A Philippine Legal Guide for Borrowers, Victims, and Concerned Citizens
I. Introduction
Online lending has made credit faster and more accessible in the Philippines. Through mobile applications, borrowers can apply for loans within minutes, upload identification documents, and receive funds through e-wallets or bank transfers. But this convenience has also created opportunities for abusive, predatory, and unlawful lending practices.
Many borrowers have reported online lending apps that harass debtors, shame them on social media, contact their family, friends, employers, or phone contacts, threaten legal action without basis, impose excessive interest and hidden fees, misuse personal data, or operate without proper registration. In the Philippine context, these practices may violate laws and regulations enforced by the Securities and Exchange Commission, the National Privacy Commission, and other government agencies.
The two most important agencies for complaints against abusive online lending apps are the Securities and Exchange Commission, or SEC, and the National Privacy Commission, or NPC. The SEC deals mainly with the legality of lending operations, corporate registration, financing or lending authority, and abusive debt collection practices. The NPC deals mainly with misuse of personal data, unauthorized access to contact lists, public shaming, threats involving personal information, and other privacy violations.
This article explains what makes an online lending app illegal or abusive, when to report to the SEC, when to report to the NPC, what evidence to collect, how to prepare a complaint, what legal rights borrowers have, and what remedies may be available under Philippine law.
II. What Are Online Lending Apps?
Online lending apps are mobile or web-based platforms that allow individuals to borrow money digitally. In the Philippines, many of these apps are operated by lending companies, financing companies, or entities that claim to offer short-term consumer loans.
A legitimate online lending app should generally be connected to a duly registered company authorized to engage in lending or financing. It should also comply with laws on lending, consumer protection, fair debt collection, data privacy, disclosure of loan terms, and electronic transactions.
An online lending app becomes legally problematic when it operates without authority, conceals the identity of the lender, charges unconscionable or undisclosed fees, uses threats or harassment to collect debts, accesses private data without valid consent, or discloses borrower information to third parties.
III. Main Philippine Laws and Regulations Involved
Several Philippine laws may apply to illegal and abusive online lending apps.
1. Lending Company Regulation Act of 2007
The Lending Company Regulation Act of 2007, or Republic Act No. 9474, regulates lending companies in the Philippines. A lending company must generally be organized as a corporation and must obtain the necessary authority from the SEC before engaging in the business of lending.
An app that lends money to the public without the required registration or authority may be operating illegally.
2. Financing Company Act
The Financing Company Act, as amended, governs financing companies. If the app’s business model falls within financing activities, the operator may need appropriate SEC authority as a financing company.
3. Data Privacy Act of 2012
The Data Privacy Act of 2012, or Republic Act No. 10173, protects personal information and sensitive personal information. It applies to entities that collect, process, store, use, disclose, or dispose of personal data.
Online lending apps usually collect highly sensitive borrower information, such as names, mobile numbers, addresses, IDs, photographs, employment details, bank or e-wallet details, and sometimes phone contact lists. If such data is collected or used unfairly, excessively, without proper consent, or for harassment, the lender may be liable under data privacy law.
4. SEC Rules on Lending and Financing Companies
The SEC has issued rules, memoranda, advisories, and enforcement actions addressing abusive lending and financing practices, including online lending app misconduct. These rules generally emphasize proper registration, transparency of loan terms, fair collection practices, and prohibition of harassment, threats, obscenity, public shaming, and unauthorized disclosure of borrower information.
5. Consumer Protection Laws
Consumer protection principles require businesses to deal fairly, disclose material terms, avoid deceptive practices, and refrain from oppressive or unconscionable conduct. Online lenders may violate consumer protection standards if they hide fees, misrepresent interest rates, use misleading advertisements, or trap borrowers in unfair repayment schemes.
6. Revised Penal Code and Cybercrime Prevention Act
In severe cases, abusive collection tactics may also involve criminal conduct. Threats, unjust vexation, grave coercion, libel, cyberlibel, identity misuse, harassment, and other offenses may be relevant depending on the facts.
The Cybercrime Prevention Act of 2012, or Republic Act No. 10175, may apply where harassment, threats, libelous posts, or unauthorized use of personal information occur through electronic systems, social media, messaging apps, or digital platforms.
IV. Difference Between Reporting to the SEC and Reporting to the NPC
The SEC and NPC handle different aspects of the problem. A single abusive online lending app may be reported to both agencies, but the complaint should be framed properly for each.
A. Report to the SEC When the Issue Concerns Lending Legality or Collection Abuse
Report to the SEC when the concern involves:
- The lending app is not registered with the SEC.
- The company has no certificate of authority to operate as a lending or financing company.
- The app uses a different name from the registered company.
- The app conceals its office address, corporate name, or contact details.
- The lender imposes hidden charges or unclear loan terms.
- The app charges excessive interest, penalties, or service fees.
- The lender uses unfair or abusive collection methods.
- Collectors threaten, insult, shame, or intimidate borrowers.
- Collectors contact third persons to pressure the borrower.
- The app continues operating despite SEC warnings, revocation, suspension, or lack of authority.
The SEC is the proper agency to examine whether the lender is authorized to conduct lending or financing business and whether it violated rules governing lending companies and financing companies.
B. Report to the NPC When the Issue Concerns Personal Data Misuse
Report to the NPC when the concern involves:
- Unauthorized access to the borrower’s phone contacts.
- Use of contact lists to shame or pressure the borrower.
- Sending messages to family, friends, co-workers, employers, or other third parties.
- Posting the borrower’s name, photo, ID, address, or debt information online.
- Threatening to expose the borrower’s personal information.
- Creating group chats or public posts to humiliate the borrower.
- Using the borrower’s ID, selfie, or personal documents for intimidation.
- Collecting excessive personal data unrelated to the loan.
- Refusing to delete or correct personal data.
- Continuing to process personal data despite withdrawal of consent, where withdrawal is legally valid.
- Failing to provide a proper privacy notice.
- Misrepresenting how borrower data will be used.
The NPC is the proper agency to address violations of the Data Privacy Act, including unauthorized processing, malicious disclosure, improper disposal, and negligent handling of personal data.
V. What Makes an Online Lending App Illegal?
An online lending app may be considered illegal or unlawfully operating if it lacks the legal authority to lend money in the Philippines.
Common red flags include:
- The app is not connected to a company registered with the SEC.
- The company is registered as a corporation but has no certificate of authority to operate as a lending or financing company.
- The app uses a brand name different from the legal company name, making accountability difficult.
- The app provides no physical office address.
- The app provides no valid customer service channel.
- The app is not transparent about interest, fees, penalties, and repayment terms.
- The lender refuses to issue receipts, loan contracts, or statements of account.
- The app changes terms after loan release.
- The app deducts excessive “processing fees” before releasing the loan.
- The app gives very short repayment periods with disproportionate penalties.
- The app forces users to allow access to contacts, photos, camera, messages, or storage beyond what is necessary.
- The app threatens users who refuse permissions.
- The app disappears from app stores but continues collecting through private links or messaging channels.
Not every irregularity automatically proves illegality, but these facts are useful indicators for complaint preparation.
VI. What Makes Debt Collection Abusive?
A lender has the right to collect a legitimate debt, but collection must be lawful, fair, and proportionate. Borrowing money does not mean the borrower waives dignity, privacy, or legal rights.
Abusive debt collection may include:
- Threatening the borrower with imprisonment merely for non-payment of debt.
- Using obscene, insulting, or degrading language.
- Calling repeatedly at unreasonable hours.
- Contacting the borrower’s relatives, friends, employer, or phone contacts to shame the borrower.
- Sending messages falsely claiming that a criminal case has already been filed.
- Pretending to be a lawyer, police officer, court sheriff, barangay official, or government officer.
- Threatening public exposure of debt.
- Posting borrower information on social media.
- Sending edited photos, fake wanted posters, or defamatory graphics.
- Threatening physical harm.
- Threatening to visit the borrower’s workplace or home in a humiliating manner.
- Creating group chats involving third parties.
- Disclosing the borrower’s loan details to people who are not parties to the loan.
- Using profane, violent, or sexually abusive messages.
- Misrepresenting the amount due.
- Adding unexplained penalties or fees.
- Continuing harassment after payment or settlement.
- Harassing people who are not borrowers, co-makers, or guarantors.
A debtor may be civilly liable for a valid loan, but debt is not a license for harassment, defamation, privacy invasion, or intimidation.
VII. Borrower Rights Under Philippine Law
Borrowers dealing with online lending apps have several important rights.
1. Right to Know the True Lender
A borrower has the right to know the legal name of the lender, its business address, its SEC registration status, and whether it has authority to operate as a lending or financing company.
2. Right to Clear Loan Terms
The borrower should be informed of the principal amount, interest rate, processing fees, service fees, penalties, repayment date, total amount due, and consequences of default.
3. Right Against Harassment
The borrower has the right not to be threatened, insulted, shamed, coerced, or subjected to abusive collection tactics.
4. Right to Privacy
The borrower has the right to protection of personal information. The lender may process personal data only for legitimate, specific, and lawful purposes.
5. Right Against Unauthorized Disclosure
Loan information should not be disclosed to third persons who are not legally entitled to receive it. A borrower’s contacts, employer, relatives, or friends should not be used as tools of public shaming.
6. Right to Access, Correction, and Objection
Under data privacy principles, borrowers may request access to their personal data, correction of inaccurate data, and may object to certain forms of processing.
7. Right to File Complaints
Borrowers may file complaints before the SEC, NPC, police authorities, prosecutors, app platforms, and other relevant agencies depending on the conduct involved.
VIII. Evidence to Collect Before Filing a Complaint
Strong evidence is essential. Victims should preserve proof before uninstalling the app, deleting messages, changing phones, or blocking collectors.
Collect the following:
1. App Information
Record the app name, icon, developer name, download link, website, customer service number, email address, and screenshots of the app store listing.
2. Company Information
Save any information about the company behind the app, including corporate name, SEC registration number, certificate of authority, address, loan agreement, privacy policy, terms and conditions, collection notices, and receipts.
3. Loan Details
Keep copies or screenshots of the loan amount, disbursement amount, deductions, fees, interest, repayment period, penalties, due date, total amount demanded, and proof of payments.
4. Harassing Messages
Save screenshots of text messages, chat messages, emails, social media messages, call logs, voicemails, and collection notices. Include the sender’s number, date, time, and full message.
5. Third-Party Harassment
Ask relatives, friends, co-workers, or employers who received messages to send screenshots. These are very important in privacy and harassment complaints.
6. Public Posts
If the lender posted information online, take screenshots showing the post, date, time, URL, account name, comments, and shared content.
7. Phone Permissions
Take screenshots showing what permissions the app requested or accessed, such as contacts, camera, photos, location, microphone, storage, SMS, or call logs.
8. Proof of Identity and Authority
Prepare a government-issued ID and documents showing that the complainant is the borrower or affected person. If filing on behalf of another person, prepare authorization.
9. Timeline
Create a simple chronological timeline showing when the loan was obtained, when it became due, when harassment began, who was contacted, what was said, and what actions were taken.
IX. How to Report to the SEC
A complaint to the SEC should focus on the lending company’s authority, registration, loan practices, and collection behavior.
A. Before Filing: Check the Lender’s Identity
The complainant should identify the app and the company behind it. Important details include:
- App name.
- Developer name.
- Lending company name.
- Financing company name.
- SEC registration number, if shown.
- Certificate of authority number, if shown.
- Website.
- Email address.
- Contact number.
- Office address.
- Names or numbers of collectors.
If the app does not disclose these details, that fact should be stated in the complaint.
B. What to Include in the SEC Complaint
A SEC complaint should include:
- Full name of the complainant.
- Contact details of the complainant.
- Name of the online lending app.
- Name of the company operating the app, if known.
- Description of the loan transaction.
- Amount borrowed.
- Amount actually received.
- Fees deducted.
- Interest and penalties imposed.
- Due date.
- Amount being collected.
- Description of abusive conduct.
- Names and numbers of collectors, if known.
- Evidence of harassment or unfair collection.
- Screenshots of messages and app details.
- Request for SEC investigation or appropriate action.
C. Grounds Commonly Raised Before the SEC
The complaint may state that the app or company appears to have committed one or more of the following:
- Operating as a lending company without proper authority.
- Operating under an unregistered or misleading app name.
- Failure to disclose complete loan terms.
- Imposition of unreasonable or hidden charges.
- Use of abusive, unfair, or unethical collection practices.
- Harassment of borrower and third parties.
- Misrepresentation of legal consequences.
- Violation of SEC rules applicable to lending and financing companies.
- Continued operations despite lack of authority or regulatory issues.
D. Possible SEC Action
Depending on the facts, the SEC may investigate, issue warnings, direct compliance, impose penalties, suspend or revoke authority, order removal of apps, refer matters to other agencies, or take enforcement action against the company and responsible officers.
The SEC’s action is regulatory in nature. It may discipline or penalize companies, but it does not automatically erase a valid debt. Borrowers should distinguish between the validity of the loan obligation and the legality of the lender’s conduct.
X. How to Report to the NPC
A complaint to the NPC should focus on personal data misuse, unauthorized access, privacy violations, and harmful disclosure of personal information.
A. What Counts as Personal Information?
Personal information includes data that identifies or can identify a person, such as:
- Full name.
- Address.
- Phone number.
- Email address.
- Photos.
- Government ID.
- Employer.
- Family details.
- Contact list.
- Social media profile.
- Loan details connected to the borrower’s identity.
Sensitive personal information may include government-issued identifiers, health information, financial information, and other protected data.
B. Common Privacy Violations by Online Lending Apps
A complaint to the NPC may involve:
- Accessing the borrower’s contact list without proper consent.
- Requiring excessive permissions unrelated to lending.
- Using contacts for collection harassment.
- Informing third parties of the borrower’s debt.
- Sending defamatory or threatening messages to contacts.
- Posting borrower information publicly.
- Using borrower photos or IDs to shame them.
- Processing personal data beyond the stated purpose.
- Failing to provide a privacy notice.
- Refusing to respond to data subject requests.
- Retaining personal data longer than necessary.
- Sharing borrower data with unknown collection agents.
- Using deceptive consent mechanisms.
- Processing data in a way that causes harm, humiliation, or discrimination.
C. What to Include in the NPC Complaint
An NPC complaint should include:
- Name and contact details of the complainant.
- Name of the online lending app.
- Name of the company or operator, if known.
- Description of the personal data collected.
- How the app obtained the data.
- App permissions requested.
- Privacy notice or terms shown by the app, if any.
- Description of unauthorized use, disclosure, or harassment.
- Names or numbers of third parties contacted.
- Screenshots of messages sent to the borrower and contacts.
- Screenshots of public posts, if any.
- Explanation of harm suffered.
- Prior request to the company, if any.
- Relief requested from the NPC.
D. Possible NPC Action
The NPC may evaluate whether there was a violation of the Data Privacy Act, require submissions from the parties, conduct investigation, order corrective action, impose administrative fines where applicable, recommend prosecution in proper cases, or require changes in data processing practices.
The NPC may also address data subject rights, such as access, correction, erasure or blocking in proper cases, and objection to unlawful processing.
XI. Reporting to Both SEC and NPC
Many online lending complaints should be filed with both agencies because the same facts may involve both lending violations and privacy violations.
For example:
A borrower obtains a loan through an app. The app deducts excessive fees and gives only seven days to repay. After default, collectors threaten the borrower and send messages to the borrower’s entire contact list, calling the borrower a scammer.
This situation may involve:
- SEC issues: lending authority, unfair loan terms, hidden charges, abusive collection practices.
- NPC issues: unauthorized contact access, disclosure of debt to third parties, misuse of personal data, harassment through personal information.
The SEC complaint should emphasize the illegal or abusive lending operation. The NPC complaint should emphasize the data privacy violation.
The complainant may attach the same evidence to both complaints but should tailor the explanation to the jurisdiction of each agency.
XII. Sample SEC Complaint Format
Subject: Complaint Against [Name of Online Lending App] for Abusive Collection Practices and Possible Unauthorized Lending Operations
Complainant:
Name: [Full Name]
Address: [Address]
Mobile Number: [Number]
Email: [Email]
Respondent:
App Name: [App Name]
Company Name: [Company Name, if known]
Developer Name: [Developer Name, if known]
Address/Contact Details: [If known]
Facts:
I respectfully file this complaint against the online lending application known as [App Name].
On [date], I applied for a loan through the app. The approved loan amount was [amount], but I received only [amount] after deductions. The app imposed [describe fees, interest, penalties, and repayment period]. The due date was [date].
After [describe event, such as delay in payment or inquiry about charges], representatives or collectors of the app began sending abusive and threatening messages. They stated that [quote or summarize threats]. They also contacted [relatives/friends/employer/other persons] even though those persons were not parties to the loan.
The collectors used the following numbers or accounts: [list numbers/accounts]. Attached are screenshots of the messages, call logs, app details, loan terms, and proof of payments.
I respectfully request the SEC to investigate whether [App Name] and its operator are duly registered and authorized to operate as a lending or financing company, and whether they violated SEC rules on fair collection practices, disclosure, and lawful lending operations.
Relief Requested:
I respectfully request that the SEC:
- Investigate the legality of the app’s lending operations.
- Verify whether the company has the necessary registration and authority.
- Investigate the abusive collection practices.
- Impose appropriate sanctions if violations are found.
- Direct the company and its collectors to stop harassment and unlawful practices.
- Refer the matter to other proper agencies if warranted.
Respectfully submitted,
[Name]
[Date]
XIII. Sample NPC Complaint Format
Subject: Complaint Against [Name of Online Lending App] for Unauthorized Use and Disclosure of Personal Information
Complainant:
Name: [Full Name]
Address: [Address]
Mobile Number: [Number]
Email: [Email]
Respondent:
App Name: [App Name]
Company Name: [Company Name, if known]
Developer Name: [Developer Name, if known]
Address/Contact Details: [If known]
Facts:
I respectfully file this complaint against [App Name] for misuse of my personal information and unauthorized disclosure of my personal data.
On [date], I downloaded and used the app to apply for a loan. The app required me to provide personal information, including [list data: name, phone number, address, ID, selfie, employment details, contacts, etc.]. The app also requested access to [contacts/camera/photos/storage/location/other permissions].
On or about [date], representatives of the app began using my personal information for collection harassment. They contacted persons in my phone contacts, including [names or descriptions], and informed them about my alleged debt. They sent messages stating [quote or summarize]. These persons were not parties to the loan and did not consent to receive my personal information.
The app or its collectors also [posted my information online / threatened to expose my data / used my photo or ID / created group chats / disclosed my address / other conduct].
I believe that the app unlawfully processed, used, and disclosed my personal information in violation of my rights as a data subject under the Data Privacy Act of 2012.
Attached are screenshots of the messages, app permissions, privacy notice, loan details, and statements from affected third parties.
Relief Requested:
I respectfully request that the National Privacy Commission:
- Investigate the unauthorized access, use, and disclosure of my personal data.
- Direct the respondent to stop processing my personal information for harassment.
- Order the deletion, blocking, or correction of unlawfully processed data, when appropriate.
- Require the respondent to identify all persons or entities that accessed or received my data.
- Impose appropriate penalties or recommend prosecution if warranted.
- Grant other reliefs available under the Data Privacy Act and NPC rules.
Respectfully submitted,
[Name]
[Date]
XIV. Practical Steps Before and After Filing
1. Do Not Panic Over Threats of Imprisonment
Non-payment of a debt is generally a civil matter. A borrower should not be easily frightened by messages claiming immediate imprisonment merely because a loan was unpaid. However, fraud or issuance of bouncing checks may create separate legal issues depending on the facts.
2. Do Not Ignore Legitimate Obligations
Reporting harassment does not automatically cancel a valid loan. If the debt is legitimate, the borrower should still consider lawful settlement, request a statement of account, dispute unlawful charges, and keep proof of payment.
3. Communicate in Writing
Avoid purely verbal negotiations. Ask for written statements of account, payment instructions, settlement terms, and confirmation of full payment.
4. Avoid Giving More Personal Data
Do not send additional IDs, selfies, passwords, OTPs, bank details, e-wallet PINs, or sensitive documents unless clearly necessary and lawful. Never give OTPs or account passwords to collectors.
5. Warn Contacts
If the app accessed contacts, inform relatives, friends, or co-workers that they may receive harassment. Ask them not to engage and to preserve screenshots.
6. Block but Preserve Evidence
Blocking abusive numbers may be necessary for safety, but preserve screenshots, call logs, and recordings where legally permissible before blocking.
7. Secure Online Accounts
Change passwords, enable two-factor authentication, review app permissions, and remove suspicious apps. Check whether the lending app has access to contacts, photos, files, or social media accounts.
8. Report the App to App Stores
Report the app to Google Play, Apple App Store, or other platforms for harassment, abusive financial services, privacy violations, or impersonation.
9. Consider Police or Prosecutor Action for Serious Threats
If threats involve physical harm, extortion, sexual abuse, identity theft, cyberlibel, grave threats, or other criminal conduct, the victim may consider reporting to the Philippine National Police Anti-Cybercrime Group, the National Bureau of Investigation Cybercrime Division, or the prosecutor’s office.
10. Keep a Complaint Folder
Maintain one folder containing screenshots, PDFs, IDs, loan documents, payment receipts, message logs, contact statements, and a timeline. Organized evidence makes complaints stronger.
XV. Common Defenses Raised by Online Lending Apps
Online lending apps may raise several defenses. Complainants should be prepared for them.
1. “The Borrower Consented”
An app may claim that the borrower consented to access contacts or disclose information. However, consent must be valid, informed, specific, freely given, and limited to lawful purposes. Consent to process data for loan evaluation does not necessarily mean consent to shame the borrower or disclose debt to third parties.
2. “The Contacts Were Character References”
Some apps claim that all contacted persons were references. But if the borrower did not knowingly nominate them as references, or if the app harvested the phone contact list, this may be improper.
3. “The Messages Were Sent by Third-Party Collectors”
The lender may blame outsourced collectors. This does not automatically excuse the lender. A company may remain accountable for agents, contractors, or service providers acting on its behalf, especially in processing personal data or collecting debts.
4. “The Borrower Failed to Pay”
Failure to pay does not justify harassment, threats, or privacy violations. Collection must remain lawful.
5. “The App Has Terms and Conditions”
Terms and conditions cannot legalize unlawful practices. A privacy policy or loan agreement cannot authorize harassment, public shaming, or excessive data processing contrary to law.
XVI. Frequently Asked Questions
1. Can I report an online lending app even if I still owe money?
Yes. A borrower may report illegal, abusive, or privacy-violating conduct even if there is an unpaid balance. The complaint concerns the lender’s conduct. The debt issue and the abuse issue are legally distinct.
2. Will filing a complaint erase my debt?
Not automatically. A valid debt may remain enforceable. However, unlawful charges, excessive penalties, or abusive practices may be investigated, and the borrower may dispute improper amounts.
3. Can collectors contact my family or employer?
Collectors should not disclose debt information to third parties or use third persons to shame or pressure the borrower. Contacting third parties may raise privacy, harassment, or unfair collection issues, especially when those persons are not guarantors, co-makers, or authorized references.
4. Can I go to jail for not paying an online loan?
Mere non-payment of debt is generally not a criminal offense. However, separate criminal liability may arise if there is fraud, falsification, bouncing checks, identity misuse, or other criminal conduct. Threats of automatic imprisonment for simple non-payment are often misleading.
5. What if the app is no longer in the app store?
The app may still be reported. Save all available information, including screenshots, download links, package names, developer names, messages, and company details.
6. What if I do not know the company behind the app?
State that in the complaint. Provide the app name, screenshots, phone numbers, account names, payment channels, bank or e-wallet accounts, and any other identifying details.
7. Can my contacts also file complaints?
Yes. Persons who received harassing messages or whose personal data was misused may also file complaints, particularly before the NPC if their personal data was processed or they were contacted without valid basis.
8. Should I uninstall the app immediately?
Preserve evidence first. Take screenshots of app permissions, loan details, messages, privacy policy, terms, account profile, and payment instructions. After preserving evidence, uninstalling may help prevent further access, but additional device security steps may also be needed.
9. Can I demand deletion of my data?
A borrower may exercise data subject rights under the Data Privacy Act, subject to legal limitations. The company may retain some data where legally required, such as for accounting, legal claims, or regulatory compliance, but it should not use retained data for harassment or unlawful disclosure.
10. Can I sue the lender?
Depending on the facts, civil, criminal, administrative, or regulatory remedies may be available. A lawyer can evaluate claims for damages, privacy violations, defamation, harassment, threats, or other causes of action.
XVII. Legal Strategy for Victims
A strong approach is to separate the issues clearly.
A. For the Debt
Ask for:
- A full statement of account.
- The loan agreement.
- Breakdown of principal, interest, fees, and penalties.
- Official payment channels.
- Written settlement terms.
- Confirmation of full payment after settlement.
B. For the Harassment
Preserve:
- Screenshots.
- Call logs.
- Voice recordings where legally permissible.
- Messages to third parties.
- Public posts.
- Names and numbers of collectors.
Then report to the SEC and, where personal data is involved, the NPC.
C. For the Privacy Violation
Document:
- What data was collected.
- Whether the app accessed contacts.
- Who received messages.
- What personal information was disclosed.
- What harm occurred.
- Whether the company had a privacy policy.
- Whether consent was valid and specific.
Then file with the NPC.
D. For Serious Threats or Criminal Conduct
Consider reporting to cybercrime authorities if there are:
- Threats of physical harm.
- Extortion.
- Sexual threats.
- Cyberlibel.
- Identity theft.
- Use of fake legal documents.
- Impersonation of police, lawyers, courts, or government agencies.
- Public posting of defamatory or private information.
XVIII. Mistakes to Avoid
Victims should avoid the following:
- Deleting evidence before filing.
- Paying through unofficial channels without receipts.
- Sending more IDs or selfies to collectors.
- Giving OTPs, passwords, or e-wallet PINs.
- Engaging in emotional arguments with collectors.
- Posting unverified accusations online without evidence.
- Ignoring real legal notices from courts or government agencies.
- Assuming all threats are valid.
- Assuming all debts disappear because the app is abusive.
- Filing vague complaints without names, dates, screenshots, or facts.
XIX. Remedies That May Be Requested
Depending on the forum and facts, a complainant may request:
Before the SEC
- Investigation of the app and company.
- Verification of authority to lend.
- Sanctions for unauthorized lending.
- Sanctions for abusive collection.
- Suspension or revocation of authority.
- Cease-and-desist action where appropriate.
- Referral to other government agencies.
- Direction to stop unlawful collection practices.
Before the NPC
- Investigation of unauthorized data processing.
- Order to stop unlawful processing.
- Deletion, blocking, or correction of personal data where proper.
- Disclosure of data recipients.
- Administrative fines or sanctions.
- Recommendation for prosecution where warranted.
- Measures to prevent further privacy harm.
Before Law Enforcement or Prosecutors
- Investigation of threats, coercion, cyberlibel, extortion, identity theft, or other crimes.
- Filing of criminal complaints where evidence supports it.
- Preservation of digital evidence.
- Identification of offenders.
In Civil Proceedings
- Damages.
- Injunction.
- Accounting of loan charges.
- Declaration of rights.
- Other civil relief depending on the facts.
XX. Data Privacy Analysis: Why Contact Harassment Is Especially Serious
One of the most abusive practices of online lending apps is contact harassment. Many borrowers grant app permissions without fully understanding that the app may access their phone contacts. When the borrower defaults, collectors send messages to people in the borrower’s contact list.
This is legally serious because the borrower’s contact list is not merely a technical feature of the phone. It contains personal data of third parties. Those people did not borrow money, did not sign the loan agreement, and may not have consented to receive collection messages.
The borrower’s debt information is also personal information. Disclosing it to unrelated persons may humiliate the borrower and pressure payment through social shame. This can be disproportionate and unlawful.
A privacy complaint becomes stronger when there is proof that:
- The app required access to contacts as a condition for the loan.
- The app’s privacy notice did not clearly explain contact use.
- The contacts were not chosen as references.
- Collectors disclosed the debt to third parties.
- Messages used insults, threats, or defamatory statements.
- The disclosure caused reputational, emotional, employment, or family harm.
XXI. SEC Analysis: Why Registration Alone Is Not Enough
Some online lenders may claim legitimacy because they are registered with the SEC. However, SEC registration as a corporation is not always the same as authority to operate as a lending or financing company.
A company may be registered as a corporation but still lack the necessary certificate of authority to engage in lending or financing. Even if it has authority, it must still comply with fair collection rules, disclosure requirements, and other regulations.
Thus, a complainant should not stop at asking whether the company is “SEC registered.” The better questions are:
- Is the company registered with the SEC?
- Does it have a certificate of authority to operate as a lending company or financing company?
- Is the app name listed or connected to the authorized company?
- Has the company been subject to SEC advisories, suspension, revocation, or enforcement action?
- Are its collection practices compliant with SEC rules?
- Are its loan charges properly disclosed and lawful?
This distinction is crucial because many abusive apps rely on the phrase “SEC registered” to appear legitimate.
XXII. Sample Evidence Checklist
Before filing, prepare the following:
- Screenshot of app name and icon.
- Screenshot of app store page.
- Developer name.
- App download link.
- Website or privacy policy.
- Terms and conditions.
- Loan agreement.
- Promissory note, if any.
- Statement of account.
- Proof of loan release.
- Proof of deductions.
- Proof of payment.
- Screenshots of messages from collectors.
- Call logs.
- Screenshots from contacts who were harassed.
- Screenshots of social media posts.
- List of collector numbers.
- List of payment accounts used by the lender.
- Screenshot of app permissions.
- Timeline of events.
- Copy of complainant’s ID.
- Authorization letter, if filing for someone else.
XXIII. Sample Timeline
A simple timeline may look like this:
- January 5, 2026 — Downloaded [App Name] and applied for a loan.
- January 5, 2026 — Approved loan amount was ₱5,000, but only ₱3,500 was released after deductions.
- January 12, 2026 — Due date. App demanded ₱6,000.
- January 13, 2026 — Collector sent threatening messages.
- January 13, 2026 — Collector contacted my sister and employer.
- January 14, 2026 — Collector created group chat with my contacts and disclosed my debt.
- January 15, 2026 — I requested a statement of account, but no clear breakdown was provided.
- January 16, 2026 — I prepared complaints for the SEC and NPC.
A timeline helps regulators understand the case quickly.
XXIV. How to Write a Strong Complaint Narrative
A strong complaint should be factual, organized, and specific. Avoid exaggeration and focus on verifiable events.
Instead of writing:
“They are scammers and criminals who ruined my life.”
Write:
“On March 10, 2026, at 9:14 a.m., a collector using mobile number [number] sent a message to my employer stating that I was a delinquent borrower and demanding that my employer force me to pay. My employer was not a co-maker, guarantor, or reference. Attached as Annex C is a screenshot of the message.”
Specific facts are more persuasive than general accusations.
XXV. Annex Format for Evidence
Label evidence clearly:
- Annex A — Screenshot of app store listing.
- Annex B — Screenshot of loan approval.
- Annex C — Proof of loan release and deductions.
- Annex D — Screenshot of collector’s threatening message.
- Annex E — Screenshot of message sent to borrower’s contact.
- Annex F — Screenshot of app permissions.
- Annex G — Copy of privacy policy.
- Annex H — Proof of payment.
- Annex I — Timeline.
- Annex J — Copy of complainant’s ID.
This format makes the complaint easier to review.
XXVI. Special Issues
1. Harassment of Non-Borrowers
People who never borrowed money may still be harassed because their number appears in the borrower’s contacts. These individuals may also complain because their own personal data was used and they were subjected to unwanted contact.
2. Employer Harassment
Contacting an employer to shame a borrower can cause reputational and employment harm. This may strengthen claims for privacy violation, harassment, or damages.
3. Public Shaming Posts
Posting a borrower’s photo, ID, address, or loan information on social media may create privacy, cyberlibel, and other legal issues.
4. Fake Legal Threats
Some collectors send fake demand letters or claim that a case has already been filed. Borrowers should verify any alleged case through official channels. Misrepresentation may be evidence of abusive collection.
5. Multiple Apps Under One Operator
Some operators use several app names. Complaints should mention all related app names, phone numbers, payment channels, and company names.
6. App Permissions and Consent
A borrower’s acceptance of app permissions does not automatically validate all data processing. The processing must still be lawful, fair, transparent, proportionate, and limited to legitimate purposes.
XXVII. Conclusion
Illegal and abusive online lending apps are not merely a private inconvenience between borrower and lender. They raise serious regulatory, consumer protection, privacy, and sometimes criminal issues. Philippine law allows borrowers and affected third parties to seek help from the appropriate agencies.
The SEC is the main agency for complaints involving unauthorized lending operations, lack of lending authority, unfair loan terms, and abusive collection practices by lending or financing companies. The NPC is the main agency for complaints involving misuse of personal data, unauthorized access to contacts, public shaming, disclosure of debt to third parties, and other violations of data privacy rights.
A complainant should preserve evidence, prepare a clear timeline, separate the lending issues from the privacy issues, and file well-organized complaints supported by screenshots, messages, loan records, app details, and witness statements. A borrower may still be responsible for a lawful debt, but no lender has the right to collect through harassment, threats, public humiliation, or unlawful use of personal information.
The key principle is simple: lenders may collect what is legally due, but they must do so lawfully. Debt collection does not override human dignity, privacy, due process, or the protections granted by Philippine law.