC if the lender, app, or collector:

Accessed your phone contacts without proper consent.
Sent messages to your contacts about your debt.
Posted your name, photo, ID, address, or other personal information online.
Used your personal data for harassment.
Shared your loan information with third parties without lawful basis.
Collected excessive personal data through the app.
Used your photos, contacts, or personal details to shame or threaten you.
Failed to protect your data from misuse.

The Data Privacy Act protects personal information and sensitive personal information. Lending apps must collect and process personal data lawfully, fairly, and only for legitimate purposes. Even if a borrower owes money, that does not give a lender unlimited authority to expose private information, shame the borrower, or contact unrelated persons.

For privacy-related lending abuses, the NPC is often the appropriate agency.

3. Philippine National Police Anti-Cybercrime Group

The Philippine National Police Anti-Cybercrime Group, or PNP-ACG, investigates cybercrime complaints.

You should report to the PNP-ACG if the online lending scam involves:

Online fraud.
Threats sent through text, chat, email, or social media.
Cyber harassment.
Identity theft.
Fake lending websites or apps.
Phishing links.
Unauthorized access to your accounts.
Use of your personal information to commit fraud.
Online extortion.
Posting defamatory or humiliating content online.

The PNP-ACG can assist in cybercrime investigation, evidence preservation, tracing digital accounts, and preparing a case for prosecution.

4. National Bureau of Investigation Cybercrime Division

The National Bureau of Investigation Cybercrime Division, or NBI-CCD, also handles cybercrime complaints.

You may report to the NBI if the matter involves:

Online scams.
Identity theft.
Cyber libel.
Threats.
Extortion.
Fake lending platforms.
Fraud using electronic communications.
Coordinated online harassment.
Use of fake accounts or anonymous numbers.

Victims may report either to the PNP-ACG or the NBI Cybercrime Division. For serious cases, large-scale scams, repeated threats, identity theft, or organized online fraud, an NBI complaint may be useful.

5. Department of Justice Office of Cybercrime

The Department of Justice Office of Cybercrime, or DOJ-OOC, is involved in cybercrime policy, coordination, and certain cybercrime-related matters. While victims commonly file investigative complaints first with the PNP-ACG or NBI, the DOJ may become involved when a case is referred for prosecution or when cybercrime-related legal processes are needed.

The DOJ is relevant where the acts may constitute violations of the Cybercrime Prevention Act, the Revised Penal Code as applied through information and communications technology, or related laws.

6. Bangko Sentral ng Pilipinas

The Bangko Sentral ng Pilipinas, or BSP, is relevant if the scam involves a bank, e-wallet, payment service provider, or financial institution under BSP supervision.

You may report to the BSP if:

Your bank account or e-wallet was used in the scam.
A payment provider failed to act on a fraud report.
The scam involved unauthorized transactions.
You were tricked into transferring money through an e-wallet or bank.
A digital financial service provider is involved.

The BSP does not regulate all lending companies, but it regulates banks, electronic money issuers, operators of payment systems, and other covered financial institutions. If money was transferred through GCash, Maya, a bank account, or another regulated financial channel, you should also report the transaction to the provider immediately and consider filing a BSP consumer complaint if the provider mishandles the matter.

7. Department of Trade and Industry

The Department of Trade and Industry, or DTI, may be relevant if the complaint involves deceptive consumer practices, misleading advertisements, or unfair commercial conduct by a business.

However, lending and financing companies are primarily regulated by the SEC, while banks and certain financial institutions are regulated by the BSP. For pure online lending abuse, the SEC, NPC, PNP-ACG, or NBI are usually more directly relevant.

8. Local Police Station or Barangay

For immediate threats, harassment, or safety concerns, a victim may also go to the local police station or barangay.

A barangay blotter or police blotter can help document:

Threats.
Harassing visits.
Repeated calls or messages.
Public shaming.
Intimidation.
Attempts to collect by force.

However, online lending scams and cyber-related acts should still be elevated to the PNP-ACG, NBI Cybercrime Division, SEC, or NPC, depending on the nature of the violation.

Which Agency Should You Report To?

The proper agency depends on the nature of the complaint.

Situation	Where to Report
Fake lending company or unregistered online lending app	SEC
Abusive debt collection by lending app	SEC
App accessed contacts or personal data without proper consent	NPC
Lender messaged your contacts about your debt	NPC and SEC
Threats, cyber harassment, extortion, fake accounts	PNP-ACG or NBI Cybercrime Division
Identity theft or use of your ID to borrow money	PNP-ACG or NBI; also report to affected lender or financial institution
Phishing or unauthorized account access	PNP-ACG or NBI; also bank/e-wallet provider
Unauthorized bank or e-wallet transaction	Bank/e-wallet provider and BSP
Misleading loan advertisement	SEC, and possibly DTI depending on the business involved
Immediate physical threat	Local police station, then PNP-ACG or NBI if online evidence is involved

In many cases, victims should file with more than one agency. For example, if an online lending app is unregistered, accessed contacts, and threatened to post defamatory content, the victim may report to the SEC, NPC, and PNP-ACG or NBI.

Philippine Laws That May Apply

1. Lending Company Regulation Act

The Lending Company Regulation Act governs lending companies in the Philippines. Lending companies must comply with registration and regulatory requirements. A person or entity that engages in lending without proper authority may be subject to penalties and regulatory action.

For online lending scams, this law becomes relevant when a company offers loans to the public without being properly registered or authorized.

2. Financing Company Act

If the entity operates as a financing company, it may fall under the Financing Company Act. Financing companies are also regulated and must comply with SEC requirements.

Some companies may present themselves as lenders, financing companies, installment providers, or credit platforms. The label they use is not conclusive. What matters is the actual nature of their business and whether they are authorized to operate.

3. SEC Rules on Online Lending Platforms

The SEC has issued rules and advisories addressing online lending platforms and abusive collection practices. These rules generally require transparency, proper registration, fair treatment of borrowers, and responsible debt collection.

Acts that may trigger SEC action include:

Threatening borrowers.
Using obscenities or insults.
Contacting persons in the borrower’s contact list to shame them.
Posting personal information online.
Using false legal threats.
Misleading borrowers about loan terms.
Operating without authority.

4. Data Privacy Act of 2012

The Data Privacy Act protects personal information and sensitive personal information. Online lenders must have a lawful basis for collecting and using personal data. They must also comply with principles of transparency, legitimate purpose, and proportionality.

Violations may arise when a lender:

Collects more data than necessary.
Forces access to contacts, photos, messages, or files unrelated to the loan.
Shares borrower information with contacts.
Posts borrower data online.
Uses personal data to harass, shame, or threaten.
Fails to secure personal information.
Uses personal data for purposes not disclosed to the borrower.

Debt collection does not erase privacy rights. A lender may pursue lawful collection, but it may not misuse personal data.

5. Cybercrime Prevention Act of 2012

The Cybercrime Prevention Act applies when crimes are committed through computers, phones, online platforms, or other information and communications technology.

Depending on the facts, online lending scams may involve:

Computer-related fraud.
Identity theft.
Cyber libel.
Illegal access.
Misuse of devices.
Online threats or extortion connected to electronic evidence.

If a scammer uses fake websites, phishing links, fake social media accounts, messaging apps, or electronic payment channels, cybercrime authorities may investigate.

6. Revised Penal Code

Even without the cybercrime law, many acts may violate the Revised Penal Code.

Possible offenses include:

Estafa, where the victim is deceived into paying money.
Grave threats, where the victim is threatened with harm.
Unjust vexation, where the victim is harassed or annoyed without lawful justification.
Slander or libel, depending on how defamatory statements are made.
Coercion, where a person is forced to do something against their will.
Usurpation or false representation, if the scammer pretends to have authority or official status.

If these acts are committed online, cybercrime provisions may also increase penalties or affect the manner of prosecution.

7. Consumer Protection Laws

Consumer protection principles may apply where borrowers are misled, deceived, or subjected to unfair terms. Loan advertisements must not be false or misleading. Charges, interest, penalties, and repayment terms should be clearly disclosed.

However, in lending cases, the SEC and BSP are usually more central than general consumer agencies, depending on the entity involved.

What Evidence Should You Prepare?

Before filing a complaint, gather and preserve evidence. Do not delete messages, uninstall apps, or reset your phone without first saving proof.

Important evidence includes:

Screenshots of the loan app or website

Capture the app name, logo, developer name, website URL, advertised loan terms, fees, and permissions requested.
Screenshots of messages

Save SMS, Viber, Messenger, WhatsApp, Telegram, email, or in-app messages showing threats, insults, demands, or scam instructions.
Call logs

Record dates, times, phone numbers, and frequency of calls.
Payment proof

Save bank transfer receipts, e-wallet receipts, reference numbers, QR codes, account names, and account numbers.
Loan documents

Keep loan agreements, disclosure statements, repayment schedules, screenshots of app dashboards, and account records.
Proof of unauthorized contact

Ask friends, family, co-workers, or contacts to send screenshots of messages they received from the lender or collector.
Proof of public posting

Screenshot social media posts, comments, group chats, or pages where your name, photo, or personal data was exposed.
Identity theft evidence

Save proof that your ID, selfie, phone number, or account was used without consent.
App permissions

Capture permissions requested by the app, such as access to contacts, camera, storage, location, or microphone.
Company details

Record the alleged company name, SEC registration number if shown, address, phone numbers, email addresses, app store links, and website links.

Timeline

Prepare a clear chronology: when you downloaded the app, when you applied, how much was borrowed, how much was received, how much was paid, when harassment began, and what threats were made.

How to File a Complaint

Step 1: Identify the nature of the violation

Ask what happened:

Was money taken through deception?
Was the lender unregistered?
Were you harassed?
Was your personal data misused?
Were your contacts messaged?
Was there an unauthorized bank or e-wallet transaction?
Was your identity used?

This determines where to file.

Step 2: Preserve all evidence

Save screenshots, receipts, messages, links, app details, and witness statements. Use cloud backup or another device. Do not rely only on your phone if the app may be deleted or your account may be blocked.

Step 3: Report to the platform or provider

If the scam involved an app, report it to the app store. If it involved Facebook, Messenger, Telegram, WhatsApp, or another platform, report the account or page. If money was sent through a bank or e-wallet, report immediately to the provider and request account freezing or transaction investigation where possible.

Step 4: File with the proper government agency

File with the SEC for lending-related violations, NPC for data privacy violations, PNP-ACG or NBI for cybercrime, and BSP for bank or e-wallet issues.

A victim may file parallel complaints when the facts overlap.

Step 5: Prepare an affidavit or complaint narrative

A complaint should clearly state:

Your full name and contact information.
The name of the lending app, company, website, or person complained of.
The date and manner of the transaction.
The amount borrowed, amount received, amount paid, and charges imposed.
The specific acts complained of.
The evidence attached.
The relief requested, such as investigation, takedown, penalty, prosecution, or protection of personal data.

Step 6: Follow up and cooperate

Agencies may request additional documents, sworn statements, device examination, or clarification. Keep copies of everything submitted.

Sample Complaint Structure

A simple complaint may be organized as follows:

Subject: Complaint Against Online Lending App for Harassment, Data Privacy Violation, and Possible Unauthorized Lending Activity

Parties: State your name and the name of the lending app, company, collector, phone number, email, website, or social media account involved.

Facts: Explain when you applied, how much was promised, how much was released, what fees were deducted, and what happened afterward.

Acts Complained Of: Describe the abusive or fraudulent acts, such as threats, public shaming, contacting third parties, unauthorized use of contacts, fake legal threats, excessive fees, or refusal to identify the company.

Evidence: List screenshots, payment receipts, messages, call logs, app permissions, app store links, witness screenshots, and other documents.

Request: Ask the agency to investigate, impose appropriate sanctions, order corrective action, protect your personal data, and refer the matter for prosecution if warranted.

Is Nonpayment of an Online Loan a Criminal Case?

As a general rule, failure to pay a debt is not automatically a criminal offense. Debt is usually a civil obligation. A lender may pursue lawful collection or civil remedies, but collectors cannot automatically have a borrower arrested merely for nonpayment.

However, a borrower may face legal consequences if there is fraud, falsification, or other criminal conduct. On the other hand, collectors who threaten arrest, shame borrowers, expose personal data, or use abusive tactics may themselves violate the law.

Victims should distinguish between:

A legitimate debt, which may still need to be resolved; and
Illegal collection methods, which may be reported even if a debt exists.

Owing money does not authorize harassment, threats, privacy violations, or public humiliation.

What If the Lending App Is Registered?

A registered lending company may still violate the law. SEC registration is not a license to harass borrowers, misuse personal data, conceal charges, or threaten criminal prosecution without basis.

If the company is registered, the borrower may still report:

Abusive collection practices to the SEC.
Data privacy violations to the NPC.
Cyber threats or online harassment to the PNP-ACG or NBI.
Payment or e-wallet issues to the relevant provider and BSP.

Registration affects the nature of the complaint but does not excuse unlawful conduct.

What If the Lending App Is Not Registered?

If the lending app or company is not registered or authorized, report it to the SEC. Include screenshots of the app, website, advertisements, messages, and any claim that it is a legitimate lender.

Unregistered lending activity may expose the operators to regulatory sanctions and possible criminal or administrative consequences. If the unregistered lender also committed fraud, identity theft, threats, or data misuse, complaints may also be filed with law enforcement and the NPC.

What If the Scam Involved Advance Fees?

Many lending scams ask for payment before loan release. The scammer may call it:

Processing fee.
Verification fee.
Insurance fee.
Notarial fee.
Release fee.
Activation fee.
Collateral fee.
Anti-money laundering clearance fee.
Tax clearance fee.

Victims should be cautious when a supposed lender asks for payment before releasing a loan, especially if payment is requested through personal bank accounts, e-wallet numbers, cryptocurrency, remittance centers, or QR codes.

If you paid an advance fee and no loan was released, report to:

PNP-ACG or NBI for online fraud.
The bank or e-wallet provider used.
BSP if a regulated financial provider mishandled the fraud report.
SEC if the scammer pretended to be a lending company.

What If Your Contacts Were Harassed?

If collectors messaged or called your contacts, this may involve both abusive collection and privacy violations.

Report to:

NPC, because your personal data and your contacts’ data may have been misused.
SEC, because the lender or collector may have engaged in unfair or abusive debt collection.
PNP-ACG or NBI, if the messages involved threats, defamation, extortion, or cyber harassment.

Ask your contacts to preserve screenshots showing the sender’s number, message, date, and time.

What If Your Photo or Name Was Posted Online?

Posting a borrower’s photo, name, ID, or debt details online may expose the poster to liability. It may involve privacy violations, cyber libel, unjust vexation, threats, or other offenses depending on the content.

Report to:

NPC for unauthorized disclosure of personal information.
PNP-ACG or NBI for cybercrime-related investigation.
SEC if the poster is connected to a lending company or online lending app.
The social media platform for takedown or account reporting.

Preserve the post before reporting it for takedown. Screenshot the URL, username, date, comments, and visible audience.

What If Someone Used Your Identity to Borrow?

Identity theft must be taken seriously. If your personal information was used to obtain a loan without your consent:

Report to the lender and deny the unauthorized transaction.
File a complaint with PNP-ACG or NBI.
Report data privacy issues to NPC if your personal data was compromised or mishandled.
Notify banks, e-wallets, and credit-related institutions if your accounts may be affected.
Keep copies of IDs, affidavits, and communications proving that you did not apply for the loan.

You may also consider executing an affidavit of denial or affidavit of identity theft for documentation.

Practical Steps for Victims

1. Stop paying suspicious advance fees

If the lender keeps asking for more money before releasing the loan, it is likely a scam.

2. Do not give OTPs or passwords

No legitimate lender should ask for your bank password, e-wallet PIN, OTP, or remote access to your phone.

3. Revoke app permissions

If safe to do so, remove unnecessary permissions from the lending app, especially contacts, photos, storage, location, microphone, or camera. Consider uninstalling the app after preserving evidence.

4. Warn your contacts

If your contacts may be harassed, inform them not to respond, pay, or provide information.

5. Block and document

You may block harassing numbers after taking screenshots and saving evidence.

6. Report payment accounts

If you sent money to a bank or e-wallet account, report the recipient account immediately to the provider.

7. Check app legitimacy

Before borrowing, check whether the company is properly registered and whether the app is officially listed or authorized.

8. Avoid social media loan offers

Be cautious of lenders operating only through Facebook pages, Messenger, Telegram, or random text messages.

Can You Recover the Money?

Recovery depends on how quickly the scam is reported, the payment channel used, and whether the recipient account can be traced or frozen.

Immediate reporting improves the chance of recovery. Victims should contact the bank, e-wallet provider, remittance service, or payment platform as soon as possible. Provide transaction reference numbers, screenshots, and the recipient account details.

Government agencies may investigate and prosecute, but they do not always guarantee immediate refund. Civil action may also be available depending on the amount involved and the identity of the scammer.

Can You Sue the Online Lender or Collector?

Depending on the facts, possible actions may include:

Administrative complaint before the SEC.
Privacy complaint before the NPC.
Criminal complaint before law enforcement or prosecutor’s office.
Civil action for damages.
Complaint with a financial regulator if a covered financial institution is involved.

The proper remedy depends on the evidence, identity of the offender, amount involved, and nature of the harm.

Red Flags of an Online Lending Scam

Be cautious if the lender:

Requires payment before loan release.
Uses personal e-wallet or bank accounts.
Has no verifiable SEC registration.
Refuses to disclose company name, address, or official contact details.
Offers guaranteed approval with no proper assessment.
Uses threats or insults.
Demands access to contacts, photos, or messages.
Advertises through random texts or social media posts.
Claims you will be arrested immediately for nonpayment.
Uses fake government, police, court, or law office names.
Gives unclear loan terms or hidden charges.
Pressures you to act immediately.

Frequently Asked Questions

Can I report an online lending app even if I owe money?

Yes. A debt does not give a lender the right to harass, threaten, shame, or misuse personal data. You may still need to address any lawful debt, but illegal collection practices may be reported.

Should I report to the SEC or NPC?

Report to the SEC if the issue concerns lending operations, registration, loan terms, or abusive collection. Report to the NPC if the issue concerns misuse of personal data, contact harvesting, unauthorized disclosure, or privacy violations. Many cases involve both.

Should I report to PNP-ACG or NBI?

Report to either if the matter involves cybercrime, online fraud, threats, identity theft, phishing, extortion, or online defamation. Serious or complex cases may be brought to either cybercrime authority.

Can collectors contact my family or friends?

Collectors should not use third-party contact as a tool for shame, pressure, or harassment. Contacting unrelated persons and disclosing debt information may raise privacy and collection-practice violations.

Can I be arrested for not paying an online loan?

Nonpayment of debt alone is generally not a ground for arrest. However, fraud or falsification may be a different matter. False threats of arrest are commonly used by abusive collectors.

What if the lender says they will post me on social media?

Preserve the threat as evidence and report it. If they post your information, screenshot the post and report to the NPC, PNP-ACG or NBI, and the platform.

What if the app is no longer available?

Save any remaining screenshots, app links, messages, payment records, and phone numbers. Even if an app is removed, operators may still be investigated based on available evidence.

Conclusion

Victims of online lending scams in the Philippines are not limited to one remedy. The correct reporting channel depends on the nature of the abuse. The SEC handles unauthorized and abusive lending operations. The NPC handles misuse of personal data. The PNP-ACG and NBI handle cybercrime, online fraud, threats, and identity theft. The BSP may be involved when banks, e-wallets, or regulated financial institutions are part of the transaction.

The most important step is to preserve evidence early. Screenshots, receipts, call logs, app details, URLs, and messages can determine whether a complaint succeeds. Even if a borrower has an unpaid loan, lenders and collectors must still follow the law. Debt collection must be lawful, fair, and respectful of privacy and dignity.